680891

Lancom LCOS 9.10 Handleiding

2023
Verklein
Vergroot
Pagina terug
1/2025
Pagina verder
connecting your business
Reference Manual
LCOS 9.10
Contents
Copyright................................................................................................................................?
1 About this documentation................................................................................................28
1.1 Constituents of this documentation..........................................................................................................28
1.1.1 LCOS, the operating system of LANCOM devices......................................................................29
1.1.2 Validity....................................................................................................................................29
1.1.3 Security settings.......................................................................................................................29
1.1.4 This documentation was created by …....................................................................................29
2 System design...................................................................................................................31
2.1 Introduction.............................................................................................................................................31
3 Configuration....................................................................................................................33
3.1 Configuration tools and approaches........................................................................................................33
3.1.1 What is the difference between these three possibilities?.........................................................33
3.2 Configuration software............................................................................................................................33
3.3 Configuration with WEBconfig.................................................................................................................34
3.3.1 Secure with HTTPS...................................................................................................................34
3.3.2 Access with WEBconfig............................................................................................................34
3.3.3 Network without a DHCP server...............................................................................................34
3.3.4 Network with DHCP server.......................................................................................................35
3.3.5 Login.......................................................................................................................................36
3.3.6 Setup Wizards..........................................................................................................................37
3.3.7 System information..................................................................................................................38
3.3.8 Configuration...........................................................................................................................40
3.3.9 LCOS menu tree.......................................................................................................................41
3.3.10 File management...................................................................................................................41
3.3.11 Extras.....................................................................................................................................41
3.3.12 HTTP session..........................................................................................................................42
3.4 Configuration with other tools.................................................................................................................43
3.4.1 Telnet.......................................................................................................................................43
3.4.2 SNMP......................................................................................................................................51
3.4.3 Encrypted configuration with SSH access.................................................................................51
3.4.4 SSH authentication..................................................................................................................52
3.4.5 ISDN Remote configuration via Dial-Up Network.....................................................................53
3.4.6 Addition(s) to LCOS 8.80..........................................................................................................56
3.5 Working with configuration files..............................................................................................................61
3.5.1 Backup copies of configuration................................................................................................62
3.5.2 Convenient series configuration...............................................................................................62
3.5.3 Running function.....................................................................................................................62
3.6 New firmware with FirmSafe....................................................................................................................62
3.6.1 This is how FirmSafe works......................................................................................................62
3.6.2 Asymmetric Firmsafe................................................................................................................63
2
Reference Manual
Contents
3.6.3 How to load new software.......................................................................................................63
3.7 Load files directly from a TFTP or HTTP server into the device...................................................................66
3.7.1 TFTP.........................................................................................................................................66
3.7.2 Loading firmware, device configuration or script via HTTP(S)....................................................66
3.7.3 Loading firmware, device configuration or script via HTTP(S) or TFTP.......................................67
3.8 How to reset the device?..........................................................................................................................68
3.9 Scripting..................................................................................................................................................69
3.9.1 Applications.............................................................................................................................69
3.9.2 Scripting function.....................................................................................................................70
3.9.3 Generating script files..............................................................................................................70
3.9.4 Uploading configuration commands and script files.................................................................72
3.9.5 Multiple parallel script sessions................................................................................................75
3.9.6 Scripting commands.................................................................................................................75
3.9.7 Addition(s) to LCOS 8.80..........................................................................................................78
3.10 Rollout Wizard.......................................................................................................................................80
3.10.1 General settings in the Rollout Wizard...................................................................................80
3.10.2 Variables................................................................................................................................81
3.10.3 Actions to be executed by the Rollout Wizard........................................................................82
3.10.4 Actions for managing the Rollout Wizard...............................................................................82
3.10.5 Addition(s) to LCOS 8.50........................................................................................................83
3.11 LANCOM Layer 2 Management protocol (LL2M)..................................................................................100
3.11.1 Introduction.........................................................................................................................100
3.11.2 Configuration of the LL2M server.........................................................................................100
3.11.3 Commands for the LL2M client.............................................................................................101
3.12 Messaging...........................................................................................................................................102
3.12.1 Example: Broken connection alert as an SMS to a mobile telephone....................................102
3.12.2 Suppress messaging in case of re-connects with a DSL connection .....................................103
3.12.3 Addition(s) to LCOS 7.70......................................................................................................104
3.13 Managing rights for different administrators........................................................................................104
3.13.1 Rights for the administrators................................................................................................105
3.13.2 Administrators' access via TFTP and SNMP...........................................................................106
3.13.3 Configuration of user rights.................................................................................................107
3.13.4 Limitation of the configuration commands...........................................................................108
3.13.5 TCP port tunnel....................................................................................................................109
3.14 Named loopback addresses.................................................................................................................111
3.14.1 Loopback addresses with ICMP polling................................................................................111
3.14.2 Loopback addresses for time servers....................................................................................112
3.14.3 Loopback addresses for SYSLOG clients................................................................................113
3.15 Addition(s) to LCOS 8.00......................................................................................................................114
3.15.1 Automatic upload of firmware or configuration from external data media...........................114
3.15.2 Alternative boot config........................................................................................................116
3.16 Addition(s) to LCOS 8.20......................................................................................................................120
3.16.1 Automatic uploading of firmware, configuration and scripts................................................120
3.17 Addition(s) to LCOS 8.50......................................................................................................................125
3
Reference Manual
Contents
3.17.1 The commands LoadFirmware, LoadConfig, LoadScript and LoadFile...................................125
3.17.2 Enhanced Sysinfo.................................................................................................................130
3.18 Addition(s) to LCOS 8.60......................................................................................................................131
3.18.1 Configurable action for alive test.........................................................................................131
3.19 Addition(s) to LCOS 8.80......................................................................................................................134
3.19.1 Setting the device time from GPS.........................................................................................134
3.19.2 SYSLOG accounting is disabled by default............................................................................135
3.19.3 Boot-persistent SYSLOG, event log and boot log..................................................................136
3.19.4 SYSLOG: Delete old messages..............................................................................................137
3.19.5 Logging configuration changes made via the command line................................................139
3.19.6 SYSLOG: Change to the default order...................................................................................140
3.20 Addition(s) to LCOS 8.84......................................................................................................................142
3.20.1 Default Rollout Wizard.........................................................................................................142
3.20.2 Automatic generation of device-specific SSH keys................................................................143
3.20.3 Suppress security confirmations during SSH key generation.................................................144
3.21 Addition(s) to LCOS 9.00......................................................................................................................144
3.21.1 Output additional ports in SYSINFO at the console...............................................................144
3.21.2 Specifying a custom SNMP port...........................................................................................144
3.21.3 Password protection for WLAN keys.....................................................................................145
3.21.4 Sorted display of a menu on the console..............................................................................145
3.21.5 Customize the management ports for device access.............................................................146
3.21.6 Comment box for access stations.........................................................................................147
3.21.7 Elliptic curve cryptography (ECC)..........................................................................................147
3.21.8 Changing the SIM card PIN..................................................................................................161
3.22 Addition(s) to LCOS 9.10......................................................................................................................162
3.22.1 TR-069 support....................................................................................................................162
3.22.2 Encrypted storage of configurations with LANconfig............................................................178
3.22.3 Each device has its own SSL key & changes to the default SSL settings................................183
4 LANCOM Management System (LCMS)..........................................................................187
4.1 Searching and configuring devices.........................................................................................................187
4.2 Configuration with LANconfig................................................................................................................188
4.2.1 Starting LANconfig.................................................................................................................188
4.2.2 Switch graphical user interface language...............................................................................190
4.2.3 Project management with LANconfig.....................................................................................191
4.2.4 User-specific settings for LANconfig.......................................................................................192
4.2.5 Customizing the toolbar.........................................................................................................193
4.2.6 Automatic backup of configuration with LANconfig...............................................................194
4.2.7 Directory structure.................................................................................................................194
4.2.8 Better overview in LANconfig with more columns..................................................................195
4.2.9 Multithreading.......................................................................................................................196
4.2.10 Manual and automatic searches for firmware updates.........................................................197
4.2.11 Password protection for SNMP read-only access..................................................................200
4.2.12 Device-specific settings for communications protocols.........................................................201
4.2.13 LANconfig behavior at Windows startup..............................................................................203
4
Reference Manual
Contents
4.2.14 Choice of Wizard or configuration dialog.............................................................................205
4.2.15 WLAN configuration with the wizards in LANconfig.............................................................206
4.2.16 Addition(s) to LCOS 8.00......................................................................................................208
4.2.17 Addition(s) to LCOS 8.50......................................................................................................209
4.2.18 Addition(s) to LCOS 8.60......................................................................................................221
4.2.19 Addition(s) to LCOS 8.80......................................................................................................231
4.2.20 Addition(s) to LCOS 8.82......................................................................................................237
4.3 Group configuration with LANconfig......................................................................................................243
4.3.1 Create a group configuration.................................................................................................244
4.3.2 Update device configurations.................................................................................................245
4.3.3 Update group configurations.................................................................................................246
4.3.4 Using multiple group configurations......................................................................................246
4.3.5 Transferring device configurations to similar models..............................................................247
4.3.6 Addition(s) to LCOS 8.60........................................................................................................248
4.4 LANmonitor—know what's going on....................................................................................................255
4.4.1 Extended display options.......................................................................................................256
4.4.2 Enquiry of the CPU and Memory utilization over SNMP..........................................................256
4.4.3 Monitor Internet connection..................................................................................................256
4.4.4 Display functions in LANmonitor............................................................................................258
4.4.5 Connection diagnosis with LANmonitor.................................................................................260
4.4.6 Addition(s) to LCOS 7.70........................................................................................................262
4.4.7 Addition(s) to LCOS 7.80........................................................................................................265
4.4.8 Addition(s) to LCOS 8.50........................................................................................................266
4.4.9 Addition(s) to LCOS 8.80........................................................................................................269
4.5 Visualization of larger WLANs with WLANmonitor.................................................................................273
4.5.1 Start the LANCOM WLANmonitor...........................................................................................273
4.5.2 Search for access points.........................................................................................................273
4.5.3 Add access points..................................................................................................................274
4.5.4 Organize access points...........................................................................................................274
4.5.5 Rogue AP and rogue client detection with the WLANmonitor.................................................275
4.6 Addition(s) to LCOS 7.80........................................................................................................................279
4.6.1 Deactivating Ethernet interfaces.............................................................................................279
4.7 Addition(s) to LCOS 8.84........................................................................................................................279
4.7.1 Enhancements to LANconfig..................................................................................................279
4.8 Addition(s) to LCOS 9.00........................................................................................................................284
4.8.1 Enhancements to LANconfig..................................................................................................284
4.8.2 Enhancements to LANmonitor................................................................................................286
4.9 Addition(s) to LCOS 9.10........................................................................................................................291
4.9.1 Proxy authentication via NTLM...............................................................................................291
4.9.2 Special LANconfig icon for devices in a cluster or using Config Sync......................................292
4.9.3 Special LANmonitor icon for devices in a cluster or using Config Sync....................................294
4.9.4 LANCOM "Wireless Quality Indicators" (WQI).........................................................................294
4.9.5 Extended number of characters for device names...................................................................295
4.9.6 Different notations for MAC addresses...................................................................................295
5
Reference Manual
Contents
4.9.7 LANconfig: Text corrections relating to access rights..............................................................296
5 Diagnosis........................................................................................................................297
5.1 Trace information—for advanced users ................................................................................................297
5.1.1 How to start a trace...............................................................................................................297
5.1.2 Overview of the keys..............................................................................................................297
5.1.3 Overview of the parameters...................................................................................................297
5.1.4 Combination commands........................................................................................................299
5.1.5 Trace filters............................................................................................................................299
5.1.6 Examples of traces.................................................................................................................299
5.1.7 Recording traces....................................................................................................................300
5.2 Tracing with LANmonitor.......................................................................................................................300
5.2.1 Introduction...........................................................................................................................301
5.2.2 Configuring the trace dumps with the Trace Wizard...............................................................302
5.2.3 LCOS menu tree of the trace dumps.......................................................................................303
5.2.4 Display of trace data..............................................................................................................305
5.2.5 Backing up and restoring the trace configuration...................................................................306
5.2.6 Backing up and restoring the trace data................................................................................306
5.2.7 Backup settings for traces......................................................................................................306
5.2.8 Saving support file.................................................................................................................306
5.2.9 Addition(s) to LCOS 8.50........................................................................................................307
5.3 SYSLOG..................................................................................................................................................319
5.3.1 Introduction...........................................................................................................................319
5.3.2 Structure of SYSLOG messages...............................................................................................320
5.3.3 Configuring SYSLOG using LANconfig....................................................................................322
5.3.4 Configuring SYSLOG using Telnet or WEBconfig.....................................................................323
5.3.5 Addition(s) to LCOS 8.80........................................................................................................325
5.3.6 Addition(s) to LCOS 8.82........................................................................................................326
5.4 The ping command................................................................................................................................329
5.5 Monitoring the switch............................................................................................................................331
5.6 Cable testing..........................................................................................................................................331
5.7 Addition(s) to LCOS 8.80........................................................................................................................332
5.7.1 Trace output for the XML interface.........................................................................................332
5.7.2 Packet capturing....................................................................................................................333
5.8 Addition(s) to LCOS 8.84........................................................................................................................334
5.8.1 Documenting events at the xDSL interfaces............................................................................334
5.8.2 SYSLOG: Extended status display of the login to the cellular network.....................................335
5.9 Addition(s) to LCOS 9.10........................................................................................................................337
5.9.1 Advanced config version information under Status.................................................................337
5.9.2 SSH identifier in the event log................................................................................................338
6 Security...........................................................................................................................339
6.1 Protection for the configuration.............................................................................................................339
6.1.1 Password protection..............................................................................................................339
6.1.2 Login barring.........................................................................................................................340
6.1.3 Restriction of the access rights on the configuration..............................................................340
6
Reference Manual
Contents
6.2 Protecting the ISDN connection.............................................................................................................343
6.2.1 Identification control..............................................................................................................343
6.2.2 Callback ................................................................................................................................344
6.3 Location verification by ISDN or GPS......................................................................................................345
6.3.1 GPS location verification........................................................................................................345
6.3.2 ISDN location verification.......................................................................................................345
6.3.3 Configuring location verification............................................................................................345
6.4 The security checklist.............................................................................................................................349
6.5 Addition(s) to LCOS 8.60........................................................................................................................352
6.5.1 Support for TLS 1.1 / 1.2........................................................................................................352
7 Routing and WAN -connections.....................................................................................353
7.1 General information ..............................................................................................................................353
7.1.1 Bridges for standard protocols...............................................................................................353
7.1.2 What happens in the case of a request from the LAN?...........................................................353
7.2 IP routing...............................................................................................................................................354
7.2.1 The IP routing table...............................................................................................................354
7.2.2 Policy-based routing..............................................................................................................356
7.2.3 Local routing..........................................................................................................................357
7.2.4 Dynamic routing with IP RIP...................................................................................................358
7.2.5 SYN/ACK speedup..................................................................................................................362
7.3 Advanced Routing and Forwarding........................................................................................................362
7.3.1 Introduction...........................................................................................................................362
7.3.2 Defining networks and assigning interfaces...........................................................................364
7.3.3 Assigning logical interfaces to bridge groups.........................................................................365
7.3.4 Interfaces tags for remote sites..............................................................................................366
7.3.5 Virtual routers........................................................................................................................367
7.3.6 NetBIOS proxy........................................................................................................................368
7.4 Configuration of remote stations............................................................................................................368
7.4.1 Peer list..................................................................................................................................369
7.4.2 Layer list................................................................................................................................370
7.5 IP masquerading....................................................................................................................................371
7.5.1 Simple masquerading.............................................................................................................371
7.5.2 Inverse masquerading............................................................................................................372
7.6 Demilitarized Zone (DMZ).......................................................................................................................374
7.6.1 Assigning interfaces to the DMZ............................................................................................374
7.6.2 Assigning network zones to the DMZ.....................................................................................375
7.6.3 Address check with DMZ and intranet interfaces....................................................................375
7.6.4 Unmasked Internet access for server in the DMZ....................................................................376
7.7 Multi-PPPoE...........................................................................................................................................377
7.7.1 Example application: Home-Office with private Internet access..............................................377
7.7.2 Configuration.........................................................................................................................377
7.8 Load balancing......................................................................................................................................378
7.8.1 DSL port mapping..................................................................................................................379
7.8.2 DSL-channel bundling (MLPPPoE)..........................................................................................381
7
Reference Manual
Contents
7.8.3 Dynamic load balancing.........................................................................................................381
7.8.4 Static load balancing.............................................................................................................382
7.8.5 Configuration of load balancing.............................................................................................382
7.9 N:N mapping.........................................................................................................................................384
7.9.1 Application examples.............................................................................................................384
7.9.2 Configuration.........................................................................................................................386
7.10 Establishing connection with PPP.........................................................................................................388
7.10.1 The protocol.........................................................................................................................388
7.10.2 Everything o.k.? Checking the line with LCP.........................................................................389
7.10.3 Assignment of IP addresses via PPP.....................................................................................390
7.10.4 Settings in the PPP list.........................................................................................................390
7.10.5 The meaning of the DEFAULT remote site.............................................................................391
7.10.6 RADIUS authentication of PPP connections..........................................................................392
7.11 DSL dial-in over PPTP...........................................................................................................................392
7.11.1 Configuration of PPTP..........................................................................................................392
7.11.2 Addition(s) to LCOS 7.80......................................................................................................393
7.12 Extended connection for flat rates—Keep-alive...................................................................................394
7.12.1 Configuration of Keep-alive function....................................................................................394
7.13 Callback functions................................................................................................................................395
7.13.1 Callback for Microsoft CBCP.................................................................................................395
7.13.2 Fast callback .......................................................................................................................396
7.13.3 Callback with RFC 1570 (PPP LCP extensions)......................................................................396
7.13.4 Overview of configuration of callback function.....................................................................396
7.14 ISDN Channel bundling with MLPPP....................................................................................................397
7.14.1 Two methods of channel bundling.......................................................................................397
7.14.2 Here's how to configure your system to combine channels...................................................398
7.15 Operating a modem over the serial interface........................................................................................398
7.15.1 Introduction.........................................................................................................................398
7.15.2 System requirements............................................................................................................399
7.15.3 Installation...........................................................................................................................399
7.15.4 Set the serial interface to modem operation.........................................................................399
7.15.5 Configuration of modem parameters....................................................................................400
7.15.6 Direct entry of AT commands...............................................................................................402
7.15.7 Statistics..............................................................................................................................402
7.15.8 Trace output........................................................................................................................402
7.15.9 Configuration of remote sites for V.24 WAN interfaces........................................................403
7.15.10 Configuration of a backup connection on the serial interface.............................................404
7.15.11 Contact assignment of modem adapter kit ........................................................................404
7.16 Manual definition of the MTU .............................................................................................................404
7.16.1 Configuration.......................................................................................................................405
7.16.2 Statistics..............................................................................................................................405
7.17 WAN RIP..............................................................................................................................................405
7.18 The rapid spanning tree protocol.........................................................................................................406
7.18.1 Classic and rapid spanning tree...........................................................................................406
8
Reference Manual
Contents
7.18.2 Improvements from rapid spanning tree..............................................................................407
7.18.3 Configuring the Spanning Tree Protocol...............................................................................407
7.18.4 Status reports via the Spanning Tree Protocol......................................................................409
7.19 The Action table...................................................................................................................................411
7.19.1 Introduction.........................................................................................................................411
7.19.2 Actions for Dynamic DNS.....................................................................................................411
7.19.3 Further example actions.......................................................................................................414
7.19.4 Configuration.......................................................................................................................415
7.20 Using the serial interface in the LAN....................................................................................................417
7.20.1 Introduction ........................................................................................................................417
7.20.2 Operating modes.................................................................................................................418
7.20.3 Serial interface configuration...............................................................................................418
7.20.4 Configuring the COM port server..........................................................................................419
7.20.5 WAN device configuration...................................................................................................423
7.20.6 Serial connection status information....................................................................................423
7.20.7 COM-port adapters..............................................................................................................426
7.20.8 Addition(s) to LCOS 7.80......................................................................................................426
7.21 Addition(s) to LCOS 7.80......................................................................................................................429
7.21.1 Routing of local services/ARP handling switchable ..............................................................429
7.22 Addition(s) to LCOS 8.20......................................................................................................................429
7.22.1 VDSL....................................................................................................................................429
7.23 Addition(s) to LCOS 8.80......................................................................................................................434
7.23.1 Default mode in the DSLoL interface....................................................................................434
7.24 Addition(s) to LCOS 8.84......................................................................................................................435
7.24.1 Volume budget....................................................................................................................435
7.24.2 Script variable for dynamic IPv6 addresses...........................................................................446
7.24.3 Assign actions from the action table of a WAN connection..................................................447
7.24.4 Selecting frequency bands in LTE cellular networks..............................................................449
7.25 Addition(s) to LCOS 9.00......................................................................................................................451
7.25.1 Revised flow control.............................................................................................................451
7.25.2 AC name configurable for PPPoE server...............................................................................453
7.25.3 Dual-SIM support for mobile devices....................................................................................454
7.25.4 Combined UMTS-GPRS operation for LTE devices.................................................................459
7.26 Addition(s) to LCOS 9.10......................................................................................................................460
7.26.1 Client binding......................................................................................................................460
7.26.2 Interface binding "Any" removed in IPv4..............................................................................467
7.26.3 Generic routing encapsulation (GRE)....................................................................................468
7.26.4 Ethernet-over-GRE tunnel (EoGRE).......................................................................................475
7.26.5 Loopback addresses for RIP.................................................................................................482
7.26.6 PPPoE snooping new...........................................................................................................483
7.26.7 Default settings in the access table for WAN connections....................................................486
8 Firewall...........................................................................................................................493
8.1 Threat analysis.......................................................................................................................................493
8.1.1 The dangers...........................................................................................................................493
9
Reference Manual
Contents
8.1.2 The ways of the perpetrators..................................................................................................493
8.1.3 The methods..........................................................................................................................494
8.1.4 The victims.............................................................................................................................494
8.2 What is a Firewall?.................................................................................................................................494
8.2.1 Tasks of a Firewall..................................................................................................................495
8.2.2 Different types of Firewalls.....................................................................................................495
8.3 The LANCOM Firewall............................................................................................................................498
8.3.1 How the LANCOM Firewall inspects data packets..................................................................499
8.3.2 Special protocols....................................................................................................................500
8.3.3 General settings of the Firewall..............................................................................................502
8.3.4 Parameters of Firewall rules...................................................................................................504
8.3.5 Alerting functions of the Firewall...........................................................................................508
8.3.6 Strategies for Firewall settings...............................................................................................512
8.3.7 Hints for setting the Firewall..................................................................................................513
8.4 Configuring the firewall with LANconfig................................................................................................516
8.4.1 Firewall wizard.......................................................................................................................516
8.4.2 Definition of firewall objects..................................................................................................516
8.4.3 Defining firewall rules............................................................................................................519
8.5 Configuring firewall rules with WEBconfig or Telnet...............................................................................521
8.5.1 Rule table..............................................................................................................................521
8.5.2 Object table...........................................................................................................................522
8.5.3 Action table...........................................................................................................................523
8.6 Firewall diagnosis..................................................................................................................................523
8.6.1 The Firewall table...................................................................................................................523
8.6.2 The filter list...........................................................................................................................525
8.6.3 The connection list.................................................................................................................526
8.6.4 Port block list.........................................................................................................................528
8.6.5 Host block list........................................................................................................................528
8.7 Firewall limitations.................................................................................................................................529
8.8 Protection against break-in attempts: Intrusion Detection......................................................................529
8.8.1 Examples for break-in attempts..............................................................................................529
8.8.2 Configuration of the IDS........................................................................................................530
8.9 Protection against “Denial of Service” attacks........................................................................................530
8.9.1 Examples of Denial of Service Attacks....................................................................................530
8.9.2 Configuration of DoS blocking...............................................................................................532
8.9.3 Configuration of ping blocking and Stealth mode..................................................................533
8.10 Addition(s) to LCOS 7.80......................................................................................................................533
8.10.1 Increased DoS threshold value for central devices................................................................533
8.11 Addition(s) to LCOS 8.82......................................................................................................................535
8.11.1 Source tags for firewall rules................................................................................................535
9 IPv6.................................................................................................................................536
9.1 IPv6 basics.............................................................................................................................................536
9.1.1 Why use IPv6-standard IP addresses?.....................................................................................536
9.1.2 IP address structure according to the IPv6 standard...............................................................536
10
Reference Manual
Contents
9.1.3 Stages of migration................................................................................................................537
9.2 IPv6 tunneling technologies...................................................................................................................537
9.2.1 6in4 tunneling.......................................................................................................................537
9.2.2 6rd tunneling.........................................................................................................................538
9.2.3 6to4 tunneling.......................................................................................................................538
9.3 DHCPv6.................................................................................................................................................539
9.3.1 DHCPv6 server.......................................................................................................................539
9.3.2 DHCPv6 client........................................................................................................................539
9.4 IPv4 VPN tunnel via IPv6........................................................................................................................539
9.4.1 Setup Wizard – Setting up an IPv4 VPN connection via IPv6..................................................540
9.5 IPv6 firewall...........................................................................................................................................541
9.5.1 Function.................................................................................................................................541
9.5.2 Configuration.........................................................................................................................541
9.5.3 Default entries for the IPv6 firewall rules................................................................................541
9.5.4 IPv6 firewall log table............................................................................................................541
9.6 Additions to the Setup menu..................................................................................................................543
9.6.1 Tunnel....................................................................................................................................543
9.6.2 Router advertisement.............................................................................................................553
9.6.3 DHCPv6.................................................................................................................................562
9.6.4 Relay agent............................................................................................................................575
9.6.5 Network.................................................................................................................................577
9.6.6 Firewall..................................................................................................................................580
9.6.7 LAN interfaces.......................................................................................................................600
9.6.8 WAN interfaces......................................................................................................................604
9.6.9 Operating..............................................................................................................................606
9.6.10 Forwarding..........................................................................................................................607
9.6.11 Router..................................................................................................................................607
9.6.12 IPv6 address........................................................................................................................609
9.7 Additions to the Status menu.................................................................................................................609
9.7.1 Log table...............................................................................................................................609
9.8 Additional command-line commands.....................................................................................................611
9.8.1 IPv6 addresses.......................................................................................................................611
9.8.2 IPv6 prefixes..........................................................................................................................612
9.8.3 IPv6 interfaces.......................................................................................................................612
9.8.4 IPv6 neighbor cache..............................................................................................................612
9.8.5 IPv6 DHCP server...................................................................................................................613
9.8.6 IPv6 DHCP client....................................................................................................................613
9.8.7 IPv6 route..............................................................................................................................613
9.8.8 Release IPv6 address..............................................................................................................613
9.8.9 Ping command for IPv6..........................................................................................................614
9.8.10 Overview of parameters.......................................................................................................614
9.9 Enhancements to LANconfig..................................................................................................................616
9.9.1 IPv6 configuration menu........................................................................................................616
9.9.2 Settings in the PPP list...........................................................................................................625
11
Reference Manual
Contents
9.9.3 IP routing tables....................................................................................................................626
9.9.4 Separate views for the IPv4 and IPv6 firewalls.......................................................................628
9.9.5 IPv6 DNS hosts in the DNS list ..............................................................................................628
9.9.6 Configuring the IPv6 firewall rules.........................................................................................628
9.10 Tutorials...............................................................................................................................................639
9.10.1 Setting up IPv6 Internet access............................................................................................639
9.10.2 Setting up a 6to4 tunnel......................................................................................................648
9.11 Addition(s) to LCOS 8.82......................................................................................................................654
9.11.1 Reconfigure function of the DHCPv6 server..........................................................................654
9.12 Addition(s) to LCOS 8.84......................................................................................................................661
9.12.1 IPv6 prefix delegation from the WWAN to the LAN..............................................................661
9.13 Addition(s) to LCOS 9.00......................................................................................................................663
9.13.1 Dual-Stack Lite (DS-Lite).......................................................................................................663
9.13.2 IPv6 support for RAS services...............................................................................................670
9.13.3 RADIUS attribute extensions for IPv6 RAS services...............................................................678
9.13.4 Loopback addresses for IPv6................................................................................................679
9.13.5 Lightweight DHCPv6 relay agent (LDRA)..............................................................................681
9.13.6 Router advertisement snooping............................................................................................687
9.14 Addition(s) to LCOS 9.10......................................................................................................................689
9.14.1 Prefix-exclude option for DHCPv6 prefix delegation.............................................................689
10 Quality of Service..........................................................................................................691
10.1 Why QoS?............................................................................................................................................691
10.2 Which data packets to prefer?..............................................................................................................691
10.2.1 What is DiffServ?..................................................................................................................692
10.2.2 Guaranteed minimum bandwidths.......................................................................................692
10.2.3 Limited maximum bandwidths.............................................................................................693
10.3 The queue concept...............................................................................................................................693
10.3.1 Queues in transmission direction..........................................................................................693
10.3.2 Queues for receiving direction..............................................................................................695
10.4 Reducing the packet length.................................................................................................................695
10.5 QoS parameters for Voice over IP applications.....................................................................................696
10.6 QoS in sending or receiving direction...................................................................................................699
10.7 QoS configuration................................................................................................................................700
10.7.1 Evaluating ToS and DiffServ fields........................................................................................700
10.7.2 Defining minimum and maximum bandwidths.....................................................................702
10.7.3 Adjusting transfer rates for interfaces..................................................................................703
10.7.4 Sending and receiving direction...........................................................................................703
10.7.5 Reducing the packet length.................................................................................................704
10.8 QoS for WLANs according to IEEE 802.11e (WMM/WME)....................................................................705
11 Virtual Private Networks (VPN)....................................................................................706
11.1 What does VPN offer?..........................................................................................................................706
11.1.1 Conventional network infrastructure....................................................................................706
11.1.2 Networking via the Internet.................................................................................................707
11.1.3 Private IP addresses on the Internet?....................................................................................707
12
Reference Manual
Contents
11.1.4 Secure communications via the Internet?.............................................................................708
11.2 LANCOM VPN: an overview..................................................................................................................708
11.2.1 VPN example application.....................................................................................................708
11.2.2 LANCOM VPN functions.......................................................................................................709
11.3 VPN connections in detail....................................................................................................................709
11.3.1 LAN-LAN coupling...............................................................................................................710
11.3.2 Dial-in connections (Remote Access Service)........................................................................710
11.4 What is LANCOM Dynamic VPN ?.........................................................................................................710
11.4.1 A look at IP addressing........................................................................................................711
11.4.2 This is how LANCOM Dynamic VPN works............................................................................711
11.4.3 Information to the Dynamic VPN registration.......................................................................714
11.5 Configuration of VPN connections........................................................................................................715
11.5.1 VPN tunnel: Connections between VPN gateways................................................................716
11.5.2 Set up VPN connections with the Setup Wizard....................................................................716
11.5.3 1-Click-VPN for networks (site-to-site)..................................................................................717
11.5.4 1-Click-VPN for LANCOM Advanced VPN Client....................................................................718
11.5.5 Inspect VPN rules.................................................................................................................719
11.5.6 Manually setting up VPN connections..................................................................................720
11.5.7 IKE config mode...................................................................................................................720
11.5.8 Prepare VPN network relationships......................................................................................721
11.5.9 Configuration with LANconfig..............................................................................................723
11.5.10 Configuration with WEBconfig...........................................................................................728
11.5.11 Establishing Security Associations collectively....................................................................731
11.5.12 Diagnosis of VPN connections............................................................................................732
11.6 Working with digital certificates...........................................................................................................732
11.6.1 Basics..................................................................................................................................732
11.6.2 Advantages of certificates....................................................................................................735
11.6.3 Structure of certificates........................................................................................................736
11.6.4 Security................................................................................................................................738
11.6.5 Certificates for establishing VPN connections.......................................................................738
11.6.6 Certificates from certificate service providers........................................................................739
11.6.7 Establishing a proprietary CA...............................................................................................739
11.6.8 Requesting a certificate with Stand-alone Windows CA........................................................739
11.6.9 Export the certificate to a PKCS#12 file................................................................................743
11.6.10 Create certificates with OpenSSL........................................................................................746
11.6.11 Upload certificates to the LANCOM....................................................................................747
11.6.12 Storing and uploading certificates......................................................................................748
11.6.13 Set up VPN connections to support certificates..................................................................750
11.6.14 Set up certificate-based VPN connections with the Setup Wizard.......................................754
11.6.15 Set up LANCOM Advanced VPN Client for certificate connections......................................757
11.6.16 Simplified RAS with certificates..........................................................................................759
11.6.17 Simplified network connection with certificates – proadaptive VPN...................................760
11.6.18 Request certificates using CERTREQ...................................................................................761
11.6.19 Certificate revocation list - CRL...........................................................................................761
13
Reference Manual
Contents
11.6.20 Diagnosis of VPN certificate connections............................................................................763
11.6.21 Addition(s) to LCOS 8.00....................................................................................................764
11.6.22 Addition(s) to LCOS 8.50....................................................................................................764
11.7 Multi-level certificates for SSL/TLS........................................................................................................767
11.7.1 Introduction.........................................................................................................................767
11.7.2 SSL/TLS with multi-level certificates......................................................................................768
11.7.3 VPN with multi-level certificates...........................................................................................768
11.8 Certificate enrollment via SCEP............................................................................................................768
11.8.1 SCEP server and SCEP client.................................................................................................768
11.8.2 Distributing certificates........................................................................................................769
11.8.3 Configuring SCEP.................................................................................................................770
11.9 NAT Traversal (NAT-T)..........................................................................................................................773
11.10 Extended Authentication Protocol (XAUTH)........................................................................................775
11.10.1 Introduction.......................................................................................................................775
11.10.2 XAUTH in LCOS..................................................................................................................776
11.10.3 Configuring XAUTH............................................................................................................776
11.11 Backup via alternative VPN connection..............................................................................................777
11.11.1 Introduction.......................................................................................................................777
11.11.2 Backup-capable network infrastructure..............................................................................778
11.11.3 Configuring the VPN backup..............................................................................................780
11.12 Specific examples of connections.......................................................................................................782
11.12.1 Static/static........................................................................................................................783
11.12.2 Dynamic/static...................................................................................................................783
11.12.3 Static/dynamic (with LANCOM Dynamic VPN)....................................................................784
11.12.4 Dynamic/dynamic (with LANCOM Dynamic VPN)................................................................784
11.12.5 VPN connections: High availability with VPN load balancing..............................................785
11.13 How does VPN work?.........................................................................................................................786
11.13.1 IPSec—The basis for LANCOM VPN...................................................................................787
11.13.2 Alternatives to IPSec..........................................................................................................787
11.14 The standards behind IPSec...............................................................................................................788
11.14.1 IPSec modules and their tasks............................................................................................788
11.14.2 Security Associations – numbered tunnels.........................................................................788
11.14.3 Encryption of the packets – the ESP protocol.....................................................................789
11.14.4 Authentication – the AH protocol......................................................................................790
11.14.5 Key management – IKE......................................................................................................791
11.15 Addition(s) to LCOS 8.00....................................................................................................................792
11.15.1 VPN Pathfinder..................................................................................................................792
11.16 Addition(s) to LCOS 8.60....................................................................................................................795
11.16.1 Improved phase 1 rekeying................................................................................................795
11.16.2 MPPE encryption for PPTP tunnels.....................................................................................795
11.17 Addition(s) to LCOS 8.62....................................................................................................................796
11.17.1 Default proposals for IKE and IPSec...................................................................................796
11.17.2 myVPN...............................................................................................................................796
11.18 Addition(s) to LCOS 8.80....................................................................................................................814
14
Reference Manual
Contents
11.18.1 Deleting all VPN errors with one command........................................................................814
11.18.2 Default proposals for IKE and IPSec...................................................................................815
11.18.3 Selecting DH group 14 for VPN connections.......................................................................815
11.18.4 Replay detection ...............................................................................................................817
11.18.5 myVPN...............................................................................................................................818
11.18.6 Intelligent precalculation of DH keys..................................................................................836
11.18.7 Additions to the Setup menu..............................................................................................838
11.18.8 Enhancements to LANconfig..............................................................................................840
11.19 Addition(s) to LCOS 8.82....................................................................................................................840
11.19.1 Hash function SHA2-256 selectable via LANconfig.............................................................840
11.20 Addition(s) to LCOS 9.00....................................................................................................................842
11.20.1 VPN remote access wizard in WEBconfig:...........................................................................842
11.20.2 L2TPv2 (Layer-2 Tunneling Protocol version 2)...................................................................842
11.20.3 Support of the DH groups 15 and 16.................................................................................886
11.21 Addition(s) to LCOS 9.10....................................................................................................................890
11.21.1 SCEP-CA function in VPN environments..............................................................................890
11.21.2 SCEP algorithms updated...................................................................................................891
11.21.3 Loopback address for L2TP connections.............................................................................898
11.21.4 Download link for the public portion of the CA certificate..................................................898
11.21.5 Configurable one-time password (OTP) for SCEP-CA...........................................................899
11.21.6 Deleting VPN error messages in the status table................................................................901
11.21.7 IPv4 addresses for VPN tunnels in the IP parameter list......................................................902
12 Virtual LANs (VLANs)....................................................................................................905
12.1 What is a Virtual LAN?.........................................................................................................................905
12.2 This is how a VLAN works....................................................................................................................905
12.2.1 Frame tagging.....................................................................................................................906
12.2.2 Conversion within the LAN interconnection..........................................................................906
12.2.3 VLAN Q-in-Q tagging...........................................................................................................907
12.2.4 Application examples...........................................................................................................907
12.3 Configuration of VLANs........................................................................................................................908
12.3.1 VLAN and ARF.....................................................................................................................908
12.3.2 VLAN and WLAN Controllers................................................................................................908
12.3.3 General settings...................................................................................................................909
12.3.4 The networktable.................................................................................................................910
12.3.5 The port table......................................................................................................................910
12.4 Configurable VLAN IDs.........................................................................................................................911
12.4.1 Different VLAN IDs per WLAN client.....................................................................................911
12.4.2 VLAN tags for DSL interfaces................................................................................................912
12.4.3 Special VLAN ID for DSLoL interfaces...................................................................................912
12.5 VLAN tags on layer 2/3 in the Ethernet................................................................................................912
12.5.1 Introduction.........................................................................................................................912
12.5.2 Configuring VLAN tagging on layer 2/3................................................................................913
12.6 Addition(s) to LCOS 8.60......................................................................................................................914
12.6.1 Group key per VLAN.............................................................................................................914
15
Reference Manual
Contents
13 Wireless LAN (WLAN)....................................................................................................917
13.1 Introduction.........................................................................................................................................917
13.2 Application scenarios...........................................................................................................................917
13.2.1 Infrastructure mode.............................................................................................................918
13.2.2 Hotspot or guest access.......................................................................................................918
13.2.3 Managed mode...................................................................................................................918
13.2.4 WLAN bridge (point-to-point)..............................................................................................919
13.2.5 WLAN bridge in relay mode.................................................................................................919
13.2.6 WLAN bridge to an access point – managed and unmanaged mixed...................................920
13.2.7 Wireless Distribution System (point-to-multipoint)................................................................920
13.2.8 Client mode.........................................................................................................................920
13.2.9 Client mode with mobile objects in industry.........................................................................921
13.3 WLAN standards..................................................................................................................................921
13.3.1 Data rates in compatibility mode.........................................................................................921
13.3.2 IEEE 802.11n.......................................................................................................................922
