MicroNet SP881B User manual

User’s Manual

Broadband VPN Firewall

Model No.: SP881B

World Wide Web: www.micronet.com.tw ; www.micronet.info

Contents

1.

INTRODUCTION .....................................................................................................1

1.1. PACKAGE CONTENTS ............................................................................................1

1.2. KEY FEATURES.....................................................................................................1

2. PHYSICAL DESCRIPTION....................................................................................3

3. BASIC SETUP ...........................................................................................................4

3.1. REQUIREMENTS ....................................................................................................4

3.2. HARDWARE INSTALLATION ..................................................................................4

3.3. IP CONFIGURATION ..............................................................................................4

3.4. QUICK SETUP........................................................................................................6

3.5. CONFIGURE USER PC..........................................................................................10

3.5.1. Windows User............................................................................................10

3.5.2. Macintosh User..........................................................................................11

3.5.3. Linux User .................................................................................................11

3.6. DMZ PORT .........................................................................................................12

4. WEB-BASED MANAGEMENT INTERFACE....................................................14

4.1. HOST IP SETUP ...................................................................................................14

4.2. ARP STATUS ......................................................................................................16

4.3. ROUTING.............................................................................................................16

4.4. VIRTUAL SERVER................................................................................................18

4.5. SPECIAL APPLICATION........................................................................................20

4.6. DYNAMIC DNS...................................................................................................21

4.7. MULTI DMZ.......................................................................................................22

4.8. UPNP..................................................................................................................23

4.9. NAT...................................................................................................................24

4.10. ADVANCED FEATURES........................................................................................27

4.11. SECURITY MANAGEMENT ...................................................................................30

4.11.1. URL Filter..................................................................................................30

4.11.2. Access Filter...............................................................................................31

4.11.3. Session Limit..............................................................................................32

4.11.4. System Filter Exception.............................................................................33

4.12. VPN CONFIGURATION........................................................................................34

4.12.1. IPSec Global Setting..................................................................................35

4.12.2. VPN Policy Setup......................................................................................36

4.12.3. IPSec Policy Option...................................................................................39

4.13. QOS CONFIGURATION.........................................................................................40

4.13.1. QoS Policy Option.....................................................................................41

4.14. BANDWIDTH MANAGEMENT...............................................................................42

4.14.1. Bandwidth Policy.......................................................................................43

4.15.

MANAGEMENT ASSISTANT .................................................................................44

4.15.1. Admin Password Screen ............................................................................44

4.15.2. Email Alert.................................................................................................44

4.15.3. SNMP.........................................................................................................45

4.15.4. SysLog.......................................................................................................46

4.15.5. Upgrade Firmware .....................................................................................47

4.16. NETWORK INFORMATION....................................................................................48

4.16.1. System Status.............................................................................................48

4.16.2. Restore Factory Defaults............................................................................50

4.16.3. WAN Status...............................................................................................50

4.16.4. NAT Status.................................................................................................51

5. APPENDIX...............................................................................................................53

5.1. APPENDIX A: TECHNICAL SPECIFICATION...........................................................53

5.2. APPENDIX B: SETTING UP BANDWIDTH CONTROL ..............................................54

5.3. APPENDIX C: USING REMOTE WEB-BASED SETUP..............................................56

1

1. Introduction

Micronet SP881B, Broadband VPN Firewall, delivers a complete broadband solution for both Cable and

DSL connections. It comes equipped with one WAN port and incorporates a four 10/100Mbps ports

switching hub. Supported connection methods include Fixed IP, Dynamic IP, PPPoE and PPTP.

Security is intact by the in-built firewall with support of a hardware DMZ. Other security protections

include: Special Applications, Virtual Servers, Multiple DMZ, Access Filter, URL Filter and VPN Pass-

Through. It is ideal for small-to-medium enterprise who emphasizes on Internet safety for its network

core.