13.3.3 IEEE 802.11a: 54 Mbps........................................................................................................928
13.3.4 IEEE 802.11h – ETSI 301 893...............................................................................................928
13.3.5 IEEE 802.11g: 54 Mbps........................................................................................................931
13.3.6 IEEE 802.11b: 11 Mbps........................................................................................................931
13.4 WLAN security ....................................................................................................................................931
13.4.1 Basics .................................................................................................................................931
13.4.2 IEEE 802.11i /WPA2.............................................................................................................932
13.4.3 TKIP and WPA .....................................................................................................................934
13.4.4 WEP ....................................................................................................................................935
13.4.5 LEPS – LANCOM Enhanced Passphrase Security...................................................................935
13.4.6 Standard WEP encryption.....................................................................................................936
13.4.7 Background WLAN scanning................................................................................................939
13.5 Configuration of WLAN parameters.....................................................................................................940
13.5.1 General WLAN settings........................................................................................................940
13.5.2 WLAN security.....................................................................................................................942
13.5.3 Selecting approved stations for the WLAN...........................................................................947
13.5.4 Encryption settings...............................................................................................................948
13.5.5 The physical WLAN interfaces..............................................................................................951
13.5.6 Point-to-point peers.............................................................................................................961
13.5.7 The logical WLAN interfaces.................................................................................................962
13.5.8 IEEE 802.1x/EAP..................................................................................................................970
13.5.9 Expert WLAN settings..........................................................................................................971
13.5.10 WLAN routing (isolated mode)...........................................................................................973
13.5.11 Addition(s) to LCOS 8.80....................................................................................................974
13.6 Configuring the client mode.................................................................................................................979
13.6.1 Client settings......................................................................................................................979
13.6.2 Set the SSID of the available networks.................................................................................980
13.6.3 Encryption settings...............................................................................................................980
13.6.4 Roaming..............................................................................................................................981
16
Reference Manual
Contents
13.6.5 Addition(s) to LCOS 7.80......................................................................................................982
13.7 Configuring point-to-point connections................................................................................................984
13.7.1 Geometric dimensioning of outdoor wireless network links..................................................985
13.7.2 Antenna alignment for P2P operations.................................................................................987
13.7.3 Measuring wireless bridges..................................................................................................989
13.7.4 Activating point-to-point operation mode............................................................................989
13.7.5 Configuration of P2P connections........................................................................................990
13.7.6 Access points in relay mode.................................................................................................993
13.7.7 Security for point-to-point connections................................................................................993
13.7.8 Addition(s) to LCOS 8.50......................................................................................................994
13.7.9 Addition(s) to LCOS 8.60......................................................................................................995
13.8 Central firmware and script management............................................................................................996
13.8.1 General settings for firmware management.........................................................................997
13.8.2 Firmware management table...............................................................................................998
13.8.3 General settings for script management...............................................................................998
13.8.4 Script management table.....................................................................................................999
13.8.5 Internal script storage (script management without an HTTP server)....................................999
13.9 DFS 2: Non-use of channels for weather radar...................................................................................1000
13.10 Bandwidth limits in the WLAN.........................................................................................................1000
13.10.1 Operating as an access point...........................................................................................1000
13.10.2 Operating as a Client.......................................................................................................1001
13.11 Addition(s) to LCOS 7.70..................................................................................................................1002
13.11.1 APSD – Automatic Power Save Delivery...........................................................................1002
13.11.2 BFWA – higher transmission power for longer ranges......................................................1003
13.12 Addition(s) to LCOS 7.80..................................................................................................................1003
13.12.1 ARF network for IAPP.......................................................................................................1003
13.13 Addition(s) to LCOS 8.50..................................................................................................................1004
13.13.1 Alarm limits for WLAN devices.........................................................................................1004
13.13.2 Interpoint alarm limits......................................................................................................1005
13.13.3 IEEE 802.11e user priority converted into VLAN tags........................................................1006
13.14 Addition(s) to LCOS 8.60..................................................................................................................1006
13.14.1 Adjustable rate adaption algorithm..................................................................................1006
13.15 Addition(s) to LCOS 8.80..................................................................................................................1008
13.15.1 Spectral scan...................................................................................................................1008
13.15.2 WLAN band steering........................................................................................................1018
13.15.3 STBC / LDPC.....................................................................................................................1021
13.15.4 LANCOM-specific UUID information element for access points.........................................1026
13.15.5 DFS..................................................................................................................................1027
13.15.6 PMK caching in the WLAN client mode............................................................................1028
13.15.7 Pre-authentication in WLAN-client mode.........................................................................1030
13.15.8 Greenfield mode for access points with IEEE 802.11n......................................................1031
13.15.9 Separate RADIUS server for each SSID..............................................................................1032
13.16 Addition(s) to LCOS 8.82..................................................................................................................1037
13.16.1 Advanced ARP handling...................................................................................................1037
17
Reference Manual
Contents
13.16.2 Multicast and broadcasts in cells can be switched off......................................................1039
13.17 Addition(s) to LCOS 8.84..................................................................................................................1042
13.17.1 LANCOM Active Radio Control (ARC)...............................................................................1042
13.17.2 Maximum EIRP value depends on the transmission standard...........................................1043
13.17.3 Adjusting the maximum transmit rate for multicasts and broadcasts................................1043
13.17.4 IGMP snooping in auto mode..........................................................................................1045
13.17.5 Converting DHCP responses from broadcast to unicast ...................................................1050
13.17.6 Adaptive noise immunity to reduce interference on the WLAN.........................................1051
13.17.7 Opportunistic key caching................................................................................................1054
13.17.8 Feature enhancement of the WLC tunnel interface...........................................................1062
13.17.9 Support for 802.11u/HotSpot 2.0 on WLAN controllers....................................................1062
13.18 Addition(s) to LCOS 9.00..................................................................................................................1090
13.18.1 Support of 802.11ac WLAN interfaces.............................................................................1090
13.18.2 Specifying client-bridge mode and bandwidth limit for each SSID....................................1102
13.18.3 Separation of P2P and WLAN/SSID configuration.............................................................1107
13.18.4 Flexible WLAN capture format..........................................................................................1124
13.18.5 Band steering with delayed scan at 2.4 GHz....................................................................1125
13.18.6 Advanced wireless LAN traces..........................................................................................1126
13.18.7 Fast roaming as per IEEE 802.11r....................................................................................1128
13.18.8 WPA2 with AES as factory setting....................................................................................1133
13.18.9 WLAN protected management frames (PMF)....................................................................1133
13.18.10 Redundant connections using PRP.................................................................................1143
13.19 Addition(s) to LCOS 9.10..................................................................................................................1158
13.19.1 Upgrade to 16 SSIDs per WLAN module...........................................................................1158
13.19.2 WLAN disabled by default................................................................................................1158
13.19.3 Wildcards for MAC address and SSID filters.....................................................................1158
13.19.4 Conformity with current ETSI radio standards in the 2.4GHz/5GHz bands.........................1168
13.19.5 Time of the DFS rescan configurable via LANconfig..........................................................1170
13.19.6 P2P support for 802.11ac................................................................................................1171
13.19.7 Client mode for 802.11ac.................................................................................................1171
13.19.8 Bandwidth limit for each WLAN client per SSID................................................................1171
13.19.9 Opportunistic key caching (OKC) adjustable on the client side..........................................1172
13.19.10 Counter for WPA login attempts.....................................................................................1172
13.19.11 Point-to-point links via 802.11ac...................................................................................1174
13.19.12 Additions to the Setup menu..........................................................................................1174
13.19.13 Additions to the Status menu.........................................................................................1175
14 WLAN Management....................................................................................................1176
14.1 Starting position................................................................................................................................1176
14.2 Technical concepts.............................................................................................................................1176
14.2.1 The CAPWAP standard.......................................................................................................1176
14.2.2 Smart controller technology...............................................................................................1177
14.2.3 Communication between access point and WLAN controller..............................................1178
14.2.4 Zero-touch management....................................................................................................1180
14.2.5 Split management..............................................................................................................1180
18
Reference Manual
Contents
14.3 Basic configuration of the WLAN controller function..........................................................................1180
14.3.1 Setting the time information for the WLAN controller.........................................................1180
14.3.2 Example: Default configuration..........................................................................................1181
14.3.3 Assigning the default configuration to the new access points............................................1182
14.3.4 Configuring the access points............................................................................................1182
14.4 Configuration.....................................................................................................................................1183
14.4.1 General settings.................................................................................................................1183
14.4.2 Profiles...............................................................................................................................1183
14.4.3 Access point configuration.................................................................................................1197
14.4.4 IP-dependent auto configuration and tagging of APs.........................................................1229
14.5 Tutorial: Virtualization and guest access accounts via the LANCOM WLAN controller.........................1231
14.5.1 Wireless LAN configuration of the WLAN controllers..........................................................1231
14.5.2 Configuring the switch.......................................................................................................1233
14.5.3 Configuring the IP networks in the WLAN controller..........................................................1235
14.5.4 Configuring Public Spot access...........................................................................................1237
14.5.5 Configuring the RADIUS server to operate a Public Spot....................................................1239
14.5.6 Configuring Internet access for the guest network.............................................................1241
14.6 Access point administration...............................................................................................................1241
14.6.1 Accepting new access points into the WLAN infrastructure manually.................................1241
14.6.2 Manually removing access points from the WLAN infrastructure........................................1243
14.6.3 Deactivating access points or permanently removing them from the WLAN
infrastructure..........................................................................................................................1244
14.7 Central firmware and script management..........................................................................................1244
14.7.1 General settings for firmware management.......................................................................1245
14.8 WLAN layer-3 tunneling.....................................................................................................................1248
14.8.1 Introduction.......................................................................................................................1248
14.8.2 Tutorials.............................................................................................................................1249
14.9 RADIUS..............................................................................................................................................1261
14.9.1 Checking WLAN clients with RADIUS (MAC filter)...............................................................1261
14.9.2 External RADIUS server......................................................................................................1262
14.10 Dynamic VLAN assignment..............................................................................................................1264
14.11 Activating 802.1x accounting for logical WLANs in WLAN controllers..............................................1265
14.12 Displays and commands in LANmonitor...........................................................................................1266
14.13 Automatic RF optimization...............................................................................................................1267
14.14 Channel-load display in WLC mode..................................................................................................1269
14.15 Backing up the certificates...............................................................................................................1269
14.15.1 Create backups of the certificates....................................................................................1269
14.15.2 Uploading a certificate backup into the device.................................................................1270
14.15.3 Backing up and restoring further files from the SCEP-CA..................................................1270
14.16 Backup solutions..............................................................................................................................1271
14.16.1 Backup with redundant WLAN controllers........................................................................1272
14.16.2 Backup with primary and secondary WLAN controllers.....................................................1273
14.16.3 Primary and secondary controllers....................................................................................1274
14.16.4 Addition(s) to LCOS 9.10..................................................................................................1275
19
Reference Manual
Contents
14.17 Addition(s) to LCOS 8.82..................................................................................................................1276
14.17.1 Band steering via WLAN controller...................................................................................1276
14.18 Addition(s) to LCOS 9.00..................................................................................................................1281
14.18.1 AutoWDS – wireless integration of APs via P2P connections............................................1281
14.18.2 IP-dependent auto configuration and tagging of APs.......................................................1345
14.18.3 Automatic selection of the 2.4-/5-GHz mode....................................................................1359
14.18.4 WLC cluster......................................................................................................................1363
14.18.5 One-click backup of the SCEP-CA.....................................................................................1377
14.18.6 Automatic restart of managed APs after firmware update................................................1377
14.18.7 Automatic search for alternative WLCs.............................................................................1378
14.18.8 U-APSD configurable by WLC...........................................................................................1378
14.18.9 Group-related radio field optimization.............................................................................1379
14.18.10 Adding new APs with the WEBconfig Setup Wizard.......................................................1380
14.18.11 Maximum bandwidth can be adjusted for each WLAN module......................................1382
14.18.12 Client steering by WLC...................................................................................................1387
14.18.13 Automatic frequency-band selection..............................................................................1398
14.19 Addition(s) to LCOS 9.10..................................................................................................................1400
14.19.1 AutoWDS operation.........................................................................................................1400
14.19.2 Disable responses to CAPWAP requests from a WAN connection.....................................1401
14.19.3 Additional date information for central firmware management........................................1402
14.19.4 Display of channel and frequency of clients logged on to the AP......................................1404
14.19.5 Using LANconfig to backup certificates............................................................................1405
14.19.6 Displaying the certificate status of an AP.........................................................................1406
14.19.7 On/off switch for AP LEDs per WLC..................................................................................1407
14.19.8 Managing Wireless-ePaper and iBeacon profiles with WLCs.............................................1413
14.19.9 The modules iBeacon and Wireless ePaper have an additional "Managed" mode............1419
14.19.10 WLAN profiles divided into basic and advanced profiles.................................................1420
14.19.11 General LBS profile and device location profile...............................................................1420
14.19.12 Additions to the Status menu.........................................................................................1424
14.19.13 WLC Clustering Wizard...................................................................................................1425
15 Public Spot..................................................................................................................1426
15.1 Introduction.......................................................................................................................................1426
15.1.1 What is a Public Spot?........................................................................................................1426
15.1.2 Possible application scenarios............................................................................................1427
15.1.3 Overview of the Public Spot module...................................................................................1434
15.2 Setup and operation..........................................................................................................................1436
15.2.1 Basic configuration............................................................................................................1437
15.2.2 Security settings.................................................................................................................1456
15.2.3 Extended functions and settings........................................................................................1457
15.2.4 Alternative login methods..................................................................................................1472
15.2.5 Default and customized authentication pages....................................................................1505
15.3 Access to the Public Spot...................................................................................................................1514
15.3.1 Requirements for logging in...............................................................................................1514
15.3.2 Logging in to the Public Spot.............................................................................................1515
20
Reference Manual
Contents
15.3.3 Session information...........................................................................................................1516
15.3.4 Logging out of the Public Spot...........................................................................................1516
15.3.5 Advice and help.................................................................................................................1517
15.4 Tutorials for setting up and using Public Spots...................................................................................1518
15.4.1 Virtualization and guest access via WLAN controller with VLAN.........................................1518
15.4.2 Virtualization and guest access via WLAN controller without VLAN....................................1528
15.4.3 Setting up an external RADIUS server for user administration............................................1538
15.4.4 Internal and external RADIUS servers combined.................................................................1539
15.4.5 Checking WLAN clients with RADIUS (MAC filter)...............................................................1542
15.4.6 Setting up an external SYSLOG server.................................................................................1542
15.5 Appendix...........................................................................................................................................1544
15.5.1 Commonly transmitted RADIUS attributes..........................................................................1544
15.5.2 RADIUS attributes transmitted via WISPr............................................................................1549
15.5.3 Expert settings for the PMS interface.................................................................................1550
15.6 Addition(s) to LCOS 8.84....................................................................................................................1554
15.6.1 Any phone number format for Smart Ticket........................................................................1554
15.6.2 Sending login data via a GSM-capable device (Smart Ticket)..............................................1554
15.6.3 Terms of use when authenticating with name, password (and MAC address).....................1558
15.6.4 Advanced configuration of user templates with LANconfig................................................1559
15.6.5 Multi-lingual login and text messaging..............................................................................1563
15.6.6 New URL placeholders (template variables)........................................................................1570
15.6.7 User-dependent HTML output on the voucher....................................................................1570
15.6.8 Show/hide the LANCOM logo and header image in the voucher.........................................1570
15.6.9 Additional languages for the authentication pages............................................................1571
15.6.10 Special template pages for Smart Ticket...........................................................................1571
15.6.11 Setting up an error page in case of WAN connection failure............................................1572
15.6.12 Template caching.............................................................................................................1573
15.6.13 Quick link to the session information window..................................................................1574
15.7 Addition(s) to LCOS 9.00....................................................................................................................1575
15.7.1 Number format for Smart Ticket.........................................................................................1575
15.7.2 Viewing Public Spot clients................................................................................................1575
15.7.3 Displaying advertising to Public Spot users........................................................................1575
15.7.4 Additional attributes for the XML interface........................................................................1580
15.7.5 Dynamic change of a user session via the XML interface....................................................1581
15.8 Addition(s) to LCOS 9.10....................................................................................................................1582
15.8.1 Restricting administrators to voucher output only..............................................................1582
15.8.2 Specify volume budget on vouchers...................................................................................1584
15.8.3 XML interface: Enhanced VLAN handling...........................................................................1585
15.8.4 "Small header image": Optimized display for 19" devices...................................................1589
15.8.5 New button "Manage user wizard"....................................................................................1589
15.8.6 Only show user accounts generated by the currently logged-on administrator...................1589
15.8.7 Evaluation of DHCP option 82 in RADIUS and Public Spot..................................................1590
15.8.8 Additions to the Status menu.............................................................................................1593
15.8.9 Additions to the Setup menu..............................................................................................1594
21
Reference Manual
Contents
16 Voice over IP (VoIP).....................................................................................................1595
16.1 Introduction.......................................................................................................................................1595
16.1.1 PC-to-PC communication ..................................................................................................1595
16.1.2 PC-to-phone and phone-to-PC communication..................................................................1595
16.2 VoIP implementation in the LANCOM VoIP Router.............................................................................1596
16.2.1 Example Applications.........................................................................................................1596
16.2.2 The central position of the LANCOM VoIP Router...............................................................1598
16.3 Call switching: Call routing................................................................................................................1600
16.3.1 SIP proxy and SIP gateway.................................................................................................1600
16.3.2 User registration at the SIP proxy.......................................................................................1600
16.3.3 Number translation at network transitions.........................................................................1603
16.3.4 The Call Manager...............................................................................................................1603
16.3.5 Making telephone calls with the LANCOM VoIP Router......................................................1604
16.3.6 Call hold, transfer call, connect call....................................................................................1606
16.3.7 Transfer of DTMF tones......................................................................................................1607
16.3.8 Transfer toll information to the internal ISDN buses...........................................................1608
16.3.9 Supporting digital calls......................................................................................................1608
16.4 Configuration of VoIP parameters......................................................................................................1608
16.4.1 General settings.................................................................................................................1609
16.4.2 Configuration of users........................................................................................................1610
16.4.3 Line configuration..............................................................................................................1619
16.5 Call Manager Configuration...............................................................................................................1630
16.5.1 Process of call routing........................................................................................................1630
16.5.2 Handling the calling party ID.............................................................................................1631
16.5.3 Call-routing table parameters.............................................................................................1632
16.5.4 Codecs...............................................................................................................................1637
16.5.5 Extended settings...............................................................................................................1638
16.6 PBX functions for LANCOM VoIP Router.............................................................................................1639
16.6.1 Connect and forward call...................................................................................................1640
16.6.2 Spontaneous call management by the user........................................................................1643
16.6.3 Configure permanent call forwarding.................................................................................1645
16.6.4 Fax via T.38 – Fax over IP (FoIP).........................................................................................1646
16.6.5 Hunt groups with call distribution......................................................................................1647
16.6.6 Multi-login.........................................................................................................................1648
16.7 VoIP media proxy – Optimized management for SIP connections.......................................................1649
16.7.1 Multiple media streams in one SIP connection...................................................................1649
16.7.2 Management of media streams in case of an upstream SIP PBX.........................................1650
16.7.3 Managing the media streams in the firewall......................................................................1650
16.7.4 Automatic QoS rules for media streams..............................................................................1650
16.7.5 Handling subscribers using different codecs.......................................................................1650
16.8 SIP-ID as switchboard number with trunk lines..................................................................................1651
16.9 Switching at the SIP provider.............................................................................................................1651
16.10 Handling canonical telephone numbers...........................................................................................1652
16.11 Processing Destination Domains......................................................................................................1652
22
Reference Manual
Contents
16.11.1 Registration at upstream exchanges................................................................................1653
16.11.2 Switching internal calls....................................................................................................1653
16.12 ISDN interface configuration............................................................................................................1653
16.12.1 Point-to-multipoint and point-to-point connections.........................................................1653
16.12.2 Bus termination, life-line support and power relay...........................................................1654
16.12.3 Protocol setting................................................................................................................1655
16.12.4 ISDN connection timing...................................................................................................1655
16.13 Configuration examples...................................................................................................................1656
16.13.1 VoIP telephony for stand-alone use..................................................................................1656
16.13.2 Using VoIP telephony to extend the upstream ISDN PBX..................................................1663
16.13.3 Using VoIP telephony to extend the downstream ISDN PBX.............................................1668
16.13.4 Using VoIP telephony to supplement existing ISDN telephones........................................1672
16.13.5 Connecting to an upstream SIP PBX.................................................................................1674
16.13.6 VoIP connectivity for locations without a SIP PBX.............................................................1677
16.13.7 The LANCOM VoIP Router at a P2P (point-to-point) connection.......................................1682
16.13.8 SIP trunking.....................................................................................................................1683
16.13.9 Remote gateway..............................................................................................................1685
16.14 Diagnosis of VoiP connections.........................................................................................................1688
16.14.1 SIP traces.........................................................................................................................1688
16.14.2 Connection diagnosis with LANmonitor...........................................................................1688
16.15 Addition(s) to LCOS 7.80..................................................................................................................1690
16.15.1 Global settings, DiffServ for SIP & RTP..............................................................................1690
16.16 Addition(s) to LCOS 8.60..................................................................................................................1691
16.16.1 SIP ALG: Proxy for bypassing NAT in the router................................................................1691
16.16.2 Restricting or preventing SIP registration over WAN connections.....................................1697
16.17 Addition(s) to LCOS 8.62..................................................................................................................1698
16.17.1 Default setting for WAN registration of a SIP user............................................................1698
16.18 Addition(s) to LCOS 8.80..................................................................................................................1699
16.18.1 Default setting for WAN registration of a SIP user............................................................1699
17 High availability – backup solutions..........................................................................1700
17.1 High availability for networks.............................................................................................................1700
17.1.1 How is a network-connection disturbance detected?..........................................................1700
17.1.2 High-availability of lines – backup connections..................................................................1703
17.1.3 High-availability of gateways – redundant gateways with VPN load balancing..................1705
17.1.4 High-availability of the Internet access – Multi-PPPoE........................................................1706
17.1.5 Example applications.........................................................................................................1706
17.2 Backup Solutions and Load Balancing with VRRP...............................................................................1708
17.2.1 Introduction.......................................................................................................................1708
17.2.2 Virtual Router Redundancy Protocol...................................................................................1708
17.2.3 Application scenarios.........................................................................................................1713
17.2.4 Interaction with internal services........................................................................................1715
17.2.5 VRRP in the WAN...............................................................................................................1718
17.2.6 Configuration.....................................................................................................................1719
17.2.7 Status Information.............................................................................................................1721
23
Reference Manual
Contents
17.3 Addition(s) to LCOS 9.10....................................................................................................................1722
17.3.1 High availability clustering.................................................................................................1722
18 Office communication with LANCAPI.........................................................................1761
18.1 What are the advantages of LANCAPI?..............................................................................................1761
18.2 The client and server principle............................................................................................................1761
18.2.1 Configuring the LANCAPI server.........................................................................................1761
18.2.2 Installing the LANCAPI client.............................................................................................1763
18.2.3 Configuration of the LANCAPI clients.................................................................................1764
18.3 How to use the LANCAPI....................................................................................................................1764
18.4 The LANCOM Systems CAPI Faxmodem..............................................................................................1765
18.4.1 Installation.........................................................................................................................1765
18.4.2 Faxing with the CAPI Faxmodem........................................................................................1765
18.4.3 Faxing under Windows XP and Windows 2000..................................................................1765
18.5 LANCOM Faxmodem option...............................................................................................................1765
18.6 Provided B channel protocols.............................................................................................................1765
19 More services..............................................................................................................1767
19.1 Automatic IP address administration with DHCP................................................................................1767
19.1.1 Introduction.......................................................................................................................1767
19.1.2 Configuring DHCP parametersLANconfig...........................................................................1768
19.1.3 Configuring DHCP parameters with telnet or WEBconfig....................................................1772
19.1.4 DHCP relay server...............................................................................................................1776
19.1.5 Configuring clients.............................................................................................................1777
19.1.6 Checking IP addresses in the LAN......................................................................................1777
19.1.7 Addition(s) to LCOS 7.80....................................................................................................1777
19.1.8 Addition(s) to LCOS 8.00....................................................................................................1780
19.1.9 Addition(s) to LCOS 8.80....................................................................................................1781
19.2 Vendor Class and User Class Identifier...............................................................................................1782
19.3 DNS...................................................................................................................................................1783
19.3.1 What does a DNS server do?..............................................................................................1783
19.3.2 DNS forwarding.................................................................................................................1783
19.3.3 Setting up the DNS server..................................................................................................1784
19.3.4 URL blocking......................................................................................................................1786
19.3.5 Dynamic DNS.....................................................................................................................1786
19.3.6 Addition(s) to LCOS 8.82....................................................................................................1788
19.4 Accounting........................................................................................................................................1791
19.4.1 Configuring accounting......................................................................................................1792
19.4.2 Snapshot configuration......................................................................................................1793
19.5 Call charge management...................................................................................................................1793
19.5.1 Connection limits for DSL and cable modem......................................................................1794
19.5.2 Charge-based ISDN connection limits................................................................................1794
19.5.3 Time dependent ISDN connection limit..............................................................................1795
19.5.4 Settings in the charge module............................................................................................1795
19.6 Time server for the local net...............................................................................................................1795
19.6.1 Configuration of the time server under LANconfig..............................................................1795
24
Reference Manual
Contents
19.6.2 Configuration of the time server with WEBconfig or Telnet.................................................1796
19.6.3 Configuring the NTP clients................................................................................................1797
19.7 Scheduled Events...............................................................................................................................1799
19.7.1 Regular Execution of Commands........................................................................................1799
19.7.2 CRON jobs with time delay.................................................................................................1799
19.7.3 Configuring the CRON job..................................................................................................1800
19.8 PPPoE Servers....................................................................................................................................1801
19.8.1 Introduction.......................................................................................................................1801
19.8.2 Example application...........................................................................................................1802
19.8.3 Configuration.....................................................................................................................1804
19.9 Remote bridge...................................................................................................................................1805
19.10 RADIUS............................................................................................................................................1806
19.10.1 How RADIUS works..........................................................................................................1807
19.10.2 Configuration of RADIUS as authenticator or NAS............................................................1807
19.10.3 Configuring RADIUS as server..........................................................................................1813
19.10.4 Addition(s) to LCOS 7.70..................................................................................................1814
19.10.5 Addition(s) to LCOS 8.84..................................................................................................1815
19.10.6 Addition(s) to LCOS 9.00..................................................................................................1825
19.10.7 Addition(s) to LCOS 9.10..................................................................................................1852
19.11 Extensions to the RADIUS server......................................................................................................1865
19.11.1 New authentication method.............................................................................................1865
19.11.2 EAP authentication..........................................................................................................1865
19.11.3 RADIUS forwarding..........................................................................................................1866
19.11.4 RADIUS server parameters...............................................................................................1867
19.11.5 Addition(s) to LCOS 7.80..................................................................................................1868
19.11.6 Addition(s) to LCOS 8.80..................................................................................................1870
19.11.7 Addition(s) to LCOS 8.82..................................................................................................1871
19.12 RADSEC...........................................................................................................................................1875
19.12.1 Configuring RADSEC for the client....................................................................................1875
19.12.2 Certificates for RADSEC....................................................................................................1875
19.13 Operating printers at the USB connector of the LANCOM.................................................................1876
19.13.1 Configuring the printer server in the LANCOM.................................................................1876
19.13.2 Printer configuration at the computer..............................................................................1877
19.14 Addition(s) to LCOS 7.70..................................................................................................................1880
19.14.1 IGMP snooping................................................................................................................1880
19.14.2 TACACS+.........................................................................................................................1889
19.15 Addition(s) to LCOS 8.00..................................................................................................................1899
19.15.1 Basic HTTP file server for LCOS 8.0...................................................................................1899
19.15.2 SSH client.........................................................................................................................1900
19.15.3 LANCOM Content Filter....................................................................................................1904
19.16 Addition(s) to LCOS 8.50..................................................................................................................1936
19.16.1 Bandwidth restriction of the LAN interfaces.....................................................................1936
19.17 Addition(s) to LCOS 8.80..................................................................................................................1937
19.17.1 LLDP................................................................................................................................1937
25
Reference Manual
Contents
19.18 Addition(s) to LCOS 8.84..................................................................................................................1946
19.18.1 Sending and receiving SMS text messages.......................................................................1946
19.19 Addition(s) to LCOS 9.00..................................................................................................................1955
19.19.1 Deactivating device LEDs – boot-persistent......................................................................1955
19.19.2 Comment box for CRON jobs............................................................................................1957
19.19.3 LANCAPI disabled by default............................................................................................1959
19.19.4 DHCP snooping and DHCP option 82...............................................................................1959
19.19.5 Enabling LLDP with LANconfig.........................................................................................1964
19.19.6 Wildcard certificates in the LANCOM Content Filter..........................................................1964
19.20 Addition(s) to LCOS 9.10..................................................................................................................1966
19.20.1 Smart certificates.............................................................................................................1966
19.20.2 ISDN................................................................................................................................2010
19.20.3 Prefer perfect forward secrecy (PFS) for connections........................................................2011
19.20.4 Input field for DHCP options extended to 251 characters.................................................2012
20 Appendix.....................................................................................................................2014
20.1 Error messages in LANmonitor...........................................................................................................2014
20.1.1 General error messages......................................................................................................2014
20.1.2 VPN error messages...........................................................................................................2014
20.2 SNMP Traps ......................................................................................................................................2017
20.3 Radio channels..................................................................................................................................2018
20.3.1 Radio channels in the 2,4 GHz frequency band..................................................................2018
20.3.2 Radio channels in the 5 GHz frequency band.....................................................................2018
20.3.3 Radio channels and frequency ranges for Indoor and Outdoor operating...........................2019
20.4 RFCs supported..................................................................................................................................2021
20.5 Glossary.............................................................................................................................................2022
26
Reference Manual
Contents
© 2014 LANCOM Systems GmbH, Wuerselen (Germany). All rights reserved.
While the information in this manual has been compiled with great care, it may not be deemed an assurance of product
characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery. The
reproduction and distribution of the documentation and software supplied with this product and the use of its contents
is subject to written authorization from LANCOM Systems. We reserve the right to make any alterations that arise as the
result of technical development.
Windows®, Windows Vista™, Windows NT® und Microsoft® are registered trademarks of Microsoft, Corp.
The LANCOM Systems logo, LCOS and the name LANCOM are registered trademarks of LANCOM Systems GmbH. All
other names or descriptions used may be trademarks or registered trademarks of their owners.
Subject to change without notice. No liability for technical errors or omissions.
Products from LANCOM Systems include software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(
www.openssl.org
).
Products from LANCOM Systems include cryptographic software written by Eric Young (
eay@cryptsoft.com
).
Products from LANCOM Systems include software developed by the NetBSD Foundation, Inc. and its contributors.
Products from LANCOM Systems contain the LZMA SDK developed by Igor Pavlov.
LANCOM Systems GmbH
Adenauerstr. 20/B2
52146 Wuerselen
Germany
www.lancom.eu
27
Reference Manual
1 About this documentation
1.1 Constituents of this documentation
The documentation of this device includes the following:
1
Installation Guide
In this getting started guide you find answers to the following questions:
2
Which software needs to be installed for the configuration?
2
How needs the device to be connected?
2
How can the device be reached by LANconfig, WEBconfig or another interface?
2
How do you start a setup assistant (e.g. for providing an internet access)?
2
How do you make a hardware check?
2
Where can you find more information and help?
1
User’s manual
The user’s manual contains all information, which are important for starting up the device. In addition you find all
technical specifications.
1
Manual PBX functionalities (only models with VoIP support)
In the manual PBX functionalities you find a detailed step-by-step guide for using a LANCOM VoIP Router as a
telephone system for a location. Also there are described the most important advices for the user and the connection
of end devices.
1
Reference manual
The reference manual completes the user’s manual and describes topics in detail, which are valid for several models
simultaneously. These are for example:
2
Systems design of the LCOS operating system
2
Configuration
2
Management
2
Diagnosis
2
Security
2
Routing and WAN functions
2
Firewall
2
Quality of Service (QoS)
2
Virtual Private Networks (VPN)
2
Virtual Local Networks (VLAN)
2
Wireless Networks
2
Voice communication in networks with Voice over IP (VoIP)
2
Back up solutions
2
LANCAPI
2
Further server services (DHCP, DNS, charge management)
The description in the reference manual is geared to the configuration with LANconfig. For every LANconfig dialogue
is given the associated path for the configuration with WEBconfig, e.g.:
LANconfig: Wireless LAN / 802.11i/WEP / WPA or Private WEP settings
28
Reference Manual
1 About this documentation
WEBconfig: LCOS Menu Tree / setup / interfaces / WLAN / encryption
The path for the configuration with console/telnet is not explicit written, but can be deduced. The telnet path for the
encryption setting is e.g.:
cd Setup/interfaces/WLAN/encryption
1
Menu reference
The menu reference describes all parameter of LCOS, the operating system of all LANCOM devices. This description
supports the user to configurate the devices with WEBconfig or telnet. The parameters in the menu reference are sorted
the way they can be reached with WEBconfig. Every parameter is not only described, but you can find as well possible
values and standards.
5
You find all documents, which are not attached to your device in a printed version, as an acrobat document
under www.lancom.de/download or on the attached product CD.
1.1.1 LCOS, the operating system of LANCOM devices
All LANCOM routers and LANCOM Wireless Access Points use the same operating system: LCOS. The operating system
developed by LANCOM Systems itself is not attackable from the outside, and thus offers high security. The consistent
use of LCOS ensures a comfortable and constant operation of all LANCOM products. The extensive feature set is available
throughout all LANCOM products (provided respective support by hardware), and continuously receives further
enhancements by free, regular software updates.
This reference manual applies to the following definitions of software, hardware and manufacturers:
1
’LCOS’ describes the device-independent operating system
1
’LANCOM’ stands as generic term for all LANCOM routers and LANCOM Router Access Points
1
’LANCOM Systems’ stands as shortened form for the manufacturer, LANCOM Systems GmbH, Germany
1.1.2 Validity
The present reference manual applies to all LANCOM routers and LANCOM Router Access Points with firmware version
7.6 or better.
The functions and settings described in this reference manual are not supported by all models and/or all firmware versions.
A table can be found in the appendix denoting the individual functions, from which firmware version they are supported
in the respective devices.
Illustrations of devices, as well as screenshots always represent just examples, which need not necessarily correspond
to the actual firmware version.
1.1.3 Security settings
For a carefree use of your device, we recommend to carry out all security settings (e.g. Firewall, encryption, access
protection, charge lock), which are not already activated at the time of purchase of your device. The LANconfig wizard
’Check Security Settings’ will support you accomplishing this. Further information regarding this topic can be found in
chapter .
We ask you additionally to inform you about technical developments and actual hints to your product on our Web page
www.lancom.eu, and to download new software versions if necessary.
1.1.4 This documentation was created by …
... several members of our staff from a variety of departments in order to ensure you the best possible support when
using your LANCOM product.
In case you encounter any errors, or just want to issue critics or enhancements, please do not hesitate to send an email
directly to: info@lancom.de
29
Reference Manual
1 About this documentation
5
Our online services www.lancom.euare available to you around the clock should you have any queries regarding
the topics discussed in this manual or require any further support. The area 'Support' will help you with many
answers to frequently asked questions (FAQs). Furthermore, the knowledgebase offers you a large reserve of
information. The latest drivers, firmware, utilities and documentation are constantly available for download. In
addition, LANCOM support is available. For telephone numbers and contact addresses of LANCOM support,
please see the enclosed leaflet or the LANCOM Systems website.
Information symbols
Very important instructions. Failure to observe this may result in damage.
Important instruction that should be observed.
Additional information that may be helpful but which is not required.
30
Reference Manual
1 About this documentation
2 System design
2.1 Introduction
The LANCOM operating system LCOS is a collection of different software modules, the LANCOM devices themselves have
different interfaces to the WAN and LAN. Depending on the particular application, data packets flow through different
modules on their way from one interface to another.
The following block diagram illustrates in abstract the general arrangement of LANCOM interfaces and LCOS modules.
In the course of this reference manual the descriptions of the individual functions will refer to this illustration to show
important connections of the particular applications and to deduce the resulting consequences.
The diagram can thus explain for which data streams the firewall comes into play, or, in case of address translations (IP
masquerading or N:N mapping), at which place which addresses are valid.
VPN services
Assignment via Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
Firewall / IDS / DoS / QoS
Policy Based Routing
IP router
Load Balancing
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
LAN
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
PPTP/VPN
Encryption:
802.11i/WPA/WEP
Assignment via Switch
Assignment via Switch
Assignment via Switch
LAN
DSL
DSoL
DMZ
Port-Mapping
Switch
Notes regarding the respective modules and interfaces:
1
The IP router takes care of routing data on IP connections between the interfaces from LAN and WAN.
1
With IP redirect requests in the LAN are redirected to a specific computer
1
The firewall (with the services “Intrusion Detection”, “Denial of Service” and “Quality of Service”) encloses the IP
router like a shield. All connections via the IP router automatically flow through the firewall as well.
1
LANCOM devices provide either a separate LAN interface or an integrated switch with multiple LAN interfaces as
interfaces to the LAN.
1
LANCOM Router access points resp. LANCOM routers with wireless modules offer additionally one or, depending on
the respective model, also two wireless interfaces for the connection of Wireless LANs. Depending on the model
every wireless interface can build up to eight different wireless networks (“multi SSID”).
1
A DMZ interface enables for some models a ’demilitarized zone’ (DMZ), which is also physically separated within the
LAN bridge from other LAN interfaces.
1
The LAN bridge provides a protocol filter that enables blocking of dedicated protocols on the LAN. Additionally,
single LAN interfaces can be separated by the “isolated mode”. Due to VLAN functions, virtual LANs may be installed
in the LAN bridge, which permit the operating of several logical networks on a physical cabling.
1
Applications can communicate with different IP modules (NetBIOS, DNS, DHCP server, RADIUS, RIP, NTP, SNMP,
SYSLOG, SMTP) either via the IP router, or directly via the LAN bridge.
1
The functions “IP masquerading” and “N:N mapping” provide suitable IP address translations between private and
public IP ranges, or also between multiple private networks.
1
Provided according authorization, direct access to the configuration and management services of the devices
(WEBconfig, Telnet, TFTP) is provided from the LAN and also from the WAN side. These services are protected by
31
Reference Manual
2 System design
filters and login barring, but do not require any processing by the firewall. Nevertheless, a direct access from WAN
to LAN (or vice versa) using the internal services as a bypass for the firewall is not possible.
1
The IPX router and the LANCAPI access on the WAN side only the ISDN interface. Both modules are independent
from the firewall, which controls only data traffic through the IP router.
1
The VPN services (including PPTP) enable data encryption in the Internet and thereby enable virtual private networks
over public data connections.
1
Depending on the specific model, either xDSL/Cable, ADSL or ISDN are available as different WAN interfaces.
1
The DSLoL interface (DSL over LAN) is no physical WAN interface, but more a “virtual WAN interface”. With appropriate
LCOS settings, it is possible to use on some models a LAN interface as an additional xDSL/Cable interface.
32
Reference Manual
2 System design
3 Configuration
This section will show you the methods and ways you can use to access the device and specify further settings. You will
find descriptions on the following topics:
1
Configuration tools
1
Monitoring and diagnosis functions of the device and software
1
Backup and restoration of entire configurations
1
Installation of new firmware in the device
3.1 Configuration tools and approaches
LANCOM are flexible devices that support a variety of tools (i.e. software) and approaches (in the form of communication
options) for their configuration. First, a look at the approaches.
You can connect to an LANCOM with three different access methods (according to the connections available).
1
Through the connected network (LAN as well as WAN—inband)
1
Through the configuration interface (config interface) on the rear of the router (also known as outband)
1
Remote configuration via ISDN access or modem (analog or GSM with LANCOM Modem Adapter Kit)
3.1.1 What is the difference between these three possibilities?
On the one hand, the availability: Configuration via outband is always available. Inband configuration is not possible,
however, in the event of a network fault. Remote configuration is also dependent on an ISDN connection.
On the other hand, whether or not you will need additional hardware and software: The inband configuration requires
one of the computers already available in the LAN or WAN, as well as only one suitable software, such as LANconfig or
WEBconfig (see following section). In addition to the configuration software, the outband configuration also requires a
computer with a serial port. The preconditions are most extensive for ISDN remote configuration: In addition to an ISDN
capable LANCOM, an ISDN card is needed in the configuration PC or alternatively, access via LANCAPI to an additional
LANCOM that is ISDN capable.
3.2 Configuration software
Situations in which the device is configured vary—as do the personal requirements and preferences of the person doing
the configuration. LANCOM routers thus feature a broad selection of configuration software:
1
LANconfig– nearly all parameters of the LANCOM can be set quickly and with ease using this menu-based application.
Outband, inband and remote configuration are supported, even for multiple devices simultaneously.
1
WEBconfig – this software is permanently installed in the router. All that is required on the workstation used for
the configuration is a web browser. WEBconfig is thus independent of operating systems. Inband and remote
configuration are supported.
1
SNMP – device-independent programs for the management of IP networks are generally based on the SNMP protocol.
It is possible to access the LANCOM inband and via remote configuration using SNMP.
1
Terminal program, Telnet – an LANCOM can be configured with a terminal program via the config interface (e.g.
HyperTerminal) or within an IP network (e.g. Telnet).
1
TFTP – the file transfer protocol TFTP can also be used within IP networks (inband and remote configuration).
33
Reference Manual
3 Configuration
The following table shows, how you can use the configuration:
Analog dail-in (with LANCOM Modem
Adapter Kit)
ISDN remote
configuration
Config Interface
(Outband)
LAN, WAN, WLAN
(Inband)
Configuration
software
YesYesYesYesLANconfig
YesYesNoYesWEBconfig
YesYesNoYesSNMP
NoNoYesNoTerminal program
NoNoNoYesTelnet
YesYesNoYesTFTP
5
Please note that all procedures access the same configuration data. For example, if you change the settings in
LANconfig, this will also have a direct effect on the values under WEBconfig and Telnet.
3.3 Configuration with WEBconfig
New with LCOS 7.6:
1
New WEBconfig with search function, comprehensive device status, on-line help, etc.
Device settings can be configured from any Web browser. WEBconfig configuration software is an integral component
of the LANCOM. A Web browser is all that is required to access WEBconfig. WEBconfig offers similar Setup Wizards to
LANconfig and hence provides the perfect conditions for easy configuration of the LANCOM – although, unlike LANconfig,
it runs under any operating system with a Web browser.
3.3.1 Secure with HTTPS
WEBconfig offers an encrypted transmission of the configuration data for secure (remote) management via HTTPS.
1
https://<IP address or device name>
5
For maximum security, please ensure to have installed the latest version of your Internet browser. For Windows
2000, LANCOM Systems recommends to use the “High Encryption Pack” or at least Internet Explorer 5.5 with
Service Pack 2 or above.
3.3.2 Access with WEBconfig
To carry out a configuration with WEBconfig, you need to know how to contact the device. Device behavior and accessibility
for configuration via a Web browser depend on whether the DHCP server and DNS server are active in the LAN already,
and whether these two server processes share the assignment in the LAN of IP addresses to symbolic names.
Following power-on, unconfigured LANCOM devices first check whether a DHCP server is already active in the LAN.
Depending on the situation, the device can either enable its own DHCP server or enable DHCP client mode. In the second
operating mode, the device can retrieve an IP address for itself from a DHCP server in the LAN.
5
If a LANCOM Wireless Router or LANCOM Access Point is centrally managed from a LANCOM WLAN Controller,
the DHCP mode is switched from auto-mode to client mode upon provision of the WLAN configuration.
3.3.3 Network without a DHCP server
In a network without a DHCP server, unconfigured LANCOM devices enable their own DHCP server service when switched
on and assign IP addresses, information on gateways, etc. to other computers in the LAN (provided they are set to
34
Reference Manual
3 Configuration
automatic retrieval of IP addresses – auto DHCP). In this constellation, the device can be accessed by every computer
with the auto DHCP function enabled with a Web browser under IP address 172.23.56.254.
5
With the factory settings and an activated DHCP server, the device forwards all incoming DNS requests to the
internal Web server. This means that a connection can easily be made to set set up an unconfigured LANCOM
by entering any name into a Web browser.
If the configuration computer does not retrieve its IP address from the LANCOM DHCP server, it determines the current
IP address of the computer (with Start / Run / cmd and command ipconfig at the prompt under Windows 2000 or
Windows XP, with Start / Run / cmd and command winipcfg at the prompt under Windows Me or Windows 9x or
with command ifconfig in the console under Linux). In this case, the LANCOM can be accessed with address x.x.x.254
(the “x”s stand for the first three blocks in the IP address of the configuration computer).
3.3.4 Network with DHCP server
If a DHCP server for the assignment of IP addresses is active in the LAN, an unconfigured LANCOM device disables its
own DHCP server, switches to DHCP client mode and retrieves an IP address from the DHCP server in the LAN. However,
this IP address is initially unknown and accessing the device depends on the name resolution:
35
Reference Manual
3 Configuration
1
If the LAN also has a DNS server for name resolution and this communicates the IP address/name assignment to the
DHCP server, the device can be reached under name "-<MAC address>", e.g. “-00a057xxxxxx”.
5
The MAC address on a sticker on the base of the device.
1
If there is no DNS server in the LAN, or if it is not coupled to the DHCP server, the device cannot be reached via the
name. In this case the following options remain:
2
Use LANconfig's “Find Device” function, or perform WEBconfig's “Device Search” from another yet accessible
LANCOM.
2
Use suitable tools to find out the IP address assigned to the LANCOM by DHCP and access the device directly
using this IP address.
2
Use the serial configuration interface to connect a computer running a terminal program to the device.
3.3.5 Login
When prompted for user name and password when accessing the device, enter your personal data in the appropriate
fields. Observe the use of upper and lower case.
If you used the general configuration access, only enter the corresponding password. The user name field remains blank
in this case.
36
Reference Manual
3 Configuration
5
As an alternative, the login dialog provides a link for an encrypted connection over HTTPS. Always use the HTTPS
connection for increased security whenever possible.
3.3.6 Setup Wizards
The setup Wizards allow quick and easy configuration of the most common device settings. Select the Wizard and enter
the appropriate data on the following screens.
5
The settings are not stored in the device until inputs are confirmed on the last screen of the Wizard.
37
Reference Manual
3 Configuration
3.3.7 System information
Under the "System Data" tab on the system information screen displays general information on the device including its
location, the firmware version, the serial number, etc.
The “Device status” tab contains comprehensive information on the current operating state of the device. This includes,
for example, a visual representation of the interfaces with information on the networks active on them. Appropriate links
38
Reference Manual
3 Configuration
can be used to call up further relevant statistics (such as DHCP table). For significant configuration deficiencies (such as
invalid time setting), a direct link to the appropriate configuration parameters is provided.
39
Reference Manual
3 Configuration
The amount of information shown on this screen can be defined under Setup/HTTP/Show device information. An index
number is also used to specify the display sequence.
LANCOM devices also store syslog information to the main memory (see Syslog). You can also view the latest syslog
entries in WEBconfig under "System information".
3.3.8 Configuration
Menu area “Configuration” provides the configuration parameters in the same structure as they are used in LANconfig.
5
Please note that not all settings can be configured from this configuration view.
40
Reference Manual
3 Configuration
3.3.9 LCOS menu tree
Menu area “LCOS menu tree” provides the configuration parameters in the same structure as they are used under Telnet.
Clicking the question mark calls up help for each configuration parameter.
3.3.10 File management
The menu area “File management” contains all actions with which files are downloaded from the device and uploaded
to the device:
1
Uploading new firmware
1
Saving configuration
1
Uploading configuration
1
Using configuration script
1
Saving configuration script
1
Uploading certificate or file
1
Downloading certificate or file
3.3.11 Extras
The menu area "Extras" contains a few functions that simplify device configuration.
41
Reference Manual
3 Configuration
The search function can be used, for example, to search the names for all configuration parameters. If you know the
name for a particular configuration parameter, but do not know which menu is used to reach this entry, you can quickly
locate the required place in the LCOS menu in this way.
Using the Show/Search function, you can search for other LANCOM devices in your network and switch directly to the
configuration of the devices located via a corresponding link.
3.3.12 HTTP session
Menu area “HTTP session” allows you to customize the display of the WEBconfig interface to your output device for
improved readability, e. g. by lowering the resolution or increasing the contrast.
42
Reference Manual
3 Configuration
3.4 Configuration with other tools
3.4.1 Telnet
New with LCOS 7.6:
1
Extended functions for editing commands
1
Function keys
Open Telnet session
To commence the configuration, start Telnet from the Windows command line with command:
1
C:\>telnet 10.0.0.1
Telnet establishes a connection to the device with the IP address entered.
After entering the password (assuming one has been set to protect the configuration) all of the configuration commands
are available to you.
5
Linux and Unix additionally support Telnet sessions via SSL-encrypted connections. Depending on the distribution
it may be necessary to replace the standard Telnet application with an SSL-capable version. Start the encrypted
Telnet connection with the following command:
1
C:\>telnet -z ssl 10.0.0.1 telnets
Changing the console language
The terminal mode operates with the languages English and German. LANCOM devices are set with English as the
standard console language. If necessary, change the console language with the following commands:
WEBconfig: LCOS menu tree / Config-Module / Language
Close the Telnet session
To close the Telnet session, enter the command exit at the command prompt:
1
C:\>exit
Structure of the command-line interface
The LANCOM command-line interface is always structured as follows:
43
Reference Manual
3 Configuration
1
Status Contains the status and statistics of all internal modules in the device
1
Setup Contains all adjustable parameters of all internal modules in the device
1
Firmware Contains the firmware management
1
Others Contains actions for establishing and terminating connections, reset, reboot and upload.
Command-line commands
The LANCOM command-line interface can be operated with the following DOS- or UNIX-style commands. The LCOS
menu commands that are available to you can be displayed at any time by entering HELP at the command line.
5
Supervisor rights are necessary to execute some commands.
DescriptionCommand
Resets the console session to script mode. In this state, commands
entered are not transferred directly to the LANCOM's configuration
RAM but initially to the device's script memory.
beginscript
Switch to the current directory. Various abbreviations can be used,
such as replacing " cd ../.." with "cd ...", etc.
cd [PATH]
Deletes the table in the branch of the menu tree defined with
Path.
del [PATH]*
Resets individual parameters, tables or entire menu trees back to
their default configuration. If PATH indicates a branch of the
menu tree, then the option -r (recursive) must be entered.
default [-r] [PATH]
Displays the current directory content. The suffix parameter "-a"
lists the SNMP IDs associated with the content of the query. The
dir [PATH] list [PATH] ls [PATH] ll [PATH]
output begins with the SNMP ID of the device followed by the
SNMP ID of the current menu. The SNMP IDs of the subordinate
items can be read from the individual entries.
Executes the action [PATH] in the current directory. Other
parameters can be entered in addition.
do [PATH] [<Parameter>]
Display argument on consoleecho <ARG>...
Ends the command line sessionexit/quit/x
Activation of a software feature with the feature code as enteredfeature <code>
Changes to the configuration using commands in the command
line are written directly to the boot-resistant Flash memory of the
flash Yes/No
devices as standard (flash yes). If updating the configuration is
suppressed in Flash (flash no), changes are only stored in RAM
(deleted on booting).
Displays a list of recently executed commands. Command "!#“
can be used to directly call the list commands using their number
(#): For example, "!3“ runs the third list command.
history
Deletes the script session contents yet to be processed. The script
session is selected by its name.
killscript
Load configuration into device via TFTP clientloadconfig
Load firmware into device via TFTP clientloadfirmware
Load script into device via TFTP clientloadscript
Change passwordpasswd
Change password (no prompt)passwd -n new [old]
Sends an ICMP echo request to the IP address specifiedping [IP address or name]
44
Reference Manual
3 Configuration
DescriptionCommand
Display of the entire configuration in the device syntaxreadconfig
Display of the SNMP Management Information Basereadmib
In a console session, the readscript command generates a text
dump of all commands and parameters required to configure the
LANCOM in its current state.
readscript [-n] [-d] [-c] [-m] [PATH]
Repeats the command every INTERVAL seconds until the process
is ended with new input
repeat <INTERVAL> <Command>
Delays the processing of configuration commands by a particular
time or terminates them at a particular time. Permissible suffixes
sleep [-u] value[suffix]
are s, m and h for seconds, minutes and hours. If no suffix is
defined, the command uses milliseconds. With option switch -u,
the sleep command accepts times in format MM/DD/YYYY
hh:mm:ss (English) or in format TT.MM.JJJJ
hh:mm:ss (German). Date configuration is only accepted if
the system time is set.
Ends the PING commandstop
Sets a configuration parameter to a particular value.set [PATH] <value(s)>
If the configuration parameter is a table value, a value must be
specified for each column.
Entering the "*" character leaves any existing table entry
unchanged.
Listing of the possible input values for a configuration parameter.set [PATH] ?
If no name is specified, the possible input values for all
configuration parameters in the current directory are specified.
Set environment variablesetenv <NAME> <VALUE>
Delete environment variableunsetenv <NAME>
Display environment variable (no line feed)getenv <NAME>
Display the entire environmentprintenv
Display of special internal data.show <options>
show ? displays all available information, such as most recent
boot processes (’bootlog’), firewall filter rules (’filter’), VPN rules
(’VPN’) and memory usage (’mem’ and ’heap’)
Display of system information (e.g. hardware/software version)sysinfo
Sends an e-mail. See 'testmail ?' for parameterstestmail
Set time (DD.MM.YYYY hh:mm:ss)time
Configuration of the diagnostics display.trace […]
List active sessionswho
Load a new configuration file in the device syntax. All subsequent
lines are interpreted as configuration values until two blank lines
occur
writeconfig
Load a new firmware file (only via TFTP)writeflash
Repeat last command!!
Repeat command <num> times!<num>
Repeat last command beginning with <prefix>!<prefix>
45
Reference Manual
3 Configuration
DescriptionCommand
Comment#<blank>
1
PATH:
2
Path name for a menu or parameter, separated by / or \
2
.. means one level higher
2
. means the current level
1
VALUE:
2
Possible input value
2
"" is a blank input value
1
NAME:
2
Sequence of characters (made up of _ 0..9 A..Z)
2
First character cannot be a digit
2
Case insensitive
1
All commands and directory/parameter names can be entered using their short-forms as long as they are unambiguous.
For example, command ”sysinfo” can be shortened to ”sys” and ”cd Management” to ”c ma”. Input ”cd /s” is not
valid, however, since it corresponds to both ”cd /Setup” and ”cd /Status”.
1
Names that contain spaces must be enclosed within quotation marks (““).
1
A command-specific help function is available for actions and commands (call the function with a question mark as
the parameter). For example, 'ping ?’ shows the options of the integrated ping command.
1
Enter ’?’ on the command line for a complete listing of the console commands available.
Addition(s) to LCOS 8.60
View contents of all subdirectories
The parameter -r causes the shell commands dir, ls, list and ll to display all subdirectories and the tables in
them.
Example:
admin@:/
> dir -r status/ppp
PPP-Phases TABINFO: 2 x [Ifc,Phase,LCP,IPCP,CCP,IPV6CP]
LCP MENU:
PAP MENU:
CHAP MENU:
IPCP MENU:
CCP MENU:
Rx-Options MENU:
Tx-Options MENU:
Delete-Values ACTION:
IPV6CP MENU:
[rek] PPP-Phases:
Ifc Phase to LCP IPCP CCP IPV6CP
----------------------------------------------------------------
DSL-CH-1 DEAD Initial Initial Initial Initial
EXT DEAD Initial Initial Initial Initial
46
Reference Manual
3 Configuration
[rek] LCP:
Rx-Errors INFO: 0
Rx-Discarded INFO: 0
Rx-Config-Request INFO: 0
Rx-Config-Ack. INFO: 0
Rx-Config-Nak. INFO: 0
Rx-Config-Reject INFO: 0
Rx-Terminate-Request INFO: 0
Rx-Terminate-Ack. INFO: 0
Rx-Code-Reject INFO: 0
Rx-Protocol-Reject INFO: 0
Rx-Echo-Request INFO: 0
Rx-Echo-Reply INFO: 0
Rx-Discard-Request INFO: 0
Tx-Config-Request INFO: 0
Tx-Config-Ack. INFO: 0
Tx-Config-Nak. INFO: 0
Tx-Config-Reject INFO: 0
Tx-Terminate-Request INFO: 0
Tx-Terminate-Ack. INFO: 0
Tx-Code-Reject INFO: 0
Tx-Protocol-Reject INFO: 0
Tx-Echo-Request INFO: 0
Tx-Echo-Reply INFO: 0
Tx-Discard-Request INFO: 0
Delete-Values ACTION:
[rek] PAP:
Rx-Discarded INFO: 0
Rx-Request INFO: 0
Rx-Success INFO: 0
Rx-Failure INFO: 0
Tx-Retry INFO: 0
Tx-Request INFO: 0
Tx-Success INFO: 0
Tx-Failure INFO: 0
Delete-Values ACTION:
[rek] CHAP:
Rx-Discarded INFO: 0
Rx-Challenge INFO: 0
Rx-Response INFO: 0
Rx-Success INFO: 0
Rx-Failure INFO: 0
Tx-Retry INFO: 0
Tx-Challenge INFO: 0
Tx-Response INFO: 0
Tx-Success INFO: 0
Tx-Failure INFO: 0
Delete-Values ACTION:
[rek] IPCP:
Rx-Discarded INFO: 0
Rx-Config-Request INFO: 0
Rx-Config-Ack. INFO: 0
Rx-Config-Nak. INFO: 0
Rx-Config-Reject INFO: 0
Rx-Terminate-Request INFO: 0
Rx-Terminate-Ack. INFO: 0
47
Reference Manual
3 Configuration
Rx-Code-Reject INFO: 0
Tx-Config-Request INFO: 0
Tx-Config-Ack. INFO: 0
Tx-Config-Nak. INFO: 0
Tx-Config-Reject INFO: 0
Tx-Terminate-Request INFO: 0
Tx-Terminate-Ack. INFO: 0
Tx-Code-Reject INFO: 0
MORE [Q(uit)]>
Output filter for command-line entries
The command-line commands show, dir and ls generates large amounts of output. The filters allow you to sift out
the information that is important for you from all the information.
To enable the filters, extend the commands to include the parameter "@", which initiates the following filter definition.
The following operators apply to filter definitions:
DescriptionOperator
OR operator: The filter applies when one of the parameters occurs in the output(space)
AND operator: The filter applies when the operand occurs in the output+
NOT operator: The filter applies when the operand does not occur in the output-
The output must exactly match the search filter"
Any string combination can be used to specify the operands, such as the names of remote stations, protocols or ports.
The filter then processes these data according to the rule of the operators used, in a similar way to Internet search
engines.
5
The filter enhances the preceding command one time only. If you invoke the command again without specifying
a filter, the output appears unfiltered again.
5
No filter is available for the following features:
show bootlog
1
1
show ethswitch rmon
1
show mem
1
show random
1
show ssh idkeys
1
show tls fingerprints
1
show tls heap
Example:
The command show vpn displays all current VPN connections. The filter show vpn @
"sales_ger" reduces the display to the connections with a name containing the string
"sales_ger" (i.e. sales representatives in Germany).
The command ls /Setup/IP-Router/IP-Routing-Table shows the parameters
to be used for accessing configured networks or remote sites. The filter ls
/Setup/IP-Router/IP-Routing-Table @ -"192.168." suppresses the display
of stations in this private IP address range.
48
Reference Manual
3 Configuration
Line-by-line display of table entries
When working with the command line, displaying tables with several columns is often confusing because the standard
line length is 80 characters. Useful for large tables, you can go directly to the any row by entering a row index when
invoking the cd command. In this way, the commands dir and ls display the content of the line in a three-column
table:
1
Left column: Property
1
Middle column: Type
1
Right column: Value
5
If the specified row does not exist an error message is displayed. If another working directory has been specified,
then a column parameter is ignored.
In this three-column view, you can use the shell command set <property> <value> directly to write a new
value into the corresponding field.
5
The set command also processes complete paths. Enter the table entries that begin with the characters "..",
"/" and "\" between quotes.
Example:
1. The command cd Status/LAN/Interfaces takes you to the overview of the LAN
interfaces.
2. The ls command lists all the information about the interfaces in a table:
Ifc Queue-Packets Link-Active
-----------------------------------------------
LAN-1 0 Yes
LAN-2 0 No
LAN-3 0 No
LAN-4 0 No
3. With the command cd lan-4 you move to the corresponding table row.
4. The ls command lists the content of this row only:
Ifc INFO: LAN-4
Queue-Packets INFO: 0
Link-Active INFO: No
Functions for editing commands
The following commands can be used to edit commands on the command line. The “ESC key sequences” show (for
comparison) the shortcuts used on typical VT100/ANSI terminals
:
DescriptionEsc key sequencesFunction
In the list of commands last run, jumps one position up (in the direction of
older commands).
ESC [AUp arrow
In the list of commands last run, jumps one position down (in the direction
of newer commands).
ESC [BDown arrow
Moves the insert cursor one position to the right.Ctrl-F ESC [CRight arrow
Moves the insert cursor one position to the left.Ctrl-B ESC [DLeft arrow
49
Reference Manual
3 Configuration
DescriptionEsc key sequencesFunction
Moves the insert cursor to the first character in the line.Ctrl-A ESC [A ESC [1˜ (Home or Pos1
Moves the insert cursor to the last character in the line.Ctrl-E ESC [F ESC OF ESC [4˜End
Switches between input and overwrite modes.ESC [ ESC [2˜Ins
Deletes the character at the current position of the insert cursor or ends
the Telnet session if the line is blank.
Ctrl-D ESC <BS>ESC [3˜Del
Deletes the next character to the left of the insert cursor.<BS><DEL>erase
Deletes all characters to the left of the insert cursor.Ctrl-Uerase-bol
Deletes all characters to the right of the insert cursor.Ctrl-Kerase-eol
Completes the input from the current position of the insert cursor for a
command or path of the LCOS menu structure:
Tabulator
1. If there is only one possibility of completing the command/path, this
is accepted by the line.
2. If there is more than one possibility of completing the command/path,
this is indicated by an audible sound when pressing the Tab key.
Pressing the Tab key again displays a list of all possibilities to complete
the entry. Then enter another character, for example, to allow
unambiguous completion of the input.
3. If there is no possibility of completing the command/path, this is
indicated by an audible sound when pressing the Tab key. No further
actions are run.
Function keys for the command line
1
Telnet: Setup / Config / Function keys
The function keys enable the user to save frequently used command sequences and to call them easily from the command
line. In the appropriate table, commands are assigned to function keys F1 to F12 as they are entered in the command
line.
1
Key
Name of function key.
Possible values:
2
Selection from function keys F1 to F12.
Default:
2
F1
1
Mapping
Description of the command/shortcut to be run on calling the function key in the command line.
Possible values:
2
All commands/shortcuts possible in the command line
Default:
2
Blank
Special values:
2
The caret symbol ^ is used to represent special control commands with ASCII values below 32.^a
2
^A stands for Ctrl-A (ASCII 1)
2
^Z stands for Ctrl-Z (ASCII 26)
50
Reference Manual
3 Configuration
2
^[ stands for Escape (ASCII 27)
2
^^ A double caret symbol stands for the caret symbol itself.
5
If a caret symbol is entered in a dialog field or editor followed directly by another character, the operating
system may possibly interpret this sequence as another special character. A Windows operating system makes,
for example, an  from input caret symbol + A. To call the caret symbol itself, enter a space before the
following character. Sequence ^A is then formed from caret symbol + space + A.
3.4.2 SNMP
The Simple Network Management Protocol (SNMP V.1 as specified in RFC 1157) allows monitoring and configuration
of the devices on a network from a single central instance.
There are a number of configuration and management programs that run via SNMP. Commercial examples are Tivoli,
OpenView from Hewlett-Packard, SunNet Manager and CiscoWorks. In addition, numerous programs also exist as
freeware and shareware.
Your LANCOM can export a so-called device MIB file (Management Information Base) for use in SNMP programs.
WEBconfig: Extras / Get Device SNMP MIB
3.4.3 Encrypted configuration with SSH access
In addition to the option to configure a LANCOM with Telnet or a terminal program, LCOS version 4.00 and later provides
an additional option of access via SSH. With a suitable SSH client such as PuTTy, you can set up an encrypted connection
to the device and thus prevent the data being transferred during configuration from being intercepted within the network.
Start PuTTy (for example) and enter the LANCOM device's IP address as the host name. Use the command prompt that
follows to log in by entering your user data.
51
Reference Manual
3 Configuration
Alternatively, you can use LANconfig under Tools / Options / Extras to enter your SSH client as an "external program“;
then start the SSH access with a right-mouseclick on the device and open WEBconfig/Console session / Open SSH
session.
The configuration is carried out with the same commands as used under Telnet or other terminal program.
3.4.4 SSH authentication
The SSH protocol generally allows two different authentication mechanisms:
1
With user name and password
1
With the help of a public key
In the public key method, a key pair is used that is made up of a private and public key – a digital certificate. Detailed
information about the keys mentioned here can be found under the section 'Digital certificates' in the chapter on VPN
in the reference manual. The private part of the key pair is saved on the client (frequently protected with a password),
the public part is loaded into the LANCOM Router.
The LANCOM Router supports both RSA and DSS/DSA keys. RSA keys are somewhat smaller, thereby allowing somewhat
faster operation.
Generating key pairs
The pairs consisting of public and private keys can be generated with the help of OpenSource software OpenSSH, for
example. The following command from a Linux operating system creates a key pair from the public part 'id_rsa.pub'
and the private part 'id_rsa':
ssh-keygen -t rsa
Entering users into the public key
The public keys are generated in the following syntax:
<Encryption algorithm> <Public key> <User> [Further users]
In order to grant access to additional users with this key, the respective user names are simply attached to the existing
key file.
52
Reference Manual
3 Configuration
Installing the private key on the SSH client
The private part of the key must be installed on the SSH client. Refer to the documentation for information on the steps
required for your SSH client.
Load public key into the LANCOM Router
The public key(s) can be uploaded to the LANCOM Router using WEBconfig. For this, select the entry Upload certificate
or file on the WEBconfig start page. In the following dialog, select the type of key ('SSH RSA key' or 'SSH DSA key'),
select the file and enter the password if required. Entering the Upload command initiates the transfer to LANCOM.
5
The uploaded file replaces an existing list of accepted keys in the device. Another way is to choose the entry edit
list of allowed puplic keys at the start page og WEBconfig and edit the key directly. You can as well edit single
keys to the existing list.
Configuring the authentication methods
The authentication methods permitted for SSH access can be set separately for LAN, WAN and WLAN.
CallConfiguration tool
LCOS menu tree > Setup > Config > SSH authentication methodsWEBconfig, Telnet
1
Methods
2
All: Allows authentication using password and digital certificate.
2
Password: Allows authentication with a password.
2
Public key: Only allows authentication with a digital certificate.
Certificate check on SSH access
When establishing the SSH connection, the client first asks the LANCOM Router which authentication methods are
permitted for this connection. If the public key method is allowed, the client searches for private keys that have been
installed and transfers these with the user name to the LANCOM Router. When the LANCOM Router finds an entry in
the list that includes the user name that corresponds to its public SSH key, the SSH connection is permitted. If the client
does not have a suitable private key installed or if the LANCOM Router does not have a corresponding entry with the
user name or public key, the SSH client can revert to authentication with user name/password – as long as this
authentication method is permitted.
3.4.5 ISDN Remote configuration via Dial-Up Network
5
The complete section on remote configuration applies only to LANCOM with ISDN interface or a serial interface
(with LANCOM Modem Adapter Kit).
Configuring routers at remote sites is particularly easy using the remote configuration method via a Dial-Up Network
from Windows. The device is accessible by the administrator immediately without any settings being made after it is
switched on and connected to the ISDN interface. This means that you save a lot of time and costs when configuring at
separate locations because you do not have to travel to the other network or instruct the staff on-site on configuring
the router.
You can also reserve a special calling number for remote configuration. Then the support technician can always access
the router even if it is really no longer accessible due to incorrect settings.
This is what you need for ISDN remote configuration
1
An LANCOM with an ISDN connection
1
A computer with a PPP client, e.g. Windows Dial-Up Network
1
A program for inband configuration, e.g. LANconfig or Telnet
53
Reference Manual
3 Configuration
1
A configuration PC with an ISDN card or access via LANCAPI to an LANCOM with ISDN access.
The first remote connection using Dial-Up Networking
For the remote connection of a LANCOM with LANconfig using Dial-Up Networking proceed as follows:
PC
Router
ISDN
PC with Dial-Up Networking,
ISDN adapter (alternatively
access to LANCAPI)
and LANconfig
LANCOM
with ISDN-interface
for the configuration
1. In the LANconfig program select Device / New, enable 'Dial-Up connection' as the connection type and enter the
calling number of the ISDN interface to which the LANCOM is connected. If you wish, you can also enter the time
period after which an idle connection is to be disconnected automatically.
2. LANconfig now automatically generates a new entry in the Dial-Up Network. Select a device that supports PPP (e.g.
the NDIS-WAN driver included with the LANCAPI) for the connection and press OK to confirm.
3. Then the LANconfig program will display a new device with the name 'Unknown' and the dial-up call number as the
address in the device list.
5
When an entry in the device list is deleted, the related connection in the Windows Dial-Up Network is also
deleted.
4. You can configure the device remotely just like all other devices. LANconfig establishes a dial-up connection enabling
you to select a configuration.
5
Always provide additional protection for the settings of the device by setting a password by switching to the
'Security' tab in the 'Management' configuration section.
The first remote connection using a PPP client and Telnet
Instead of a remote configuration with LANconfig it is also possible to access over ISDN with Telnet. For a remote
configuration of a LANCOM with Telnet over any PPP client proceed as follows:
I
PC
Router
ISDN
PC with Dial-Up Networking,
ISDN adapter (alternatively
access to LANCAPI)
and LANconfig
LANCOM
with ISDN-interface
for the configuration
1. Establish a connection to the LANCOM with your PPP client using the following details:
1
User name 'ADMIN'
1
The password selected in LANCOM
1
An IP address for the connection, only if required
2. Open a Telnet session to the LANCOM. Use the following IP address for this purpose:
54
Reference Manual
3 Configuration
'172.17.17.18', if you have not defined an IP address for the PPP client. The LANCOM automatically uses this
address if no other address has been defined. The PC making the call will respond to the IP '172.17.17.17'.
1
1
Raise the IP address of the PC by one, if you have defined an address. Example: You have set the IP '10.0.200.123'
for the PPP client, the LANCOM then responds to '10.0.200.124'. Exception: If the digits '254' are at the end of
the IP address, the router responds to 'x.x.x.1'.
3. You can configure the LANCOM remotely just like all other devices.
5
Always provide additional protection for the settings of the device by setting a password. Alternatively, enter
the following command during a Telnet or terminal connection:
passwd
You will then be prompted to enter and confirm a new password.
The default layer for remote field installations
The PPP connection of any other remote site to the router, of course, will only succeed if the device answers every call
with the corresponding PPP settings. This is the case using the factory default settings because the default protocol
(default layer) is set to PPP.
You may, however, want to change the default layer for LAN-to-LAN connections, for example, to a different protocol
after the first configuration run. Then the device will no longer take calls on the dial-up connection using the PPP settings.
The solution to this is to agree upon a special calling number for configuration access:
The administrator access for ISDN remote management
If the device receives a call on this number, it will always use PPP, regardless of any other settings made on the router.
Only a specific user name which is automatically entered by the LANconfig program during call establishment will be
accepted during the PPP negotiations:
1. Switch to the 'Admin' tab in the 'Management' configuration section.
1. Enter a number (MSN) at your location which is not being used for other purposes in the 'Device Configuration' area.
Alternatively, enter the following command:
set /setup/config/Farconfig 123456
55
Reference Manual
3 Configuration
5
As long as no MSN is entered for the configuration access, a non-configured LANCOM accepts the calls on
all MSNs. As soon as the first change is saved in the configuration, the device only takes calls on the configured
MSN! If no MSN configuration is entered the remote access is switched off and the device is protected against
access over ISDN.
3.4.6 Addition(s) to LCOS 8.80
Configurable SSH algorithms
The SSH implementation in the operating system of your device supports numerous cryptographic methods (algorithms).
The devices can optionally restrict the choice of cryptographic methods to the algorithms of your preference.
Additions to the Setup menu
SSH
This item manages the mechanisms used for SSH encryption. You can select which algorithms are supported in both
server and client mode.
Telnet path:
Setup > Config
Cipher algorithms
The cipher algorithms are used for encrypting and decrypting data. Select one or more of the available algorithms.
Telnet path:
Setup > Config > SSH
Possible values:
3DES-cbc
3DES-ctr
arcfour
arcfour128
arcfour256
blowfish-cbc
blowfish-ctr
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
Default:
3des-cbc,3des-ctr,arcfour,arcfour128,arcfour256,blowfish-cbc,blowfish-ctr,aes128-cbc,
aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr
56
Reference Manual
3 Configuration
MAC algorithms
MAC algorithms are used to check the integrity of messages. Select one or more of the available algorithms.
Telnet path:
Setup > Config > SSH
Possible values:
hmac-md5-96
hmac-md5
hmac-sha1-96
hmac-sha1
hmac-sha2-256-96
hmac-sha2-256
hmac-sha2-512-96
hmac-sha2-512
Default:
hmac-md5-96,hmac-md5,hmac-sha1-96,hmac-sha1,hmac-sha2-256-96,
hmac-sha2-256,hmac-sha2-512-96,hmac-sha2-512
Key exchange algorithms
The MAC key exchange algorithms are used to negotiate the key algorithm. Select one or more of the available algorithms.
Telnet path:
Setup > Config > SSH
Possible values:
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
Default:
diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,
diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
Host key algorithms
The host key algorithms are used to authenticate hosts. Select one or more of the available algorithms.
Telnet path:
Setup > Config > SSH
Possible values:
ssh-rsa
ssh-dss
Default:
ssh-rsa,ssh-dss
57
Reference Manual
3 Configuration
Min host key length
This parameter defines the minimum length of your host keys.
Telnet path:
Setup > Config > SSH
Possible values:
Max. 5 numbers
Default:
512
Max host key length
This parameter defines the maximum length of your host keys.
Telnet path:
Setup > Config > SSH
Possible values:
Max. 5 numbers
Default:
8192
DH groups
The Diffie-Hellman groups are used for the key exchange. Select one or more of the available groups.
Telnet path:
Setup > Config > SSH
Possible values:
Group 1
Group 5
Group 14
Group 15
Group 16
Default:
Group 1, group 5, group 14
File transfer via SCP
SCP (Secure Copy) is a protocol for the secure transfer of data between two computers in a network. Administrators
often use SCP to exchange data between servers or between servers and workstations. With a suitable tool (e. g. the
Putty add-on pscp.exe on Windows operating systems) you can also exchange data between your PC/notebook and a
LANCOM device.
Download pscp.exe from the Putty download page to perform file transfer from a Windows operating system.
Then open a command line window using the command cmd.
58
Reference Manual
3 Configuration
Change to the directory where you have saved the file pscp.exe and run the following command to transfer a file from
your Windows computer to the device. Enter the options -scp and -pw followed by your password:
C:\PortableApps\PuTTYPortable>pscp.exe -scp -pw ******* c:\path\myfile.ext
<User>@<IP-address>:target
Change the order of the source and destination, to transfer the file from the device to your computer:
C:\PortableApps\PuTTYPortable>pscp.exe -scp -pw ******* <User>@<IP-address>:target
c:\path\myfile.ext
Enter the following command to save the configuration from the device to a file named config.lcs on your
computer:
C:\PortableApps\PuTTYPortable>pscp.exe -scp -pw ******* root@123.123.123.123:config
c:\config.lcs
To upload a new firmware file from your computer to the device, enter the following command:
C:\PortableApps\PuTTYPortable>pscp.exe -scp -pw ******* c:\firmware.upx
root@123.123.123.123:firmware
The following table specifically shows which files you can read via SCP from the device and which ones you can write
to it:
Table 1: Files for the SCP file transfer
DescriptionWriteReadTarget
SSL – certificate (*.pem, *.crt.
*.cer [BASE64])
YesYesssl_cert
SSL – private key (*.key [BASE64
unencrypted])
Yesssl_privkey
SSL – root CA certificate (*.pem,
*.crt. *.cer [BASE64])
YesYesssl_rootcert
SSL – container as PKCS#12 file
(*.pfx, *.p12)
Yesssl_pkcs12
SSL – RSA key (*.key [BASE64
unencrypted])
Yesssh_rsakey
SSL – DSA key (*.key [BASE64
unencrypted])
Yesssh_dsakey
SSH – accepted public keyYesssh_authkeys
VPN – root CA certificate
(*.pem, *.crt. *.cer [BASE64])
YesYesvpn_rootcert
VPN – device certificate (*.pem,
*.crt. *.cer [BASE64])
YesYesvpn_devcert
SSL – private device key (*.key
[BASE64 unencrypted])
Yesvpn_devprivkey
VPN – container (VPN1) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12
VPN – container (VPN2) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_2
VPN – container (VPN3) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_3
VPN – container (VPN4) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_4
59
Reference Manual
3 Configuration
DescriptionWriteReadTarget
VPN – container (VPN5) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_5
VPN – container (VPN6) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_6
VPN – container (VPN7) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_7
VPN – container (VPN8) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_8
VPN – container (VPN9) as
PKCS#12 file (*.pfx, *.p12)
Yesvpn_pkcs12_9
VPN - add additional CA
certificates (*.pfx, *.p12, *.pem,
*.crt. *.cer [BASE64])
Yesvpn_add_cas
EAP/TLS – root CA certificate
(*.pem, *.crt. *.cer [BASE64])
YesYeseaptls_rootcert
EAP/TLS – device certificate
(*.pem, *.crt. *.cer [BASE64])
YesYeseaptls_devcert
EAP/TLS – private device key
(*.key [BASE64 unencrypted])
Yeseaptls_privkey
EAP/TLS – container as PKCS#12
file (*.pfx, *.p12)
Yeseaptls_pkcs12
RADSEC – root CA certificate
(*.pem, *.crt. *.cer [BASE64])
YesYesradsec_rootcert
RADSEC – device certificate
(*.pem, *.crt. *.cer [BASE64])
YesYesradsec_devcert
RADSEC – private device key
(*.key [BASE64 unencrypted])
Yesradsec_privkey
RADSEC – container as
PKCS#12 file (*.pfx, *.p12)
Yesradsec_pkcs12
RADIUS server – summary
accounting (*.csv)
YesYesradiuss_accnt_total
SCEP-CA – certificate listYesYesscep_cert_list
SCEP-CA – serial numberYesYesscep_cert_serial
Backup for SCEP-CA – PKCS12
container
Yesscep_ca_backup
Backup for SCEP-CA – PKCS12
container
Yesscep_ra_backup
SCEP-CA – PKCS12 containerYesscep_ca_pkcs12
SCEP-CA – PKCS12 containerYesscep_ra_pkcs12
Public Spot – welcome page
(*.html, *.htm)
YesYespbspot_template_welcome
Public Spot – login page
(*.html, *.htm)
YesYespbspot_template_login
Public Spot – error page (*.html,
*.htm)
YesYespbspot_template_error
60
Reference Manual
3 Configuration
DescriptionWriteReadTarget
Public Spot – home page
(*.html, *.htm)
YesYespbspot_template_start
Public Spot – status page
(*.html, *.htm)
YesYespbspot_template_status
Public Spot – logoff page
(*.html, *.htm)
YesYespbspot_template_logoff
Public Spot – help page (*.html,
*.htm)
YesYespbspot_template_help
Public Spot – no proxy page
(*.html, *.htm)
YesYespbspot_template_noproxy
Public Spot – voucher page
(*.html, *.htm)
YesYespbspot_template_voucher
Public Spot – GTC page (*.html,
*.htm)
YesYespbspot_template_agb
Public Spot – header image
pages (*.gif, *.png, *.jpeg)
YesYespbspot_formhdrimg
CAPWAP – WLC_Script_1.lcsYesYesWLC_Script_1.lcs
CAPWAP – WLC_Script_2.lcsYesYesWLC_Script_2.lcs
CAPWAP – WLC_Script_3.lcsYesYesWLC_Script_3.lcs
Yesdefault_pkcs12
Yesrollout_wizard
Yesrollout_template
Yesrollout_logo
Yeship_cert_0
Text for display after
command-line login (e.g. ASCII
logos)
YesYesissue
Device configurationYesYesconfig
Firmware updateYesfirmware
3.5 Working with configuration files
The current configuration of an LANCOM can be saved as a file and reloaded in the device (or in another device of the
same type) if necessary.
61
Reference Manual
3 Configuration
Additionally, configuration files can be generated and edited offline for any LANCOM device, firmware option and
software version:
3.5.1 Backup copies of configuration
With this function you can create backup copies of the configuration of your LANCOM.
3.5.2 Convenient series configuration
However, even when you are faced with the task of configuring several LANCOM of the same type, you will come to
appreciate the function for saving and restoring configurations. In this case you can save a great deal of work by first
importing identical parameters as a basic configuration and then only making individual settings to the separate devices.
3.5.3 Running function
LANconfig:
Device / Configuration Management / Save to File Device / Configuration Management / Restore from File Edit / New
Configuration File Edit / Edit Configuration File Device / Configuration Management / Print ...
WEBconfig: Save Configuration / Load Configuration (in main menu)
3.6 New firmware with FirmSafe
New with LCOS 7.60:
1
Asymmetric firmsafe
3.6.1 This is how FirmSafe works
FirmSafe makes the installation of the new software safe: The used firmware is not simply overwritten but saved additionally
in the device as a second firmware. Therewith your device is protected against the results of a power blackout or a
disconnection while installing the firmware.
Of the two firmware versions saved in the device only one can ever be active. When loading a new firmware version the
active firmware version is not overwritten. You can decide which firmware will be activated after the upload:
1
'Immediate': The first option is to load the new firmware and activate it immediately. The following situations can
result:
62
Reference Manual
3 Configuration
The new firmware is loaded successfully and works as desired. Then all is well.
2
2
The device no longer responds after loading the new firmware. If an error occurs during the upload, the device
automatically reactivates the previous firmware version and reboots the device.
1
'Login': To avoid problems with faulty uploads there is the second option with which the firmware is uploaded and
also immediately booted.
2
In contrast to the first option, the device will wait for the adjusted firmsafe timeout (using WEBconfig in the menu
LCOS menu tree / Firmware / Timeout-firmsafe, using Telnet adjust with 'Firmware/Timeout-firmsafe') until
it is logged on over Telnet, a terminal program or WEBconfig. Only if this login attempt is successful does the
new firmware remain active permanently.
2
If the device no longer responds or it is impossible to log in, it automatically loads the previous firmware version
and reboots the device with it.
1
'Manual': With the third option you can define a time period during which you want to test the new firmware yourself.
The device will start with the new firmware and wait for the preset period until the loaded firmware is manually
activated and therefore becomes permanently effective. Activate the new firmware using LANconfig with Device /
Firmware Management / Activate Firmware running in Test Mode, using Telnet under 'firmware/firmsafe table'
with the command 'set # active' (# is the position of the firmware in the firmsafe table). Using WEBconfig you can
find the firmsafe table under LCOS menu tree/ Firmware.
The modus for the firmware upload can be adjusted using WEBconfig in the menu LCOS menu tree / Firmware /
Mode-firmsafe, using Telnet under 'firmware/timeout firmsafe'. Using LANconfig select the modus when selecting the
new firmware file.
5
LIt is only possible to upload a second firmware, if the device has enough memory for two firmware versions.
Current firmware versions (in occasion with additional software options) may use up more than half of the
available memory. In this case the asymmetric firmware is used.
3.6.2 Asymmetric Firmsafe
Because of large range of functions in the firmware, some models are unable to simultaneously store two complete
versions of the firmware. These devices use the asymmetric Firmsafe. Here, the device always contains a complete version
and a minimal version of the firmware. The minimal version normally remains unused, but it allows local access to the
device after a failed upload of the complete firmware version (e.g. as a result of a power cut during the upload process)
so as to load an executable version of the firmware onto the device. The minimal firmware can not be configurated.
Changes in the configuration over LANconfig, WEBconfig or Telnet are not saved in the device
Advanced functions, such as remote administration, are not available whilst the minimal firmware is active. However,
the LL2M server is also active in a minimal firmware version and offers access to the device provided it is reachable from
an LL2M client over layer 2 (Ethernet).
Switching over to asymmetric Firmsafe
To switch devices to asymmetric Firmsafe, converter firmware is first loaded onto the device. This converts the firmware
currently not activated in the device into a minimal firmware version, creating room for new and more comprehensive
firmware. This process only has to be performed once.
You can then load a new, complete firmware version onto the device, which becomes active after a successful upload.
The minimal firmware remains in the device to ensure that the device can be accessed.
Firmware upgrade with asymmetric Firmsafe
The subsequent firmware upload automatically overwrites the active firmware with new firmware.
3.6.3 How to load new software
There are various ways of carrying out a firmware upload, all of which produce the same result:
63
Reference Manual
3 Configuration
1
LANconfig
1
WEBconfig
1
Terminal program
1
TFTP
All settings will remain unchanged by a firmware upload. All the same you should save the configuration first for safety's
sake (with Device/ Configuration Management / Save to Fileif using LANconfig, for example). Before uploading you
should also save a version of the current firmware. If you do not have the firmware as a file, you can download it from
www.lancom.de.
If the newly installed release contains parameters which are not present in the device's current firmware, the device will
add the missing values using the default settings.
LANconfig
When using LANconfig, highlight the desired device in the selection list and click on Device/ Firmware Upload, or
click directly on the Firmware Upload button. Then select the directory in which the new version is located and mark
the corresponding file.
LANconfig then tells you the version number and the date of the firmware in the description and offers to upload the
file. The firmware you already have installed will be replaced by the selected release by clicking Open.
You also have to decide whether the firmware should be permanently activated immediately after loading or set a testing
period during which you will activate the firmware yourself. To activate the firmware during the set test period, click on
Edit/ Firmware Management. After upload, start the new firmware in test mode.
WEBconfig
Start WEBconfig in your web browser. On the starting page, follow the Perform a Firmware Upload link. In the next
window you can browse the folder system to find the firmware file and click Start Upload to start the installation.
Terminal program (e.g. Telix or Hyperterminal in Windows)
If using a terminal program, you should first select the 'set mode-firmsafe' command on the 'Firmware' menu and select
the mode in which you want the new firmware to be loaded (immediately, login or manually). If desired, you can also
set the time period of the firmware test under 'set Timeout-firmsafe'.
Select the 'do Firmware-upload' command to prepare the router to receive the upload. Now begin the upload procedure
from your terminal program:
1
If you are using Telix, click on the Upload button, specify 'XModem' for the transfer and select the desired file for
the upload.
64
Reference Manual
3 Configuration
1
If you are using Hyperterminal, click on Transfer/ Send File, select the file, specify 'XModem' as the protocol and
start the transfer with OK.
5
The firmware upload over a terminal program is only possible over a serial configuration interface.
TFTP
TFTP can be used to install new firmware on LANCOM. This can be done with the command (or target) writeflash. For
example, to install new firmware in a LANCOM with the IP address 10.0.0.1, enter the following command under Windows
2000 or Windows NT:
1
tftp -i 10.0.0.1 put Lc_16xxu.282 writeflash
Firmware upload via the serial interface with configuration reset
The serial interface can also be used to load firmware into the device. Entering the serial number instead of the
configuration password results in the device configuration being reset to its ex-factory settings. In this way you can
re-open the device in the case that the configuration password is lost and the reset button has been set to 'Ignore' or
'Boot only'.
1. Use the serial configuration cable to connect the device to a computer.
2. On the computer, start a terminal program such as Hyperterminal.
3. Open a connection with the settings 115200bps, 8n1, hardware handshake (RTS/CTS).
4. In the terminal program's welcome screen, press the Return key until the request to enter the password appears.
5. Enter the serial number that is displayed under the firmware version and press Return again.
1. The device now expects a firmware upload. To initiate this, in Hyperterminal you click on Transfer/ Send file and
select X-Modem as the transfer protocol.
5
Uploading the firmware in this way completely deletes the configuration, which is returned to its ex-factory
settings! Consequently, this option should only be used if the configuration password is no longer available.
65
Reference Manual
3 Configuration
3.7 Load files directly from a TFTP or HTTP server into the device
New in LCOS 7.60:
1
Specification of server, path and file in URL notation
1
Loading files into the device from an HTTP(S) server
Certain functions cannot be run satisfactorily, or not at all, via Telnet. These functions include those where entire files
are transferred, such as the upload of firmware, and saving or restoring configuration data. TFTP or HTTP(S) is used in
these cases.
3.7.1 TFTP
TFTP is available in Windows operating systems as standard. It enables the simple transfer of files to/from other devices
over the network.
The syntax of the TFTP call is dependent on the operating system. The syntax under Windows:
1
tftp -i <IP address Host> [get|put] source [destination]
5
The ASCII format is pre-configured on many TFTP clients. Binary transmission therefore usually needs to be
selected explicitly for the transfer of binary data (such as firmware). Parameter '-i' is used for this in this
example under Windows.
If the device is password-protected, user name and password must be included in the TFTP command. The file name is
either made up of the master password and the command to be executed (for supervisors), or of the combined user
name and password separated by a colon (for local administrators), with the command as a suffix. A command sent by
TFTP therefore resembles the following:
1
<Master password><Command> or
1
<User name>:<Password>@<Command>
The rights to use TFTP can be restricted for administrators—see also “Managing rights for different administrators”.
3.7.2 Loading firmware, device configuration or script via HTTP(S)
By supporting HTTP and in particular HTTPS, downloads of firmware, device configurations or scripts can also be used
by LANCOM devices for automated processes (e.g. self-provisioning) that source files from the Internet. In practice it is
far simpler to provide a cental HTTPS server with a unique Internet address (URI) than a comparable TFTP server, and an
existing Web server can be modified to offer this function.
A certificate used optionally for the HTTPS server is uploaded by WEBconfig to the device as the SSL root CA certificate:
66
Reference Manual
3 Configuration
3.7.3 Loading firmware, device configuration or script via HTTP(S) or TFTP
Along with the option to load firmware or a configuration file into a device using LANconfig or WEBconfig, Telnet and
SSH can also be used to directly upload the relevant files from an HTTP(S) or TFTP server. This process can simplify device
administration in larger installations with regular firmware update and/or configuration. HTTP(S) and TFTP can also be
used to load scripts (e.g. with partial configurations) into devices.
For this, the firmware and configuration files or scripts are stored on an HTTP(S) or TFTP server. A TFTP server is identical
to an FTP server in terms of functionality, but uses a different protocol for data transmission. When using an HTTPS
server, a certificate used to check the identity of the server can be stored on the device. The files can be retrieved from
this server with the following commands:
1
LoadConfig
1
LoadFirmware
1
LoadScript
The server, the directory and the file can be specified in two ways:
1
By using the TFTP protocol with parameters -s and -f:
2
-s <Server IP address or server name>
2
-f <File path and file name>
1
To use TFTP or HTTP(S), the command can be specified in the usual URL notation (either TFTP or HTTP(S) is entered
as the protocol):
2
Command protocol://server/directory/file name
When accessing a password-protected area on an HTTP(S) server, user name and password are entered accordingly:
2
Command protocol://user name:password@server/directory/file name
When using HTTPS, a certificate can be specified with which the identity of the server is checked.
2
-c <Certificate name>
The following variables are permitted in the file name (including path):
1
%m - LAN MAC address (hexadecimal, lowercase, no separators)
1
%s - Serial number
1
%n - Device name
1
%l - Location (from the configuration file)
1
%d - Device type
Examples:
The following Telnet command loads a firmware file named 'LC-1811-5.00.0019.upx' into the device from directory
'LCOS/500' on the server with IP address '192.168.2.200':
1
LoadFirmware -s 192.168.2.200 -f LCOS/500/LC-1811-5.00.0019.upx
The following command in a Telnet session loads a script consistent with the MAC address from the server with IP address
'192.168.2.200' into the device:
1
LoadScript -s 192.168.2.200 -f %m.lcs
The following command in a Telnet session loads into the device a firmware file named 'LC-1811-5.00.0019.upx' from
directory 'download' on the HTTPS server with IP address 'www.myserver.com'. The identity of the server is checked with
the “sslroot.crt” certificate.
1
LoadFirmware -c sslroot.crt
https://www.myserver.com/download/LC-1811-5.00.0019.upx
67
Reference Manual
3 Configuration
If the parameters -s and/or -f are not specified, the device uses default values set in path
/setup/config/TFTP-Client:
1
Config address
1
Config file name
1
Firmware address
1
Firmware file name
These default values can be used if the latest configurations and firmware versions are always stored under the same
name in the same location. In this case, the simple commands LoadConfig and LoadFirmware can be used
to load the relevant files.
3.8 How to reset the device?
If you have to configure the device regardless of possible existing settings, or if a connection to the device configuration
failed, you can put back the device into the factory default state with a Reset. To do so, push the Reset button until
the device LEDs will light up (approx. 5 seconds).
5
After applying the reset, the device will start fresh with factory defaults. All settings will be lost. Therefore, you
should save the current configuration if possible before the reset!
5
Please notice that also the WLAN encryption settings of the device will get lost in case of a reset and the standard
WEP key comes into effect again. The wireless configuration of a device with WLAN interface will only succeed
after a reset, if the standard WEP key is programmed into the WLAN adapter!
The reset button offers two basic functions—boot (restart) and reset (to the factory settings)—which are called by
pressing the button for different lengths of time.
Some devices simply cannot be installed under lock and key. There is consequently a risk that the configuration will be
deleted by someone pressing the reset button too long. With the suitable setting, the behavior of the reset button can
be controlled accordingly (only for devices with serial configuration interface):
WEBconfig: LCOS Menu Tree / Setup / Config
1
Reset button
This option controls the behavior of the reset button when it is pressed:
2
Ignore: The button is ignored.
5
Please observe the following notice: The settings 'Ignore' or 'Boot only' makes it impossible to reset
the configuration to the factory settings using the reset button. If the password is lost for a device with
this setting, there is no way to access the configuration! In this case the serial communications interface
can be used to upload a new firmware version to the device-this resets the device to its factory settings,
68
Reference Manual
3 Configuration
which results in the deletion of the former configuration. Instructions on firmware uploads via the serial
configuration interface are available here .
2
Reset-or-boot (standard setting): Press the button briefly to restart the device. Pressing the button for 5 seconds
or longer restarts the device and resets the configuration to its factory settings. All LEDs on the device light up
continuously. Once the switch is released the device will restart with the restored factory settings.
5
After applying the reset, the device will start fresh with factory defaults. All settings will be lost. Therefore,
you should save the current configuration if possible before the reset!
5
Please notice that also the WLAN encryption settings of the device will get lost in case of a reset and the
standard WEP key comes into effect again. The wireless configuration of a device with WLAN interface will
only succeed after a reset, if the standard WEP key is programmed into the WLAN adapter! After a reset, the
LANCOM access point returns to managed mode, in which case the configuration cannot be directly accessed
via the WLAN interface!
3.9 Scripting
Installations with multiple LANCOM devices often profit from the automatic execution of certain configuration tasks.
The scripting function in LANCOM enables entire sets of commands for device configuration to be stored in a single
file—a script—for transfer to one or more devices in one step.
3.9.1 Applications
Scripting provides users with a powerful tool for the centralized configuration of LANCOM devices, and thus a wide
range of potential applications:
1
Read-out device configurations in a form that is easy to read and save
The configuration files generated by LANconfig are not intended for processing with other tools; users will only get
an overview of the complete configuration from a print-out of the configuration file. The scripting functions can
output the configuration as ASCII text to be saved as a text file.
1
Edit the configuration with a simple text editor
If offline configuration with LANconfig is not possible or not desired, a configuration file generated by scripting can
be edited with a text editor and then uploaded to the device again.
1
Edit sections of the configuration
Instead of the entire configuration, smaller sections of it can be read out from a device instead (e.g. just the firewall
settings). Just as with complete configurations, sections can be edited and transferred to one or more devices. This
allows the particular settings in a device to be uploaded to other models or devices with a different version of the
firmware.
1
Automized configuration updates
The centralized storage of configuration scripts in combination with scheduled LCOS commands (cron jobs) can be
used to keep vital sections of the configuration in multiple devices up to date, e.g. the encryption settings for a
WLAN.
1
Convenient roll-out for larger installations
The installation of multiple devices at different locations can be very easily controlled from a central location. Even
employees without administrator rights can then set up the devices with a single command.
1
Storage of configuration to volatile memory only
69
Reference Manual
3 Configuration
Scripting commands can store configuration changes in RAM only, whereby storage of configuration information to
the non-volatile flash memory is prevented. This ensures that the configuration is available only until the next system
boot, so that in case of theft, for example, sensitive elements of the configuration cannot fall into the wrong hands.
1
Configuration changes in test mode
The same mechanism allows changes to the configuration in test mode. A script triggers a time-delayed system boot;
the intervening time period can be used to change and test the device's configuration without risk. Should the
changes lead to a failure, the device automatically reboots after the time delay and is reset to its original configuration.
Comparable to the FirmSafe function, this variation is a type of "ConfSafe". Changes to the configuration after a
firmware update can, on occasion, be impossible to edit in the case of a later downgrade to an older firmware version.
If, however, the configuration subsequent to the firmware upgrade is stored in test mode only, then downgrading
and subsequently re-booting the system will result in the restoration of the original firmware and its configuration.