1.1. Package Contents

y SP881B Broadband VPN Firewall

y Quick Installation Guide

y Manual CD

y Power Adapter

y RJ-45 Ethernet Cable

1.2. Key Features

y Shared Broadband Internet Access

 All LAN users can access the Internet through the SP881B Firewall Router by a

single Broadband modem and connection.

y Supports all common Connection Methods

 All popular DSL and Cable Modems and connection methods are supported,

including Fixed IP, Dynamic IP, PPPoE, and PPTP.

y PPPoE Session Management

 Multiple PPPoE sessions are supported and users can choose to “map” sessions to

individual PC.

y Multiple IP Address Support

 If ISP allocates user with multiple IP addresses, these are also supported and user

can “map” IP addresses to individual PC.

y Special Applications

 This feature allows user to use some non-standard applications, where the port

number used for the response is different to the port number used by the sender.

y Virtual Servers

 This feature allows Internet users to access Internet servers on LAN. For standard

servers such as Web, FTP or E-Mail servers, only the IP address of the server PC is

2

required. Users can also define their own server types if required.

y Multiple DMZ

 A "DMZ" PC will receive incoming connection requests, which would otherwise be

blocked. For each IP address allocated by ISP, a separate "DMZ" PC can be

specified. So if your ISP has given you multiple IP addresses, you can have multiple

“DMZ” PCs. Each “DMZ” PC has unrestricted 2-way Internet access, providing the

ability to run programs that are otherwise incompatible with NAT routers like the

SP881B Firewall Router.

y Access Filter

 The network Administrator can use the Access Filter to gain fine control over the

Internet access and applications available to LAN users. Five (5) user groups are

available, and each group can have different access rights.

y URL Filter

 Use this feature to block access to undesirable websites. Users can even have

different settings for different groups of PC.

y Session Limit

 With Session Limit feature, if the numbers of new sessions for system exceed the

maximum in the sampling time, any new session will be drop.

y System Filter Exception

 With System Filter Exception, the packets will not be processed by firewall or NAT

module, but be processed directly by system protocol stack.

y VPN ( Virtual Private Network)

 Support up to 20 VPN tunnels for VPN connection. It also supports IPSec and

PPTP Pass-Through.

2. Physical Description

Front View

Rear View

Component Description

DC 5V

Connect the supplied power adapter in the power

slot.

Reset Button

When pressed and released for 1 second, the

SP881B Firewall Router will reboot (restart). For

resets to default, please press the button over 3

seconds.

LAN Ports

Connect the PCs to these ports. Both 10BaseT and

100BaseT connections can be used simultaneously.

Any port will automatically operate as an "Uplink" port

if required. Just use a normal LAN cable to connect to

a normal port on another hub.

WAN

Connect the primary Broadband Modem in the WAN

port.

DMZ

Connect to local host (PC) or hub on this hardware

DMZ port.

LED Status Operation

On Power is on POWER

Off Power is off

On

Firmware not loaded or

Hardware Error

Off Normal Operation

Status

Blinking Data In/Out

Green 100BaseT Detected

Orange 10BaseT Detected

LINK/ACT

(WAN/LAN)

Off No connection

Other LED Indications

y WAN Link/Act LED continuous Flash: MAC address not assigned.

y WAN Link/Act LED solid On: SDRAM error.

y LAN1 Link/Act LED solid On: Timer/Interrupt error.

3

3. Basic Setup

3.1. Requirements

y The DSL or Cable modems, each with an Internet Access account with an ISP.

y Network cables. Use standard 10/100BaseT network (UTP) cables with RJ45 connectors

y TCP/IP network protocol must be installed on all PCs.

3.2. Hardware Installation

1. Ensure both SP881B and Cable/DSL modem are switched off. Leave the modem

connected to their data line.

2. Connect the modem to the WAN port of the SP881B Broadband Router using a RJ-45

Ethernet Cable.

3. Connect PC to the SP881B Broadband Router via one of the LAN port using a RJ-45

Ethernet Cable.

4. Connect the provided power adapter on SP881B’s Adapter port and power on both modem

and router.

5. Check the LEDs to verify successful connection.

 The power LED should be on.

 WAN LED should be on if it is connected to a modem.

 The Error LED will light up during startup then turns off. If the LED remains on,

there will be error in your setup. Please recheck steps above.

 For each LAN port that is connected, its corresponding LED will light up to indicate

successful connection and traffic for the port.

3.3. IP Configuration

Follow the steps below to configure and set up Broadband Router. A computer with wired Ethernet

connection to the wireless router is required for first time configuration. PC/Notebook must belong in the

same IP range and subnet. Follow the steps below to configure IP settings for LAN PC.

4

Step 1. In the control panel, double click on Network Connections. Double click on the local area

connection (e.g. LAN). The following screen will appear. Highlight ‘Internet Protocol (TCP/IP)’ and click

on ‘Properties’.

Step 2. Select ‘Obtain an IP address automatically’ and ‘Obtain DNS server address automatically’, then

click <OK>.

Step 3. In DOS command, type ‘ipconfig’ to view information on LAN connection. Ensure the IP address

and subnet mask are on the same subnet as the router.

5

Default Values

IP Address 192.168.1.1

Subnet Mask 255.255.255.0

Username ‘admin’

Password Leave the password field blank

3.4. Quick Setup

SP881B is embedded with http sever and provides a series of web pages, which display the

configuration and status of the system. After configuration of IP, the management interface can be

access by entering the IP address of the router into the browser.

Step 1. Login page will appear to prompt users to enter the username and password.

Step 2. After correctly entering the login details, the following interface will appear. Please enter new

password details and press <Submit>.

6

Step 3. Select LAN & DHCP from the menu. Users will see a screen like the example below.

Component Description

LAN IP

Configuration

IP address - for the Load Balancer, as seen from the

local LAN. Use the default value unless the address

is already in use or your LAN is using a different IP

address range. In the latter case, enter an unused IP

Address from within the range used by your LAN.

Subnet Mask - The default value 255.255.255.0 is

standard for small (class "C") networks. For other

networks, use the Subnet Mask for the LAN segment

to which the Load Balancer is attached (the same

value as the PCs on that LAN segment).

Optional

Configuration

LAN Any IP – By default is disabled. If you enable

‘LAN Any IP’, that means you can setup local host IP

(static IP) other than device LAN IP segment, and yet

it still can access Internet through NAT.

Alias LAN – When both enable ‘LAN Any IP’ & ‘Alias

LAN’, the LAN segment will give you maximum 5 sets

of LAN segment.

7

8

DHCP

Configuration

DHCP Server Setup - If Enabled, the Load Balancer

will allocate IP Addresses to PCs (DHCP clients) on

your LAN when they start up. The default and

recommended value is ‘Enable’. (Windows systems,

by default, act as DHCP clients. This setting is called

‘Obtain an IP address automatically’.) If you are

already using a DHCP Server, the DHCP Server

setting must be ‘Disabled’. The existing DHCP server

must be set to provide the IP address of the Load

Balancer as the Default Gateway.

Lease Time – It is a finite period of time for a DHCP

server lease an IP address to a client.

DNS Server IP for Client – An IP address of the

default DNS server for the client requesting DHCP

service.

Offered IP Range fields set the values used by the

DHCP server when allocating IP Addresses to DHCP

clients. This range also determines the number of

DHCP clients supported.

DHCP Free List

Free Entry indicates how many DHCP entries are not

currently allocated, and still available. This table

shows the IP addresses which have been allocated

by the DHCP Server function. For each address

which has been allocated, the following information is

shown.

Name – The ‘hostname’ of the PC. In some cases,

this may not be known.

MAC Address – The physical address (network

adapter address) of the PC.

IP Address – The IP address allocated to this PC.

Type – Indicates IP address to be dynamic or static.