3.9.2 Scripting function
Scripting involves the collective transmission of a series of configuration commands to a LANCOM device just as if they
were entered at a Telnet console (or similar). There are two variants of the collective transfer of configuration commands:
1
The device is set to script mode by entering the command beginscript at the console. In this mode, the
commands are not executed individually but are stored in an intermediate memory in the LANCOM. These commands
are only executed after the command exit has been entered.
1
Alternatively, the configuration commands are written offline to a script file (text file) and uploaded to the device as
a complete script.
The configuration commands in the script file initially effect the configuration that is stored in the device's RAM only.
The flash mode then determines whether or not the changes are to be made to the flash memory as well.
1
In Flash Yes mode (standard), the configuration commands are directly written to the device's flash memory and are
thus non-volatile (i.e. boot resistant). Since the flash mode is always ON with the other methods of configuration
(console without script, LANconfig or WEBconfig), the configuration changes are written first to the RAM memory
and then immediately to the flash memory.
Flash ONEXIT
Script
commands
in the script
memory
Beginscript
"Normal" configuration
via console,
LANconfig or WEBconfig
Configuration
in RAM
(deleted
upon booting)
Configuration
in flash
(not deleted
upon booting)
Configuration
for operating
the LANCOM
1
In Flash No mode the data are written to RAM only and are thus available only until the next boot.
2
During the boot process, the device reads the configuration data from the flash memory.
2
The configuration in the RAM can be written to the flash memory at any time with the command "Flash Yes".
While operating, LANCOM devices work with the information stored in the RAM configuration. The script commands
stored in the intermediate memory are, just like the configuration in the flash memory, of no relevance to the real-time
operations of a LANCOM.
3.9.3 Generating script files
A script for a LANCOM configuration exists in the form of a conventional text file. These include any necessary comments
and of the all of the commands as used e.g. with a Telnet console to set the configuration. There are two different ways
to generate a script file:
1
The script can be generated entirely with a text editor.
1
The configuration, or a section of it, is read out of a device, stored as a script file and then altered with a suitable
text editor.
70
Reference Manual
3 Configuration
Read out the configuration via the console
1. Log on to the console with Supervisor rights.
2. Switch to the branch of the configuration tree that you wish to read out.
3. At the command prompt, execute the command readscript. Observe the optional command extensions.
4. Using the Clipboard, copy and paste the required text section into a text editor and adapt the script to your
requirements.
Via TFTP from the command line interface (DOS box)
The configuration commands can be read out directly from the command-line interface via TFTP.
1. To do this, open up a DOS box, for example.
2. Enter the following command at the prompt:
C:\>tftp IP address get "PASSWORDreadscript path" script.lcs
1
IP address is the address of the device containing the configuration commands you wish to read out.
1
PASSWORD is the appropriate password for the device.
1
Path defines the branch of the configuration menu tree that is to be read out. If no path is entered then the
entire configuration will be read out.
1
script.lcs is the name of the script file in the current directory where the commands will be written to.
5
Please be aware that device passwords will be clearly visible as plain text while entering this command!
Via Hyperterminal
Terminal programs such as Hyperterminal provide an option of storing the text displayed by the console directly to a text
file. This method is especially advantageous when dealing with larger configuration files as it avoids the potentially
confusing method of using the Clipboard.
1. Set up a connection to the device with Hyperterminal.
2. Select the menu item Transfer / Capture Text and select the desired storage location and file name for the script.
71
Reference Manual
3 Configuration
1. At the command prompt, execute the command readscript. Observe the optional command extensions.
2. As soon as you have called up all of the required sections of the configuration, stop the recording with the menu
item Transfer / Capture Text / Stop.
The configuration commands are now available as a script file and can be altered as required.
Download script from device
Installations with multiple LANCOM devices often profit from the automatic execution of certain configuration tasks.
The scripting function in LANCOM enables entire sets of commands for device configuration to be stored in a single
file—a script—for transfer to one or more devices in one step.
5
Detailed information about scripting can be found under the section 'scripting' in the chapter on Network
Management with LANtools in the reference manual.
In addition to manually setting a script and console read-outs, script files can also be read out from a device with the
help of LANconfig. For this, right click on the corresponding entry in the device list and select the entry Configuration
management / Save script to file from the context menu. Select the following options here:
1
Numeric sections
Enable this option if you do not want the configuration sections in the script to be displayed in cleartext (e.g.
/setup/wlan/ppp), but numerically (/2/2/5).
1
Default parameters
Unless defined otherwise, the only parameters saved in a script are those that deviate from the default values. Enable
this option if the standard values should also be entered into the script.
1
Column names
Unless defined otherwise, the fields of a table are initially entered as column names in the scripts and, thereafter,
only the respective values are inserted into the rows. Enable this option when every value in the table should explicitly
receive the description of the column in which it is inserted.
1
Comments
Activate this option when additional comments should be included in the script file.
1
Compact formatting
2
Enable this option if spaces and tabs should be suppressed.
1
Download only selected sections
Without further entries, the entire device configuration will always be saved in the script. In contrast, entering the
sections also makes it possible to save partial configurations. Enter the sections to which the script should be
transferred into this field, e.g. /setup/wlan.
3.9.4 Uploading configuration commands and script files
There are two basic methods of uploading the script commands to the intermediate memory of the LANCOM:
1
The commands can be manually entered at a console in script mode (with the command "beginscript"). In this way
the commands are written directly from the console to the intermediate memory. After all of the commands are
ready, they are processed by entering the command "exit" and are then transferred to the RAM.
1
The required command sequence can be saved to a text file. This text file is then sent to the intermediate memory
by using an appropriate tool (LANconfig, terminal program, TFTP). If the necessary commands are included in the
file, the transfer of the configuration to the RAM will be started automatically.
There are various ways to upload script files to LANCOM devices, the choice of which depends upon the configuration
tool that you prefer to use.
72
Reference Manual
3 Configuration
Command input via console session (Telnet, SSH)
In a console session, a script can be uploaded to the device via the Clipboard:
1. Open your script with any text editor and transfer the configuration commands to the Clipboard.
2. Log on to the console with Supervisor rights.
3. Start the script mode with the command beginscript.
1. Paste the commands from the Clipboard following the script prompt (script>). In Telnet, for example, with a
right mouse-click on the upper frame of the window.
2. Entering the command exit executes of the configuration commands.
5
If the command exit is already included in the commands after pasting, the execution of the configuration
will be carried out automatically immediately after pasting!
Upload script with TFTP client
During a console session (e.g. via Telnet or SSH), TFTP commands can be used to upload script files to the device directly
from a TFTP server.
1. Log on to the console with Supervisor rights.
2. Enter the following command at the prompt:
>loadscript -s IP address -f script.lcs
1
IP address is the address of the TFCTP server where the script file is stored.
1
script.lcs is the name of the script file on the TFTP server
Upload script with LANconfig
LANconfig has the option to upload a script either to a single device or to multiple devices simultaneously.
1. Click on a device with the right mouse key and use the context menu to select the entry Configuration Management
/ ApplyScript. If multiple devices are marked, the entry ApplyScript appears directly in the context menu.
73
Reference Manual
3 Configuration
2. In the following dialog, select the required script file (*.lcs) for upload.
5
The upload of the script starts automatically. Status and error messages are either displayed directly by LANconfig
or the can be viewed in a console session with the command show script.
Upload script with Hyperterminal
A further way to upload scripts to a LANCOM is to use a terminal program such as Hyperterminal as supplied with
Windows.
1. Set up a connection to the device with Hyperterminal.
2. Select the menu item Transfer / Capture Text.
3. Choose the required script file and start the transfer.
Following the successful completion of the transfer, the script is started automatically.
74
Reference Manual
3 Configuration
3.9.5 Multiple parallel script sessions
The LANCOM can manage multiple simultaneous script sessions. Just as multiple console sessions can be run simultaneously
on a single device, different scripts can also access the LANCOM at the same time. Parallel script sessions are especially
useful in the following scenarios:
1
Script initiates a time-delayed reboot of the device after 30 minutes, for example. A second script is active during
the device's run time and changes its configuration for test purposes; the flash mode is deactivated for this. If the
changes in configuration from script make the device unattainable, then the restart prompted by script 30 minutes
later causes these changes to be rejected.
1
When using different scripts for partial configurations, multiple scripts can started simultaneously, for example with
cron jobs. The individual configuration tasks do not need to be delayed until the previous script has completed its
processing.
3.9.6 Scripting commands
1
readscript
In a console session, the command readscript generates a text dump of all commands and parameters that are
required for the configuration of the LANCOM in its current state. In the simplest case, the LANCOM lists only
commands that are relevant to those parameters that no longer have the factory settings.
Syntax: readscript [-n][-d][-c] [-m] [PATH]
5
Supervisor rights are necessary to execute this command.
75
Reference Manual
3 Configuration
Example: For a LANCOM that is set up only for Internet-by-call via ISDN, the command readscript will produce the
following console output (assuming that there are no further restrictions):
From this example it is possible to recognize the behavior or the script that was generated with the command
readscript.
2
First of all the parameters with values different from the default settings are displayed.
2
The values in the tables are deleted (del *) and replaced with the current values in the configuration (add
*).
2
Only those table entries or values which cannot be left empty are directly changed with the Set command.
5
The table lines or strings containing passwords are displayed in plain text as this is the format required
by the Telnet user interface.
This script can be used to program other LANCOMs with exactly the same configuration as the original device.
As these scripts can be very long in some cases, it is possible to generate scripts that focus only on parts of the
configuration. To do this, you first change to the directory with the configuration that is to be recorded (e.g. cd
set/ip-router/firewall for the firewall settings) and then execute the readscript command.
Alternatively, enter the path directly with the readscript command as a path parameter (e.g. readscript
set/ip-router/firewall). In both cases, only the firewall settings that have been changed will be
recorded in the script.
The following options can be used with the readscript command:
76
Reference Manual
3 Configuration
3
-d (default): The commands for modifying parameters that are set to the factory settings will be
listed as well. These long scripts are useful for transferring configurations between different types of devices
or between devices with different firmware versions as the factory settings can vary.
3
-n (numeric): This suffix causes the paths to be output in the numeric form of the SNMP description
instead of plain text. This also facilitates the transfer of scripts between devices with different firmware
versions as the path names may change but the SNMP tree generally does not.
3
-c (comment): In combination with -d and -n, this parameter generates additional comments which
make the script easier to read. For the parameter -d, every command combination that sets a default value
is marked with # default value. With -n, each numeric path is supplemented with its plain text
equivalent.
3
-m (minimize): This parameter removes any gaps in the script, so making it more compact.
2
#
The # character followed by a space at the start of a line are the first characters of a comment. Subsequent
characters to the end of the line will be ignored.
5
The space after the # is obligatory.
2
del *
This command deletes the table in the branch of the menu tree defined with Path.
Syntax: del [PATH]*
2
default
This command enables individual parameters, tables or entire menu trees to be reset to their factory settings.
Syntax: default [-r] [PATH]
This command returns the parameters addressed by the PATH to their factory settings. If PATH indicates a
branch of the menu tree, then the option -r (recursive) must be entered.
5
Supervisor rights are necessary to execute this command.
2
beginscript
The command beginscript switches a console session into script mode. In this state, commands entered
are not transferred directly to the LANCOM's configuration RAM but initially to the device's script memory. The
commands will only be transferred to and started in the configuration RAM via a script session by executing the
command exit.
5
Supervisor rights are necessary to execute this command.
2
show script
77
Reference Manual
3 Configuration
The command show script displays the content of the most recently executed script and an overview of the
currently running scripts. The names displayed in this output can be used to interruption scripts early.
5
Supervisor rights are necessary to execute this command.
1
killscript
The command killscript deletes the content of a script session that has not yet been executed. The script session is
selected by its name.
5
Supervisor rights are necessary to execute this command.
1
flash Yes/No
When configuring a device with scripts, any add-, set- or del- command can lead to an (unintentional) update of
the configuration in flash; to prevent this, the update to flash function can be deactivated. After concluding the
configuration, this function can be activated again with flash Yes. Changes in the RAM configuration are then
written to flash. The status flash Yes/No is stored globally.
5
Supervisor rights are necessary to execute this command.
1
sleep
The sleep command allows the processing of configuration commands to be delayed for a certain time period or to
be scheduled for a certain time.
Syntax: sleep [-u] value[suffix]
Permissible suffixes are s, m, or h for seconds, minutes, or hours; if no suffix is defined, the units are milliseconds.
With the option switch -u, the sleep command accepts times in the format MM/DD/YYYY hh:mm:ss (English)
or in the format TT.MM.JJJJ hh:mm:ss (German).
5
Times will only be accepted if the system time has been set.
The sleep function is useful for a time-delayed reboot when testing an altered configuration or for a scheduled
firmware update for large-scale roll-outs with multiple devices.
3.9.7 Addition(s) to LCOS 8.80
Tab command when scripting
When working with scripts, the tab command enables the desired columns for the subsequent set command.
78
Reference Manual
3 Configuration
When you perform the configuration with a command line tool, you generally supplement the set command with the
values for the columns of the table.
For example, you set the values for the performance settings of a WLAN interface as follows:
> cd /Setup/Interfaces/WLAN/Performance
> set ?
Possible Entries for columns in Performance:
[1][Ifc] : WLAN-1 (1)
[5][QoS] : No (0), Yes (1)
[2][Tx-Bursting] : 5 chars from: 1234567890
> set WLAN-1 Yes *
In this example the Performance table has three columns:
1
Ifc, the desired interface
1
Enable or disable QoS
1
The desired value for TX bursting
With the command set WLAN-1 Yes * you enable the QoS function for WLAN-1, and you leave the value for TX
bursting unchanged with the asterisk (*).
Working with the set command in this way is adequate for tables with only a few columns. However, tables with many
columns can pose a major challenge. For example, the table under Setup > Interfaces > WLAN > Transmission
contains 22 entries:
> cd /Setup/Interfaces/WLAN/Transmission
> set ?
Possible Entries for columns in Transmission:
[1][Ifc] : WLAN-1 (1), WLAN-1-2 (16), WLAN-1-3 (17), WLAN-1-4 (18), WLAN-1-5
(19), WLAN-1-6 (20), WLAN-1-7 (21), WLAN-1-8 (22)
[2][Packet-Size] : 5 Chars from: 1234567890
[3][Min-Tx-Rate] : Auto (0), 1M (1), 2M (2), 5.5M (4), 11M (6), 6M (8), 9M (9), 12M
(10), 18M (11), 24M (12), 36M (13), 48M (14), 54M (15)
[9][Max-Tx-Rate] : Auto (0), 1M (1), 2M (2), 5.5M (4), 11M (6), 6M (8), 9M (9), 12M
(10), 18M (11), 24M (12), 36M (13), 48M (14), 54M (15)
[4][Basic-Rate] : 1M (1), 2M (2), 5.5M (4), 11M (6), 6M (8), 9M (9), 12M (10), 18M
(11), 24M (12), 36M (13), 48M (14), 54M (15)
[19][EAPOL-Rate] : Like-Data (0), 1M (1), 2M (2), 5.5M (4), 11M (6), 6M (8), 9M
(9), 12M (10), 18M (11), 24M (12), 36M (13), 48M (14), 54M (15), HT-1-6.5M (28), HT-1-13M
(29), HT-1-19.5M (30),
HT-1-26M (31), HT-1-39M (32), HT-1-52M (33), HT-1-58.5M (34), HT-1-65M (35), HT-2-13M (36),
HT-2-26M (37), HT-2-39M (38), HT-2-52M (39), HT-2-78M (40), HT-2-104M (41), HT-2-117M
(42), HT-2-130M (43)
[12][Hard-Retries] : 3 Chars from: 1234567890
[11][Soft-Retries] : 3 Chars from: 1234567890
[7][11b-Preamble] : Auto (0), Long (1)
[16][Min-HT-MCS] : Auto (0), MCS-0/8 (1), MCS-1/9 (2), MCS-2/10 (3), MCS-3/11 (4),
MCS-4/12 (5), MCS-5/13 (6), MCS-6/14 (7), MCS-7/15 (8)
[17][Max-HT-MCS] : Auto (0), MCS-0/8 (1), MCS-1/9 (2), MCS-2/10 (3), MCS-3/11 (4),
MCS-4/12 (5), MCS-5/13 (6), MCS-6/14 (7), MCS-7/15 (8)
[23][Use-STBC] : No (0), Yes (1)
[24][Use-LDPC] : No (0), Yes (1)
[13][Short-Guard-Interval] : Auto (0), No (1)
[18][Min-Spatial-Streams] : Auto (0), One (1), Two (2), Three (3)
[14][Max-Spatial-Streams] : Auto (0), One (1), Two (2), Three (3)
[15][Send-Aggregates] : No (0), Yes (1)
[22][Receive-Aggregates]: No (0), Yes (1)
[20][Max-Aggr.-Packet-Count] : 2 Chars from: 1234567890
[6][RTS-Threshold] : 5 Chars from: 1234567890
[10][Min-Frag-Len] : 5 Chars from: 1234567890
[21][ProbeRsp-Retries] : 3 Chars from: 1234567890
79
Reference Manual
3 Configuration
Use the following command to set the short guard interval in the transmission table for the WLAN-1-3 interface to No:
> set WLAN-1-3 * * * * * * * * * * * * No
5
The asterisks for the values after the column for the short guard interval are unnecessary in this example, as the
columns will be ignored when setting the new values.
As an alternative to this rather confusing and error-prone notation, you can use the tab command as the first step to
determine which columns are changed with the subsequent set command:
> tab Ifc short guard-Interval
> set WLAN-1-3 No
The tab command also makes it possible to change the order of the columns. The following example for the WLAN-1-3
interface sets the value for the short guard interval to No and the value for Use-LDPC to Yes, although the corresponding
columns in the table are displayed in a different order:
> tab Ifc short guard-Interval Use-LDPC
> set WLAN-1-3 No Yes
5
The tables may only contain only a selection of the columns, depending on the hardware model. The tab
command ignores columns which do not exist for that device. This gives you the option to develop unified scripts
for different hardware models. The tab instructions in the scripts reference the maximum number of required
columns. Depending on the model, the script only performs the set instructions for the existing columns.
You can also abbreviate the tabcommand with curly brackets. Use the following command to set the short guard
interval in the transmission table for the WLAN-1-3 interface to No:
> set WLAN-1-3 {short-guard} No
The curly brackets also enable you to change the order of the columns. The following example for the WLAN-1-3 interface
sets the value for the short guard interval to No and the value for Use-LDPC to Yes, although the corresponding
columns in the table are displayed in a different order:
> set WLAN-1-3 {Short-Guard-Interval} No {Use-LDPC} Yes
3.10 Rollout Wizard
In complex scenarios with multiple LANCOM devices at different locations, on-site technicians may not be available to
carry out the installation and configuration of a LANCOM. A large part of the configuration can be prepared at
headquarters. All that has to be set up on-site are a few location-dependent parameters. The Rollout Wizard allows
non-expert, on-site employees to carry out these last-minute adjustments with the help of a browser. After running the
Rollout Wizard the device is either operational or it can independently retrieve the rest of its configuration from a central
storage location.
The parameters for configuration can be found under the following paths:
WEBconfig: LCOS menu tree/ Setup/ HTTP / Rollout-Wizard
3.10.1 General settings in the Rollout Wizard
1
Operating
Switches the Rollout Wizard on or off. After being switched on the Wizard appears directly on the WEBconfig start
page.
2
Possible values: On, off
2
Default: Off
1
Title
80
Reference Manual
3 Configuration
The name for the Rollout Wizard that appears on the start page of WEBconfig.
2
Possible values: Maximum 64 alphanumerical characters
2
Default: Roll-out
3.10.2 Variables
Maximum ten variables can be defined with Index, Ident, Title, Type, Min-Value, Max-Value and Default-Value.
1
Index
Index for the variable. The Rollout Wizard displays the variables in ascending order.
2
Possible values: 1 to 232 - 1
2
Default: 0
1
Ident
Unique identifier of variables that are referenced during the execution of actions. Identifiers are not required for
fields that are not used by users to enter their data (e.g. label).
2
Possible values: Maximum 64 alphanumerical characters
2
Default: blank
1
Title
Name of the variable as displayed by the Rollout Wizard in WEBconfig.
2
Possible values: Maximum 64 alphanumerical characters
2
Default: blank
1
Type
Name of the variable as displayed by the Rollout Wizard in WEBconfig.
2
Possible values: Label, Integer, String, Password, Checkmark
2
Label: Text that is displayed to provide explanations of the other variables. Min.-Value and Max.-Value are of no
further significance for these entries.
2
Integer: Allows the entry of a positive integer number between 0 and 232 - 1. By entering the Min.-Value and
Max.-Value, the range of entries can be limited. Also, a default value can be defined. This default value must be
between the Min. and Max.-Values.
2
String: Enables text to be entered. By entering the Min.-Value and Max.-Value, the length of the string can be
limited. Also, a default value can be defined. This default text must be shorter than the maximum length, otherwise
it will be truncated.
2
Password: splayed while being entered. Entering a password has to be repeated. The Rollout Wizard will execute
no actions if the passwords do not agree.
2
Checkmark: Simple option that can be switched on or off. Min.-Value and Max.-Value are of no further significance
for these entries. Checkmarks are activated as standard if the default value is not empty.
2
Default: Label
1
Min-Value
Minimum value for the current variable (if type = integer) or minimum number of characters (where type = String or
Password).
2
Possible values: 0 to 232 - 1
2
Default: 0
1
Max-Value
Maximum value for the current variable (if type = integer) or maximum number of characters (where type = String
or Password).
81
Reference Manual
3 Configuration
2
Possible values: 0 to 232 - 1
2
Default: 0
1
Default value
Default value of the current variable.
2
Possible values: Maximum 64 alphanumerical characters
2
Default: blank
3.10.3 Actions to be executed by the Rollout Wizard
Max. 19 definitions of actions (with index and action) which are to be executed by the Rollout Wizard after the user data
has been entered.
1
Index
Index for the action. The Rollout Wizard executes the actions in ascending order.
2
Possible values: 1 to 232 - 1
2
Default: 0
1
Action
Action to be executed by the Rollout Wizard after the user data has been entered.
2
Possible values: Similar to Cron commands, actions are entered in the syntax [Protocol:]Argument. If
no protocol is entered, 'exec.' is applied.
2
exec: Executes any command just as it is used in Telnet to configure a LANCOM. The following example sets the
name of the device to 'MyLANCOM':
exec: set /setup/name MyLANCOM
2
mailto: Enables an e-mail to be sent upon entry of the address, subject and body text, for example:
mailto:admin@mylancom.de?subject=Rollout?body=LANCOM setup completed
5
To make use of the mail function, an SMTP account must be set up in the device.
2
http and http: Enables a Web site to be accessed, for example to carry out an action there.
<http:|http:>//[user[:pass]@]hostname[:port]/...
2
Variables in the actions: When actions are executed, the values as defined with the Rollout Wizard can be
referenced. To this end, the variable's identifier is used for the action with a leading percent character. The
identifier must be enclosed by curly brackets if other alphanumeric characters are included in the action. The
following example sets the name of the device to the format 'Site (branch)', if the location of the device is being
queried as a variable with the identifier 'Location':
exec: set /setup/name %{Location}(Branch)
For variables of the type Integer or String, the value as entered by the user is used. In the case of variables of the
type Checkmark, '1' (switched on) or '0' (switched off) is used.
5
If the expression for the action contains spaces then the expression must be enclosed by quotation marks.
2
Default: blank
3.10.4 Actions for managing the Rollout Wizard
1
Renumber variables
1
Renumber actions
82
Reference Manual
3 Configuration
As explained above, variables and actions are displayed or processed in the order of their index. Occasionally,
variables/actions with neighboring index numbers require a new entry to be entered between them. With this action,
the indices can automatically be renumbered with a certain interval between them.
When being executed, the arguments can be defined with the start value and increment. This action renumbers the
entries starting with the start value and continuing with the increment as chosen. If the start value and increment
are not defined, both are set automatically to 10. If no arguments are entered, the action renumbers the indices with
10, 20, 30, etc.
3.10.5 Addition(s) to LCOS 8.50
Custom Rollout Wizard
Introduction
In large-scale networking projects, administrators often have to install many devices of the same or similar type at
different locations. To reduce or avoid the need to be personally present at the various locations, administrators often
prepare the equipment at the central office for rollout. On location, an employee or a customer then runs a special wizard
that sets the site-related parts of the configuration and puts the device into operation.
With a special instruction language, LCOS gives administrators the ability to define highly complex wizards. Custom
wizards support the following functions:
1
Definition of any internal variables
1
Conditional branches
1
Conditional goto instructions to any URL
1
Conditional display of notices
1
Runs all (non-interactive) actions that are available with the LCOS command line interface
1
Read-out current values from the configuration in the devices
1
Write new values to the configuration in the devices
1
Status checks such as checking the time in the device
1
Connection checks, e.g. the successful VPN connection to a specific remote site
In compliance with the rules of the instruction language, the administrator compiles a new Wizard in the form of a text
file, which is then loaded into the device.The user on-site can run the custom wizard from WEBconfig by using the
appropriate name.
5
You can restrict certain administrator accounts to be available specifically under the Rollout Wizard only, allowing
even inexperienced users to configure certain functions without allowing access to the complete configuration.
5
At the time of the release of LCOS 8.50, users of the following devices can use the instruction language to
customize wizards:
1
LANCOM 1681V
1
LANCOM 1711+ VPN
1
LANCOM 1721+ VPN
1
LANCOM 1821n Wireless
1
LANCOM 1811n Wireless
1
LANCOM 1751 UMTS
Structure of the custom wizard
The instructions that describe a custom wizard consist of the following sections:
1
String tables with the necessary texts in English and German.
1
A definition of the wizard.
83
Reference Manual
3 Configuration
1
Any number of sections describing the HTML pages that the wizard is to display.
1
An initialization section, which defines the actions when you start the wizard.
1
A concluding section, which defines the actions when you stop the wizard.
Note the following conventions for the instructions that describe the wizard:
1
The elements of the instructions exactly follow the structure given above.
1
The text file with the instructions is encoded in ISO 8859-1.
1
Comments start with a semicolon and serve only to improve the readability of the instructions.
1
Internal variables begin with the key word wizard. (Including the dot) and store information for the internal
processing of the wizard.
1
Configuration variables begin with the keyword config. (including the dot) and read out information from the
current device configuration, or they write them to the current configuration. Enter the configuration variables in
one of the following forms:
2
Dedicated parameters in the configuration are referenced via config.1.<SNMP-ID>, for example
config.1.2.1 to access the device name (to be found in the menu under /setup/name)
5
One way to find the SNMP-ID for a parameter in the configuration is to enter the command ls -a at
the command line in the corresponding submenu.
2
You can reference the values in a table with:
config.^.<SNMP-ID>.<Line>.ID:<Column>
Example for finding the value in the first line and the column with ID '2' in the routing table '1.2.8.2':
config.1.2.8.2.1.ID:2
2
If you do not know the ID of the column, an alternative for you to reference the values in a table is to enter:
config.1.<SNMP-ID>.<Line>.<Column>
Example for finding the value in the first line and second column:
config.1.2.8.2.1.2
2
If you do not know which line in the table you need, you can reference the values in a table via a known value
in the first column:
config.<SNMP-ID>."<Known-Value>".ID:<Column>
Example for finding the value in the column with ID '2' on the line with the value of the default route in its first
column:
config.1.2.8.2."255.255.255.0".ID:2
If the table contains multiple rows with the same value in the first column, then the configuration variable
references the first of these lines.
2
If the required line in the table is only defined after the user has entered input into the wizard, you can reference
the value in the table by using a variable with:
config.<SNMP-ID>.\"<Internal-Variable>\".ID:<Column>
Example for finding the line whose first column contains a value that agrees with the current value of the internal
variable wizard.target_network:
config.1.2.8.2."\wizard.target_network"\.ID:2
1
Device-property variables begin with the key word device. (including the dot) and are used to read-out specific
properties from the device. For more information about the device variables, see the
Using device properties as
variables
.
String tables
The instructions for the custom wizard basically define the texts that are to be displayed in German and English.
84
Reference Manual
3 Configuration
The line stringtable "English" delivers the English text, the line stringtable "German" delivers
the German texts. Each string definition consists of the keyword string, followed by the name of the string and the
value enclosed by double inverted commas.
The following example shows the string tables with just one entry:
; -String tables start---------------------------------------------
stringtable "English"
string title_test, "Test wizard"
stringtable "Deutsch"
string title_test, "Test-Assistent"
; -String tables end-----------------------------------------------
5
The interpreter of the instructions that describe the custom wizard in LCOS requires all texts to contain a German
and an English definition. LCOS will not execute the wizard if an entry in the English string table is not accompanied
by an entry of the same name in the German string table (or vice versa).
Definition of the wizard
The definition specifies the name of the wizard. The keyword wizard precedes the internal name in double inverted
commas followed by the reference to an entry in the string table (
String tables
). The wizard displays the external name
defined by this string when the HTML page is executed:
; -Wizard Definition Start---------------------------
wizard "My_Test-Wizard", title_test
; -Wizard Definition End----------------------------
Sections
The sections represent the actual HTML pages that are displayed when the wizard is executed in the user's browser.
Each section begins with the keyword section and ends with the beginning of the next section. The last section ends
at the beginning of the 'on-init' area, i.e. there is no explicit keyword for the end.
The sections include the following elements in any order and quantity:
1
Conditions
1
Optional freely definable name of the section, starting with the keyword label, followed by a string of upper- and
lowercase letters and underscores '_':
Label My_RolloutAssistent
5
The instruction set for the wizard can use the freely definable name as a goto target.
1
Static text starting with the keyword static_text followed by a reference to an entry in the string table
(String
tables)
:
static_text str.conf_general
1
Fields for different data types such as text or IP address, check boxes, radio buttons, selection lists, etc.
5
Information on the various fields can be found in the
"Fields"
section.
1
Actions performed by the wizard in different situations depending on the keyword at the beginning of the block:
2
on_show: The wizard performs the actions in this block before a section (HTML page) is displayed.
2
on_skip: The wizard performs the actions in this block if a section (HTML page) is not to be displayed due to
conditions contained within it.
2
on_next: The wizard performs the actions in this block if the user clicks on 'Next' in the section (HTML page).
2
on_back: The wizard performs the actions in this block if the user clicks on 'Back' in the section (HTML page).
5
Notes on the structure of the blocks with the actions and the elements in them are to be found in the
Actions
section.
85
Reference Manual
3 Configuration
Conditions
You can specify any number of conditions for an element. Conditions in different lines are AND operators; conditions in
one line are OR operators.
The instructions for the wizard can add conditions to any element in a section. Conditions always refer to the previous
element. They consist of a class specifier and one or more condition patterns. A pattern consists of two operands and
one operator.
If a condition contains multiple condition patterns in one line, the wizard evaluates this expression as an OR operator.
If the instructions contains multiple conditions relating to a parent element on separate lines, the wizard assesses the
expression to be an AND operation.
The instructions can include the following classes:
1
only-if: The preceding element is only executed or displayed when at least one of the following condition
patterns is fulfilled.
1
skip-if: The preceding element is not executed or displayed when all of the following condition patterns are
fulfilled.
The condition pattern can contain the following operands:
1
Static text
1
Internal variables of the wizard
1
Variables for referencing values from the current configuration of the device (configuration variables)
1
The character '*' as a wildcard
The condition pattern can contain the following operators:
1
equal: Checks if the two operands are equal.
1
exists: Checks if the specified configuration variable is set, i.e. that the value of the parameter in the configuration
is not empty.
1
empty: Checks if the first operand is empty. The second operand is specified as a wildcard '*'.
1
contains: Checks if the first operand contains the second operand.
1
!: Negates the condition.
Examples:
The following condition only displays the section if the internal variable 'wizard.test_select' is equal to '0'.
section
only_if wizard.test_select, "0", equal
The following condition sets the internal variable 'wizard.intranet_name' to the value 'INTRANET' if this variable is empty.
set wizard.intranet_name, "INTRANET" only_if wizard.intranet_name, *, empty
The following condition sets the internal variable 'wizard.target_1' to the value 'TARGET_1' if the internal variable
'wizard.select_target' is set either to '1' or '5'.
set wizard.target_1, "TARGET_1" only_if wizard.select_target, "1", equal,
wizard.select_target, "5", equal
Fields and attributes
The wizard uses fields in order to display information to the user and to give the user the option to enter information.
Each field corresponds to an internal variable.
The wizard defines a field by specifying the appropriate key word, followed by an internal variable on the same line.
Additional lines that follow can optionally contain the attributes for the field.
86
Reference Manual
3 Configuration
An example of a field definition in the wizard:
selection_buttons select_inet
description str.inet_Selection
button_text str.inet_PPPoE, str.inet_IPoE
This field generates a group of radio buttons, only one of which can be activated by the user. The wizard places the text
defined in the string table str.inet_Selection as a description next to the field. For the radio buttons themselves,
the wizard displays the text under str.inet_PPPoE and str.inet_IPoE. After an option was selected by
the user, the wizard writes the selected value to the internal variable wizard.select_inet.
You can use the following fields in the wizard:
check_local_ip: This field checks if the wizard previously changed the device's IP address and redirects the user
to the corresponding HTML page. Possible attributes:
1
destination: Target for forwarding as a FQDN or IPv4 address.
1
timeout: Wait time before forwarding.
check_time: This field verifies if the device has valid time information. Possible attributes:
1
success_jump: Label of the page that the wizard opens if the check is successful.
1
fail_jump: Label of the page that the wizard opens if the check fails.
1
limit: Maximum number of checks before the wizard considers the test to have failed. Set the limit to the value
'0' to continue the checks without limit.
1
timeout: Wait time between two checks.
entryfield_hex: This field is used for entering hexadecimal values, such as MAC addresses. Possible attributes:
1
description: Field description in the HTML display
1
max_len: Maximum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_ipaddress: This field is used to enter IPv4 addresses. Possible attributes:
1
description: Field description in the HTML display
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
never_zero: A value of '1' for this attribute denotes a field that may not contain the value '0'.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_numbers: This field is used to enter telephone numbers. Possible attributes:
1
description: Field description in the HTML display
1
max_len: Maximum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_numeric: This field is used to enter numbers. Possible attributes:
1
description: Field description in the HTML display
1
range_min: Minimum value that the user can enter in this field
1
range_max: Maximum value that the user can enter in this field
1
signed_value: Allows you to specify a numerical value with a sign
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
87
Reference Manual
3 Configuration
1
unit: The unit of value shown after the input field in the wizard's HTML display.
entryfield_text: This field is used to enter text. The attribute hidden is for fields used to enter passwords.
Possible attributes:
1
description: Field description in the HTML display
1
hidden: Identifies a field used by the user to enter a password.
1
add_to_charset: Adds extra characters to the default input character set.
1
convert_to_upper: Converts user input into uppercase letters
1
max_len: Maximum number of characters that the user can enter into this field
1
min_len: Minimum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
unit: The unit of value shown after the input field in the wizard's HTML display.
entryfield_textwithlist: This field is used to enter text. The user also has the option of selecting from a
set of predefined values. Possible attributes:
1
description: Field description in the HTML display
1
default_value: Default value
1
max_len: Maximum number of characters that the user can enter into this field
1
item_value: List of predefined values that the user can select for this field
onoff_switch: This field creates a simple check box. Possible attributes:
1
description: Field description in the HTML display
1
value_list: List of the two values that the check box may take on
1
default_selection: Default value
page_switch: This field creates a link with which the user can switch to one of the wizard's several other HTML
pages. Possible attributes:
1
page_description: Comma-separated list of text strings or references to strings that describe the possible
link targets.
1
page_label: Comma-separated list or page labels of the possible link targets.
1
description: Field description in the HTML display
ping_barrier: This field stops the wizard from being executed until a ping to the target was answered successfully.
Possible attributes:
1
destination: Target address for the ping.
1
loopback: Loopback address used by the ping instead of the default reply address
1
success_jump: Label of the page that the wizard opens if the ping is successful.
1
fail_jump: Label of the page that the wizard opens if the ping fails.
1
limit: Maximum number of pings before the wizard considers the test to have failed. Set the limit to the value
'0' to continue sending pings without limit.
1
timeout: Wait time between two pings.
popup: This field opens the entered target address in a popup window. Possible attributes:
1
None
5
The target address can contain variables (see
Variables
on page 89).
readonly_text: This field creates a read-only field. The wizard can use these fields to display text. The wizard can
use hidden attributes to define internal variables. Possible attributes:
1
description: Field description in the HTML display
1
unit: The unit of value shown after the input field in the wizard's HTML display
1
hidden: Identifies a hidden field.
88
Reference Manual
3 Configuration
selection_buttons: This field generates a group of radio buttons, only one of which can be activated by the
user. Possible attributes:
1
description: Field description in the HTML display
1
button_text: Comma-separated list of text strings or references to strings that describe the individual radio
buttons.
1
button_value: Comma-separated list of text strings with the values of the individual radio buttons.
selection_list: This field generates a drop-down selection list for the user to select a value. Possible attributes:
1
description: Field description in the HTML display
1
item_text: Comma-separated list of text strings or references to strings that describe the individual list entries.
1
item_value: Comma-separated list of text strings with the values of the individual list entries.
1
default_selection: Default value
static_text: This field creates static text on the HTML page following the field name as a reference to a text string.
Possible attributes:
1
None
Variables
In some attributes of the fields you can use variables to replace the value of the attribute with another string or supplement
it with an additional string.
to insert an internal variable into the value of an attribute, use the syntax $(VariableName). To insert the user
name from the internal variable wizard.username into a URL, add the following attribute:
http://host/directory?param=$(username)
To insert a predefined variable into the value of an attribute, use the syntax %VariableName. You can use the
following predefined variables in the attributes:
1
% inserts a percent sign.
1
f inserts the version and the date of the firmware currently active in the device.
1
r inserts the hardware release of the device.
1
v inserts the version of the loader currently active in the device.
1
m inserts the MAC address of the device.
1
s inserts the serial number of the device.
1
n inserts the name of the device.
1
l inserts the location of the device.
1
d inserts the type of the device.
Actions
The wizard uses actions to change values in the device configuration.
One or more conditions can be defined for any action. If these conditions are met, the wizard performs the action.
set
Syntax:
1
set $target, $sourcelist
1
set $target, $number, add
1
set $target, $number, sub
This action replaces the content of the target variable with the specified source. The source contains a comma-separated
list of variables or text strings.
If the target variable is a single configuration parameter, specify only one value as the source. Other values are ignored.
89
Reference Manual
3 Configuration
If the target variable is a table, you should first specify the value in the source from the line that the wizard should
change. The wizard searches the first index column for this value and it changes the first line in which it finds this value.
If the wizard does not find a line with the matching value, it adds a new line to the table.
If the target variable is a numeric value, you can use the add or sub action to add or subtract the amount defined as
$number.
Examples
The following action sets the default route to the desired values:
set config.1.2.8.2, "255.255.255.255", "0.0.0.0", "0", "INTERNET", "0", "on", "Yes", ""
The following action increases the value of the ARP aging minutes to '5':
set config.1.2.7.11, "5", add
The following action reduces the value of the ARP aging minutes by '5':
set config.1.2.7.11, "5", sub
del
This action clears the contents of the target variable. If this variable is a table, enter the value from the first index column
in the line that is to be deleted.
Example
The following action deletes the default route from the routing table:
del config.1.2.8.2, "255.255.255.0"
cat
This action lists the content of the source variables after the target variable.
Example
The following action adds the content of the variables wizard.user and the variable wizard.name:
cat wizard.name, wizard.user
cut
This action removes a certain number of characters from the target variables. Enter as a parameter the position of the
character to be deleted counting from the left and, optionally, the number of characters to be deleted.
Examples
The following action will delete all characters in the variable wizard.name after the 2nd character.
cut wizard.name, 2
The following action will delete all characters in the variable wizard.name exactly 4 characters after the 2nd
character.
cut wizard.name, 2, 4
trigger_config_change
Depending on the part of the firmware that is affected, changes by the wizard to the configuration do not take immediate
effect, as some modules use internal structures for the configuration.
The action trigger_config_change triggers an update to these internal structures. You should insert this
action into a section if you want to make sure that the configuration has been updated when you change a page in the
Rollout Wizard.
When you exit, the wizard automatically executes this action.
90
Reference Manual
3 Configuration
exec
The string that follows this is executed as a command on the console. In this case variables can be used in the string,
for example to start a LoadScript.
Trace for rollout wizards
The HTML pages of the wizard only display the results of internal processing. While the wizard is being built, the trace
can provide additional information to the administrator which could be used for further optimization, for example about
the analysis of the various conditions.
Start trace from the command line using the command trace + rollout-wizard.
Using user-defined HTML templates
An an option, the appearance of the wizard can be adapted to your company's design guidelines by uploading a
customized HTML template into the device. The template can specify the basic structure of HTML pages and the design
of colors, fonts, etc. by means of CSS rules.
Two fixed tags in the HTML template are used to insert the contents from the wizard into the respective HTML pages:
1
<WIZARD_LOGO>: The wizard inserts the logo (GIF, JPEG or PNG format) as saved to the device under
'WEBconfig/File management/Upload certificate or file'.
1
<WIZARD_CONTENT>: This tag marks the point where the wizard inserts the contents of the sections in the
form of a two-column table with the corresponding buttons.
A very simple example of an HTML template looks like this:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Titel des Assistenten</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div>
<WIZARD_LOGO>
</div>
<WIZARD_CONTENT>
</body>
</html>
The wizard a selection of predefined CSS classes that you can easily customize by specifying appropriate values in your
HTML template, including:
1
class="header": The CSS class for the header with the logo.
1
class="wizardName": The CSS class paragraph with the name of the wizard at the head of the page.
1
class="headerLogo": The CSS class for the area for the logo in the header.
1
class="wizardTable": The CSS class for tables with the displayed fields.
1
class="footer": The CSS class for the footer with the buttons.
Using device properties as variables
In some situations, a wizard has to make decisions based on the device properties. For instance, the wizard should only
write certain values to the configuration if the device has a particular type of WAN interface. The wizard has access to
certain variables of the device properties. These variables begin with the key word device. (including the dot),
followed by the name of the relevant property. The wizard can use the following variables for read-access to the device
properties:
device.flags.dhcp_addr: This variable indicates whether a DHCP server has assigned an IP address to the
device (in which case the variable is set to '128 ') or not ('0').
91
Reference Manual
3 Configuration
device.hasADSL: This variable indicates whether the device has an ADSL interface ('1') or not ('0').
device.hasISDN: This variable indicates whether the device has an ISDN interface ('1') or not ('0').
device.hasUMTS: This variable indicates whether the device has an UMTS interface ('1') or not ('0').
device.hasDSL: This variable indicates whether the device has an DSL interface ('1') or not ('0').
device.FirmwareVersion: This variable indicates the current firmware version of the device.
device.HardwareRelease: This variable indicates the hardware release of the device.
device.LoaderVersion: This variable indicates the loader version of the device.
device.MacAddress: This variable indicates the MAC address of the device in hexadecimal notation without any
separators.
device.SerialNumber: This variable indicates the serial number of the device.
device.Location: This variable indicates the location of the device as specified under /setup/snmp.
device.DeviceString: This variable indicates the type of the device.
device.Name: This variable indicates the name of the device as specified under /setup.
Uploading files for the wizard
To make the wizard available, upload the following files to the device:
Rollout-Assistent: The instructions for compiling the wizard (required). This ISO-8859-1 encoded text file is
required for operating the wizard. There is no limit on its size.
Template-fuer-Rollout-Assistent(*.html,*.htm): An HTML template for the wizard (optional).
This template controls the way that the sections appear in the HTML pages when the user's browser displays the wizard.
The template allows you to use your own CSS information to define the layout. If you do not load a custom HTML template
into the device, the wizard uses a predefined template. The template must not exceed a size of 64KB.
Logo-fuer-Rollout-Assistent(*.gif,*.png.*.jpeg): Your company logo (optional). The wizard
places this image file at the location of the <WIZARD_LOGO> marker in the template. If you do not load a logo into
the device, the wizard uses a predefined logo.
Go to 'WEBconfig/File management/Upload certificate or file' to upload these files.
92
Reference Manual
3 Configuration
Deleting wizard files from the device
To delete wizard files from the device, use the remove command. Certain parameters allow you to define which files
are to be deleted:
rollout <action> [file]
Available actions:
1
-r
1
-remove
Available files:
1
all: Deletes the wizard, the template and the logo
1
wizard: Deletes the wizard
1
template: Deletes the template
1
logo: Deletes the logo
The Rollout Wizard in the LCOS menu
The following parameters control the behavior of the Rollout Wizard.
Operating
Switches the Rollout Wizard on or off. After being switched on the Wizard appears as an option on the WEBconfig start
page.
Telnet path: /Setup/HTTP/Rollout-Wizard
Possible values:
1
On
1
Off
Default: Off
Title
The name for the Rollout Wizard as displayed on the start page of WEBconfig.
Telnet path: /Setup/HTTP/Rollout-Wizard
Possible values:
1
Max. 50 characters
Default: Rollout
Use extra checks
This option enables consistency tests that check some internal aspects of the wizard.
5
Executing these additional tests is very time consuming. Activate this option only during development of the
wizard and deactivate this option for normal operation.
Telnet path: /Setup/HTTP/Rollout-Wizard
Possible values:
1
On
1
Off
Default: Off
93
Reference Manual
3 Configuration
Starting the Rollout Wizard
To make the wizard available, upload the following files to the device:
Go to 'WEBconfig/File management/Upload certificate or file' to upload these files.
Example of a Rollout Wizard:
This section presents an example of a Rollout Wizard. The wizard is used for setting up an Internet connection.