Status – If set to ‘Dynamic’, the IP address was

allocated by this DHCP Server. If set to ‘Sniffed’, the

IP address was detected by examining the LAN,

rather than allocated by the DHCP Server. In this

case, the Name is usually not known.

Time Left – The time expired since which IP address

is leased.

Step 4. Enter the WAN connection in the field below. Information like IP details, username and

password can be obtained from ISP. Press <Submit and Reboot> to restart the device.

Component Description

WAN Connection

Check the Connection Type with your ISP, and select

the appropriate option.

Static IP – Select this connection type if your ISP has

provided a Fixed or Static IP address. Then enter the

data into the Address Info fields.

Dynamic IP – Select this if your ISP provides an IP

address automatically when you connect. You can

ignore the Address Info fields.

PPPoE – Select this if your ISP uses this method.

(Usually, your ISP will provide some PPPoE software.

This software is no longer required, and should not

be used.) If this method is selected, you must

complete the PPPoE dialup fields.

PPTP Connection – This is for PPTP users only.

Enter the Username and Password provided by your

ISP. If using PPTP, enable the PPTP Connection

checkbox, and enter the IP address of the PPTP

server. If using the PPTP connection method, select

Static IP or Dynamic IP, as appropriate and according

to the IP address method used by your ISP.

Address Info

This is for Static IP users only. Enter the address

information provided by your ISP. If your ISP

provided multiple IP address, you can use the Multi-

DMZ screen to assign the additional IP addresses.

DNS (Optional for

dynamic IP)

If users are using a Fixed IP address, it is necessary

to enter at least one DNS. If users are using Dynamic

IP or PPPoE, DNS information is optional.

9

10

Optional Host name – This is required by some ISPs. If your

ISP provided a Host Name, enter the detail in this

field. Otherwise, leave it as the default value.

Domain name – This is required by some ISPs. If

your ISP provided a Domain Name, enter the detail in

this field. Otherwise, leave it as the default value.

MAC address – Some ISP records your MAC

address (also called "Physical address" or "Network

Adapter address"). If so, you can enter the MAC

address expected by your ISP in this field. Otherwise,

this should be left at the default value.

3.5. Configure User PC

3.5.1. Windows User

TCP/IP Setting

y By default, the SP881B Firewall Router will act as a DHCP Server, automatically providing a

suitable IP Address (and related information) to each PC when the PC boots.

y For all non-Server versions of Windows, the default TCP/IP setting is to act as a DHCP

client. In Windows, this is called Obtain an IP address automatically. Just start (or restart)

your PC and it will obtain an IP address from the SP881B Firewall Router.

Internet Access

For Windows 9x/2000

1. Select Start Menu - Settings - Control Panel - Internet Options.

2. Select the Connection tab, and click the <Setup> button.

3. Select "I want to set up my Internet connection manually, or I want to connect through a

local area network (LAN)" and click <Next>.

4. Select "I connect through a local area network (LAN)" and click <Next>.

5. Ensure all of the boxes on the following Local area network Internet Configuration screen

are unchecked.

6. Check the "No" option when prompted "Do you want to set up an Internet mail account

now?"

7. Click <Finish> to close the Internet Connection Wizard.

8. Setup is now completed.

For Windows XP

1. Select Start Menu - Control Panel - Network and Internet Connections.

2. Select Set up or change your Internet Connection.

3. Select the Connection tab, and click the <Setup> button.

4. Cancel the pop-up "Location Information" screen.

5. Click “Next” on the "New Connection Wizard" screen.

6. Select "Connect to the Internet" and click <Next>.

11

7. Select "Set up my connection manually" and click <Next>.

8. Check "Connect using a broadband connection that is always on" and click <Next>.

9. Click <Finish> to close the New Connection Wizard.

10. Setup is now completed.

Accessing AOL

To access AOL (America-On-Line) through the SP881B Firewall Router, the AOL for Windows software

must be configured to use TCP/IP network access, rather than a dial-up connection. The configuration

process is as follows:

1. Start the AOL for Windows communication software. Ensure that it is Version 2.5, 3.0 or

later. This procedure will not work with earlier versions.