In the first section, the wizard defines the text that the device provides for display on the various HTML pages.
stringtable "German"
string title_MyCompany, "MyCompany Rollout"
string txt_Welcome, "Welcome to the MyCompany Rollout Wizard"
string dev_serial_number, "Serial number"
string dev_type, "Device type"
;---Page: What type of connection string inet_Selection, "Internet connection type" string
inet_PPPoE, "PPPoE" string inet_IPoE, "IPoE" ;---Page: IPoE
string inet_ipoe, "Please enter the details for the connection."
string con_ipaddress, "IP address"
string con_subnet, "Net mask"
string con_gateway, "Gateway"
string con_dns, "DNS"
;---Page: PPPoE
string inet_pppoe, "Please enter your username and password."
con_username string, "username"
string con_password, "password"
--- Page: End
string end, "The configuration is now complete."
The wizard starts the first line of the next section with the name 'MyCompany Rollout'. The device displays the text string
str.title_MyCompany as the title of the HTML page.
The wizard then defines the sections, which correspond to the required HTML pages.
The 'Start' section first shows a static greeting text. Below that, the Wizard has two read-only fields that display the
device type and serial number. The wizard reads out these two values from the device using the field on_show when
it opens the page. The wizard offers the user a selection of options for the Internet connection, either 'PPPoE' or 'IPoE'.
Since no values are defined for the option fields, the wizard sets the variable select_inet according to the user's
selection, e.g. PPPoE to '0' and IPoE to '1'.
wizard "MyCompany Rollout", str.title_MyCompany
section ;---Start---
static_text str.txt_Welcome
readonly_text device_string
description str.dev_type
readonly_text device_serial_number
description str.dev_serial_number
selection_buttons select_inet
description str.inet_Selection
button_text str.inet_PPPoE, str.inet_IPoE
on_show
set wizard.device_string, device.DeviceString
set wizard.device_serial_number, device.SerialNumber
on_next
94
Reference Manual
3 Configuration
The wizard only displays the IPoE section if the variable select_inet is set to the value '1'.
On this page, the wizard asks the user to provide values for the IP address, netmask, gateway and DNS server. All fields
are required to run the wizard.
section ;---IPoE---
only_if wizard.select_inet, "1", equal
static_text str.inet_ipoe
entryfield_ipaddress inet_ipaddress
description str.con_ipaddress
never_empty 1
entryfield_ipaddress inet_subnet
description str.con_subnet
never_empty 1
entryfield_ipaddress inet_gateway
description str.con_gateway
never_empty 1
entryfield_ipaddress inet_dns
description str.con_dns
never_empty 1
The wizard only displays the PPPoE section if the variable select_inet is set to the value '0'.
95
Reference Manual
3 Configuration
On this page of the wizard prompts the user for the user name and password, each with a maximum length of 30
characters.
section ;---PPPoE---
only_if wizard.select_inet, "0", equal
static_text str.inet_pppoe
entryfield_text inet_username
description str.con_username
max_len 30
entryfield_text inet_password
description str.con_password
max_len 30
The last page of the wizard initially displays a summary in static text. Follow-up actions are carried out when the wizard
is finished:
1
If the user has selected IPoE, the wizard creates a corresponding remote site and an entry in the list of IP parameters.
1
If the user has selected PPPoE, the wizard creates a corresponding remote site and an entry in the PPP list.
1
Whichever option is selected, the Wizard creates a default route 'INTERNET in the router.
section ;---ende---
static_text str.ende
on_init ;---Befehle, die bei der Initialisierung des Wizards durchgeführt werden.---
on_apply ;---Befehle, die bei der Fertigstellung des Wizards durchgeführt werden.---
;---Wenn IPoE ausgewählt wurde, werden die entsprechenden Daten nun eingetragen.
;---Remote site
set config.1.2.2.19, "INTERNET", "9999", "", "", "IPOE", "0", "000000000000"
only_if wizard.select_inet, "1", equal
;---IP-Parameter
set config.1.2.2.20, "INTERNET", wizard.inet_ipaddress, wizard.inet_subnet, "0.0.0.0",
wizard.inet_gateway, wizard.inet_dns, "0.0.0.0", "0.0.0.0", "0.0.0.0"
only_if wizard.select_inet, "1", equal
;---If PPPoE was selected, the corresponding data is entered.
;---Remote site
set config.1.2.2.19, "INTERNET", "9999", "", "", "PPPOE", "0", "000000000000"
only_if wizard.select_inet, "0", equal
;---PPP list
set config.1.2.2.5, "INTERNET", "none", "60", wizard.inet_password, "5", "5", "10", "5",
96
Reference Manual
3 Configuration
"2", wizard.inet_username, "1"
only_if wizard.select_inet, "0", equal
;---Set the default route.
set config.1.2.8.2, "255.255.255.255", "0.0.0.0", "0", "INTERNET", "0", "on", "Yes", ""
Addition(s) to LCOS 8.60
Checking the system-time source in the customized Rollout Wizard
The field check_time contains the new attribute source to verify the source of the system time.
Fields and attributes
The wizard uses fields in order to display information to the user and to give the user the option to enter information.
Each field corresponds to an internal variable.
The wizard defines a field by specifying the appropriate key word, followed by an internal variable on the same line.
Additional lines that follow can optionally contain the attributes for the field.
An example of a field definition in the wizard:
selection_buttons select_inet
description str.inet_Selection
button_text str.inet_PPPoE, str.inet_IPoE
This field generates a group of radio buttons, only one of which can be activated by the user. The wizard places the text
defined in the string table str.inet_Selection as a description next to the field. For the radio buttons themselves,
the wizard displays the text under str.inet_PPPoE and str.inet_IPoE. After an option was selected by
the user, the wizard writes the selected value to the internal variable wizard.select_inet.
You can use the following fields in the wizard:
check_local_ip: This field checks if the wizard previously changed the device's IP address and redirects the user
to the corresponding HTML page. Possible attributes:
1
destination: Target for forwarding as a FQDN or IPv4 address.
1
timeout: Wait time before forwarding.
check_time: This field verifies if the device has valid time information. Possible attributes:
1
success_jump: Label of the page that the wizard opens if the check is successful.
1
fail_jump: Label of the page that the wizard opens if the check fails.
97
Reference Manual
3 Configuration
1
limit: Maximum number of checks before the wizard considers the test to have failed. Set the limit to the value
'0' to continue the checks without limit.
1
timeout: Wait time between two checks.
1
source: The system-time source to be checked. If system time is obtained from another source, the test is evaluated
as failed. Possible entries:
2
RAM
2
NTP
2
CAPWAP
2
RTC
2
ISDN
2
LANCONFIG
2
manual
entryfield_hex: This field is used for entering hexadecimal values, such as MAC addresses. Possible attributes:
1
description: Field description in the HTML display
1
max_len: Maximum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_ipaddress: This field is used to enter IPv4 addresses. Possible attributes:
1
description: Field description in the HTML display
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
never_zero: A value of '1' for this attribute denotes a field that may not contain the value '0'.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_numbers: This field is used to enter telephone numbers. Possible attributes:
1
description: Field description in the HTML display
1
max_len: Maximum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
entryfield_numeric: This field is used to enter numbers. Possible attributes:
1
description: Field description in the HTML display
1
range_min: Minimum value that the user can enter in this field
1
range_max: Maximum value that the user can enter in this field
1
signed_value: Allows you to specify a numerical value with a sign
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
add_to_charset: Adds extra characters to the default input character set.
1
default_value: Default value
1
unit: The unit of value shown after the input field in the wizard's HTML display.
entryfield_text: This field is used to enter text. The attribute hidden is for fields used to enter passwords.
Possible attributes:
1
description: Field description in the HTML display
1
hidden: Identifies a field used by the user to enter a password.
1
add_to_charset: Adds extra characters to the default input character set.
1
convert_to_upper: Converts user input into uppercase letters
98
Reference Manual
3 Configuration
1
max_len: Maximum number of characters that the user can enter into this field
1
min_len: Minimum number of characters that the user can enter into this field
1
never_empty: A value of '1' for this attribute denotes a field that the user must fill out.
1
unit: The unit of value shown after the input field in the wizard's HTML display.
entryfield_textwithlist: This field is used to enter text. The user also has the option of selecting from a
set of predefined values. Possible attributes:
1
description: Field description in the HTML display
1
default_value: Default value
1
max_len: Maximum number of characters that the user can enter into this field
1
item_value: List of predefined values that the user can select for this field
onoff_switch: This field creates a simple check box. Possible attributes:
1
description: Field description in the HTML display
1
value_list: List of the two values that the check box may take on
1
default_selection: Default value
page_switch: This field creates a link with which the user can switch to one of the wizard's several other HTML
pages. Possible attributes:
1
page_description: Comma-separated list of text strings or references to strings that describe the possible
link targets.
1
page_label: Comma-separated list or page labels of the possible link targets.
1
description: Field description in the HTML display
ping_barrier: This field stops the wizard from being executed until a ping to the target was answered successfully.
Possible attributes:
1
destination: Target address for the ping.
1
loopback: Loopback address used by the ping instead of the default reply address
1
success_jump: Label of the page that the wizard opens if the ping is successful.
1
fail_jump: Label of the page that the wizard opens if the ping fails.
1
limit: Maximum number of pings before the wizard considers the test to have failed. Set the limit to the value
'0' to continue sending pings without limit.
1
timeout: Wait time between two pings.
popup: This field opens the entered target address in a popup window. Possible attributes:
1
None
5
The target address can contain variables.
readonly_text: This field creates a read-only field. The wizard can use these fields to display text. The wizard can
use hidden attributes to define internal variables. Possible attributes:
1
description: Field description in the HTML display
1
unit: The unit of value shown after the input field in the wizard's HTML display
1
hidden: Identifies a hidden field.
selection_buttons: This field generates a group of radio buttons, only one of which can be activated by the
user. Possible attributes:
1
description: Field description in the HTML display
1
button_text: Comma-separated list of text strings or references to strings that describe the individual radio
buttons.
1
button_value: Comma-separated list of text strings with the values of the individual radio buttons.
99
Reference Manual
3 Configuration
selection_list: This field generates a drop-down selection list for the user to select a value. Possible attributes:
1
description: Field description in the HTML display
1
item_text: Comma-separated list of text strings or references to strings that describe the individual list entries.
1
item_value: Comma-separated list of text strings with the values of the individual list entries.
1
default_selection: Default value
static_text: This field creates static text on the HTML page following the field name as a reference to a text string.
Possible attributes:
1
None
3.11 LANCOM Layer 2 Management protocol (LL2M)
3.11.1 Introduction
As a pre-requisite for all methods of configuring a LANCOM, an IP connection must exist between the configuration
computer and the LANCOM. No matter whether LANconfig, WEBconfig or Telnet is used, no configuration commands
can be sent to the device without an IP connection. In the event of erroneous configuration of the TCP/IP settings or
VLAN parameters, this IP connection may be impossible to establish. The only option in this case is to access the device
via the serial configuration interface (not available on all devices) or to reset the device to its factory settings. However,
both options require physical access to the device—this may not always be the case for concealed installation of Access
Points and can represent considerable overhead for larger-scale installations.
The LANCOM Layer 2 Management Protocol (LL2M) is used to also enable configuration access to a device even without
an IP connection. All this protocol requires is a connection on layer 2 (i.e. via Ethernet directly or via layer-2 switches)
to establish a configuration session. LL2M connections are supported on LAN or WLAN connections, but not via WAN.
Connections via LL2M are password protected and are resistant to replay attacks.
LL2M establishes a client-server structure for this purpose: The LL2M client sends requests or commands to the LL2M
server that responds to the requests or runs the commands. The LL2M client is integrated into LCOS and is run from the
command line. The LL2M server is also integrated into LCOS and is usually only enabled for a brief period after device
power-on. In this time frame, an administrator can use the LL2M client to perform changes to the configuration of the
device running the LL2M server.
3.11.2 Configuration of the LL2M server
WEBconfig: LCOS Menu Tree/Setup/Config/LL2M
1
Operating
Enables/disables the LL2M server. An LL2M client can contact an enabled LL2M server for the duration of the time
limit following device boot/power-on.
Possible values:
2
Yes, No
Default:
2
Yes
1
Time limit
Defines the period in seconds during which an enabled LL2M server can be contacted by an LL2M client after device
boot/power-on. The LL2M server is disabled automatically after expiry of the time limit.
Possible values:
2
0 to 4294967295
100
Reference Manual
3 Configuration
Default:
2
0
Special values:
2
0 disables the time limit. The LL2M server stays permanently enabled in this state.
3.11.3 Commands for the LL2M client
For every LL2M command, an encrypted tunnel is set up that protects the log-in information transferred on transmission.
To use the integrated LL2M client, start a Telnet session on a LANCOM that has local access to the LL2M server via the
available physical medium (LAN, WLAN). The following commands can be used to contact the LL2M server in this console
session.
5
You must have root rights on the LL2M server to run commands on the LL2M client.
1
LL2Mdetect
The LL2M client uses this command to send a SYSINFO request to the LL2M server. The server then sends its system
information, such as hardware and serial number, back to the client for display. The LL2Mdetect command can be
restricted using the following parameters.
2
-a <MAC address>: Restricts the command to those devices with the specified MAC address only. The MAC
address is specified in format “00a057010203”, “00-a0-57-01-02-03” or “00:a0:57:01:02:03”.
5
If no MAC limitations are set, the detect is sent as a multicast (or optionally as a broadcast) to all
LL2M-compatible devices. To contact groups of MAC addresses, * and x can by used as placeholders in
individual MAC address positions, e.g. “00-a0-57-xx-xx-xx” for all LANCOM MAC addresses.
2
-t <device type>: Restricts the command to those devices of the corresponding hardware type only.
2
-r <hardware release>: Restricts the command to those devices with the corresponding hardware release only.
2
-f <version>: Restricts the command to those devices with the corresponding firmware version only.
2
-s <serial number>: Restricts the command to those devices with the corresponding serial number only.
2
-b : Sends the LL2Mdetect request as a broadcast and not as a multicast.
2
-v <VLAN ID>: Only sends the LL2Mdetect request on the VLAN specified. If no VLAN ID is specified, the VLAN
ID of the first defined IP network is used.
Example:
2
ll2mdetect -r A: This command sends a SYSINFO request to all devices with hardware release “A”.
The response from the LL2M server contains the following information:
2
Device name
2
Device type
2
Serial number
2
MAC address
2
Hardware release
2
Firmware version with date
1
LL2Mexec
The LL2M client uses this command to send a single-line command to run on the LL2M server. Several commands
can be combined in one LL2M command by using semicolons as separators. Depending on the command, either the
actions are run on the remote device and the responses from the remote device are sent to the LL2M client for display.
The LL2Mexec command conforms to the following syntax:
2
ll2mexec <user>[:<password>]@<MAC address>
The LL2Mexec command can be restricted using the following parameters.
101
Reference Manual
3 Configuration
2
-v <VLAN ID>: Only sends the LL2Mexec command on the VLAN specified. If no VLAN ID is specified, the VLAN
ID of the first defined IP network is used.
Example:
2
ll2mexec root@00a057010203 set name MyLANCOM: This command logs the LL2M client on to the LL2M server
with MAC address “00a057010203“ as user “root”. The user is prompted for the password in the console session.
The LL2M client then sets the name of the remote device to “MyLANCOM”.
3.12 Messaging
The action table contains the following variables for control over messaging when certain events occur in the LANCOM:
1
%a
WAN IP address of the WAN connection relating to the action.
1
%H
Host name of the WAN connection relating to the action.
1
%h
as %h, except the hostname is in small letters
1
%c
Connection name of the WAN connection relating to the action.
1
%n
Device name
1
%s
Device serial number
1
%m
Device MAC address (as in Sysinfo)
1
%t
Time and date in the format YYYY-MM-DD hh:mm:ss
3.12.1 Example: Broken connection alert as an SMS to a mobile telephone
The placeholder %t allows the current time of an event to be incorporated into a message. For example, an alert about
the interruption of an important VPN connection can be sent by e-mail or as an SMS to a system administrator's mobile
telephone.
The following requirements have to be met for messaging:
1
The status of the VPN connection must be monitored, for example by means of "dead-peer-detection" (DPD).
1
The LANCOM has to be configured as an NTP client in order to have the current system time.
1
An SMTP account must be set up for transmitting e-mails.
102
Reference Manual
3 Configuration
Once these requirements are fulfilled, messaging can be set up. This is done with a new entry in the action table; e. g.
with LANconfig under Communication / General / Action table.
Select the remote site for the relevant connection. As Condition select 'Broken' and enter the action as the transmission
of an e-mail.
mailto:admin@mycompany.com?subject=VPN connection broken at %t?body=VPN
connection to Subsidiary 1 was broken.
If the connection is broken, this action sends an e-mail to the administrator with the time of the event in the subject
line.
5
If the mail is sent to an appropriate Mail2SMS gateway the alert can be sent directly to a mobile telephone.
5
For complex scenarios with several subsidiaries, each of the remote sites is given a corresponding entry in the
central LANCOM. For monitoring the central device itself, an action is entered into a device at one of the
subsidiaries. In this way the administrator receives an alert even if the VPN gateway at the central location fails,
which could potentially prevent any messages from being transmitted.
3.12.2 Suppress messaging in case of re-connects with a DSL connection
Some providers interrupt the DSL connection used for the VPN connections once every 24 hours. To avoid informing the
administrator of these regular interruptions, messaging can be disabled at the time when the re-connect occurs.
First of all an action is required to force the re-connect to occur at a fixed time; generally at night when the Internet
connection is not in use. The entry defines, for example, 03:00h and the Internet connection is broken with the command
do other/manual/disconnect internet.
With two more cron commands set /setup/wan/action-table/1 yes/no the corresponding entry in
the action table is switched off three minutes before 03:00h and switched on again three minutes after 03:00h. The
number 1 following the path to the action table is an index that stands for the first entry in the table.
103
Reference Manual
3 Configuration
3.12.3 Addition(s) to LCOS 7.70
Sending attachments with the mailto command
E-mails with information on device status can be sent automatically if certain events occur. To do this, just include the
mailto command into entries in the action table or cron table.
Attachments can be sent with the e-mails. This allows the results of console commands executed on the device before
sending the mail to be sent as an attachment. In this way, the content of tables or menus (e.g. detailed status messages)
can be sent by e-mail.
1
Action (action table) or command (cron table) (max. 250 characters)
Here you describe the action that is be executed at a certain time or when a change in the status of the WAN
connection occurs. Only one action can be triggered per entry.
Possible values for the actions (max. 250 characters):
2
mailto: – This prefix causes an e-mail to be sent.
Optional variables for the actions:
2
attach=`console command`
Any console command can be entered which outputs useful information. The console command is enclosed in
"backquotes" also known as backticks. This character is produced with the aid of the "accent grave" key.
The output of the console command is written to a text file for attachment to the mail. This text file is headed by the
command and a time/date stamp, followed by the output.
Default:
2
Blank
Examples:
The following action enables you to sent the ADSL status by e-mail:
mailto:admin@mycompany.com?subject=ADSL_status?attach=`dir /status/adsl`.
An action can be used to send mutliple console commands:
mailto:admin@mycompany.com?subject=Status_reports?attach=`dir /status/adsl`?attach=`dir /status/config` The
attached files are named 'cmd1.txt', 'cmd2.txt', etc.
3.13 Managing rights for different administrators
New in LCOS 7.60:
1
Administrators without trace rights
Multiple administrators can be set up in the configuration of the LANCOM, each with different access rights. Up to 16
different administrators can be set up in a LANCOM.
5
Along with the administrators set up in the configuration, there is also the "root" administrator with the main
password for the device. This administrator always has full rights and cannot be deleted or renamed. To log in
as root administrator, enter the user name "root" in the login window or leave this field empty.
As soon as a password is set for the "root" administrator in the device's configuration, then WEBconfig will display the
button Login that starts the login window. After entering the correct user name and password, the main menu of the
WEBconfig will appear . This menu only displays the options that are available to the administrator who is currently
logged in.
104
Reference Manual
3 Configuration
If more than one administrator is set up in the admin table, the main menu features an additional button Change
administrator, which makes it possible to switch to a different user ID (with different rights, if applicable).
3.13.1 Rights for the administrators
Two different groups are differentiated regarding administrators' rights.
1
Each administrator belongs to a certain group that has globally defined rights assigned to it.
1
Each administrator also has "function rights" that determine personal access to certain functions such as the Setup
Wizards.
Administrator groups
RightsDescription under
LANconfig
Description under
Telnet/Terminal
Supervisor - member of all groupsAllSupervisor
Local administrator with read and write accessLimitedAdmin-RW
Local administrator with read and write access but without trace
rights
Limited without trace rightsAdmin-RW limit
Local administrator with read access but no write accessRead onlyAdmin-RO
Local administrator with read access but no write access and no
trace rights
Read only without trace rightsAdmin-RO limit
No access to the configurationNoneNone
1
Supervisor: Has full access to the configuration
1
Local administrator with read and write access: Also has full access to the configuration, although the following
options are prohibited:
2
Upload firmware onto the device
2
Upload configuration onto the device
2
Configuration with LANconfig
5
Local administrators with write access can also edit the admin table. However, a local administrator can only
change or create entries for users with the same or fewer rights than himself. It follows that a local
administrator cannot create a supervisor access and assign himself those rights.
1
Local administrator with read and write rights but without trace rights: Also has full access to the configuration,
although the following options are prohibited:
2
Upload firmware onto the device
2
Upload configuration onto the device
2
Configuration with LANconfig
2
Trace output via Telnet or LANmonitor
5
Local administrators with write access but without trace rights cannot create administrators with trace rights.
1
Local administrator with read access: Can read the configuration with Telnet or a terminal program, but cannot
change any values. The administrators can be assigned certain configuration options via their function rights.
1
None: Cannot read the configuration. The administrators can be assigned certain configuration options via their
function rights.
Function rights
Function rights can be used to grant the following options to users:
105
Reference Manual
3 Configuration
1
Basic Settings Wizard
1
Security Settings Wizard
1
Internet Connection Wizard
1
Selection of Internet Provider Wizard
1
RAS Account Wizard
1
LAN-LAN Connection Wizard
1
Change time and date
1
Search for further devices
1
WLAN link test
1
a/b Wizard
3.13.2 Administrators' access via TFTP and SNMP
The additional access possibilities for administrators are generally used for configuring the device with Telnet, terminal
programs or SSH access. However, the other administrators can also access the device via TFTP or SNMP.
Access with LANconfig
A user with supervisor rights can login to LANconfig by entering his user data into the Password field of the login window
in the combination <User name>:<Password>.
Access with TFTP
In TFTP, the user name and password are coded in the source (TFTP read request) or target file names (TFTP write request).
The file name is either made up of the master password and the command to be executed, or of the combined user name
and password separated by a colon, plus with the command as a suffix. A command sent by TFTP therefore resembles
the following:
1
<Master password><Command> or
1
<User name>:<Password>@<Command>
Examples (the LANCOM has the address mylancom.intern, the master password is 'RootPwd' and a user has been set
up named 'LocalAdmin' with the password 'Admin'):
1
Read the configuration from the device (supervisor only)
tftp mylancom.intern GET RootPwdreadconfig mylancom.lcf
1
Write the configuration to the device (supervisor only)
tftp mylancom.intern PUT mylancom.lcf RootPwdwriteconfig
1
Read out the device MIB (for the local administrator)
tftp mylancom.intern GET localadmin:Admin@readmib mylancom.mib
For the menus and available commands, the same limitations on rights apply as with Telnet.
Access with SNMP management systems
For the administration of networks with the help of SNMP tools such as HP OpenView, the various levels of administrator
access can be used for the precise control of rights.
Under SNMP, user name and password are coded in the "community". Here, the 'public' community can be selected or
one of either the master password or a combination of user name and password divided by a colon can be selected.
5
The community 'public' corresponds with the rights of a local administrator with read-only access, as long as
the SNMP read access without password is enabled. If this access is not allowed, then the 'public' community
will have access to no menus at all.
Otherwise, the same limitations on rights apply for the menus as with Telnet.
106
Reference Manual
3 Configuration
3.13.3 Configuration of user rights
When using LANconfig for the configuration, you will find the list of administrators in the configuration area 'Management'
on the 'Admin' tab under the button Further administrators.
Enter the following values:
1
Name for the new administrator with password.
1
Access rights
1
Function rights
5
You can temporarily deactivate the entries without having to delete them completely with the button 'Entry
active'.
Under WEBconfig, Telnet or a terminal program, you will find the admin table under the following paths:
WEBconfig: LCOS menu tree / Setup / Config-module / Admin.-table
The different user groups are represented by the following values:
RightsDescription
Supervisor - member of all groupsSupervisor
Local administrator with read and write accessAdmin-RW
Local administrator with read and write access but without trace rightsAdmin-RW limit
Local administrator with read access but no write accessAdmin-RO
Local administrator with read access but no write access, without trace rightsAdmin-RO limit
No access to the configurationNone
The different function rights are represented by the following hexadecimal values:
RightsValue
The user can run the Basic Settings Wizard0x00000001
The user can run the Security Wizard0x00000002
The user can run the Internet Wizard0x00000004
The user can run the Wizard for selecting Internet providers0x00000008
The user can run the RAS Wizard0x00000010
107
Reference Manual
3 Configuration
RightsValue
The user can run the LAN-LAN Coupling Wizard0x00000020
The user can set the date and time (also applies for Telnet and TFTP)0x00000040
The user can search for additional devices0x00000080
The user can run the WLAN Link test (also applies for Telnet)0x00000100
The user can run the a/b Wizard0x00000200
The user can run the WTP Assignment Wizard0x00000400
The user can run the Public Spot Wizard0x00000800
The user can run the WLAN Wizard0x00001000
The user can run the Rollout Wizard0x00002000
The user can run the Dynamic DNS Wizard0x00004000
The user can run the VoIP Call Manager Wizard0x00008000
The user can run the WLC Profile Wizard0x00010000
The entry results from the sum of the first, second and third columns from the right. If, for example, the user is to receive
rights to use the "Security Wizard", "Selection of Internet provider", "RAS Wizard", "Change time" and "WLAN Link
Test", then the resulting values are as follows:
1
First column from the right: 2 (Security Wizard) + 8 (Selection of Internet Provider) = "a" (hexadecimal)
1
Second column from the right: 1 (RAS Wizard) + 4 (Change Time) = "5" (hexadecimal)
1
Third column from the right: 1 (WLAN-Linktest) = "1" (hexadecimal)
For this example, enter the the function rights as "0000015a".
Put differently, this is an OR operator with the following hexadecimal values:
ValueDescription
0x00000002
Security Settings Wizard
0x00000008
Selecting the provider
0x00000010
RAS Account Wizard
0x00000040
Changing the time
0x00000100
WLAN link test
0x0000015a
OR operated
Examples:
The following command sets up a new user in the table who, as local administrator "Smith" with the password
"BW46zG29", can select the Internet provider. The user will be activated immediately:
set Smith BW46zG29 yes Admin-RW 00000008
The following command extends the function rights such that user "Smith" can also run the WLAN link test (the asterisks
stand for the values which are not to be changed):
set Smith * * * 00000108
3.13.4 Limitation of the configuration commands
The availability of commands when configuring the devices with Telnet or a terminal program depends on the user's
rights:
108
Reference Manual
3 Configuration
RemarkLocal administratorSupervisorCommand
4activateimage
4cfgreset
The 'linktest' command can also be executed if the
user possesses the function right to carry out a
WLAN link test
4linktest
4readconfig
4writeconfig
4writeflash
44setenv
44testmail
The 'time' command can also be executed if the
user possesses the function right to set the system
time
44time
44unsetenv
44delete/rm
44readmib
44WLA
44set
All other commands (such as 'cd', 'ls', 'trace', etc...) can be used by all users. The user must possess at least write access
to be able to operate commands that cause changes to the system (e.g. 'do' or 'time').
5
The commands listed above are not available in all LCOS versions nor LANCOM models.
3.13.5 TCP port tunnel
In some cases it can be useful to enable temporary remote access to a station within a LAN, e.g. via HTTP (TCP port 80)
or TELNET (TCP port 23). For example, if questions come up concerning network devices such as a LANCOM VP-100, the
Support department is best able to assist with direct access to the device in the customer's LAN. The standard method
for accessing LAN devices via inverse masquerading (port forwarding) sometimes requires a special configuration of the
firewall—changes are made which, if they are not deleted again afterwards, can represent a security risk.
As an alternative to permanent access which is based on port forwarding, a temporary remote-maintenance access can
be set up that automatically closes again after certain periods of inactivity. To this end, a support staff member requiring
access to a device in the customer's network, for example, creates a "TCP/HTTP" tunnel using TCP port 80 to provide
this access.
5
This access only applies to the IP address that was the source of the tunnel. Network access to devices released
in this way is not transferable!
Configuring the TCP/HTTP tunnel
The following parameters are available for configuring TCP/HTTP tunnel in LANCOM:
WEBconfig: LCOS menu tree / Setup / HTTP
1
Max. tunnel connections
The maximum number of simultaneously active TCP/HTTP tunnels
1
Tunnel idle timeout
109
Reference Manual
3 Configuration
Life-expectancy of an inactive tunnel. After expiry of this time period the tunnel closes automatically unless data
transfer is actively taking place.
Create the TCP/HTTP tunnel
1. HTTP tunnels are set up on the start page of WEBconfig. In WEBconfig log on to the LANCOM Wireless behind which
the device to be released is located. If necessary obtain the required login data from the responsible administrator.
2. In the area 'Extras', select the entry Create TCP/HTTP tunnel
1. Enter the name or IP address of the device that is to be temporarily available via HTTP.
1. Select a port for the HTTP tunnel and, if applicable, enter the routing tag of the IP network in which the device is
located and confirm your entries with Create.
2. The dialog that follows displays a confirmation of the newly created tunnel and provides a link to the device.
5
Apart from HTTP or HTTPS-based access, remote maintenance can also be based on any other TCP service such
as telnet connections (TCP port 23) or SSH (TCP port 22).
Deleting the tunnel prematurely
The newly created HTTP tunnel is deleted automatically if the tunnel remains inactive for the duration of the tunnel idle
timeout. To delete the tunnel earlier, click on LCOS menu tree / Status / TCP-IP / HTTP to access the list of active
tunnels and delete the one you no longer require.
5
Although active TCP connections in this tunnel are not terminated immediately, no new connections can be
established.
110
Reference Manual
3 Configuration
3.14 Named loopback addresses
A LANCOM Wireless can be set with up to 16 loopback addresses with which it can be addressed, for example for the
management of large network structures. To use the loopback addresses for certain networks (e.g. in the context of
Advanced Routing and Forwarding), these addresses can be assigned with routing tags. To simplify the identification in
other configuration units, the loopback addresses can be given freely definable names:
LANconfig: TCP/IP / General / Loopback addresses
WEBconfig: LCOS menu tree > Setup > TCP-IP > Loopback list
1
Name
A freely definable name for the loopback address.
1
Loopback address
Loopback address for the device.
1
Routing tag
Routing tag of the loopback address. Loopback addresses with the routing tag '0' (untagged) are visible to all
networks. Loopback addresses with a different routing tag are only visible to networks with the same routing tag.
3.14.1 Loopback addresses with ICMP polling
Similar to LCP monitoring, ICMP polling transmits regular requests to a remote site. Ping commands are transmitted and
the answers to them are monitored. Unlike LCP monitoring, the target site for ICMP pings can be freely defined. Pinging
a router in a remote network thus provides monitoring for the entire connection and not just the section to the Internet
provider.
A ping interval is defined for the remote site in the polling table. Further, for the event that replies are missed, the number
of retries before the transmission of a new LCP request is defined. Should the transmitter not receive any reply to the
retries, the target for the ping requests is classified as unavailable.
Up to four different IP addresses can be entered for each remote site that will be checked in the remote network in
parallel. Only if all of the IP addresses are unavailable is the connection considered to have failed.
5
With the ICMP polling, an entire connection can be monitored from end to end.
LANconfig: Communication / Remote Sites / Polling table
111
Reference Manual
3 Configuration
WEBconfig: LCOS menu tree / Setup / WAN / Polling table
1
Peer
Name of the remote station which is to be checked with this entry.
1
IP address 1 - 4
IP addresses for targeting with ICMP requests to check the remote site.
5
If no IP address is entered for a remote site that can be checked with a ping, then the IP address of the DNS
server that was determined during the PPP negotiation will be checked instead.
1
Ping interval
The time entered into the polling table defines the time interval between ping requests. If the value "0" is entered,
then the standard value of 30 seconds applies.
1
Retries
If no reply to a ping is received then the remote site will be checked in shorter intervals. The device then tries to reach
the remote site once a second. The number of retries defines how many times these attempts are repeated. If the
value "0" is entered, then the standard value of 5 retries applies.
1
Loopback address
Sender address sent with the ping; this is also the destination for the answering ping.
3.14.2 Loopback addresses for time servers
LANCOM Wirelesss can retrieve time information from public time servers in the Internet (NTP server). The LANCOM can
then be provided the time to all stations in the local network. When defining the time server, the name or IP address of
the NTP server being queried by the LANCOM Wireless can be entered as well as loopback addresses.
LANconfig: Date & time / Synchronization / Time server
WEBconfig: LCOS Menu Tree / LCOS menu tree / Setup / NTP / RQ address
1
Name
Name or IP address of the NTP server. The LANCOM Wireless attempts to reach the servers in the order that they are
entered.
1
Loopback address
Sender address sent with the NTP request; this is also the destination for the NTP answer.
112
Reference Manual
3 Configuration
3.14.3 Loopback addresses for SYSLOG clients
The SYSLOG module enables the logging of accesses to the LANCOM Wireless. SYSLOG clients are set up to be able to
receive the SYSLOG messages.
LANconfig: Log & Trace / SYSLOG / SYSLOG clients
WEBconfig: LCOS menu tree / Setup / SYSLOG / SYSLOG table
1
IP address
IP address of the SYSLOG client.
1
Loopback address
Sender address entered into the SYSLOG message. No answer is expected to a SYSLOG message.
1
Source
2
System: System messages (boot events, timer system, etc.)
2
Logins: Messages concerning the user's login or logout during the PPP negotiation, and any errors that occur
during this.
2
System time: Messages about changes to the system time
2
Console logins: Messages about console logins (Telnet, Outband, etc.), logouts and any errors that occurred
during this.
2
Connections: Messages about establishment and termination of connections and any errors that occurred (display
trace)
2
Accounting: Accounting information stored after termination of a connection (user, online time, transfer volumes)
2
Administration: Messages on changes to the configuration, remotely executed commands, etc.
2
Router: Regular statistics about the most frequently used services (breakdown per port number) and messages
about filtered packets, routing errors, etc.
1
Priority
2
Alert: This is a collection of messages of interest to the administrator (general SYSLOG priority: PANIC, ALERT,
CRIT).
2
Error: At this level all error messages which can occur under normal conditions are communicated; no special
attention is required by the administrator, e.g. connection errors (general SYSLOG priority: ERROR).
2
Warning: This level communicates messages which do not compromise normal operating conditions (general
SYSLOG priority: WARNING).
2
Information: At this level, all messages are sent that have a purely informational character (e.g. accounting)
(general SYSLOG priority: NOTICE, INFORM).
2
Debug: Communication of all debug messages. Debug messages generate large data volumes and can compromise
the device's operation. For this reason they should be disabled for normal operations and only used for
trouble-shooting (general SYSLOG priority: DEBUG).
113
Reference Manual
3 Configuration
3.15 Addition(s) to LCOS 8.00
3.15.1 Automatic upload of firmware or configuration from external data media
Introduction
LANCOM devices with a USB connector can be commissioned very easily with the aid of an external data medium.
Firmware files, loaders and even full configurations or scripts can be uploaded into the device from a USB medium.
Automatic upload of loader and/or firmware files
With this function activated and a USB medium mounted, the device searches for a loader and/or firmware files in the
directory "Firmware". All files in the directory with the file extension ".upx" will be considered for automatic loading if
they are for the correct device type. This is done by reading the file headers and processing the files according to the
following rules:
1
If at least one .upx file with a loader is found, then the loader with the highest version number is loaded, unless the
device already contains a loader with a higher version number.
1
If at least one firmware file is found, then the firmware with the highest version number is loaded into the device,
assuming that its version number is not equal to that of active or inactive firmware versions already in the device.
During the automatic load procedure, the device's power LED and online LED blink alternately. If a loader is uploaded
first, the device will restart after this and it will commence a second automatic upload if new firmware is found. During
this second load procedure, too, the device's power LED and online LED blink alternately.
The automatic uploading of loaders and/or firmware may, if applicable, be followed by further uploads of configuration
files and/or script files.
Once the automatic upload procedure is complete, all LEDs on the device light up in green for 30 seconds. The USB
medium can be removed.
Automatic upload of configuration and/or script files
With this function activated and a USB medium mounted, the device searches for configuration and/or skript files in the
directory "Config". All files in the directory with the file extension ".lcs" or ".lcf" will be considered for automatic loading
if they are for the correct device type. This is done by reading the file headers and processing the files according to the
following rules:
1
A full configuration ".lcf" is always loaded before a script ".lcs". Full configurations will only be loaded if the device
type matches the device doing the loading, and if the firmware version entered into the header is the same as the
active firmare in the device. If several suitable full configurations are found, then selection procedure follows these
criteria:
2
The configuration header contains a device serial number that matches that of the device doing the upload.
2
The configuration header contains a MAC address that matches that of the device doing the upload.
2
If multiple configuration files are left over after applying these selection criteria, then the configuration with the
most recent date is taken.
5
The header parameters for configuration files can be set manually in the file dialog of LANconfig when an
offline configuration is to be saved.
1
If there is no full configuration available, then a script file (".lcs") is used instead, if available. If several suitable
scripts are found, then selection procedure follows these criteria:
2
The script header contains a device serial number that matches that of the device doing the upload.
2
The script header contains a MAC address that matches that of the device doing the upload.
2
The script header contains a firmware version that matches that of the device doing the upload.
114
Reference Manual
3 Configuration
2
If multiple script files are left over after applying these selection criteria, then the script with the most recent date
is taken.
5
The header parameters for scripts can be set manually using a text editor in the corrsponding script file as
"SERIAL:" and/or "MAC:" and if applicable a firmware version.
During the automatic load procedure, the device's power LED and online LED blink alternately.
Once the automatic upload procedure is complete, all LEDs on the device light up in green for 30 seconds. The USB
medium can be removed.
Configuration
The configuration for automatic loading is to be found under the following menu:
1
LANconfig: Management / USB-Datenträger
1
WEBconfig: LCOS menu tree / Setup / Autoload
1
Firmware
This option activates the automatic loading of loader and/or firmware files from a connected USB medium.
Possible values:
2
Off
Automatic loading of loader and/or firmware files is deactivated.
2
On
Automatic loading of loader and/or firmware files is activated.
When a USB medium is mounted, a suitable loader and/or firmware file us uploaded to the device. The USB medium
is mounted when it is plugged into the USB connector on the device, or when it is restarted.
2
On unconfigured device
Automatic loading of loader and/or firmware files is only activated when the device has its factory settings. A
configuration reset can be used to return the device to its factory settings at any time.
Default:
2
On unconfigured device
5
This option is set to "inactive" in the Security Settings Wizard or the Basic Settings Wizard.
1
Configuration
This option activates the automatic loading of configuration and/or script files from a connected USB medium.
Possible values:
115
Reference Manual
3 Configuration
2
Off
Automatic loading of configuration and/or script files is deactivated.
2
On
Automatic loading of configuration and/or script files is activated.
When a USB medium is mounted, a suitable configuration and/or script file us uploaded to the device. The USB
medium is mounted when it is plugged into the USB connector on the device, or when it is restarted.
2
On unconfigured device
Automatic loading of configuration and/or script files is only activated when the device has its factory settings. A
configuration reset can be used to return the device to its factory settings at any time.
Default:
2
On unconfigured device
5
This option is set to "inactive" in the Security Settings Wizard or the Basic Settings Wizard.
5
If a user wants to avoid that an undesirable configuration is loaded to the device due to plugging an USB
medium an resetting the device to factory default, then the reset button has to be de-activated.
Meta data for configuration files
For the automatic loading from a USB data storage the configuration files can be marked with the serial number and/or
MAC address of a device. The devices will load only a configuration using the auto load function if the loading device’s
serial number or MAC address match the values from the configuration file.
LANconfig offers a feature to enter these information as meta data when saving a configuration file using the Meta
Parameter button:
3.15.2 Alternative boot config
Introduction
The way that a LANCOM device operates is determined by its configuration. The configuration is defined by the user and
stored to a special portion of the flash memory that remains intact even when the device is restarted (configuration
memory). When shipped, the configuration memory is empty because it does not yet have a user-defined configuration.
Once in operation, the configuration memory can be deleted again by carrying out a configuration reset. If a device with
116
Reference Manual
3 Configuration
an empty configuration memory is restarted or rebooted, the parameter values are taken from a boot configuration
containing default values for the respective model.
A configuration is only written to the configuration memory if at least one parameter has been changed. The full
configuration is written to the configuration memory. Even if only the device name is changed, current values for all of
the parameters available to the device are stored to the user-defined configuration. Values for unchanged parameters
are taken from a boot configuration.
LANCOM devices can make use of three different boot configurations:
1
LANCOM factory settings: These are the default values for the model as shipped, i.e. the LANCOM standard. The
standard boot configuration is contained in the device's firmware.
1
Customer-specific standard settings: These are the customer's own standard settings for the model in question. These
are used when the configuration memory is empty but the LANCOM default settings should not be used. This function
provides LANCOM devices with persistent settings (i.e. remaining available however many times the device is rebooted
or reset) that contain customer-specific standard settings for the boot procedure. Customer-specific standard settings
are not deleted by a configuration reset. Customer-specific standard settings are stored to the first boot memory
space.
1
Rollout configuration: This configuration is useful for large-scale rollout scenarios where multiple devices need a
boot configuration that differs from the LANCOM default configuration. The rollout configuration is activated by
pressing the reset key for a particular length of time. The specialized rollout configuration is stored to the second
boot memory space.
Using the boot configuration
When started normally, the LANCOM devices try to use the available configurations in a set order:
1
User-defined configuration (in the configuration memory)
1
Customer-specific standard settings (in the first boot memory space)
1
LANCOM factory settings (in firmware)
The customer-specific standard settings are taken automatically and in preference to the LANCOM factory settings,
assuming that the configuration memory is empty.
The rollout configuration is activated with the reset button. The reset button fulfills various functions depending upon
how long the button is pressed:
1
Less than 5 seconds: Boot (restart), whereby the user-defined configuration is loaded from the configuration memory.
If the user-defined configuration is empty, then the customer-specific standard settings (first memory space) are
loaded instead. The loading of the customer-specific standard settings is visible when all LEDs on the device light
up briefly in red. Similarly, the LANCOM factory settings are loaded if the first memory space is empty.
1
Longer than 5 seconds until the first time that all device LEDs light up: Configuration reset (deletes the configuration
memory) followed by a restart. In this case the customer-specific standard settings (first memory space) are loaded
instead. The loading of the customer-specific standard settings is visible when all LEDs on the device light up briefly
in red. The LANCOM factory settings are loaded if the first memory space is empty.
1
Longer than 15 seconds until the second time that all device LEDs light up: Activating the rollout configuration and
deleting the user-defined configuration After restarting, the rollout configuration is started from the second memory
space. The loading of the rollout configuration is visible when all LEDs on the device light up twice briefly in red. The
LANCOM factory settings are loaded if the second memory space is empty.
The rollout configuration is activated directly after restarting if the reset button is pressed for more than 15 seconds. The
next time the device is restarted, the normal boot sequence applies again automatically (user-defined configuration,
customer-specific standard settings, LANCOM factory settings).
5
If the reset button has been deactivated in the configuration (set to 'Ignore' or 'Boot only'), it is impossible to
load the rollout configuration.
The following diagram illustrates which configuration is loaded by the different reset procedures, depending on the
status of the device. Examples:
117
Reference Manual
3 Configuration
1
If the button is pressed for less than 5 seconds, the user-defined configuration is loaded. If this is not available, then
the customer-specific standard settings are loaded. If this is not available then the LANCOM factory settings are
loaded.
1
If the reset button is pressed for more than 15 seconds then the user-defined configuration is loaded. If this is not
available then the rollout configuration is loaded. if this is not available then the LANCOM factory settings are loaded.
X 1 X
X
1 X
X
1
X
X 1 X
X
1
X
X
1
2 X
X
1
2
X
X 1 2 X
Reset < 5 seconds
Reset > 5 seconds
Reset > 15 seconds
Reset via serial interface
X
User-defined configuration
Customer-specific standard settings
Rollout configuration
LANCOM factory settings
1
2
X
Restoring the LANCOM factory settings via the serial port
If both memory spaces are taken up with customer-specific standard settings and a rollout configuration, then the device
cannot be reset to the LANCOM factory settings by using the reset button. If it becomes impossible to access the
configuration (e.g. in case of a lost password), then the LANCOM factory settings can only by restored by means of the
serial interface.
The serial interface can be used to load firmware into the device. Entering the serial number instead of the configuration
password results in the device configuration being reset to its ex-factory settings. In this way you can regain access to
the device if it becomes impossible to restore the LANCOM factory settings in any other way.
1. Use the serial configuration cable to connect the device to a computer.
2. On the computer, start a terminal program such as Hyperterminal.
3. Open a connection with the settings 115200bps, 8n1, hardware handshake (RTS/CTS).
4. In the terminal program's welcome screen, press the Return key until the request to enter the password appears.
118
Reference Manual
3 Configuration
5. Enter the serial number that is displayed under the firmware version and press Return again.
1. The device now expects a firmware upload. You initiate this in Hyperterminal by clicking onTransfer/ Send file and
selecting X-Modem as the transfer protocol.
5
Uploading the firmware in this way completely deletes the configuration, including the boot configuration, and
returns the device to its ex-factory settings! This deletes all of the files stored on the device, including any rollout
certificates. For this reason you should only use this option if you have no other way of accessing the device.
The configuration and boot configuration are deleted even if the firmware upload is interrupted.
Storing and uploading the boot configurations
The customer-specific standard settings and the rollout configuration are saved in a compressed format. By means of
the command line function, the current device configuration can be saved as customer-specific standard settings or as
a rollout configuration. Use the following command for this:
1. bootconfig -savecurrent [1,2, all] or bootconfig -s [1,2, all]
Entering the appropriate number ensures that either the first boot memory space for the customer-specific standard
settings is selected, or the second boot memory space for the rollout configuration. The parameter "all" writes the current
configuration to both memory spaces at the same time.
WEBconfig can also be used to upload customer-specific settings or the rollout configuration into the device:
1
WEBconfig: LCOS menu tree / File management / Upload configuration
Here you select the configuration file to be used and you activate the purpose as either customer-specific standard
settings and/or rollout configuration.
119
Reference Manual
3 Configuration
5
If both memory spaces are taken up with customer-specific standard settings and a rollout configuration, then
the device cannot be reset to the LANCOM factory settings by using the reset button. In this case you should
use the function.
Deleting the boot configuration
The alternative and the special boot configurations cannot be deleted with the normal file functions. Use the following
command for this:
1. bootconfig -remove [1,2, all] or bootconfig -r [1,2, all]
Selecting the appropriate number ensures that the corresponding boot memory space is selected. The parameter "all"
causes both memory spaces to be deleted at once.
Working with certificates
In order for VPN and SSL/TLS to function after a configuration reset, a standard certificate can be stored to the device
as a PKCS#12 container. This standard certificate is only used by the customer-specific standard settings and the rollout
configuration.
1
If the customer-specific standard settings are loaded, the standard certificate is copied to the normal certificate
storage location for VPN and SSL/TLS. This ensures that it remains available even after rebooting.
1
If the rollout configuration is loaded, the standard certificate for VPN is used, but it is not copied. This means that
in case of a restart (even without a configuration reset) the device has no access to the certificate.
You can upload the standard certificate into the device with WEBconfig.
1
WEBconfig: LCOS menu tree / File management / Upload certificate or file
Select the certificate and commence the upload with Start upload.
3.16 Addition(s) to LCOS 8.20
3.16.1 Automatic uploading of firmware, configuration and scripts
Introduction
Firmware, configuration or script files can be uploaded to a device in a number of ways. The management of large
installations is facilitated by options for automatically uploading these files from a network or from an external storage
drive when the device is started.
120
Reference Manual
3 Configuration
2.60 Autoload
This menu is used to set up the automatic uploading of firmware, configurations or scripts from external data media or
from a URL.
Telnet path: /Setup/Autoload
2.60.1 Network
This menu is used to configure the automatic uploading of firmware, configurations or scripts over the network.
The settings made in this area are used when the commands LoadFirmware, LoadConfig or LoadScript are invoked from
the command line. These commands upload firmware, configurations or scripts to the device using the TFTP or HTTP(S)
client.
Telnet path: /Setup/Autoload/Network
5
Loading firmware, configurations or scripts using the TFTP or HTTP(S) client can only succeed if the URL required
to load the relevant file is fully configured and the URL is accessible when the command is executed. Alternatively,
the URL can be entered as a parameter when the command is executed.
5
The values for Condition, URL and Minimum-Version set under /Setup/Autoload/Network constitute default values.
These values are only used in cases where no other appropriate parameters are entered when the commands
LoadFirmware, LoadConfig or Load Script are invoked on the command line.
Parameters for the commands LoadFirmware, LoadConfig and LoadScript
The commands LoadFirmware, LoadConfig and LoadScript instruct the device to upload firmware or a configuration or
to run a script. These commands are initiated from the command line. The parameters are used to control the behavior
of the commands.
The parameters can be used in any combination. The only requirement is for a URL to be specified.
Values for condition, URL, or minimum version entered at the command line overwrite the values set under
/Setup/Autoload/Network. Conversely, the values defined in the setup act to supplement the command-line commands
if no parameters are entered manually.
The following parameters are of particular importance for automatic uploading:
1
-Cn: This parameter checks if the firmware referenced by the command is newer than the firmware on the device.
1
-Cd: This parameter checks if the firmware, configuration or script file referenced by the command is different to
the firmware or configuration on the device, or newer than the last executed script. When the LoadScript command
is used, this parameter updates the checksum stored in the device for the most recently executed script.
1
-u: This parameter disables the version checking. The firmware, configuration or script file referenced by the command
is uploaded and executed unconditionally. When the LoadScript command is used, this parameter does not change
the checksum stored in the device for the most recently executed script.
1
<URL>: This parameter specifies the storage location of the firmware, configuration or script file referenced by the
command. The URL can take the form "tftp://foo", "http://foo" or "https://foo".
1
-m: This value defines the minimum version of the firmware. The firmware referenced by the command must be at
least of this version in order for the command LoadFirmware to execute.
The default setting for the conditions under /Setup/Autoload/Network are "Unconditionally". In the default
setting, no version checking is carried out when the commands LoadFirmware and LoadConfig upload firmware,
or when LoadScript executes a script file.
The parameter -u always has priority over other parameters entered in a command.
2.60.1.1 Firmware
This menu is used to configure the automatic uploading of firmware over the network.
121
Reference Manual
3 Configuration
Telnet path: /Setup/Autoload/Network/Firmware
2.60.1.1.1 Condition
This is where you select the condition under which the firmware specified under /Setup/Autoload/Network/Firmware/URL
will be uploaded when the command LoadFirmware is executed.
Telnet path: /Setup/Autoload/Network/Firmware
Possible values:
1
Unconditionally: The firmware will always be uploaded to and executed from the memory location of the inactive
firmware. This setting deactivates version checking and the firmware specified will be uploaded in every case.
1
If different: The firmware is uploaded to and executed from the memory location for the inactive firmware if it is of
a different version to the firmware active in the device and the inactive firmware. If the specified firmware is of the
same version as one of the two existing firmware versions, then the firmware will not be uploaded. The LoadFirmware
command compares the firmware version (e.g. "8.10"), the release code (e.g. "RU1") and the file date.
1
If newer: The firmware is uploaded and executed only if it is newer than the firmware currently active in the device.
The firmware is only uploaded to the memory location for the inactive firmware if it is newer than the active and
inactive firmware versions on the device. If the specified firmware is older than one of the two existing firmware
versions, then it will not be uploaded.
Default: Unconditionally
5
If the command LoadFirmware is executed twice in succession with the setting "unconditionally", both memory
locations will contain the same firmware version.
2.60.1.1.2 Minimum version
Specify the minimum version of the firmware to be loaded over the network.
Telnet path: /Setup/Autoload/Network/Minimum-Version
Possible values:
1
Max. 14 characters
Default: Blank
5
Firmware versions with a lower version number will be ignored.
2.60.1.1.3 URL
Specify the URL of the firmware that is to be uploaded over the network using the LoadFirmware command.
Telnet path: /Setup/Autoload/Firmware/URL
Possible values:
1
Max. 127 characters beginning with "tftp://", "http://" or "https://"
Default: Blank
5
The TFTP or HTTP(S) client loads the file entered here only if the LoadFirmware command is entered without a
URL as a parameter. A specific file at a known location can be loaded by entering its URL as a parameter.
2.60.1.2 Configuration
This menu is used to configure the automatic uploading of a configuration over the network.
Telnet path: /Setup/Autoload/Network/Configuration
122
Reference Manual
3 Configuration
2.60.1.2.1 Condition
This is where you select the condition under which the configuration specified under
/Setup/Autoload/Network/Configuration/URL will be uploaded when the device is started.
Telnet path: /Setup/Autoload/Network/Configuration
Possible values:
1
Unconditionally: The configuration will always be uploaded.
1
If different: The configuration will only be uploaded if it has a different version number than the configuration that
is currently active in the device.
Default: Unconditionally
2.60.1.2.3 URL
Specify the URL of the configuration that is to be uploaded over the network using the LoadConfig command.
Telnet path: /Setup/Autoload/Configuration/URL
Possible values:
1
Max. 127 characters beginning with "tftp://", "http://" or "https://"
Default: Blank
5
The TFTP or HTTP(S) client loads the file entered here only if the LoadConfig command is entered without additional
parameters. Defining appropriate parameters when the command is invoked allows a specific file to be loaded.
2.60.1.3 Script
This menu is used to configure the automatic uploading of a script over the network.
Telnet path: /Setup/Autoload/Network/Script
2.60.1.3.1 Condition
This is where you select the condition under which the script specified under /Setup/Autoload/Network/Configuration/URL
will be uploaded when the command LoadScript is executed.
Telnet path: /Setup/Autoload/Network/Script
Possible values:
1
Unconditionally: The script will always be executed. This setting deactivates the checksum comparison and the
specified script will always be uploaded unconditionally.In this case, the LoadScript command does not change the
checksum for the most recently executed scripts as stored in the device.
1
If different: The script will only be executed if it differs from the last executed script. The difference to the last executed
script is determined using a checksum. For this the complete script is always uploaded. The LoadScript command
then compares the checksum of the uploaded script with the checksum of the last executed script stored in the device.
When the script is executed, the LoadScript command updates the checksum stored in the device.
Default: Unconditionally
2.60.1.3.3 URL
Specify the URL of the script that is to be uploaded over the network using the LoadFirmware command.
Telnet path: /Setup/Autoload/Script/URL
Possible values:
1
Max. 127 characters beginning with "tftp://", "http://" or "https://"
Default: Blank
123
Reference Manual
3 Configuration
5
The TFTP or HTTP(S) client loads the file entered here only if the LoadScript command is entered without additional
parameters. Defining appropriate parameters when the command is invoked allows a specific file to be loaded.
2.60.1.4 TFTP client
This menu contains the configuration for the TFTP client.
Telnet path: /Setup/Autoload/Network/TFTP-Client
2.60.1.4.1 Bytes per hashmark
This setting determines the number of bytes successfully loaded by the TFTP client after which a hash sign (#) is output
on the command line when running LoadFirmware, LoadConfig or LoadScript. The TFTP client uses theses hash marks
to produce a progress bar when uploading firmware, configurations or scripts.
Telnet path: /Setup/Autoload/Network/TFTP-Client
Possible values:
1
4 characters
Default: 8192
5
This value is used only when loading with TFTP, not HTTP or HTTPS. With HTTP or HTTPS a hash mark is displayed
at least every 100ms to display progress.
2.60.56 USB
This menu is used to configure the automatic uploading of firmware or configurations from external data media.
Telnet path: /Setup/Autoload/USB
2.60.56.1 Firmware and loader
This option activates the automatic loading of loader and/or firmware files from a connected USB medium. Save the
required loader and/or firmware files in the "Firmware" directory located in the root directory of the connected USB
media.
Telnet path: /Setup/Autoload/USB
Possible values:
1
Inactive: Automatic loading of loader and/or firmware files is deactivated.
1
Active: Automatic loading of loader and/or firmware files is activated. When a USB medium is mounted, a suitable
loader and/or firmware file us uploaded to the device. The USB medium is mounted when it is plugged into the USB
connector on the device, or when it is restarted.
1
If-unconfigured Automatic loading of loader and/or firmware files is only activated when the device has its factory
settings. A configuration reset can be used to return the device to its factory settings at any time.
Default:
1
If-unconfigured
5
This option is set to "inactive" in the Security Settings Wizard or the Basic Settings Wizard.
2.60.56.2 Configuration and script
This option activates the automatic loading of configuration and/or script files from a connected USB medium. Save the
required configuration and/or script files in the "Config" directory located in the root directory of the connected USB
media.
124
Reference Manual
3 Configuration
Telnet path: /Setup/Autoload/USB
Possible values:
1
Inactive: Automatic loading of configuration and/or script files is deactivated.
1
Active: Automatic loading of configuration and/or script files is activated. When a USB medium is mounted, a suitable
configuration and/or script file us uploaded to the device. The USB medium is mounted when it is plugged into the
USB connector on the device, or when it is restarted.
1
If-unconfigured Automatic loading of configuration and/or script files is only activated when the device has its factory
settings. A configuration reset can be used to return the device to its factory settings at any time.
Default:
1
If-unconfigured
5
This option is set to "inactive" in the Security Settings Wizard or the Basic Settings Wizard.
5
A device can be fed with an undesirable configuration by resetting it to its factory settings and inserting a
prepared USB data media. To prevent this you have to deactivated the reset switch.
3.17 Addition(s) to LCOS 8.50
3.17.1 The commands LoadFirmware, LoadConfig, LoadScript and LoadFile
Various applications, such as loading configurations, firmware versions, scripts, and verifying server identity with
certificates, require files to be stored to a device. You can to upload these files to a device with LANconfig or WEBconfig.
Alternatively, you can use Telnet or SSH to issue a command from the command line to download the files directly from
a server (TFTP, HTTP or HTTPS) and into the device. This process simplifies device administration in larger installations
that rely on regular updates to the firmware and/or configurations.
The following commands are used to upload different file types to the device:
1
LoadConfig: Uploads a configuration file (with file extension *.lcf) into the device.
1
LoadFirmware: Uploads a firmware file (with file extension *.upx) into the device.
1
LoadScript: Uploads a script (file extension *.lcs) to the device, e.g. for partial configurations.
1
LoadFile: Uploads various types of file to the device.
The following descriptions use 'LoadCommand' to describe the upload commands in general.
The upload commands can use the protocols TFTP, HTTP and HTTPS to upload the selected file. A TFTP server is identical
to an FTP server in terms of functionality, but uses a different protocol for data transmission. When using an HTTPS
server, a certificate used to check the identity of the server can be stored on the device.
5
The LoadFile command in LCOS version 8.50 supports the protocols HTTP and HTTPS only.
The load commands are invoked from the command line interface with the following syntax:
LoadCommand <parameters>
The parameters are used to control the behavior of the commands. The parameters can be used in any combination. The
only requirement is for a URL to be specified.
Values for condition, URL, or minimum version entered at the command line overwrite (once only) the values set under
/Setup/Autoload/Network. Conversely, the values defined in the setup act to supplement the command-line commands
if no parameters are entered manually.
General parameters for the load commands:
125
Reference Manual
3 Configuration
1
-a: This parameter defines the sender address that the device sends to the server when downloading a file. Enter the
sender address in one of the following forms:
2
Any valid IP address
2
INT for the address of the first intranet
2
DMZ for the address of the first DMZ
2
LB0 to LBF for the 16 loopback addresses
5
If the list of IP networks or loopback addresses contains an entry named 'DMZ' then the associated IP
address will be used.
1
<URL>: This parameter specifies the the URL for downloading a file from a TFTP or HTTP(S) server. Enter the URL in
the following form:
LoadCommand protocol://Server/Directory/Filename.ext
For password-protected file access, enter the data in the following form:
LoadCommand protocol://username:password@Server/Directory/Filename.ext
1
-s: When downloading a file from a TFTP server, this parameter specifies its DNS name or IP address. Use this syntax
as an alternative to specifying a URL.
1
-f: When downloading a file from a TFTP server, this parameter specifies the name of the required file. Use this syntax
as an alternative to specifying a URL.
If the parameters <URL> or -s and -f are not specified, the device executes the commands LoadFirmware, LoadConfig
or LoadScript with the default values for the URL as defined under /Setup/Autoload/:
Use these default values if the latest configurations, scripts and firmware versions are always stored under the same
name in the same location. If this is the case, the commands LoadConfig, LoadFirmware and LoadScript can be used
very easily to load the relevant files automatically.
The following parameters are of particular importance for automatic uploading:
-Cn: This parameter checks if the file referenced by the LoadFirmware command is newer than the firmware on the
device.
1
-Cd: This parameter checks if the file referenced by the LoadFirmware, LoadConfig or LoadScript command is different
to the firmware or configuration on the device, or newer than the last executed script. When the LoadScript command
is used, this parameter updates the checksum stored in the device for the most recently executed script.
1
-u: This parameter disables the version checking. The file referenced by the LoadFirmware, LoadConfig or LoadScript
command is uploaded and executed unconditionally. When the LoadScript command is used, this parameter does
not change the checksum stored in the device for the most recently executed script.
1
-m: This value defines the minimum version of the firmware. The firmware referenced by the command must be at
least of this version in order for the command LoadFirmware to execute.
5
The default setting for the conditions under /Setup/Autoload/Network are "Unconditionally". In the default
setting, no version checking is carried out when the commands LoadFirmware and LoadConfig upload firmware,
or when LoadScript executes a script file.
5
The parameter -u always has priority over other parameters entered in a command.
When transferring files from an HTTPS server to a client device, the network components check the identity of the remote
site by using certificates. For the automatic loading from HTTPS servers, additional parameters are available for
downloading and subsequently checking the certificates:
1
-o <Path/Filename.ext>: This parameter specifies the destination when downloading a file from an HTTP(S) server
with the LoadFile command. For example, you can use this option to save a certificate on your device for future
identity verification when accessing an HTTPS server.
1
-c <Path/Filename.ext>: This parameter specifies the name of the certificate used by the device to check the identity
of an HTTPS server when downloading a file.
126
Reference Manual
3 Configuration
1
-p <Path/Filename.ext>: When downloading a file from an HTTPS server, this parameter specifies the name of the
PKCS#12 container. The PKCS#12 container can contain multiple CA certificates, and thus supports the identity
checking of HTTPS servers with certificate chains. A PKCS#12 container can additionally contain a device certificate
and the corresponding private key, so that it can confirm the identity of the device to the HTTPS server if this server
requires authentication by certificate.
1
-d: The device uses this passphrase to encrypt an unencrypted PKCS#12 container.
1
-n: This parameter disables the server-name check when downloading a file from an HTTPS server using the LoadFile
command. If you use the download URL to specify the server as a DNS name (and not as an IP address), then the
device additionally communicates the server name when sending its request to the server. If the HTTPS server is a
virtual server, then this server can respond with the appropriate certificates for the reported DNS name. Without this
parameter, the device checks whether the DNS name in the download URL agrees with the common name of the
submitted certificates. The unit will start the download only if this check is successful.
Use one of the two following notations to specify a file in the file system of the device:
1
Specify a location in the device's internal file system with the path '/minifs/filename.ext'.
1
Specify a location on an external USB data medium with the path '/mountpoint/directory/filename.ext'. The available
mount points are listed under '/status/file-system/volumes'.
In file names that include the path, you can use the following general variables:
1
%m: The LAN MAC address of the device (hexadecimal, lowercase letters, no separators)
1
%s: The device serial number.
1
%n: The device name
1
%l: The location of the device ('location' – from the configuration)
1
%d: The device type
5
You can use these variables in the load commands, but you cannot change the values for the variables.
In addition to these general variables, you can also use the following environment variables that relate to the device for
more flexibility when executing the load commands. All predefined environment variables begin with two underscores:
When entering commands on the command line, the variables are preceded by a dollar sign.
1
__BLDDEVICE: The sub-project of the device. This environment variable stands for the second part of the value
for PROJECT if you execute the command #sysinfo# from the command line. The sub-project generally
consists of a string without spaces and it stands for the hardware model of the current device.
1
__DEVICE: The type of the device, for example as displayed in LANconfig or on the device type label.
1
__FWBUILD: The build number of the firmware currently used in the device. The build number is a number
1
__FWVERSION: The version number of the firmware currently used in the device, in the form 'x.yy'. The firmware
version consists of the major release before the dot and the minor release after it.
1
__LDRBUILD: The build number of the firmware currently operating in the device. The build number is a four-digit
number.
1
When requested for the loader build number, older loaders return an empty string.
5
1
__LDRVERSION: The version number of the loader currently installed in the device, in the form 'x.yy'. The loader
version consists of the major release before the dot and the minor release after it.
1
__MACADDRESS: The type of the device, given as a 12-digit string of hexadecimal values with lowercase letters
and no separators.
1
__SERIALNO: The device serial number.
1
__SYSNAME: The system name of the device.
5
If you have already used a name from the environment variables as a user-defined variable in a section of the
configuration, then both the configuration and the commands on the command line work primarily with the
values of the user-defined variables.
127
Reference Manual
3 Configuration
Use the following commands in the CLI to display or modify the environment variables:
1
printenv: Displays all environment variables and their current values. If you have set one or more environment
variables with the command setenv, the output of the command printenv shows the user-defined value at
the top and the default value below it.
1
echo __device: Displays the current values of a single environment variable, in this example the value for the
variable '__DEVICE'.
1
setenv __device MeinWert: Sets the value of an environment variable to the desired value.
1
unsetenv __device: Sets the value of an environment variable to the default value.
Examples of load commands:
1
With the following Telnet command, the device loads a firmware file named 'LC-1811-5.00.0019.upx' into the device
from directory 'LCOS/850' on the TFTP server with IP address '192.168.2.200':
LoadFirmware -s 192.168.2.200 -f LCOS/850/LC-1811-8.50.0019.upx
1
With the following Telnet command, the device loads a script intended for a certain MAC-address (named, for
example, '00a0571735da.lcs') from the TFTP server with IP address '192.168.2.200':
LoadScript -s 192.168.2.200 -f %m.lcs
1
With the following Telnet command, the device loads a firmware file named 'LC-1811-5.00.0019.upx' into the device
from directory 'download' on the HTTP server 'www.myserver.com'. At the same time the identity of the server is
checked with the certificate 'sslroot.crt':
LoadFirmware -c sslroot.crt https://www.myserver.com/download/LC-1811-8.50.0019.upx
1
With the following Telnet command, the device loads a script intended for the specified serial number and the current
firmware. The device reads the values for serial number and firmware from the corresponding environment variables:
Loadscript $__SERIALNO-$__FWVERSION.lcs
Example applications
Regularly updating configuration and firmware
This scenario describes how to regularly update the configuration and the firmware of a device every 24 hours.
Requirements:
1
The device is currently equipped with firmware version '8.30' and a corresponding configuration.
1
The HTTP server contains the new firmware version in the form of a file 'LCOS.upx' and the corresponding configuration
in the form of a file 'LCOS.lcs'.
Configuration:
1. Specify the path that the 'LoadFirmware' command uses to source the upload if no other parameters are available.
For example, enter the following command to load the firmware from an HTTP server:
set /setup/Setup/Autoload/Network/Firmware/URL http://www.mycompany.de/firmware/LCOS.upx
2. Set the conditions for loading the firmware such that only firmware that is newer than that in the device is loaded:
set /Setup/Autoload/Network/Firmware/Condition if-newer
3. Specify the path that the 'LoadConfig' command uses to source the upload if no other parameters are available. For
example, enter the following command to load the configuration from an HTTP server:
set /setup/Setup/Autoload/Network/Firmware/URL
http://www.mycompany.de/configuration/LCOS.lcf
4. Set the conditions for loading the configuration such that only a configuration that is different from that in the device
is loaded:
set /Setup/Autoload/Network/Config/Condition if-different
128
Reference Manual
3 Configuration
5. Create a cron job that regularly runs the command 'LoadFirmware' at 23:55h:
cd /Setup/Config/Cron-Table
set 1 * * * 55 23 * * * LoadFirmware
6. Create a cron job that regularly runs the command 'LoadConfig' at 23:59h:
set 2 * * * 59 23 * * * LoadConfig
Update configuration after first updating firmware
This scenario describes a potential situation within a project whereby a firmware update is to be carried out followed
by an update of the configuration by script.
Requirements:
1
The device is currently equipped with firmware version '8.30' and a corresponding configuration.
1
The HTTP server contains the new firmware version in the form of a file 'LCOS-850.upx' and the corresponding
configuration in the form of a file '<Serial number>-850.lcs'.
5
In this scenario, the configuration script is only to be applied once the device has been equipped with the
appropriate firmware.
Configuration:
1. Specify the path that the 'LoadFirmware' command uses to source the upload if no other parameters are available.
For example, enter the following command to load the firmware from an HTTP server:
set /setup/Setup/Autoload/Network/Firmware/URL http://www.mycompany.de/firmware
2. Set the conditions for loading the firmware such that only firmware that is newer than that in the device is loaded:
set /Setup/Autoload/Network/Firmware/Condition if-newer
3. Specify the path that the 'LoadConfig' command uses to source the upload if no other parameters are available. For
example, enter the following command to load the configuration from an HTTP server:
set /setup/Setup/Autoload/Network/Firmware/URL http://www.mycompany.de/configuration
4. Set the conditions for loading the configuration such that only a configuration that is different from that in the device
is loaded:
set /Setup/Autoload/Network/Config/Condition if-different
5. Create a cron job that regularly runs the command 'LoadFIRMWARE' every 10 minutes:
cd /Setup/Config/Cron-Table
set 1 * * * 10 * * * * LoadFirmware
6. Create a cron job that regularly runs the command 'LoadScript' every 10 minutes:
set 2 * * * 10 * * * * LoadScript\ $__SERIALNO-$__FWVERSION.lcs
The result:
With this configuration, the device always initially loads the latest firmware.
If the device executes the command 'LoadScript' after initially uploading the firmware and configuration script from the
HTTP server, then the environment variable '__FWVERSION' is set with the value '8 .30 ' at this time. The command
LoadScript\ $__SERIALNO-$__FWVERSION.lcs does not find a suitable configuration script at this
time. The device then executes the command LoadFirmware LCOS.upx and after rebooting, the environment
variable '__FWVERSION' is set to the value '8.50 '. The command LoadScript\
$__SERIALNO-$__FWVERSION.lcs then finds a suitable script to update the configuration.
129
Reference Manual
3 Configuration
5
In the cron command Loadscript\ $__SERIALNO-$__FWVERSION.lcs, the space between
the load script command and the environment variables is protected with a backslash. Trying to use the alternative
notation of enclosing the entire command in quotation marks will result in an error. LCOS treats environment
variables in quotation marks as normal text, so the any variables would be ignored.
3.17.2 Enhanced Sysinfo
To determine whether changes have been made to the configuration, and to find the time/date when a change was
made, Sysinfo contains additional entries in the field CONFIG_STATUS.
The devices store the value CONFIG_STATUS each time a change is made to the configuration (via the command line,
via SNMP or by loading a script or complete configurations).The value CONFIG_STATUS consists of the following
components:
1
Hash value of the device configuration as a unique identifier of configuration status.
1
Timestamp of the last change to the configuration in the format HHMMSSddmmyyyy based on Coordinated Universal
Time UTC. The reference to UTC guarantees unique values without being influenced by time zone or daylight-saving
settings.
1
Counter of configuration changes, sequential.
The field CONFIG_STATUS contains, along with a value for the configuration status switches and a value for the
configuration flash status, the additional components in the form <Hash>.<Date>.<Counter>.
Changes to the configuration can be implemented in the appropriate files or scripts (e.g. with LCMS) or on the devices
directly (by command line or WEBconfig). The content of CONFIG_STATUS is influenced by the method by which
configuration changes are made.
The device configuration hash value
Hash values are calculated solely by LCOS, the operating system used by the devices. The hash value differs for every
state of configuration, and a modified hash value indicates that a device configuration has been changed.
5
LCOS stores the calculated hash value to the device during the flash process.
Timestamp of the last configuration change
Both LCOS and LCMS can set the timestamp, assuming that they have a valid time.
5
If the chosen method of configuration does not have a valid time, the device sets the timestamp to the value
'00: 00:00 0000-00-00'.
Configuration changes counter
When the devices are shipped, the counter of configuration changes is set to '0'. Every configuration change after this
increases the value by 1. The configuration-changes counter allows changes to the current version of the configuration
to be determined, even if no valid time of configuration was available and the timestamp is therefore set to '00: 00:00
0000-00-00'.
5
A configuration counter that shows '0' after changes have been made to the configuration indicates an error
while reading or writing the counter during flashing.
Displaying CONFIG_STATUS
130
Reference Manual
3 Configuration
To display the value for CONFIG_STATUS, enter the command sysinfo on the command line for the device.
Displaying system information on the command line
3.18 Addition(s) to LCOS 8.60
3.18.1 Configurable action for alive test
Until now, the alive test only allowed for a cold or warm start in the event of failure. In some cases it may be preferable
to execute an action, e.g. to reset a WLAN module. This type of action can significantly reduce the interruption time
compared to a cold or warm start.
Additions to the menu system
Alive test
This menu contains the settings for the alive test. The alive test sends a ping to a destination address at configurable
intervals. If there is no response from the destination, the device performs a reboot or other action according to defined
criteria.
To configure the alive test you have to define the target address, the action to be performed, the combination of pings
and retries, and the threshold for triggering the defined action. The parameters required for this have the following
default values:
1
Fail limit: 10
1
Test interval: 10
1
Retry interval: 1
1
Retry count: 1
These settings cause the device to transmit a ping every 10 seconds (test interval). If this ping is not answered, the device
repeats the ping after 1 second (retry interval) and exactly one time (retry count). If this ping also goes unanswered, the
device considers the series to have failed. If 10 series in a row fail (fail limit) then the device triggers the defined action,
in this case after 10 x 10 seconds = 100 seconds.
SNMP ID: 2.7.21
Telnet path: Setup/TCP-IP
131
Reference Manual
3 Configuration
Action
Enter the action to be performed by the device if the target address is unreachable. You can use the same actions as
used in the cron table, i.e. executing CLI commands, HTTP requests, or sending messages.
5
The action set here will only be executed if the boot type is set to the value Action. The boot type is configured
under /Setup/TCP-IP/Alive-test/Boot-type (also see
Boot type
).
SNMP ID: 2.7.21.7
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
251 characters
Default: Blank
Boot type
The device executes this action if the ping to the target address was unsuccessful.
SNMP ID: 2.7.21.6
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
Cold boot: The device performs a cold boot.
1
Warm boot: The device performs a warm boot.
1
Action: The device performs a configurable action. Configure the action under /Setup/TCP-IP/Alive-Test
(also see
Action
).
Default: Warm boot
Fail limit
This parameter defines the number of consecutive failed test series before the device is rebooted or the configured action
is executed.
5
The product of the error limit and test interval defines the overall duration until rebooting or executing the action.
SNMP ID: 2.7.21.5
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
0 to 4294967295
Default: 10
Test interval
The time interval in seconds, in which the device sends a ping to the target address. If the ping is unanswered, the device
optionally repeats a set number of pings in the defined interval. With this configuration, the device forms a "series" of
ping attempts. Only when all pings go unanswered is the complete series evaluated as unsuccessful.
5
The product of the error limit and test interval defines the overall duration until rebooting or executing the action.
SNMP ID: 2.7.21.2
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
132
Reference Manual
3 Configuration
1
0 to 4294967295 seconds
5
Select the test interval as a time which is greater than the product of the retry interval and retry count, so
that the desired number of retries can be performed within the test interval.
Default: 10
Retry interval
If a ping goes unanswered, this value defines the time interval before the device repeats the ping to the target address.
SNMP ID: 2.7.21.4
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
0 to 4294967295
5
Set the retry interval to a number such that the product of retry interval and retry count is less than the test
interval. This ensures that the desired number of retries can be performed within the test interval.
Default: 1
Special values: With a retry interval of 0 the device sends no repeat pings.
Retry count
If a ping goes unanswered, this value defines the number of times that the device will repeat the ping to the target
address.
SNMP ID: 2.7.21.3
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
0 to 4294967295
5
Set the retry count to a number such that the product of retry interval and retry count is less than the test
interval. This ensures that the desired number of retries can be performed within the test interval.
Default: 1
Special values: With a retry count of 0 the device sends no repeat pings.
Target address
The target address to which the device sends a ping.
SNMP ID: 2.7.21.1
Telnet path: /Setup/TCP-IP/Alive-Test
Possible values:
1
Valid IP address.
133
Reference Manual
3 Configuration
3.19 Addition(s) to LCOS 8.80
3.19.1 Setting the device time from GPS
From LCOS 8.80, you have the option of retrieving the time for the device via GPS automatically as an alternative to an
NTP server or ISDN. Prerequisites for the obtaining the device time from GPS are:
1
The operating mode of the 3G/4G modem is set to WWAN (
2.23.7.2 Operating
1
The GPS module is enabled (
2.40.1 Operating)
1
The Fetch method for the device time is set to GPS (
2.14.1 Fetch method
The current GPS time is to be found in LANmonitor (
Display of GPS time
) or the device status area (
1.63.3 Timestamp
(GPS)
).
5
This feature is available only on devices with internal WWAN module from Sierra. Please check the specifications
for your model to see whether your device supports this function.
5
The retrieval of GPS time requires an active SIM card in the device. The time is only available once the device
has successfully gained a GPS fix. This requires the connection to at least four satellites in sufficient quality.
5
The time received from GPS may differ by a few seconds from the actual time due to run-time variations and the
non-observance of leap seconds in the GPS network.
Additions to the menu system
Additions to the Setup menu
Fetch method
Select here if and how the device synchronizes its internal real-time clock.
Telnet path:
Setup > Time
Possible values:
None
ISDN
NTP
GPS
Default:
NTP
Operating
Select the operating mode for the interface.
Telnet path:
Setup > Interfaces > Mobile
134
Reference Manual
3 Configuration
Possible values:
No
modem
WWAN
UMTS-GPRS
Default:
No
Operating
Activate or deactivate the GPS function here. You can activate the GPS module independently of the location verification
function, for example to monitor the current positional coordinates with LANmonitor.
Telnet path:
Setup > GPS
Possible values:
No
Yes
Default:
No
Additions to the Status menu
Timestamp (GPS)
This entry shows the time that was last received from the GPS network.
Telnet path:
Status > GPS
3.19.2 SYSLOG accounting is disabled by default
In the SYSLOG server table, you define which system information is sent by the device to the defined SYSLOG server, and
with which SYSLOG level. By default, this table includes 8 entries for the destination IP address 127.0.0.1, which
represents the internal SYSLOG device memory.
root@:/Setup/SYSLOG/Server
> l
Idx. IP-Address Source Level Loopback-Addr.
-------------------------------------------------------
0001 127.0.0.1 04 00 INTRANET
0002 127.0.0.1 01 1f INTRANET
0003 127.0.0.1 10 02 INTRANET
0004 127.0.0.1 40 08 INTRANET
0005 127.0.0.1 02 0a INTRANET
0006 127.0.0.1 08 08 INTRANET
0007 127.0.0.1 20 00 INTRANET
0008 127.0.0.1 80 01 INTRANET
135
Reference Manual
3 Configuration
By default, the device does not send any SYSLOG messages to SYSLOG's internal memory for the sources 04 (clock time)
and 20 (accounting).
3.19.3 Boot-persistent SYSLOG, event log and boot log
As of LCOS version 8.80, you can save SYSLOG, event log, and boot log messages so that they are available even after
rebooting the device (boot persistent).
Additions to the Setup menu
Backup interval
This parameter defines the interval in hours for the boot-persistent storage of SYSLOG messages to the flash memory of
the device.
SNMP ID: 2.22.6
Telnet path: /Setup/SYSLOG
Possible values:
1
1 to 99
Default: 2
Backup active
Enables the boot-persistent storage of SYSLOG messages to the flash memory of the device.
SNMP ID: 2.22.7
Telnet path: /Setup/SYSLOG
Possible values:
1
Yes
1
No
Default: Yes
Save bootlog
This parameter enables or disables the boot-persistent storage of SYSLOG messages to the flash memory of the device.
Bootlog information is not lost even when restarting after a loss of mains power.
5
If necessary, you can delete the persistent bootlog memory with the CLI command deletebootlog.
SNMP ID: 2.11.71
Telnet path: Setup/Config
Possible values:
1
Yes
1
No
Default: Yes
136
Reference Manual
3 Configuration
Enhancements to command-line commands
Delete bootlog
The bootlog saves the information about the boot processes of the device. With the parameter
Save-Bootlog
you can
optionally enable persistent storage of the bootlogs.
By entering the command deletebootlog anywhere on the command line you can delete the contents of the
persistent bootlog storage, if necessary.
Enhancements to LANconfig
Boot-persistent SYSLOG, event log and boot log
In LANconfig, the settings for the boot-persistent SYSLOG, event log and boot-log messages are to be found under Log
& Trace > System events.
3.19.4 SYSLOG: Delete old messages
As of LCOS version 8.80, the devices are able to automatically delete old SYSLOG messages after a defined retention
period.
Additions to the menu system
Max. message age, hours
This parameter defines the maximum period for retaining SYSLOG messages in the internal SYSLOG memory of the device
in hours. After this period expires the device automatically deletes the obsolete SYSLOG messages if auto-delete is
activated under
Remove old messages
.
137
Reference Manual
3 Configuration
Telnet path:
Setup > SYSLOG
Possible values:
1 to 99
Default:
24
Remove old messages
This parameter enables deletion of the SYSLOG messages in the device after the period set for
Maximum-message-age
.
Telnet path:
Setup > SYSLOG
Possible values:
Yes
No
Default:
No
138
Reference Manual
3 Configuration
Enhancements to LANconfig
Automatically delete SYSLOG entries
In LANconfig, the settings for the automatic deletion of SYSLOG entries are to be found under Log & Trace > System
events.
Select the option Remove old entries from the system event table to enable automatic deletion.
In the field Delete entries after: you set the time, in hours, after which the device is to delete the entries in the table.
3.19.5 Logging configuration changes made via the command line
To meet the increased security requirements of network infrastructures, the devices are capable of logging to SYSLOG
any changes to the configuration made via the command line interface. Configuration changes include any changes to
the configuration parameters, executing actions, and uploading files such as certificates.
The devices write the following information to the SYSLOG:
1
User name
1
Name of the modified menu item or the executed action
1
New value (or a notice that the change was not successful, e. g. due to a lack of permission)
Additions to the Setup menu
Log CLI changes
This parameter enables logging of the commands entered on the command line. Enable this parameter to log an entry
in the internal SYSLOG memory when a command is entered on the command line of the device.
139
Reference Manual
3 Configuration
5
This protocol logs commands entered on the command line only. Configuration changes and actions made using
LANconfig and WEBconfig are not logged.
SNMP ID: 2.22.8
Telnet path: /Setup/SYSLOG
Possible values:
1
Yes
1
No
Default: No
Enhancements to LANconfig
Sending configuration changes made with the command line to the SYSLOG server
In LANconfig, the settings for logging configuration changes made via the CLI console are to be found under Log &
Trace > System events.
5
This protocol logs commands entered on the command line only. Configuration changes and actions made using
LANconfig and WEBconfig are not logged.
3.19.6 SYSLOG: Change to the default order
As of LCOS version 8.80, the SYSLOG table show the latest messages at the top by default. You can reverse the sorting
order if you wish.
140
Reference Manual
3 Configuration
Additions to the Setup menu
Message table order
This item determines the order in which the messages table is displayed.
SNMP ID: 2.22.5
Telnet path: /Setup/SYSLOG
Possible values:
1
Oldest on top
1
Newest on top
Default: Newest-on-top
Enhancements to LANconfig
Order of the system events
In LANconfig, the settings for the order in which system events are displayed are to be found under Log & Trace >
System events.
141
Reference Manual
3 Configuration
3.20 Addition(s) to LCOS 8.84
3.20.1 Default Rollout Wizard
Your device is supplied with a preconfigured Rollout Wizard, which allows you to retrieve a configuration from a
LANCOM
Large Scale Rollout & Management (LSR)
server with just a few clicks. The Default Rollout Wizard runs if you have
enabled the Rollout Wizard in LCOS but have not set up a customized Rollout Wizard.
The Default Rollout Wizard asks you for all the information that it needs to connect to the LSR. This includes:
1
The protocol used for the connection (HTTP or HTTPS);
1
The IP address or the DNS name of the LSR server;
1
The user name and password for authentication against the LSR;
1
The name or number of the rollout project;
1
The device ID (optional); and
1
The rollout TAN for the device.
4
This process can be partially or even fully automated if you enter the relevant information into the device
permanently. The table for this is located in the Setup menu under HTTP > Rollout-Wizard > Presets. Standard
presets are the port and the loopback address used by the Wizard.
4
If your device has a USB port, its automatic upload feature allows a USB stick to supply an unconfigured device
with the basic information required by the Rollout Wizard.
Before the device starts processing the rollout, the wizard displays a summary of the connection data used. Also, the
device uses an ICMP echo request (ping) to determine whether the specified server is available. If this test fails, you have
the option to re-configure the wizard or to continue the rollout process anyway. The host is available, the device begins
with the retrieval of a configuration from the LSR.
5
If the LSR server can be accessed via the Internet, but you are running the Rollout Wizard on a device without
an Internet connection, you must first execute the Internet Setup Wizard.
Additions to the Setup menu
Presets
This table enables you to predefine the values for all of the parameters that are requested by the Default Rollout Wizard.
Parameters configured in this way are no longer queried when you run the Default Rollout Wizard.
5
A 'blank' predefined value for Port and for Source loopback address will be interpreted by the device as the
entry 'Auto'. In this case, the Default Rollout Wizard uses the corresponding HTTP(S) standard port and, as the
loopback address, the address of your device that matches to the target. If you are working with different ARF
networks, you must use the loopback address to specify the ARF where the LSR server is located.
Telnet path:
Setup > HTTP > Rollout-Wizard
Name
This entry shows the name of the parameter to be filled out with preset values.
Telnet path:
Setup > HTTP > Rollout-Wizard > Presets
142
Reference Manual
3 Configuration
Preset
For the corresponding parameter, this entry shows the preset value to be used by the Rollout Wizard.
Telnet path:
Setup > HTTP > Rollout-Wizard > Presets
Possible values:
Any string, max. 127 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Use preset
This entry defines whether the parameter value configured here is to be used by the Rollout Wizard. If set to yes, the
Rollout Wizard will no longer query this parameter.
Telnet path:
Setup > HTTP > Rollout-Wizard > Presets
Possible values:
No
Yes
Default:
(Depends on the line)
Delete Wizard
This action is used when you want to delete a custom Rollout Wizard. The next time you start the Rollout Wizard, the
device reverts to the standard internal LCOS wizard.
Telnet path:
Setup > HTTP > Rollout-Wizard
Possible parameters:
No parameters available
3.20.2 Automatic generation of device-specific SSH keys
Ex-factory, all LCOS-based devices with an LCOS version earlier than 8.84 are equipped with a default set of cryptographic
keys that are represented by the following fingerprints:
SSH
ssh-dss 27:c5:1d:9f:be:27:3d:50:d7:bf:c1:68:0b:18:97:d7
ssh-rsa 03:56:e6:52:ee:d2:da:f0:73:b5:df:3d:09:08:54:b7
If you have a device with LCOS 8.84 or later and you have not uploaded an individual key to the device, the internal SSH
server will try to compile its own device-specific SSH keys after a configuration reset followed directly by a system restart.
These include
1
an SSH-2 RSA key of 2048-bit length and
1
an SSH-2 DSS key of 1024-bit length (as defined in FIPS 186-2),
which the device stores as ssh_rsakey and ssh_dsakey in its internal file system.
143
Reference Manual
3 Configuration
If key generation is successful, the entry SSH: ... host key generated is entered as a note in the SYSLOG; if it fails, an
entry SSH: host key generation failed, try later again with '...' is made as an alarm. If key generation fails (e.g.
insufficient entropy), the device falls back to its factory cryptographic key.
5
If you perform an update from an older version of LCOS to 8.84 or higher without a subsequent configuration
reset, the device does not generate a device-specific SSH key. This is to maintain compatibility with existing
installations. However, you can manually initiate the key generation. Enter the following commands in the
console:
sshkeygen -t rsa -b 2048 -f ssh_rsakey
sshkeygen -t dsa -b 1024 -f ssh_dsakey
3.20.3 Suppress security confirmations during SSH key generation
As of LCOS 8.84, you have the option of suppressing any security prompts during the SSH key generation with LCOS:
sshkeygen [-?|-h] [-t (dsa|rsa)] [-b <bits>] -f <OutputFile> [-q]
-q
This parameter enables the 'quiet' mode for the key generation. If you set this parameter, LCOS overwrites
any existing RSA or DSA keys without asking for confirmation, and there is no output about the progress of
the operation. You can use this parameter in a script, for example, to suppress security confirmations by the
user.
3.21 Addition(s) to LCOS 9.00
3.21.1 Output additional ports in SYSINFO at the console
As of LCOS version 9.00, the sysinfo command also outputs the numbers of the following ports:
1
HTTP
1
HTTPS
1
TELNET
1
TELNET-SSL
1
SSH
1
SNMP
1
TFTP
3.21.2 Specifying a custom SNMP port
As of LCOS 9.00 you have the option of changing the default port for the SNMP service from port 161.
Enter the respective port in LANmonitor, for example, when adding a new device. You also have the option of configuring
new devices by entering IP addresses and the SNMP port when executing the program. To do this, start the LANmonitor
with the syntax lanmon /add:[<IPv6-Address>]:<Port>, for example,
lanmon /add:[fe80::2a0:57ff:fe1b:3302]:161.
Additions to the Setup menu
Port
Enter the port of the computer where an SNMP manager is installed.
144
Reference Manual
3 Configuration
SNMP ID:
2.9.2.5
Telnet path:
Setup > SNMP > IP-Traps
Possible values:
Max. 5 characters from 0123456789
0 … 65535
Default:
empty
Port
Using this parameter, you specify the port which external programs (such as LANmonitor) use to access the SNMP service.
SNMP ID:
2.9.21
Telnet path:
Setup > SNMP
Possible values:
0 … 65535
Default:
161
3.21.3 Password protection for WLAN keys
As of LCOS 9.00 the system no longer displays WPA and WEP group keys in plain text on the console, but masked
(********). As a result, it is no longer possible to read these keys via SNMP, for example.
3.21.4 Sorted display of a menu on the console
As of LCOS 9.00 you have the option of sorting the output of the menu items by using the argument -s.
Description
Command
Displays the current directory content. Possible arguments are:
dir|list|ls|llong [-a] [-r] [-s]
[<Path>] [<Filter>]
1
-a: In addition to the content of the query, this also lists the
SNMP IDs. The output begins with the SNMP ID of the device
followed by the SNMP ID of the current menu. The SNMP IDs
of the subordinate items can be read from the individual
entries.