2. Click the <Setup> button.

3. Select Create Location, and change the location name from "New Locality" to "SP881B

Firewall Router".

4. Click <Edit Location>. Select TCP/IP for the Network field. (Leave the Phone Number

blank.)

5. Click <Save>, then <OK>.

6. Configuration is now complete.

7. Before clicking "Sign On", always ensure that you are using the "SP881B Firewall Router"

location.

3.5.2. Macintosh User

From your Macintosh, you can access the Internet via the SP881B Firewall Router. The procedure is as

follows.

1. Open the TCP/IP Control Panel.

2. Select Ethernet from the Connect via pop-up menu.

3. Select Using DHCP Server from the Configure pop-up menu. The DHCP Client ID field can

be left blank.

4. Close the TCP/IP panel, save your settings.

Note: If users are using manually assigned IP addresses instead of DHCP, the required changes are:

y Set the Router Address field to the SP881B Firewall Router’s IP Address.

y Ensure your DNS settings are correct.

3.5.3. Linux User

To access the Internet via the SP881B Firewall Router, it is only necessary to set the SP881B Firewall

Router as the "Gateway", and ensure your Name Server settings are correct. Ensure you are logged in

as "root" before attempting any changes.

By default, most UNIX installations use a fixed IP Address. If you wish to continue using a fixed IP

Address, make the following changes to your configuration.

y Set your Default Gateway to the IP Address of the SP881B Firewall Router.

y Ensure your DNS (Name server) settings are correct.

To act as a DHCP Client (recommended), the procedure below may vary according to your version of

Linux and X -windows shell:

y Start your X Windows client.

y Select Control Panel - Network

y Select the "Interface" entry for your Network card. Normally, this will be called "eth0".

y Click the Edit button, set the "protocol" to "DHCP", and save this data.

y To apply your changes

y Use the "Deactivate" and "Activate" buttons, if available.

y Or, restart your system.

3.6. DMZ Port

SP881B Firewall VPN Link Balancer with one hardware DMZ is implemented through the hardware. The

router has a separate hardware Ethernet port for DMZ. Multiple devices with public IP addresses

assigned by the ISP can be connected. Incoming data for these devices from the Internet will be sent by

the router to the hardware Ethernet port directly.

y The DMZ port is a normal port, not an ‘uplink’ port.

y PCs connected to the DMZ port are on the same LAN segment as PCs connected to the

Hub ports. They must use the same IP address range.

y PCs connected to the DMZ port are not visible to PCs on the hub (LAN) ports. So you

cannot use Microsoft networking or other networking protocols to connect to PCs on the

DMZ.

y PCs connected to the DMZ port still share the WAN port IP address for Internet access.

12

13

Component Description

DMZ Settings DMZ Port – It use a standard LAN cable to connect a

normal port on the other hub.

Associated Interface – WAN1 port is the hardware

DMZ port associated with.

Access From LAN –The local LAN user can access

DMZ port, if this check-box is been checked.

DMZ Broadcast / Outbound – The device that

connects to DMZ port, their packets can be broadcast

to the Internet. If DMZ “Broadcast / Outbound” is

been enabled.

ARP Table – It is a mechanism for viewing ARP

related information.

4. Web-Based Management Interface

4.1. Host IP Setup

This feature is used in the following situations:

y Users have Multi-Session PPPoE, and wish to bind each session to a particular PC on the

LAN.

y Users wish to use the Access Filter feature. This requires that each PC be identified by

using the Host IP Setup screen.

y Users wish to have different URL Block settings for different PCs. This requires that each

PC be identified by using the Host IP Setup screen. (Users do not have to use the Host IP

feature to apply the same URL Block settings to all PCs.)

y Users wish to reserve a particular (LAN) IP address for a particular PC on your LAN. This

allows the PC to use DHCP (Windows calls this "Obtain an IP address automatically") while

gaining the benefits of a fixed IP address. The PC's IP address will never change, so it can

be provided to other people and applications.