1
-r: Also lists all subdirectories as well as the tables they
contain.
1
-s: Sorts the display of the current directory; grouped by
sub directories, tables, values, and actions; in ascending
alphabetical order.
145
Reference Manual
3 Configuration
Alternatively, you have the option of setting the default to sorted output using the corresponding setup parameter
Setup > Config > Sort-menu.
3.21.5 Customize the management ports for device access
LANconfig features the option to change the port numbers for the management protocols.
1. Start LANconfig and open the configuration dialog for the device.
2. Switch to the dialog Management > Admin and click Ports.
3. Enter the port numbers for the required management protocols.
4. Close all open dialog windows by clicking on OK.
LANconfig writes the configuration back to the device.
Additions to the Setup menu
Sort-menu
Using this parameter, you specify whether the device displays menu items in ascending alphabetical order on the console
by default. The setting corresponds to the option switch -s when listing menu or table contents.
SNMP ID:
2.11.73
Telnet path:
Setup > Config
Possible values:
No
Yes
Default:
No
146
Reference Manual
3 Configuration
3.21.6 Comment box for access stations
As of LCOS9.00 you can add comments to the filter entries in the table of access stations.
Additions to the Setup menu
Comment
This parameter allows you to enter a comment on the entry.
SNMP ID:
2.7.6.4
Telnet path:
Setup > TCP-IP > Access-list
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
3.21.7 Elliptic curve cryptography (ECC)
As of LCOS9.00 you can generate ECDSA keys on a device in addition to the RSA and DSA keys.
SSH key generation with LCOS
To generate a key pair consisting of a public and a private key, you enter the following command at the console:
sshkeygen [-?|-h] [-t (dsa|rsa|ecdsa)] [-b <Bits>] -f <OutputFile> [-q]
-?, -h
Displays a brief help text about the available parameters
-t (dsa|rsa|ecdsa)
This parameter specifies what type of key is generated. SSH supports the following types of keys:
1
RSA keys are most widely used and have a length between 512 and 16384 bits. If possible you should
work with keys of 1024 to 2048 bits in length.
1
DSA keys follow the Digital Signature Standard (DSS) set down by the National Institute of Standards and
Technology (NIST) and are typically used in environments which are required to comply with the Federal
Information Processing Standard (FIPS). DSA and DSS keys are always 1024 bits long, but they are slower
to process than a corresponding RSA key.
1
ECDSA keys are a variant of DSA keys, whereby the device uses elliptic curves for key generation (elliptic
curve cryptography, ECC). ECC is an alternative to the conventional signature and key exchange techniques
such as RSA and Diffie-Hellman. The main advantage of elliptic curves is that their mathematical properties
offer the same key strength as RSA or Diffie-Hellman but with a significantly shorter key length. This
147
Reference Manual
3 Configuration
provides for better hardware performance. ECC and its integration in SSL and TLS are described in RFCs
5656 and 4492.
If no type is specified, the command generates an RSA key by default.
-b <bits>
This parameter sets the length of the RSA key in bits. If you do not specify a length, the command produces
a key with a length of 1024 bits by default.
-f <OutputFile>
These parameters specify the mounting point of the generated key file in the device file system. The choice
of mounting point depends on what type key you are generating. The choices available to you are:
1
ssh_rsakey for RSA keys
1
ssh_dsakey for DSA keys
1
ssh_ecdsakey for ECDSA keys
-q
This parameter enables the 'quiet' mode for the key generation. If you set this parameter, LCOS overwrites
any existing RSA or DSA keys without asking; there is no information about the progress of the operation.
You can, for example, use this parameter in a script to suppress any security prompts for the users.
Additions to the Setup menu
SSL
The parameters for HTTPS connections are specified here.
SNMP ID:
2.21.40
Telnet path:
Setup > HTTP
Port
Port for the HTTPS server connection
SNMP ID:
2.21.40.10
Telnet path:
Setup > HTTP > SSL
Possible values:
0 … 65535
Default:
443
148
Reference Manual
3 Configuration
Use-User-Provided-Certificate
Here you select whether you want to use a user-provided certificate.
SNMP ID:
2.21.40.11
Telnet path:
Setup > HTTP > SSL
Possible values:
Yes
No
Default:
Yes
Versions
This bitmask specifies which versions of the protocol are allowed.
SNMP ID:
2.21.40.3
Telnet path:
Setup > HTTP > SSL
Possible values:
SSLv3
TLSv1
TLSv1.1
TLSv1.2
Default:
SSLv3
TLSv1
Key-exchange algorithms
This bitmask specifies which key-exchange methods are available.
SNMP ID:
2.21.40.4
149
Reference Manual
3 Configuration
Telnet path:
Setup > HTTP > SSL
Possible values:
RSA
DHE
ECDHE
Default:
RSA
DHE
ECDHE
Crypto-Algorithms
This bitmask specifies which cryptographic algorithms are allowed.
SNMP ID:
2.21.40.5
Telnet path:
Setup > HTTP > SSL
Possible values:
RC4-40
RC4-56
RC4-128
DES40
DES
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Default:
RC4-128
3DES
AES-128
AES-256
AESGCM-128
150
Reference Manual
3 Configuration
AESGCM-256
Hash algorithms
This bit mask specifies which hash algorithms are allowed and implies what HMAC algorithms used to protect of the
integrity of the messages.
SNMP ID:
2.21.40.6
Telnet path:
Setup > HTTP > SSL
Possible values:
MD5
SHA1
SHA2-256
SHA2-384
Default:
MD5
SHA1
SHA2-256
SHA2-384
Key-exchange algorithms
The MAC key exchange algorithms are used to negotiate the key algorithm. Select one or more of the available algorithms.
SNMP ID:
2.11.28.3
Telnet path:
Setup > Config > SSH
151
Reference Manual
3 Configuration
Possible values:
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2
curve25519-sha256
Default:
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
Hostkey algorithms
The host key algorithms are used to authenticate hosts. Select one or more of the available algorithms.
SNMP ID:
2.11.28.4
Telnet path:
Setup > Config > SSH
Possible values:
ssh-rsa
ssh-dss
ecdsa-sha2
ssh-ed25519
Default:
ssh-rsa
ssh-dss
Elliptic curves
This is where you select the (NIST) curves used by the device for the elliptic curve cryptography (ECC).
4
All of the NIST curves given here are suitable for the ECDH key agreement, whereas host keys are based on the
curves nistp256 and nistp384.
152
Reference Manual
3 Configuration
SNMP ID:
2.11.28.9
Telnet path:
Setup > Config > SSH
Possible values:
nistp256
nistp384
nistp521
Default:
nistp256
nistp384
nistp521
Telnet-SSL
The parameters for Telnet-SSL connections are specified here.
SNMP ID:
2.11.29
Telnet path:
Setup > Config
PORT
This port is used for encrypted configuration connections via telnet.
SNMP ID:
2.11.29.10
Telnet path:
Setup > Config > Telnet-SSL
Possible values:
0 … 65535
Default:
992
153
Reference Manual
3 Configuration
Versions
This bitmask specifies which versions of the protocol are allowed.
SNMP ID:
2.11.29.2
Telnet path:
Setup > Config > Telnet-SSL
Possible values:
SSLv3
TLSv1
TLSv1.1
TLSv1.2
Default:
SSLv3
TLSv1
Key-exchange algorithms
This bitmask specifies which key-exchange methods are available.
SNMP ID:
2.11.29.3
Telnet path:
Setup > Config > Telnet-SSL
Possible values:
RSA
DHE
ECDHE
Default:
RSA
DHE
ECDHE
Crypto-Algorithms
This bitmask specifies which cryptographic algorithms are allowed.
154
Reference Manual
3 Configuration
SNMP ID:
2.11.29.4
Telnet path:
Setup > Config > Telnet-SSL
Possible values:
RC4-40
RC4-56
RC4-128
DES40
DES
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Default:
RC4-128
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Hash algorithms
This bit mask specifies which hash algorithms are allowed and implies what HMAC algorithms used to protect of the
integrity of the messages.
SNMP ID:
2.11.29.5
Telnet path:
Setup > Config > Telnet-SSL
155
Reference Manual
3 Configuration
Possible values:
MD5
SHA1
SHA2-256
SHA2-384
Default:
MD5
SHA1
SHA2-256
SHA2-384
EAP-TLS
The parameters for EAP-TLS connections are specified here.
SNMP ID:
2.25.10.10.19
Telnet path:
Setup > RADIUS > Server > EAP
Check username
TLS authenticates the client via certificate only. If this option is activated, the RADIUS server additionally checks if the
username in the certificate is contained in the RADIUS user table.
SNMP ID:
2.25.10.10.19.10
Telnet path:
Setup > RADIUS > Server > EAP > EAP-TLS
Possible values:
Yes
No
Default:
No
156
Reference Manual
3 Configuration
Key-exchange algorithms
This bitmask specifies which key-exchange methods are available.
SNMP ID:
2.25.10.10.19.3
Telnet path:
Setup > RADIUS > Server > EAP > EAP-TLS
Possible values:
RSA
DHE
ECDHE
Default:
RSA
DHE
ECDHE
Crypto-Algorithms
This bitmask specifies which cryptographic algorithms are allowed.
SNMP ID:
2.25.10.10.19.4
Telnet path:
Setup > RADIUS > Server > EAP > EAP-TLS
Possible values:
RC4-40
RC4-56
RC4-128
DES40
DES
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Default:
RC4-128
3DES
157
Reference Manual
3 Configuration
AES-128
AES-256
AESGCM-128
AESGCM-256
Hash algorithms
This bit mask specifies which hash algorithms are allowed and implies what HMAC algorithms used to protect of the
integrity of the messages.
SNMP ID:
2.25.10.10.19.5
Telnet path:
Setup > RADIUS > Server > EAP > EAP-TLS
Possible values:
MD5
SHA1
SHA2-256
SHA2-384
Default:
MD5
SHA1
SHA2-256
SHA2-384
RADSEC
The parameters for READSEC connections are specified here.
SNMP ID:
2.25.20
Telnet path:
Setup > RADIUS
158
Reference Manual
3 Configuration
Versions
This bitmask specifies which versions of the protocol are allowed.
SNMP ID:
2.25.20.1
Telnet path:
Setup > RADIUS > RADSEC
Possible values:
SSLv3
TLSv1
TLSv1.1
TLSv1.2
Default:
SSLv3
TLSv1
Key-exchange algorithms
This bitmask specifies which key-exchange methods are available.
SNMP ID:
2.25.20.2
Telnet path:
Setup > RADIUS > RADSEC
Possible values:
RSA
DHE
ECDHE
Default:
RSA
DHE
ECDHE
Crypto-Algorithms
This bitmask specifies which cryptographic algorithms are allowed.
159
Reference Manual
3 Configuration
SNMP ID:
2.25.20.3
Telnet path:
Setup > RADIUS > RADSEC
Possible values:
RC4-40
RC4-56
RC4-128
DES40
DES
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Default:
RC4-128
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Hash algorithms
This bit mask specifies which hash algorithms are allowed and implies what HMAC algorithms used to protect of the
integrity of the messages.
SNMP ID:
2.25.20.4
Telnet path:
Setup > RADIUS > RADSEC
160
Reference Manual
3 Configuration
Possible values:
MD5
SHA1
SHA2-256
SHA2-384
Default:
MD5
SHA1
SHA2-256
SHA2-384
3.21.8 Changing the SIM card PIN
For devices with a cellular modem, LANconfig gives you the option to change the PIN of the SIM card. You make the
change simply by entering the old PIN and then the new PIN. In the interests of security, LANconfig requires an additional
confirmation of the new PIN. Alternatively you can make the change from the command line by executing the action
PIN-change.
The following steps describe the procedure in LANconfig.
1. In the LANconfig device overview, select the device requiring the PIN change.
2. From the menu bar, choose Device > Change SIM card PIN. A new dialog box opens.
3. Enter the old PIN and then your new PIN. Confirm the new PIN by entering it again.
4. Click OK to accept the change.
Additions to the Status menu
PIN change
Use this action to change the PIN of the SIM card. The syntax when entering the arguments is:
<oldPIN> <newPIN> <newPIN>
5
The action can be performed only after the modem has been successfully initialized. This is particularly important
when scripts are being used to implement a configuration.
SNMP ID:
1.49.42
161
Reference Manual
3 Configuration
Telnet path:
Status > Modem-Cellular-Network
Possible arguments:
<oldPIN>
Old PIN
<newPIN>
New PIN
<newPIN>
Confirmation of the new PIN
Additions to the Setup menu
PIN change
This action changes the PIN of the SIM card in your device. Syntax:
do pin-change <old_PIN><new_PIN> <new_PIN>
SNMP ID:
2.23.41.12
Telnet path:
Setup > Interfaces > Mobile
Possible values:
4 characters from [0-9]
3.22 Addition(s) to LCOS 9.10
3.22.1 TR-069 support
As of LCOS version 9.10, our routers support certain features of the TR-069 (CWMP) specification for automated
provisioning and the securely encrypted remote management of routers, for example in provider environments.
CPE WAN Management Protocol (CWMP)
The CPE WAN Management Protocol (CWMP) enables devices to be remotely configured via a WAN link. Communication
between the device (customer premises equipment, CPE) and the configuration server (auto configuration server, ACS)
is conducted via SOAP/HTTP(S) in the form of remote procedure calls (RPC). A large number of RPCs are specified for the
CWMP, the following of which are implemented in LCOS:
1
GetRPCMethods
1
SetParameterValues
1
GetParameterValues
1
GetParameterNames
1
FactoryReset
1
Reboot
1
Download
2
Firmware-Update
162
Reference Manual
3 Configuration
2
Script download (*.lcs files)
LCOS additionally supports the manufacturer-specific RPC:
1
X_LANCOM_DE_Command
4
To find more information about the parameters of the RPC, visit the
Broadband Forum
.
The CPE supports the following types of authentication at an ACS:
1
HTTP Basic
1
HTTP Digest
1
HTTPS by client certificate
Setting up CWMP with LANconfig
In LANconfig, the CPE WAN Management Protocol is configured under Management > CWMP.
CWMP activated
Enables or disables CWMP.
ACS URL
Here you enter the address of the ACS (auto configuration server) which the CPE (customer premises equipment)
connects to. The address is entered in the IPv4, IPv6, or FQDN format.
HTTP and HTTPS are permitted, although the use of HTTPS is preferred. Otherwise the devices transmit
device-specific parameters, such as passwords or access data, unencrypted. Before you can use HTTPS, the
trusted root certificate for verifying the server identity needs to be uploaded to the device.
ACS username
Enter a user name for the device to use when connecting with the ACS (auto configuration server).
ACS password
Enter a password for the device to use when connecting with the ACS (auto configuration server).
Remote administrator
Select one of the configured device administrators to be used by the ACS (auto configuration server) when
connecting to this device. The name you select must be an enabled device administrator with appropriate
privileges, i.e. root access to change the firmware.
163
Reference Manual
3 Configuration
Source address
This is where you can configure an optional sender address to be used instead of the one otherwise
automatically selected for the destination address. If you have configured loopback addresses, you can specify
them here as source address.
4
If the source address set here is a loopback address, then the device will use this unmasked even for
remote stations that are masked.
The device accepts addresses in various input formats:
1
Name of the IP network (ARF network), whose address should be used.
1
"INT" for the address of the first intranet.
1
"DMZ" for the address of the first DMZ (caution: If there is an interface called "DMZ", then the device
takes its address).
1
LB0 ... LBF for one of the 16 loopback addresses or its name
1
Any IP address in the form x.x.x.x.
Periodic inform activated
Enables or disables the sending of periodic inform messages from the device to the ACS (auto configuration
server).
Periodic inform interval
This is the interval in seconds between two periodic inform messages sent by the device to the ACS (auto
configuration server). The ACS then requests further information from the device.
The default value is 1200 seconds (20 minutes). Do not set a value that is too small, as inform messages
increase network load. The interval does not commence before the device and server have exchanged all of
the necessary information.
Allow file transmission
This switch allows you to transfer a firmware or a script file from the ACS (auto configuration server) to this
device.
Manage firmware updates
This switch allows the ACS (auto configuration server) to make firmware modifications to the device.
Allow changing of the username
This switch allows the ACS (auto configuration server) to change the device administrator or to change the
name and password of the device administrator used to connect to the device.
In the default setting, the connection request URL uses HTTP port 80. You configure this in LANconfig under
Management > Admin in the section Management protocols under Ports.
164
Reference Manual
3 Configuration
In order for an ACS to request the device to connect, it must be possible to access the corresponding HTTP port via the
WAN or VPN. This requires that access either via WAN or VPN is allowed in LANconfig under Management > Admin
in the section Configuration access ways under Access rights > From a WAN interface.
If you use IPv6, you additionally need to set the IPv6 firewall to allow access to the corresponding port under
Firewall/QoS > IPv6 rules > IPv6 inbound rules.
4
The connection request is only possible with authentication by means of user name and password.
If HTTPS is used in the ACS URL, the CPE validates the ACS certificate. To this end, you first have to save the CWMP root
CA certificate on the CPE. If the CPE is unable to validate the server certificate against the existing root CA certificate, it
rejects the connection. The certificate is uploaded either by LANconfig or WEBconfig. In LANconfig you do this as follows:
165
Reference Manual
3 Configuration
1. In the device view section, right-click on the corresponding device and, under Configuration management, select
the item Upload certificate or file.
2. In the dialog that follows, set the certificate type to “CWMP root CA certificate” and click Open.
When using SSL/TLS for authentication at the CPE, you upload the client certificate and the private key by means of
PKCS#12 file (CWMP container as PKCS#12 file) onto the CPE.
Device configuration via CWMP
All CWMP parameters are configured on the command line either by a script file or by the manufacturer-specific RPC
X_LANCOM_DE_Command.
166
Reference Manual
3 Configuration
Configuration via script
The CWMP download command <cwmp:download> is used to configure the device by means of a script
file (*.lcs). The file type is 3 Vendor Configuration File. The URL is the address of the
server where the configuration script is stored.
4
LANconfig files of the *.lcf format are not supported.
Configuration by means of manufacturer-specific RPC X_LANCOM_DE_Command
The X_LANCOM_DE_Command function is defined as follows:
Request
<cwmp:X_LANCOM_DE_Command>
<Command> CLI-Kommando </Command>
</cwmp:X_LANCOM_DE_Command>
Response
<cwmp:X_LANCOM_DE_CommandResponse>
<Status>1</Status>
<Result>1</Result>
</cwmp:X_LANCOM_DE_CommandResponse>
The following example sets the IPv4 address of the device to the “INTRANET”:
<cwmp:X_LANCOM_DE_Command>
<Command>set /Setup/TCP-IP/Network-list/INTRANET {IP-address} 192.168.80.1</Command>
</cwmp:X_LANCOM_DE_Command>
Due to the asynchronous execution of the console commands, the X_LANCOM_DE_Command always
reports a successful execution of the command, regardless of whether the command was executed correctly
or not. A successful execution requires the config status to be read out under Status > Config.
To check the configuration status, you can read out the following CWMP parameters before or after using the script or
X_LANCOM_DE_Command:
1
InternetGatewayDevice.DeviceInfo.X_LANCOM_DE_ConfigVersion
1
InternetGatewayDevice.DeviceInfo.X_LANCOM_DE_LastScriptComment
1
InternetGatewayDevice.DeviceInfo.X_LANCOM_DE_LastScriptErrorLine
1
InternetGatewayDevice.DeviceInfo.X_LANCOM_DE_LastScriptSuccessful
4
The values correspond to the status values under Status > Config.
Additions to the Setup menu
CWMP
The CPE WAN Management Protocol (CWMP) enables devices to be remotely configured via a WAN link. Communication
between the device (customer premises equipment, CPE) and the configuration server (auto configuration server, ACS)
is conducted via SOAP/HTTP(S) in the form of remote procedure calls (RPC).
SNMP ID:
2.44
Telnet path:
Setup
167
Reference Manual
3 Configuration
NTP server
This directory displays the NTP server for time synchronization as configured by the CWMP.
SNMP ID:
2.44.1
Telnet path:
Setup > CWMP
NTP-Server-1
Displays the first NTP server.
SNMP ID:
2.44.1.1
Telnet path:
Setup > CWMP > NTP-Server
NTP-Server-2
Displays the second NTP server.
SNMP ID:
2.44.1.2
Telnet path:
Setup > CWMP > NTP-Server
NTP-Server-3
Displays the third NTP server.
SNMP ID:
2.44.1.3
Telnet path:
Setup > CWMP > NTP-Server
NTP-Server-4
Displays the fourth NTP server.
168
Reference Manual
3 Configuration
SNMP ID:
2.44.1.4
Telnet path:
Setup > CWMP > NTP-Server
NTP-Server-5
Displays the fifth NTP server.
SNMP ID:
2.44.1.5
Telnet path:
Setup > CWMP > NTP-Server
Operating
Enables or disables CWMP.
SNMP ID:
2.44.2
Telnet path:
Setup > CWMP
Possible values:
No
Yes
Default:
No
Allow file download
This switch allows you to transfer a firmware or a script file from the ACS (auto configuration server) to this device.
SNMP ID:
2.44.3
Telnet path:
Setup > CWMP
169
Reference Manual
3 Configuration
Possible values:
No
Yes
Default:
No
Inform retry limit
Here you specify how many times the CPE attempts to deliver an inform message to the ACS after a failure.
SNMP ID:
2.44.4
Telnet path:
Setup > CWMP
Possible values:
Max. 10 characters from 0123456789
Default:
10
Special values:
0
Retry disabled
Source address
This is where you can configure an optional sender address to be used instead of the one otherwise automatically selected
for the destination address. If you have configured loopback addresses, you can specify them here as source address.
4
If the source address set here is a loopback address, then the device will use this unmasked even for remote
stations that are masked.
SNMP ID:
2.44.5
Telnet path:
Setup > CWMP
Possible values:
Max. 16 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
170
Reference Manual
3 Configuration
Special values:
Name of the IP network (ARF network), whose address should be used.
"INT" for the address of the first intranet.
"DMZ" for the address of the first DMZ (caution: If there is an interface called "DMZ", then the
device takes its address).
LB0 ... LBF for one of the 16 loopback addresses or its name
Any IP address in the form x.x.x.x.
Default:
empty
ACS URL
Here you enter the address of the ACS (auto configuration server) which the device connects to. The address is entered
in the IPv4, IPv6, or FQDN format.
SNMP ID:
2.44.6
Telnet path:
Setup > CWMP
Possible values:
Max. 255 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
empty
ACS username
Enter a user name for the device to use when connecting with the ACS (auto configuration server).
SNMP ID:
2.44.7
Telnet path:
Setup > CWMP
Possible values:
Max. 255 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
empty
ACS password
Enter a password for the device to use when connecting with the ACS (auto configuration server).
171
Reference Manual
3 Configuration
SNMP ID:
2.44.8
Telnet path:
Setup > CWMP
Possible values:
Max. 255 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
empty
Periodic inform activated
Enables or disables the sending of periodic inform messages from the device to the ACS (auto configuration server).
SNMP ID:
2.44.9
Telnet path:
Setup > CWMP
Possible values:
No
Yes
Default:
No
Periodic inform interval
This is the interval in seconds between two periodic inform messages sent by the device to the ACS (auto configuration
server). The ACS then requests further information from the device.
The default value is 1200 seconds (20 minutes). Do not set a value that is too small, as inform messages increase network
load. The interval does not commence before the device and server have exchanged all of the necessary information.
SNMP ID:
2.44.10
Telnet path:
Setup > CWMP
Possible values:
Max. 10 characters from 0123456789
172
Reference Manual
3 Configuration
Default:
1200
Special values:
0
Periodic-Inform disabled
Periodic inform time
Specify the periodic inform time. This entry in the “dateTime” format contains the time for the first inform message.
Example: 0001-02-03T03:04:05+06:00.
SNMP ID:
2.44.11
Telnet path:
Setup > CWMP
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
empty
Connection request username
Select one of the configured device administrators to be used by the ACS (auto configuration server) when connecting
to this device. The name you select must be an enabled device administrator with appropriate privileges, i.e. root access
to change the firmware.
SNMP ID:
2.44.12
Telnet path:
Setup > CWMP
Possible values:
Max. 255 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
empty
Updates managed
This switch allows the ACS (auto configuration server) to make firmware modifications to the device.
173
Reference Manual
3 Configuration
SNMP ID:
2.44.13
Telnet path:
Setup > CWMP
Possible values:
No
Yes
Default:
No
Allow user change
This switch allows the ACS (auto configuration server) to change the device administrator or to change the name of the
device administrator that it uses to connect to the device.
SNMP ID:
2.44.14
Telnet path:
Setup > CWMP
Possible values:
No
Yes
Default:
No
Provisioning code
Displays the ACS provisioning code.
SNMP ID:
2.44.15
Telnet path:
Setup > CWMP
174
Reference Manual
3 Configuration
Parameter key
Displays the parameter key.
The ACS uses the parameter key to maintain an overview of its changes.
SNMP ID:
2.44.16
Telnet path:
Setup > CWMP
Command-Key
Displays the command key of the ACS.
SNMP ID:
2.44.17
Telnet path:
Setup > CWMP
Additions to the Status menu
CWMP
This menu shows you certain features of the TR-069 (CWMP) specification.
SNMP ID:
1.85
Telnet path:
Status > CWMP
Operating
This menu shows you whether CWMP is activated.
SNMP ID:
1.85.1
Telnet path:
Status > CWMP
175
Reference Manual
3 Configuration
Possible values:
Yes
No
Allow file download
This menu shows you whether the device is allowed to download firmware or script files from an external server.
SNMP ID:
1.85.2
Telnet path:
Status > CWMP
Possible values:
Yes
No
Provisioning code
This entry shows the provisioning code as configured by the provider.
SNMP ID:
1.85.3
Telnet path:
Status > CWMP
Parameter key
Shows the CWMP parameter key.
SNMP ID:
1.85.4
Telnet path:
Status > CWMP
Command-Key
Shows the CWMP command key.
176
Reference Manual
3 Configuration
SNMP ID:
1.85.5
Telnet path:
Status > CWMP
NTP-Server-1
This entry shows you the first NTP server for time synchronization.
SNMP ID:
1.85.6
Telnet path:
Status > CWMP
NTP-Server-2
This entry shows you the second NTP server for time synchronization.
SNMP ID:
1.85.7
Telnet path:
Status > CWMP
NTP-Server-3
This entry shows you the third NTP server for time synchronization.
SNMP ID:
1.85.8
Telnet path:
Status > CWMP
NTP-Server-4
This entry shows you the fourth NTP server for time synchronization.
SNMP ID:
1.85.9
177
Reference Manual
3 Configuration
Telnet path:
Status > CWMP
NTP-Server-5
This entry shows you the fifth NTP server for time synchronization.
SNMP ID:
1.85.10
Telnet path:
Status > CWMP
Allow user change
This entry indicates whether the ACS is allowed to change the local administrator (applies for user name and password).
SNMP ID:
1.85.11
Telnet path:
Status > CWMP
Possible values:
Yes
No
3.22.2 Encrypted storage of configurations with LANconfig
As of LCOS version 9.10, it is possible to encrypt configuration and script files and to give them a checksum. Configuration
files can be given password protection for encryption and secure storage with LANconfig, so preventing any unauthorized
access to configurations.
Table 2: Overview of all commands available at the command line
DescriptionCommand
Shows the complete configuration in the format of the device syntax.
readconfig [-h] [-s
<password>]
1
-h: Adds a checksum to the configuration file.
1
-s <password>: Encrypts the configuration file with the use of the
specified password.
Access rights: Supervisor-Read
The readscript command generates a text dump of all commands and parameters
required to configure the device in its current state. You can use the following option
switches for this:
readscript [-n] [-d] [-i]
[-c] [-m] [-h] [-s
<password>]
1
-n: The text output is only numerical without identifiers. The output only
contains the current status values of the configuration as well as the associated
SNMP IDs.
178
Reference Manual
3 Configuration
DescriptionCommand
1
-d: The default values are included in the text output.
1
-i: The table designations are included in the text output.
1
-c: Includes any comments contained in the script file.
1
-m: The text is output to the screen in a compact but difficult to read format
(no indentations).
1
-h: Adds a checksum to the script file.
1
-s <password>: Encrypts the script file with the use of the specified
password.
Access rights: Supervisor-Read
Saving and loading device-configuration and script files
A device configuration file contains all of its settings. Script files are useful for managing the settings of a device
automatically. To protect of these files against unauthorized access or transmission errors, it is possible to export them
from or upload them to the device in an encrypted state and with a checksum.
There are three different file types:
1
No checksum, no encryption: A text file with content readable by a text editor.
1
Checksum: The text file contains information about the checksum and the hash algorithm for calculating this checksum.
The contents of this text file is readable with a simple text editor.
4
LANconfig prior to version 9.10 recognizes files with checksums.
1
Encryption: Before the file is exported it is encrypted by the device using a password chosen by the administrator.
The text file contains information about the encryption algorithm used, as well as a checksum. The contents of the
text file is no longer decipherable by a text editor, with the exception of the file header.
4
LANconfig prior to version 9.10 cannot read encrypted files.
4
The file extensions of these files are .lcf for configuration files or .lcs for script files. The detection of a
file that is encrypted and/or contains a checksum relies exclusively on the file header.
Configuration management with WEBconfig and the console
To export a configuration file from WEBconfig, navigate to the view File management > Save configuration.
The following options are available:
No entries
By default, all options are disabled. A click on Download invokes the dialog for downloading an unencrypted
configuration file without a checksum.
179
Reference Manual
3 Configuration
Include checksum
A click on Download invokes the dialog for downloading an unencrypted configuration file with a checksum.
Password
Specify a password if you want to encrypt the configuration file before downloading it.
To save the configuration from the console, use the following parameters:
1
readconfig: Backs up the configuration without checksum and encryption.
1
readconfig -h: Adds a checksum to the configuration file.
1
readconfig -s <password>: Encrypts the configuration file with the use of the specified password.
To upload a configuration file with WEBconfig, navigate to the view File management > Upload configuration.
If the configuration file is encrypted, enter the appropriate password and click on Start upload.
4
For more information about alternate boot configurations, see the chapter
Alternative boot config
.
Script management with WEBconfig and the console
To export a script file from WEBconfig, navigate to the view File management > Save configuration script.
The following options are available:
180
Reference Manual
3 Configuration
Parameters
By default, all options are disabled. A click on Download invokes the dialog for downloading an unencrypted
script file without a checksum.
Password
Specify a password if you want to encrypt the script file before downloading it.
To save the script file from the console, the following parameters are available:
1
readscript: Backs up the configuration without checksum and encryption.
1
readscript -h: Adds a checksum to the configuration file.
1
readscript -s <password>: Encrypts the configuration file with the use of the specified password.
4
More information about the parameters, see the chapter
Commands for the console
in the section about
readscript.
To upload a script file with WEBconfig, navigate to the view File management > Execute configuration script.
If the script file is encrypted, enter the appropriate password and click on Start upload.
Configuration management with LANconfig
You can use LANconfig to save a configuration file by right-clicking on the corresponding device in the list of devices.
From the context dialog, open the save dialog under Configuration management > Save as file.
The following entries are available:
File name
LANconfig composes the file name from various pieces of information (including version number, date and
time). Change the name to suit your needs.
181
Reference Manual
3 Configuration
File type
Choose whether this is a configuration file or something else.
Password
Specify a password if you want to encrypt the configuration file before downloading it.
Under Advanced you can set optional parameters that are processed by the device when a configuration file is loaded
automatically (auto-load). Use this to customize the configuration.
You can use LANconfig to upload a configuration file to the device by right-clicking on the device where the configuration
is to be uploaded. From the context dialog, open the restore dialog under Configuration management > Restore
from file.
Select the required configuration file, enter the password (if applicable) and click Open to upload the configuration to
the device.
Additions to the Status menu
Script log
This table provides an overview of the executed scripts.
SNMP ID:
1.11.23
Telnet path:
Status > Config
Index
Shows the index of this entry.
SNMP ID:
1.11.23.1
Telnet path:
Status > Config > Script-Log
Time
Shows the time of this entry.
SNMP ID:
1.11.23.2
Telnet path:
Status > Config > Script-Log
182
Reference Manual
3 Configuration
Comment
Shows the comment for this entry.
SNMP ID:
1.11.23.3
Telnet path:
Status > Config > Script-Log
Successful
Shows whether the script was successfully completed.
SNMP ID:
1.11.23.4
Telnet path:
Status > Config > Script-Log
Error line
In the event of an error, this shows which line of the script caused the abort.
SNMP ID:
1.11.23.5
Telnet path:
Status > Config > Script-Log
3.22.3 Each device has its own SSL key & changes to the default SSL settings
As of LCOS version 9.10, after a configuration reset each device generates its own SSL RSA key of 2048-bit length.
Further, “RC4-128” is no longer set as the default for HTTPS connections.
Automatic generation of device-specific SSH/SSL keys
If you have a device with LCOS 8.84 or higher and you have not loaded an individual key into the device, then resetting
the configuration will prompt the internal SSH server to try and compile its own device-specific SSH keys directly at the
system startup. These include:
1
an SSH-2-RSA key with 2048 bit length;
1
an SSH-2-DSS key with 1024 bit length (as per FIPS 186-2);
1
an SSH-2-ECDSA key with 256, 384 or 521 bit length;
1
an SSL-RSA key with 2048 bit length;
which the device stores in its internal file system as ssh_rsakey, ssh_dsakey, ssl_privkey or
ssh_ecdsakey.
183
Reference Manual
3 Configuration
If key generation is successful, the entry SSH ... host key generated is entered into the SYSLOG as a
“notice”; If it fails, the entry SSH: host key generation failed, try later again with
'...' is entered as an “alert”. The failure to generate a key, for example if there is too little entropy, causes the system
to revert to the factory implemented cryptographic key.
5
When you an update from an older LCOS version to 8.84 or higher without subsequently doing a configuration
reset, the device does not generate a device-specific SSH/SSL key. This maintains compatibility with existing
installations. However, you can trigger the key generation manually. Enter the following commands in the console:
sshkeygen -t rsa -b 2048 -f ssh_rsakey
sshkeygen -t dsa -b 1024 -f ssh_dsakey
sshkeygen -t ecdsa -b 256 -f ssh_ecdsakey
sshkeygen -t rsa -b 2048 -f ssl_privkey
Manually create custom SSH keys
You have the option to replace the factory installed and automatically generated SSH/SSL keys with your own RSA, DSA
or DSS keys, in order to achieve stronger encryption. A number of alternatives are available here:
1
You can generate the individual keys on the console using LCOS.
1
Using an external program, you can create an OpenSSH private key and then upload this key to the device as SSH-
DSA-key [...] or SSH-RSA key (*.key [BASE64 unencrypted]).
The use of an external program is an option if your device has insufficient entropy, so causing key creation with LCOS
to fail.
SSH key generation with LCOS
To generate a key pair consisting of a public and a private key, you enter the following command at the console:
sshkeygen [-?|-h] [-t (dsa|rsa|ecdsa)] [-b <Bits>] -f <OutputFile> [-q]
-?, -h
Displays a brief help text about the available parameters
-t (dsa|rsa|ecdsa)
This parameter specifies what type of key is generated. SSH supports the following types of keys:
1
RSA keys are most widely used and have a length between 512 and 16384 bits. If possible you should
work with keys of 1024 to 2048 bits in length.
1
DSA keys follow the Digital Signature Standard (DSS) set down by the National Institute of Standards and
Technology (NIST) and are typically used in environments which are required to comply with the Federal
Information Processing Standard (FIPS). DSA or DSS keys are always 1024 bits long, but they are slower
to process than a corresponding RSA key.
1
ECDSA keys are a variant of DSA keys, whereby the device uses elliptic curves for key generation (elliptic
curve cryptography, ECC). ECC is an alternative to the conventional signature and key exchange techniques
such as RSA and Diffie-Hellman. The main advantage of elliptic curves is that their mathematical properties
offer the same key strength as RSA or Diffie-Hellman but with a significantly shorter key length. This
provides for better hardware performance. ECC and its integration in SSL and TLS are described in RFCs
5656 and 4492.
If no type is specified, the command generates an RSA key by default.
-b <bits>
This parameter sets the length of the RSA key in bits. If you do not specify a length, the command produces
a key with a length of 1024 bits by default.
184
Reference Manual
3 Configuration
-f <OutputFile>
These parameters specify the mounting point of the generated key file in the device file system. The choice
of mounting point depends on what type key you are generating. The choices available to you are:
1
ssh_rsakey for RSA keys
1
ssh_dsakey for DSA keys
1
ssh_ecdsakey for ECDSA keys
1
ssl_privkey for SSL-RSA keys
-q
This parameter enables the 'quiet' mode for the key generation. If you set this parameter, LCOS overwrites
any existing RSA or DSA keys without asking; there is no information about the progress of the operation.
You can, for example, use this parameter in a script to suppress any security prompts for the users.
SSH key generation with Linux systems
Many Linux distributions already feature the OpenSSH package. All you have to do to generate the key file is to enter a
simple command into the shell. The syntax corresponds to the LCOS command sshkeygen:
ssh-keygen [-t (dsa|rsa)] [-b <Bits>] [-f <OutputFile>]
The command ssh-keygen -t rsa -b 4096 -f hostkey creates an RSA key of 4096 bits in length,
which consists of the private component 'hostkey' and the public component 'hostkey.pub'.
SSH key generation with Windows systems
Windows systems not are inherently capable of compiling SSH keys. You should instead use a suitable utility program
such as the free software PuTTYgen.
A guide on how to create an individual key with PuTTYgen is available in the section
Generating an SSH keypair with
PuTTY
. After following the various steps to generate the key, do not use the buttons Save public key and Save private
key, but instead choose Conversions > Export OpenSSH key. The resulting OpenSSH private key can then be uploaded
into the device without further processing.
Additions to the Setup menu
Crypro algorithms
This bitmask specifies which cryptographic algorithms are allowed.
SNMP ID:
2.21.40.5
Telnet path:
Setup > HTTP > SSL
185
Reference Manual
3 Configuration
Possible values:
RC4-40
RC4-56
RC4-128
DES40
DES
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
Default:
3DES
AES-128
AES-256
AESGCM-128
AESGCM-256
186
Reference Manual
3 Configuration
4 LANCOM Management System (LCMS)
The device supports different ways (i.e. interfaces) and means (i.e. software) of configuration. There is no end of different
situations in which configurations have to be carried out, or ways in which operators prefer to work. This is why the
device offers a wide range of ways to set up the configuration.
One option is to carry out the configuration with LANconfig, the menu-based, clearly structured software that allows
you to adjust almost all of the relevant parameters.
The program LANmonitor provides an overview of the status of the device, its connections, and status values. With
WLAN devices, further information about the wireless networks and the clients connected to them are available from
the WLANmonitor.
LANtracer allows you to perform advanced trace functions for specific information (e.g. status values and function
messages), either once only or for monitoring over a longer period. The trace data it produces can be used for logging
or diagnostics.
The following sections discuss in detail the operation of the applications mentioned above.
5
To work with the various LCMS applications you will need a configuration computer with a Windows operating
system.
4.1 Searching and configuring devices
5
Always switch on your device first before starting the PC for configuration.
A Router or an Access Point can be configured in the following ways (provided that the model is equipped with the
according interface):
1
Via the local network (LAN) .
1
Via the wireless network (WLAN) , if the WLAN encryption (e.g. WEP) of a device with a wireless interface and in the
configuration PC has been adjusted correctly and/or has been deactivated.
1
Via the serial configuration interface .
1
Via a ISDN connection
Router
RouterRouter
ACCESS POINT
LAPTO P
ISDN
LAN
LAN
LAN
1 2 3 4
187
Reference Manual
4 LANCOM Management System (LCMS)
4.2 Configuration with LANconfig
4.2.1 Starting LANconfig
Start LANconfig by, for example, using the Windows Start menu: Start / Programme / LANCOM / LANconfig. LANconfig
will now automatically search for devices on the local network. It will automatically launch the setup wizard if a device
which has not yet been configured is found on the local area network LANconfig.
5
If the firewall is activated the LANconfig might not be able to find the new device in the LAN. In this occasion
deactivate the firewill whilst the configuration.
Your LANCOM device is equipped with an extensive firewall and protects your computer even if no further firewall is
active.
Find new devices
Click on the Find button or call up the command with Device E Findto initiate a search for a new device manually.
LANconfig will then prompt for a location to search. You will only need to specify the local area network if using the
inband solution, and then you're off.
188
Reference Manual
4 LANCOM Management System (LCMS)
Once LANconfig has finished its search, it displays a list of all the devices it has found, together with their names and,
perhaps a description, the IP address and its status.
The expanded range of functions for professionals
Two different display options can be selected for configuring the devices with LANconfig:
1
The 'Simple configuration display' mode only shows the settings required under normal circumstances.
1
The 'Complete configuration display' mode shows all available configuration options. Some of them should only be
modified by experienced users.
Select the display mode in the View / Options menu.
Double-clicking the entry for the highlighted device and then clicking the Configure button or the Device/ Configure
option reads the device's current settings and displays the 'General' configuration selection.
The integrated Help function
The remainder of the program's operation is self-explanatory or you can use the online help. You can click on the 'Help'
button top right in any window or right-click on an unclear term at any time to call up context-sensitive help.
Management of multiple devices
LANconfig supports multi device remote management. Simply select the desired devices, and LANconfig performs all
actions for all selected devices then, one after the other. The only requirement: The devices must be of the same type.
In order to support an easy management, the devices can be grouped together. Therefore, ensure to enable ’Folder Tree’
in the View menu, and group the devices by ’drag an drop’ into the desired folders.
189
Reference Manual
4 LANCOM Management System (LCMS)
5
LANconfig shows only those parameters that are suitable for multi device configuration when more than one
device is selected, e.g. MAC Access Control Lists for all LANCOM Access Points.
4.2.2 Switch graphical user interface language
The language for the LANconfig, LANmonitor or WLANmonitor graphical user interface can be set to 'German' or 'English'.
LANconfig: Tools / Options / Extras
LANmonitor and WLANmonitor: Tools / Options / General
190
Reference Manual
4 LANCOM Management System (LCMS)
4.2.3 Project management with LANconfig
LANconfig facilitates the configuration of various devices within a project with a range of functions that can be run on
several devices at once. If the list in LANconfig contains multiple devices, just click on the device of your choice with the
right mouse key to open a context menu offering the following actions:
1
Configure: Opens up the LANconfig configuration dialog for the selected device
1
Check: Checks if the selected device can be contacted
1
Firmware upload: Uploads firmware simultaneously to all selected devices
1
Apply Script: Applies a configuration script to all selected devices
1
Open Telnet session: Opens up multiple DOS windows and sets up a Telnet connection to each device
1
Monitor device: Starts LANmonitor for the surveillance of the selected devices
191
Reference Manual
4 LANCOM Management System (LCMS)
1
Set date/time: Sets the same time on all selected devices.
5
When setting the time, please observe the functions of the LANCOM as NTP client and NTP server.
1
Delete: Deletes the selected devices from the LANconfig list.
4.2.4 User-specific settings for LANconfig
The program settings for LANconfig are saved to the file 'lanconf.ini' located in the program directory when the program
is ended. This includes, among others, the displayed devices, directory structure, selected language, etc. When the
program is started, LANconfig reads this ini file and restores the previous status of the software. To save the ini file, the
user needs a write authorization to the program directory.
As an alternative to the .ini file in the program directory, the program settings can be read from another source. The
current user's user directory can be chosen, or indeed any other lanconf.ini from any location:
1
By selecting the user directory, users can save their personal settings even if they don't have a write authorization
for the program directory.
1
Selecting an alternative storage location can be used, for example, to transfer program settings to any other LANconfig
installation, or to save the program settings to a central location in the network for use by multiple users.
LANconfig: Options / Application
1
Use user-specific settings
Activates the use of the lanconf.ini file in the current user's directory ..\User\Application
Files\LANCOM\LANconfig.
With this option activated, changes to the program settings are saved to this ini file.
2
Possible values: On/off
2
Default: Off
5
If this option is activated in parallel with the 'Use configuration file' option, then the file selected here will
be used when the program starts and changes made to the program settings are stored to it.
1
Use configuration file
Activates the usage of the lanconf.ini from the given directory.
With this option activated, changes to the program settings are saved to the ini file selected here.
192
Reference Manual
4 LANCOM Management System (LCMS)
2
Possible values: On/off and selection of the settings file
2
Default: Off
5
The file you select must be a valid LANconfig settings file.
5
If neither of the two options is activated, the ini file from the program directory will be used instead.
4.2.5 Customizing the toolbar
To customize the toolbar, select the following options in LANconfig under View / Toolbar:
1
Standard buttons: Hides/displays the buttons.
1
Large icons: Shows a larger view of the icons.
1
Show text: Text describing the action is displayed under each icon.
1
Customize: Opens up a dialog enabling the displayed icons to be selected. A separator can be inserted between
groups of icons. The order of the icons can also be changed.
1
Reset: Resets the settings for the toolbar to the default values.
193
Reference Manual
4 LANCOM Management System (LCMS)
4.2.6 Automatic backup of configuration with LANconfig
LANconfig can automatically save backups of the current configuration prior to changes in firmware or configuration.
Global settings to be used for all devices are available under Tools / Options / Backup. Additionally, special backup
settings can be defined for individual devices. To access them, right-click the appropriate device and select entry Properties
/ Backup from the context menu.
Select the following options here:
1
Are the global or the device-specific backup settings for this device to be used (in device-specific dialogue only)?
1
The event prior to which the configuration is to be saved (firmware upload, configuration change or script execution).
1
In which format the configuration is to be saved (configuration file, script - possibly with options).