14

15

Component Description

Host Network

Identity

Host name (Required) – Enter a suitable name.

Generally, users should use the ‘Hostname’

(computer name) defined on the Host itself.

MAC Address (Required) – Also called Physical

Address or Network Adapter Address. Enter the MAC

address of this host.

MAC Button – Check ARP list for entering MAC

Address.

Select Group – Select the group users wish to put

this host into.

Reserve in DHCP – Select ‘Enable’ to reserve a

particular (LAN) IP address for a particular PC on the

LAN. This allows the PC to use DHCP (Windows

calls this "obtain an IP address automatically") while

having an IP address which never changes.

Reserved IP – Enter the IP address users wish to

reserve, if the setting above is ‘Enable’. Otherwise,

ignore this field.

Block All Access – Enable this checkbox will block

all traffic for this particular local host name.

DHCP List – Check DHCP list for entering DHCP IP

Address.

Host Network

Binding

Bind WAN port/Session – Select ‘Enable’ if users

wish to associate this PC with a particular PPPoE

Session. All traffic for that PC will then use the

selected PPPoE port and session.

Binding Method – Allow users to bind traffic to WAN

port.

Select WAN Port/Select PPPoE session – If the

setting above is ‘Enable’, select the desired port and

session. Otherwise, ignore these settings.

Note: Multiple PPPoE sessions are defined on the

Advanced PPPoE screen.

Host & Group List

This table shows the current bindings.

4.2. ARP Status

This interface is for showing LAN & WAN Address Resolution Protocol (ARP) statistics and information.

Component Description

Arp Statistics

Requests (In / Out) – The numbers of system ARP

sent to requests.

Reply (In / Out) –The numbers of system ARP

replies to.

System Time – System starting time.

Global Arp Ageout Time – Arp time out. By default

is 600 seconds. If set to “0” means no expire.

Arp Table

List all LAN, WAN address resolution and its related

info.

Arp Entry Add /

Update

According to IP and MAC address, add or update a

record to a ARP table

Arp Query Check

Input LAN or WAN IP address to query ARP.

4.3. Routing

This section is only relevant if users’ LAN has other Routers or Gateways.

y If users don't have other Routers or Gateways on the LAN, ignore the Static Routing page

completely.

y If users’ LAN has other Gateways and Routers, configure the Static Routing screen as

described below. Users also need to configure the other Routers.

y If there is an entry or entries in the Routing table with an Index of zero (0), these are System

entries. Users cannot modify or delete these entries.

16

Component Description

Dynamic Routing RIP v2 – This acts as “master” switch. If enabled, the

selected WAN or LAN will run RIPv1/v2, otherwise

they don’t have RIP function.

LAN, WAN – If enabled, any WAN or LAN can

execute RIP function.

Static Routing Entry Index – If adding a new entry, ignore this field.

To edit an existing entry, select it from the list, and

click the <Select> button. The screen will then

update with the data for the selected entry. If the

Index is 0, this is a System entry that users cannot

delete or modify.

Network Address – The network address of the

remote LAN segment. For standard class "C" LAN,

the network address is the first 3 fields of the

Destination IP Address. The 4th (last) field can be left

at 0.

Netmask – The Network Mask for the remote LAN

segment. For class "C" networks, the default mask is

255.255.255.0

Gateway –The IP Address of the Gateway or Router

that the SP881B Firewall Router must use to

communicate with the destination above. (Not the

router attached to the remote segment.)

Interface –Select the correct interface, usually "LAN".

The "WAN" interface is only available if NAT

(Network Address Translation) is disabled.

Metric –The number of "hops" (routers) to pass

through to reach the remote LAN segment. The

shortest path will be used.

17

Page is loading ...

MicroNet SP881B User manual

MicroNet SP881B User manual

Related papers

Other documents