1
In which directory the configuration is to be saved.
1
How the file name of the backup file is to be structured. Placeholders can be used for device information (IP address,
hardware type, etc.) and time information. Please refer to the online help function for further information on
placeholders.
4.2.7 Directory structure
LANconfig uses a directory structure for a clear overview when managing multiple devices. Folders dedicated to projects
or customers can be set up to organize the relevant devices:
1
Create a new folder by clicking on the parent directory with the right mouse key and selecting "New Folder" from
the context menu.
1
Just use the mouse to drag and drop the devices into the appropriate folder. Devices can also be moved from one
folder to another in this way.
194
Reference Manual
4 LANCOM Management System (LCMS)
5
The arrangement of devices in folders effects only the display of the devices within LANconfig. The organization
of the folders has no influence on the configuration of the devices.
5
The directory structure in the left margin of the LANconfig window can be switched on and off with the F6
function key or by using the menu View / Folder Tree.
4.2.8 Better overview in LANconfig with more columns
Even for large-scale projects, a better overview and quicker orientation are facilitated in LANconfig by the columns
featuring device-related details that can be displayed or concealed according to your needs. Simply click on the column
header with the right-hand mouse button and use Select columns. The menu item Arrange icons allows you to sort
the items as you prefer.
The following details can be displayed in the various columns:
1
Device name
1
Description
1
Address
1
Device status
1
Progress
1
Device type
1
Hardware release
1
Serial number
1
MAC address
1
Firmware version (active)
1
Firmsafe
1
1. Image version
195
Reference Manual
4 LANCOM Management System (LCMS)
1
2. Image version
4.2.9 Multithreading
The management of larger projects can be aided by simultaneously opening up configuration windows for multiple
devices to compare similarities and differences. LANconfig allows multiple configuration dialogs to be opened at the
196
Reference Manual
4 LANCOM Management System (LCMS)
same time ("multithreading"). After opening the configuration for a device, simply open up further configurations from
the device list in LANconfig. All of the configurations can be processed in parallel.
5
"Cut and paste" can be used to transfer content between the configuration windows via the Windows clipboard.
Multithreading allows changes to both the internal configurations of the available devices and to the configuration files.
Each configuration is written separately to the file and to the device when the dialog is closed.
4.2.10 Manual and automatic searches for firmware updates
To make the update of LANCOM devices with new firmware as convenient as possible, the firmware files for the various
LANCOM models and LCOS versions are, ideally, saved to a central archive directory. The search for new versions of the
firmware in this directory can either be initiated manually or automatically after starting LANconfig.
197
Reference Manual
4 LANCOM Management System (LCMS)
Automatic search for firmware updates
The directory where LANconfig is to search for the updates is set under Tools / Options / Extras. It is also possible
to set up LANconfig to search the firmware archive and to check if any of the devices found require an update. With this
option activated, starting LANconfig automatically displays all of the devices for which new updates are available.
198
Reference Manual
4 LANCOM Management System (LCMS)
Manual search for firmware updates
To search manually for firmware updates, click with the right-hand mouse key on a device marked in the list and select
the following point from the context menu: Firmware management / Check for firmware update. If you wish to
update several devices simultaneously, the entry Check for firmware updates is displayed directly in the context menu.
View a full list of all firmware versions
If your search in the archive did not reveal a new firmware version, you can alternatively view a full list of all of the
firmware files that have been found. You can, for example, switch back to an older version. LANconfig displays all versions
found for the marked devices, including the version currently active in each device. For each device, you can select
precisely one firmware version that will then be uploaded onto the device.
199
Reference Manual
4 LANCOM Management System (LCMS)
4.2.11 Password protection for SNMP read-only access.
The read-only access to a LANCOM device via SNMP—for example with LANmonitor--can be password protected. This
uses the same user data as with access to LANconfig. Password protection of SNMP access means that the user data
must be entered before information about the device status, etc. can be accessed over SNMP.
User information can be entered in LANmonitor separately for each device. To do this, click with the right-hand mouse
key on the required device, select the Options point from the context menu and enter your user data.
Access rights in LANmonitor depend on the rights possessed by the user:
1
A supervisor has full access to the information in LANmonitor and can execute actions such as closing a connection,
among others.
1
A local administrator also has full access to the information in LANmonitor and can execute actions such as closing
a connection, among others.
1
A user with read-only rights can view the information in LANmonitor but cannot take any actions such as closing a
connection.
200
Reference Manual
4 LANCOM Management System (LCMS)
1
A user without rights has no SNMP access to the device's information.
LANconfig: Management/ General
WEBconfig: LCOS menu tree / Setup / Config modul / Password-required-for-SNMP-read-access
4.2.12 Device-specific settings for communications protocols
With LANconfig, all device actions are conducted using the TFTP protocol. Since this protocol has disadvantages compared
to other protocols when transmitting large volumes of data, the protocols HTTPS and HTTP can also be used as alternatives.
The use of the protocols can be set either globally for all devices managed by a LANconfig or specifically for each individual
device. The global settings overwrite the specific settings here – therefore, in the specific device settings, only the settings
allowed in the global configuration can take effect.
201
Reference Manual
4 LANCOM Management System (LCMS)
Configuration of the global communication settings
When setting up the communications protocols, one must differentiate between the protocol that is used solely for
checking the device and for other operations such as a firmware upload, etc.:
LANconfig: Tools / Options / Communication
1
HTTPS, HTTP, TFPT
When this is selected, the individual protocols are enabled for the operations firmware upload, configuration
up/download, and script up/download. In these operations, LANconfig attempts to use these protocols in the order
HTTPS, HTTP and TFTP. If the transfer fails when using a selected protocol, then the next protocol is automatically
attempted.
1
Prefer checks via TFTP
When checking the devices, only small amounts of data are transferred with the system information. As such, device
checks could be performed using the TFTP protocol, particularly in the LAN. When this option is activated, the TFTP
protocol is used to check the device first, regardless of the previously set communications protocols. If the check via
TFTP fails, then the protocols HTTPS and HTTP are attempted in that order.
5
The device-specific settings are subordinate to the global communications settings. This allows, for example,
the use of a protocol to be restricted centrally.
202
Reference Manual
4 LANCOM Management System (LCMS)
Configuration of the specific communication settings
For configuring the specific communications settings, the properties dialog of a device is opened via the context menu
(right-click on mouse):
1
HTTPS, HTTP, TFPT
Select the communications protocols as described in the global settings:
In the fields under the protocols, the port to be used can be entered using the following default values:
2
HTTPS: 443
2
HTTP: 80
2
TFTP: 69
1
Prefer checks via TFTP
Preferred checking via TFTP as described in the global settings.
For all specific communications settings, the global settings are considered to be superordinate. A protocol can
therefore only be used for operating a device when it is also activated in the global settings.
4.2.13 LANconfig behavior at Windows startup
LANconfig can be automatically started when the operating system starts.
203
Reference Manual
4 LANCOM Management System (LCMS)
Configuring the behavior of LANconfig at startup
The following parameters are used to configure the startup behavior of LANconfig:
LANconfig: Options / Extras / Application
1
Windows system startup
2
Start LANconfig never: LANconfig does not start automatically with the operating system, and it has to be started
manually.
2
Start LANconfig always: LANconfig always starts automatically after Windows starts successfully.
2
Start LANconfig like last time: LANconfig starts in the program in the same status as when Windows was shut
down the last time: If LANconfig was active then it will be started again; if inactive, LANconfig will not be
automatically restarted.
5
When changing to a setting that enables LANconfig to be started automatically, a change is made to the
operating system's registry. Personal firewalls on the computer or the operating system itself (Windows XP
or Windows VistaTM) may interpret this change as an attack and may issue a warning or even prevent the
entry from being made. In order for LANconfig's startup behavior to be controlled as desired, you can ignore
these warnings and allow the changes to be made.
204
Reference Manual
4 LANCOM Management System (LCMS)
4.2.14 Choice of Wizard or configuration dialog
You can define how LANconfig reacts when an entry in the list of devices is double-clicked, i.e. whether a Setup Wizard
or the dialog for manually editing the configuration appears.
The standard behavior of LANconfig can be set under:
LANconfig: Tools / Options / Extras
1
Editing the configuration
205
Reference Manual
4 LANCOM Management System (LCMS)
Use Wizard as standard: Double-clicking on a device entry in LANconfig will open up a dialog offering a choice
of Wizards. As an alternative, the option 'Manually edit the configuration' can be selected here.
2
2
Edit manually as standard: Double-clicking on a device entry in LANconfig will open up a dialog for editing the
configuration manually.
4.2.15 WLAN configuration with the wizards in LANconfig
Highly convenient installation wizards are available to help you with the configuration of LANCOM Access Points for
your wireless LAN.
The settings include the general shared parameters and also the individual settings for one or more logical wireless LAN
networks (WLAN radio cells or SSIDs).
206
Reference Manual
4 LANCOM Management System (LCMS)
1. Mark your LANCOM Access Point in the selection window in LANconfig. From the command line, select Extras /
Setup Wizard.
1. In the selection menu, select the Setup Wizard, Configure WLAN interface and confirm the selection with Continue.
2. Make the settings as requested by the wizard and as described as follows.
Country settings
Regulations for the operation of WLAN cards differ from country to country. The use of some radio channels is prohibited
in certain countries. To operate the LANCOM Access Points while observing the regulations in various countries, all
physical WLAN interfaces can be set up for the country where they are operated.
WLAN module operation
The WLAN modules can be operated in various operating modes:
1
As a base station (Access Point mode), the device makes the link between WLAN clients and the cabled LAN. Parallel
to this, point-to-point connections are possible as well.
1
In Managed Mode the Access Points also accept WLAN clients into the network, although the clients then join a
WLAN infrastructure that is configured by a central WLAN-Controller. In this operating mode, no further WLAN
configuration is necessary as all WLAN parameters are provided by the WLAN-Controller.
1
In client mode, the device itself locates the connection to another Access Point and attempts to register with a wireless
network. In this case the device serves, for example, to link a cabled network device to an Access Point over a wireless
connection. In this operating mode, parallel point-to-point connections are not possible.
For further information please refer to section  Client Mode.
Physical WLAN settings
Along with the radio channels, the physical WLAN settings can also be used to activate options such as the bundling of
WLAN packets (TX Burst), hardware compression, or the use of QoS compliant with 802.11e. You also control the settings
for the diversity behavior here.
207
Reference Manual
4 LANCOM Management System (LCMS)
Logical WLAN networks
Each WLAN module can support up to eight logical WLAN networks for mobile WLAN clients to register with. The
following parameters have to be set when configuring a logical WLAN network:
1
The network name (SSID)
1
Open or closed radio LAN
1
Encryption settings
1
MAC filter
1
Client-bridge operation
1
Filter settings
Point-to-point settings
The configuration of P2P connections involves setting not only the operating mode but also the station name that the
Access Point can connect to. Also, the role as "Master" or "Slave" is set here.
Along with the settings for the Access Point itself, also to be defined is the remote site that the Access Point can contact
via the P2P connection.
For further information please refer to section  Point-to-point connections.
4.2.16 Addition(s) to LCOS 8.00
LANconfig configuration tree
As of version 8.00, the two top layers of the configuration menu in LANconfig are permanently visible in a dedicated
area as a "configuration tree". This new structure makes it easier to navigate through the program for quick switching
between the main configuration areas.
208
Reference Manual
4 LANCOM Management System (LCMS)
4.2.17 Addition(s) to LCOS 8.50
LANCOM QuickFinder
The configuration dialogs in LANconfig, LANmonitor and WLANmonitor include numerous sections, parameters and
their values, as well as tables.
LANCOM QuickFinder in LANconfig
In the main view of LANconfig you will find the LANCOM QuickFinder in the toolbar. Entering a search term in the search
window reduces the number of available devices in the list. LANconfig searches through all the values available in the
columns in the device list, including any hidden columns. Click on the icon next to the magnifying glass to make the
search case sensitive.
If you are looking for a particular value or term in LANconfig or in the configuration, LANCOM QuickFinder quickly
displays all of the locations where the string occurs in the LANconfig dialogs.
1. Start LANconfig.
2. Open the device configuration that you want to search through.
3. In the search box, type the phrase that you are looking for (e.g. 'wlan'). Searching is not case-sensitive. You can
enter parts of words or numbers, as well as complete strings. If there are spaces in the search string, then only strings
containing the matching spaces will be searched for. The search function does not support wildcards.
209
Reference Manual
4 LANCOM Management System (LCMS)
The configuration tree in the left pane of LANconfig is now reduced to just those sections that feature the search string:
Select an area in the configuration (e.g. 'WLAN/General') to view the relevant search results framed in color in the
configuration dialog:
5
In LANconfig version 8.50, the search results in the firewall section are not displayed in color.
210
Reference Manual
4 LANCOM Management System (LCMS)
Use the navigation buttons 'forwards' and 'back' to move between the most recently visited dialogs:
For quick access to the last 10 visited dialogs, click on the arrow to the right of the 'forwards' button:
Click on the 'x' to the right of the search box to clear the search and display all entries in the configuration again.
An option to reduce the number of search results is to select the sections where LANconfig should limit the search to.
Click on the magnifying glass to the left of the search box and select or deselect the required categories. Here you can
also specify whether the search should highlight the results in color, or whether the configuration tree is to be reduced
to the relevant dialogs only:
5
LANconfig resets the search settings and the list of recent dialogs when the configuration is closed.
LANCOM QuickFinder in LANmonitor
Depending on the application, LANmonitor can display multiple devices with entries containing the searched term. After
starting the search LANmonitor initially highlights the first finding. You can move between the search results either by
211
Reference Manual
4 LANCOM Management System (LCMS)
using the arrow keys to the right of the search window, or by pressing Ctrl+F3 for the next occurrence and Ctrl+Shift+F3
to the previous occurrence.
LANCOM QuickFinder in WLANmonitor
WLANmonitor includes access points and WLAN clients. Clicking on the magnifying glass on the left side of the search
window opens a context menu to select the type of search. Depending on the application you can search for access
points only, clients only, or all entries.
For example, your configuration may contain settings for your Internet provider. To find these you just have to enter the
name to find all of the places in the configuration that refer to this provider.
You can search for text from the following areas:
212
Reference Manual
4 LANCOM Management System (LCMS)
1
Entries in the configuration tree
1
Names of the sections in each configuration dialog
1
Parameters
1
Values of the parameters
1
Explanatory texts in the dialogs
1
Table names
1
Column names in tables
To use the search in LANconfig proceed as follows:
LANCOM QuickFinder in LANconfig
In the main view of LANconfig you will find the LANCOM QuickFinder in the toolbar. Entering a search term in the search
window reduces the number of available devices in the list. LANconfig searches through all the values available in the
columns in the device list, including any hidden columns. Click on the icon next to the magnifying glass to make the
search case sensitive.
If you are looking for a particular value or term in LANconfig or in the configuration, LANCOM QuickFinder quickly
displays all of the locations where the string occurs in the LANconfig dialogs.
1. Start LANconfig.
2. Open the device configuration that you want to search through.
3. In the search box, type the phrase that you are looking for (e.g. 'wlan'). Searching is not case-sensitive. You can
enter parts of words or numbers, as well as complete strings. If there are spaces in the search string, then only strings
containing the matching spaces will be searched for. The search function does not support wildcards.
213
Reference Manual
4 LANCOM Management System (LCMS)
The configuration tree in the left pane of LANconfig is now reduced to just those sections that feature the search string:
Select an area in the configuration (e.g. 'WLAN/General') to view the relevant search results framed in color in the
configuration dialog:
5
In LANconfig version 8.50, the search results in the firewall section are not displayed in color.
214
Reference Manual
4 LANCOM Management System (LCMS)
Use the navigation buttons 'forwards' and 'back' to move between the most recently visited dialogs:
For quick access to the last 10 visited dialogs, click on the arrow to the right of the 'forwards' button:
Click on the 'x' to the right of the search box to clear the search and display all entries in the configuration again.
An option to reduce the number of search results is to select the sections where LANconfig should limit the search to.
Click on the magnifying glass to the left of the search box and select or deselect the required categories. Here you can
also specify whether the search should highlight the results in color, or whether the configuration tree is to be reduced
to the relevant dialogs only:
5
LANconfig resets the search settings and the list of recent dialogs when the configuration is closed.
For example, your configuration may contain settings for your Internet provider. To find these you just have to enter the
name to find all of the places in the configuration that refer to this provider.
You can search for text from the following areas:
1
Entries in the configuration tree
1
Names of the sections in each configuration dialog
1
Parameters
1
Values of the parameters
1
Explanatory texts in the dialogs
1
Table names
1
Column names in tables
To use the search in LANconfig proceed as follows:
215
Reference Manual
4 LANCOM Management System (LCMS)
LANCOM QuickFinder in LANmonitor
Depending on the application, LANmonitor can display multiple devices with entries containing the searched term. After
starting the search LANmonitor initially highlights the first finding. You can move between the search results either by
using the arrow keys to the right of the search window, or by pressing Ctrl+F3 for the next occurrence and Ctrl+Shift+F3
to the previous occurrence.
LANCOM QuickFinder in WLANmonitor
WLANmonitor includes access points and WLAN clients. Clicking on the magnifying glass on the left side of the search
window opens a context menu to select the type of search. Depending on the application you can search for access
points only, clients only, or all entries.
216
Reference Manual
4 LANCOM Management System (LCMS)
LANCOM Software Update for LCMS
The software update for LCMS allows you to automatically download new versions of the LCMS and your device firmware.
5
New versions for LCMS (LANconfig, LANmonitor and WLANmonitor) are downloaded directly from the freely
accessible download section of the LANCOM web server. Device-specific software such as new firmware versions
require an account in the customer portal myLANCOM.
Manually starting the Software Update
To start the software update manually in LANconfig proceed as follows:
1. Start LANconfig.
2. Click on the Tools menu and select 'Check for updates...'.
LANconfig searches the local firmware archive for updates. Optionally, you can extend the search with the following
items:
1
Find more updates online in the download area of the LANCOM web server.
1
Include Release Candidates in the search. If you enable this option, the Software Update will not only offer to
download the released software versions for use in productive environments, but also any available release candidates.
5
Release candidates include the new features of upcoming software versions and have been thoroughly tested.
Until the final release of version, the software may be further optimized—partly due to user feedback.
Settings for the automatic search for new updates
Proceed as follows to start the software update automatically in LANconfig each time the application starts:
1. Start LANconfig.
2. Click on the Tools menu and select 'Options...'.
217
Reference Manual
4 LANCOM Management System (LCMS)
3. Go to the 'Update' tab.
Configure the following items for the automatic update:
1
Select the time interval for the automatic check for updates (daily, weekly or monthly). Alternatively, disable the
automatic search with the setting 'Never'.
1
Find more updates online in the download area of the LANCOM web server.
1
Release candidates include the new features of upcoming software versions and have been thoroughly tested.
Until the final release of version, the software may be further optimized—partly due to user feedback.
5
Include Release Candidates in the search. If you enable this option, the Software Update will not only offer to
download the released software versions for use in productive environments, but also any available release candidates.
1
Select a suitable location for the firmware archive. The firmware archive has the following functions:
2
When carrying out the automatic search for updates, LANconfig searches this location for new versions of the
LCMS and the firmware.
2
This is the location where LANCOM Software Update stores the updates from the download section of the LANCOM
web server.
Selecting and installing the available updates
After successful connection to the update server, LANconfig displays the available updates.
218
Reference Manual
4 LANCOM Management System (LCMS)
Select the appropriate versions and click on 'Download'. As an alternative, you can click on the entries with the right-hand
mouse key and select the entry 'Select all' or 'Select none' from the context menu.
5
The first time you select firmware for download, the LANCOM Software Update requests you to enter your login
data for myLANCOM.
LANCOM Software Update now downloads the selected software one after other and stores the files in the firmware
archive.
219
Reference Manual
4 LANCOM Management System (LCMS)
After successfully downloading the software, LANCOM Software Update offers to install the downloaded software
(LANconfig and LANmonitor only):
After installation, the LANCOM Software Update displays the results of the update procedure:
Software update via MyLANCOM
For some functions, the LANCOM Software Update requires access to the customer portal myLANCOM.
Proceed as follows to enter your myLANCOM credentials:
1. Start LANconfig.
2. Click on the Tools menu and select 'Check online for updates...'.
3. In the dialog with the results of the software updates, click on the 'Settings' button.
4. In the next dialog, enter the user name and password for access to myLANCOM.
220
Reference Manual
4 LANCOM Management System (LCMS)
5. If you wish, you can select the option 'Offer release candidate updates if available'. If you enable this option, the
Software Update will not only offer to download the released software versions for use in productive environments,
but also any available release candidates.
4.2.18 Addition(s) to LCOS 8.60
Exporting CSV data sets
You can export the list of devices found on the network and later import them into LANconfig in one go. LANconfig
stores the list of managed devices in a CSV file.
To export the data, proceed as follows:
1. Select the menu item File > Export device list.
2. Set the location to save the file.
3. Enter a file name.
4. Specify the column separator, which separates the various device parameters.
5. Start saving by clicking on Save.
6. A dialog confirms the number of data sets stored.
7. Close the dialog by clicking OK.
The CSV file that is generated contains the following data:
DEVICE_PATH;DEVICE_INTERFACE;DEVICE_ADDRESS;DEVICE_TIMEOUT;DEVICE_STARTUP;
DEVICE_PROTOCOLS;DEVICE_PORTS;DEVICE_ADMIN;DEVICE_PASSWORD;DEVICE_NAME;
DEVICE_DESCRIPTION;DEVICE_TYPE;DEVICE_SERNO;DEVICE_HWADDR;DEVICE_HWREL;
DEVICE_LOCATION;DEVICE_COMMENT;DEVICE_BACKUP;DEVICE_VPN
Group1;IP;192.168.2.35;10;1;263;;admin;Ht34bd5L;Etage1;L-54ag;LANCOM
L-54ag Wireless;008520600482;00a0570bc9bf;B;;;;
Group1;IP;192.168.2.34;10;1;263;;admin;Ht34bd5L;Etage2;L-54ag;LANCOM
L-54ag Wireless;008520600843;00a05719a8fb;B;;;;
The first row contains the name of the device parameters. Each row that follows contains the parameter values for one
device. If 2 semicolons appear in direct succession, then the enclosed parameter value is blank.
The variable name in the first row correspond to the following LANconfig entries:
1
DEVICE_PATH: Path name in the folder view
1
DEVICE_INTERFACE: Connection type
1
DEVICE_ADDRESS: IP address or domain name and COM port or telephone number respectively
1
DEVICE_TIMEOUT: Maximum response time of the device
1
DEVICE_STARTUP: Device check at startup
1
DEVICE_PROTOCOLS: Communication protocols
221
Reference Manual
4 LANCOM Management System (LCMS)
1
DEVICE_PORTS: Ports
1
DEVICE_ADMIN: Administrator name
1
DEVICE_PASSWORD: Administrator password
1
DEVICE_NAME: Device name
1
DEVICE_DESCRIPTION: Description
1
DEVICE_TYPE: Device type
1
DEVICE_SERNO: Serial number
1
DEVICE_HWADDR: MAC address
1
DEVICE_HWREL: Hardware release
1
DEVICE_LOCATION: Location
1
DEVICE_COMMENT: Comment
1
DEVICE_BACKUP: Storage location for the configuration backup created by LANconfig
1
DEVICE_VPN: Parameter set for 1-Click-VPN
5
Use a text editor or spreadsheet to manage the list of exported devices.
5
If a device password is stored in LANconfig, the password is saved in plain text in the CSV file. Remember to
delete these access credentials before you pass this file on or save it to a freely accessible server.
Additions to the menu system
File
The menu item 'File' is used to manage devices in general and to exit LANconfig.
Export device list
You can export the list of devices found on the network and later import them into LANconfig in one go. LANconfig
stores the list of managed devices as a CSV file.
Importing from a data source
In LANconfig you can import a large number of devices from a script file in one go by processing the device files with
an Import Wizard. You also have the option of using this device file together with a configuration template file to create
a custom configuration file for each device. The template file contains variables for the values in the device file.
5
The device file is saved in CSV format.
Additions to the menu system
File
The menu item 'File' is used to manage devices in general and to exit LANconfig.
Devices/configurations from CSV file...
In LANconfig you can import a large number of devices from a script file in one go by processing the device files with
an Import Wizard. You also have the option of using this device file together with a configuration template file to create
a custom configuration file for each device. The template file contains variables for the values in the device file.
Example application: Importing from a single data source
This scenario describes how to use a script file and a simple CSV-format device file to generate your own data source
for importing data.
222
Reference Manual
4 LANCOM Management System (LCMS)
Content of the CSV file
The CSV file contains device-related data records, which LANconfig can import. This provides you with a convenient
method of managing this data on the network.
The following is an example of a simple CSV file:
CONFIG_FILENAME;DEVICE_PATH;DEVICE_INTERFACE;DEVICE_ADDRESS;DEVICE_LOCATION;DEVICE_NAME;KEY;USER
Fil52146.lcs;Affiliate/NRW;IP;192.168.1.1;Wuerselen;Fil52146;secret1;user1@internet
Fil80637.lcs;Affiliate/BAY;IP;192.168.2.1;Muenchen;Fil80637;secret2;user2@internet
The header contains the names of the device parameters. The following lines itemizes the various devices line by line,
and their parameters are separated by semicolons. If 2 semicolons appear in direct succession, then the enclosed
parameter value is blank.
The parameter names on the first line can be freely defined. If you decide to use the standard LANCOM variable names,
LANconfig automatically allocates the device parameters during the import.
1
DEVICE_PATH: Path name in the folder view
1
DEVICE_INTERFACE: Connection type
1
DEVICE_TIMEOUT: Maximum response time of the device
1
DEVICE_STARTUP: Device check at startup
1
DEVICE_PROTOCOLS: Communication protocols
1
DEVICE_PORTS: Ports
1
DEVICE_ADMIN: Administrator name
1
DEVICE_PASSWORD: Administrator password
1
DEVICE_NAME: Device name
1
DEVICE_DESCRIPTION: Description
1
DEVICE_BACKUP: Storage location for the configuration backup created by LANconfig
1
DEVICE_VPN: Parameter set for 1-Click-VPN
If you choose not to use the LANCOM default variable names, you may need to manually assign the values to the
appropriate device properties in LANconfig during the import.
Content of the configuration template file
The template file contains Telnet commands that Telnet executes sequentially. This is why this template file is also referred
to as a script file.
5
For an overview of the available Telnet commands see the Reference Manual chapter "Configuration with different
tools" under "Telnet".
A configuration template file can appear as follows:
lang English
flash No
set /Setup/Name "$DEVICE_NAME$"
set /Setup/SNMP/Location "$DEVICE_LOCATION$"
cd /Setup/TCP-IP/Network-list
tab Network-name IP-Address IP-Netmask VLAN-ID Interface Src-check Type Rtg-tag Comment
add "INTRANET" $DEVICE_ADDRESS$ 255.255.255.0 0 any loose Intranet 0 "local intranet"
cd /
cd /Setup/WAN/PPP
tab Peer Authent.request Authent-response Key Time Try Conf Fail Term Username Rights
add "INTERNET" none PAP "$KEY$" 6 5 10 5 2 "$USER$" IP
cd /
cd /Setup/WAN/DSL-Broadband-Peers
del *
223
Reference Manual
4 LANCOM Management System (LCMS)
tab Peer SH-Time AC-name Servicename WAN-layer ATM-VPI ATM-VCI MAC-Type user-def.-MAC
DSL-ifc(s) VLAN-ID
add "INTERNET" 9999 "" "" "PPPOEOA" 1 32 local 000000000000 "" 0
cd /
cd /Setup/IP-Router/IP-Routing-Table
tab IP-Address IP-Netmask Rtg-tag Peer-or-IP Distance Masquerade Active Comment
add 255.255.255.255 0.0.0.0 0 "INTERNET" 0 on Yes "default route"
cd /
flash Yes
# done
exit
The variables begin and end with a character or a string (here:'$').
In this template file, the variables represent certain device parameters. During the import process, you associate these
variables with the corresponding entries in the device file. The Configuration Wizard then replaces the variables with the
associated device data from the CSV file.
Creating the configuration files
Proceed as follows to create device-specific configuration files:
1. Open the Import Wizard in the menu File > Devices/Configurations from CSV file....
2. If necessary, confirm the Welcome dialog with Next. The option to Skip this page on next call will suppress the
appearance of the welcome screen when the Wizard is run in future.
3. If applicable, select the profile used for a previous data import. The option Skip profile settings and start the
import immediately uses the settings in the selected profile without modification. Select <New profile> to use
a new profile instead of an existing one. Click on Next.
224
Reference Manual
4 LANCOM Management System (LCMS)
4. In the Data source field enter the path to the CSV file. With Browse ... you select the file from your local file system.
5. You can select the column delimiter in the CSV file. The default is the semicolon.
6. Set the row number where the data records start. This allows you to avoid importing any existing column headings
and additional information. If a line in the CSV file contains only LANCOM default variable names (see section
Exporting CSV data sets
), then this line is used to assign the variables automatically. This ensures that exporting and
importing the same file will function without any manual assignment. However, if a configuration is generated with
additional variables, the auto-detect will not function.
7. The Preview field instantly shows the parameters you have selected for import. Confirm your entries with Next.
8. To use the data records to create new devices in LANconfig, select the option Automatically create devices in
LANconfig. After clicking Next, the following pages are used to select the device properties to be carried over to
LANconfig.
5
If this option is disabled, the Wizard will skip the subsequent 2 steps.
225
Reference Manual
4 LANCOM Management System (LCMS)
9. The devices are identified using their connection address. Use the drop-down list to select the column in the data
set that contains the connection address and click on Next. If you use LANCOM default variable names, assignment
takes place automatically.
10. Align the columns according to the relevant device properties. Properties that have been aligned are marked in the
list with a preceding "+". Then click on Next. If you use LANCOM default variable names, assignment takes place
automatically.
226
Reference Manual
4 LANCOM Management System (LCMS)
11. You have the option to create individual configuration files from the data sets. Simply activate the option Generate
configuration files.
12. Use the Template field to set the path to the template file to be used as the basis for these configuration files. By
clicking on Browse you open the dialog for loading a configuration script template. In the fields Variable start and
Variable end you define which characters (or strings) are to mark the start and end of the variables in the template
file. This enables the Wizard to identify the variables in the template file.
13. You determine the storage path in the field Target path. This is where LANconfig stores the new configuration files.
Click on Browse to specify a target path on your local file system. Click on Next.
14. Assign the columns in the data source to the variables used in the template file. Do this by selecting the column
number from the list of columns and assigning this number to a variable from the properties list. Variables are also
assigned automatically if the column headings contain the same variable names as those between the start and end
characters in the script file. The column headings in the view below updates immediately with every change. To
continue, click on Next.
5
If your entries are incomplete, the Wizard alerts you about potential import problems and suggests corrections.
227
Reference Manual
4 LANCOM Management System (LCMS)
15. The summary informs you about the actions that are executed in the next step. If you need to make any changes,
click on Back. This returns you to the appropriate input mask. By clicking on Next you start the data import.
5
If the data import would overwrite a device that already exists in LANconfig, the Wizard gives you the
following options:
1
Overwrite the device.
1
Create a configuration file anyway.
1
Use this decision for all other existing devices.
16. The status dialog that follows indicates the actions performed. Click on Copy to clipboard to save the status message
to the clipboard. Click on Next.
17. Finally, you have the option to save the current import settings to a profile for future actions.
18. Complete the import by clicking on Finish.
If you have opted to generate a custom configuration file, the Wizard saves a separate configuration file for each device
in the specified folder. These configuration files are named according to the file name "<CONFIG_FILENAME>.lcs", which
defines the CSV file:
lang English
flash No
set /Setup/Name "Fil52146"
set /Setup/SNMP/Location "Wuerselen"
cd /Setup/TCP-IP/Network-list
tab Network-name IP-Address IP-Netmask VLAN-ID Interface Src-check Type Rtg-tag Comment
add "INTRANET" 192.168.1.1 255.255.255.0 0 any loose Intranet 0 "local intranet"
cd /
cd /Setup/WAN/PPP
tab Peer Authent.request Authent-response Key Time Try Conf Fail Term Username Rights
add "INTERNET" none PAP "secret1" 6 5 10 5 2 "user1@internet" IP
cd /
cd /Setup/WAN/DSL-Broadband-Peers
del *
tab Peer SH-Time AC-name Servicename WAN-layer ATM-VPI ATM-VCI MAC-Type user-def.-MAC
DSL-ifc(s) VLAN-ID
add "INTERNET" 9999 "" "" "PPPOEOA" 1 32 local 000000000000 "" 0
cd /
cd /Setup/IP-Router/IP-Routing-Table
tab IP-Address IP-Netmask Rtg-tag Peer-or-IP Distance Masquerade Active Comment
add 255.255.255.255 0.0.0.0 0 "INTERNET" 0 on Yes "default route"
cd /
228
Reference Manual
4 LANCOM Management System (LCMS)
flash Yes
# done
exit
The Wizard has replaced all variables with the appropriate device parameters.
This configuration file gives you the option to use LANconfig to transfer the device settings as defined in the template
file to other devices. Highlight the appropriate device and click on Device > Configuration management > Restore
script from script file.
Better overview in LANconfig with more columns
As a help for large-scale projects, LANconfig provides a better overview and quicker orientation with its columns featuring
device-related details that can be shown or hidden according to your needs. Choose the columns to be displayed from
View > Select columns. The menu item View > Arrange icons allows you to sort the items as you prefer.
229
Reference Manual
4 LANCOM Management System (LCMS)
5
Sort the view by clicking with the left mouse button in the appropriate column heading. Each new click reverses
the sorting.
The following details can be displayed in the various columns:
1
Name
1
Folder
1
Description
1
Comment
1
Address
1
Location
1
Device status
1
Progress
1
Device type
1
Product code
1
Hardware release
1
Serial number
1
MAC address
1
Firmware version
1
Firmsafe
1
1) Image version
1
2) Image version
With Select all or Hide all you can show or hide all columns with just one click.
230
Reference Manual
4 LANCOM Management System (LCMS)
5
The column Comment contains the information in comment field 1 for the device.
4.2.19 Addition(s) to LCOS 8.80
Creating a password in LANconfig
LANconfig provides the option to automatically generate a password at all points in the configuration, which require
the input of a password or a passphrase.
231
Reference Manual
4 LANCOM Management System (LCMS)
Enable the option Show next to the box for entering the password. Then click on the button Generate password to
create a password suggestion.
Optionally click the arrow next to the Generate password button to open the dialog box for the password policy
settings.
Use the slider to set the desired password strength. With the User defined setting, you can define the maximum password
length and the required character types. The settings Good, Very goodand Maximum are predefined settings with
reasonable, non-modifiable values.
After making your changes, click on the Generate password button again to create a new password proposal in line
with your password guidelines.
5
LANconfig stores the current settings in this dialog box for the current user.
Internal browser in LANconfig
Until now, LANconfig opened WEBconfig in the system's default browser. As of LCOS version 8.80, you have the option
of starting LANconfig's own internal browser as an alternative.
LANconfig menu structure
Using the menu bar, you can manage devices and their configurations, and you can customize the appearance and
functioning of LANconfig.
Device
Under the menu item Device you can edit the configurations of devices connected to the network, organize firmware
updates and monitor device connections.
The functions in the Device menu are only offered for selection if at least one device has been chosen from the list of
devices. The menu can also be called by clicking on a device with the right mouse button when it is marked.
232
Reference Manual
4 LANCOM Management System (LCMS)
WEBconfig / console session
You can select the following actions under Device > WEBconfig / console session:
Open web browser
Opens the web browser for the device marked.
5
Under Tools > Options > Extras > Browser used to display WEBconfig, you choose whether
LANconfig should use the system default browser or its own internal browser.
233
Reference Manual
4 LANCOM Management System (LCMS)
Open Telnet session
Opens the telnet session.
Open SSH session
Opens a configuration session with an SSH client.
5
For Telnet and SSH connections, you must specify the programs that LANconfig should use to connect to the
device. Set these items under Tools > Options > Extras > External programs.
Extras
Clicking on Tools > Options opens up the dialog box for further optional settings. (You can also reach this dialog box
by pressing F7).
Options
Under the menu item Options you can invoke additional functions, for example to communicate with connected devices,
invoke external applications, or carry out automatic searches for firmware updates.
Extras
This dialog window allows you to make additional settings.
234
Reference Manual
4 LANCOM Management System (LCMS)
Set up new devices
If this option is checked, LANconfig launches the Setup Wizard whenever it finds an unconfigured device.
External programs
This item determines the executable files for the Telnet client and the SSH client to be used by LANconfig for
connections to the devices.
Automatic retry
Attempts
Specify the number of attempts for a firmware or configuration upload.
You can set a number between 1 and 9999. LANconfig always attempts to make a connection. If this fails a
retry is attempted after the defined interval. The operation is retried until LANconfig reaches the number of
defined attempts or until the operation succeeds. LANconfig may terminate the retries if a situation arises in
which completion is unlikely without external intervention. This may be when the device cannot open a file,
for example.
Time interval
Enter the time interval in minutes between two attempts to upload the firmware or configuration. You can
set an interval between 1 and 9999.
Browser used to display WEBconfig
This item sets the default browser used by LANconfig to display WEBconfig. You can choose between your
operating system's default browser and LANconfig's internal browser, LCCEF (LANCOM Chromium Embedded
Framework).
235
Reference Manual
4 LANCOM Management System (LCMS)
Setting the SNMP read-only community 'Public'
In LANconfig, the setting for the SNMP read-only community 'Public' is to be found under Management > Admin.
Quicklinks for managing source tables
Values can be selected from an input field after they have previously been specified in one or more tables. So-called
Quicklinks offer you a direct way to manage these source tables. This allows you to bypass the default configuration
order. Instead of creating new elements after first exiting the current selection, you can create these items directly if
necessary. These new elements are immediately available for selection.
236
Reference Manual
4 LANCOM Management System (LCMS)
To clarify the structure of the configuration, LANconfig shows the configuration path apart along with the individual
sources. If the configuration parameters can be chosen from multiple source tables, LANconfig groups the entries
accordingly. For each group, LANconfig additionally specifies the number of entries contained.
4.2.20 Addition(s) to LCOS 8.82
SSH configuration protocol in LANconfig
In conjunction with CC compliance (Common Criteria), LANconfig supports the configuration of LANCOM CC products
via SSH or data transfer via SCP as of the LCOS version 8.82.
Enhancements to LANconfig
Device-specific settings for communications protocols
The transfer of configuration data when working with LANconfig can be handled by various protocols: HTTPS, SSH, HTTP
or TFTP.
Widely available protocols are defined globally. In addition, it is possible to disable protocols for specific devices. However,
it is not possible to re-enable a globally disabled protocol for an individual device.
237
Reference Manual
4 LANCOM Management System (LCMS)
Configuration of the global communication settings
The configuration of the communication protocols differentiates between the protocol strictly for testing the device and
the protocols for other operations, such as firmware uploads, etc.:
LANconfig: Extras > Options > Communication
1
HTTPS, SSH, HTTP, TFTP
When this is selected, you enable the individual protocols for the operations firmware upload, configuration
up/download, and script up/download. In these operations, LANconfig attempts to use these protocols in the order
HTTPS, SSH, HTTP and TFTP. If the transfer fails when using one of the selected protocols, LANconfig automatically
tries the next protocol.
1
Prefer checks via TFTP
The device evaluation only transfers small amounts of data with the system information. As such, it makes sense to
perform device checks in the LAN by TFTP protocol. When this option is activated, LANconfig first uses the TFTP
protocol to check the device, regardless of the communication protocols set previously. If the check via TFTP fails,
then LANconfig attempts the protocols HTTPS, SSH, and HTTP.
1
Using public key authentication
If you have selected the SSH protocol, you can alternatively perform the authentication via a private key. In this case,
the authentication dialog for password entry is not invoked. Enter the path to your private key file in the fields, and,
if necessary, the passphrase that you used to encrypt the file. Load the corresponding public key with LANconfig or
WEBconfig onto each device.
5
The global communication settings take precedence over the device-specific settings in order to prevent, for
example, the central use of a protocol.
LANconfig menu structure
Using the menu bar, you can manage devices and their configurations, and you can customize the appearance and
functioning of LANconfig.
File
The menu item File is used to manage devices in general, and to exit LANconfig as needed.
238
Reference Manual
4 LANCOM Management System (LCMS)
Add device
You can add a new device under File > Add device. A window is displayed where you can make the settings for the
device, the connection, and backups.
General
Interface
In Interface you can configure the connection settings for a device.
Please select how the device is to be reached:
1
Network connection (TCP/IP): Select this option if the device can be reached over an IP network.
1
Serial port: Select this option if the device is connected directly to your computer's serial port.
1
Dial-up connection: Select this option if the device can be reached via Dial-Up Networking.
5
Please note that some routers do not support remote configuration via a dial-up connection.
1
IP/Name: Enter the IP address of the device. You can also enter a domain name (DN or FQDN) or a
NetBIOS name. This name is checked at every access. LANconfig stores and uses the resolved IP address.
If this check is not possible, then LANconfig takes the last IP address that was last used successfully.
1
Timeout: Here you enter how many seconds the program should wait for a response from this device.
1
HTTPS, SSH, HTTP, TFTP: When this is selected, you enable the individual protocols for the operations
firmware upload, configuration up/download, and script up/download. In these operations, LANconfig
attempts to use these protocols in the order HTTPS, SSH, HTTP and TFTP. If the transfer fails when using
one of the selected protocols, LANconfig automatically tries the next protocol.
239
Reference Manual
4 LANCOM Management System (LCMS)
1
Prefer 'check' via TFTP: This option causes LANconfig to perform checks with TFTP, irrespective of other
protocols that are selected. This is advantageous for devices located in the LAN. The checks are faster
and place less load on the computer, which makes an appreciable difference when processing a large
number of devices. The fact that HTTPS is not used should not be a problem in the LAN.
1
Check the status of this device at startup: Check this box if LANconfig should check the status of the
device every time it is started.
1
Check for possible firmware updates: Select this option if LANconfig should check for possible firmware
updates.
As described in the section 'Communication protocols and ports', LANconfig tests other protocols and executes
them if TFTP is not available. Here, too, global settings take priority over the device-specific settings.
After you have made the settings, the program tries to access the device and retrieve its name and version.
If this fails, LANconfig shows a shrot error message in the Device status column.
General
In this section you can access the credentials for the device and enter a description.
1
Administrator: Enter the username for the administrator.
1
Password: Enter the associated password here.
1
Description: Enter the description of the device that you want LANconfig to display in the main window.
LANconfig stores the credentials persistently, so that you no longer need to enter them when re-accessing
the device.
5
If you save the username and password permanently, any user who is permitted to run LANmonitor
also has access to the device.
Communication protocols and ports
LANconfig performs these checks, i.e. the transfer of system information, by using the communications protocols set
here.
LANconfig performs device actions such as uploading scripts, firmware and configurations, as well as configuration
download, with the communications protocols selected here.
5
For devices with LCOS versions predating version 5.20, LANconfig uses the TFTP protocol for all actions, irrespective
of the protocols set here.
LANconfig attempts to carry out the device actions outlined above in the order HTTPS, SSH, HTTP, and TFTP and SSH. If
an action fails because of the protocol, then LANconfig repeats them with the next selected protocol.
At least one protocol must be selected in order for the action to function.
5
When using HTTP(S) and a proxy server, it may be necessary to circumvent this proxy server so that LANconfig
can reach the device. You can bypass the proxy server for local addresses by using a setting in the Window's
Control Panel, Internet options. In the Internet options' advanced settings, you can also define further addresses
which should not be contacted via the proxy server.
240
Reference Manual
4 LANCOM Management System (LCMS)
Protocols can be set globally or by means of device-specific settings. The global settings in the options menu take priority
over the device-specific settings. A benefit of this is that a single global switch can be used to disable a protocol for all
devices.
Tips
1
When shipped, the device does not yet have an IP address. In this case, enter the IP address of your computer and
replace the last part of the number sequence by 254: If your computer's IP address is 192.168.1.1, then assign the
IP address 192.168.1.254 to the device.
1
Also, if you do not know the device's IP address, you additionally have the option of searching for it with File >
Devices.
Potential problems when connecting with a new device
If LANconfig cannot reach a device at all, then one of the following error messages is displayed under status.
To check a device again, mark it in the list and click on Device > Check in the menu bar.
1
Serial error: LANconfig could not open the serial interface. Close any program that may be accessing the port.
1
IP error: Check that the IP address of the device is correct and that your computer is properly connected to the
network. You can also check that the TCP/IP protocol is installed properly and correctly configured.
1
No response: Check if the IP address of the device is correct. Another possibility is that the network connection
between your computer and the device is too slow or unreliable.
1
Status unknown: LANconfig reached the device via the specified IP address, but was unable to request any additional
information. LANconfig may not support this device.
1
Access denied: Access to this device from your computer is blocked.
Device
Under the menu item Device you can edit the configurations of devices connected to the network, organize firmware
updates and monitor device connections.
The functions in the Device menu are only offered for selection if at least one device has been chosen from the list of
devices. The menu can also be called by clicking on a device with the right mouse button when it is marked.
WEBconfig / console session
You can select the following actions under Device > WEBconfig / console session:
241
Reference Manual
4 LANCOM Management System (LCMS)
Open web browser
Opens the web browser for the device marked.
5
Under Tools > Options > Extras > Browser used to display WEBconfig, you choose whether
LANconfig should use the system default browser or its own internal browser.
Open Telnet session
Opens the telnet session.
Open SSH session
Opens a configuration session with an SSH client.
Extras
Clicking on Tools > Options opens up the dialog box for further optional settings. (You can also reach this dialog box
by pressing F7).
Options
Under the menu item Options you can invoke additional functions, for example to communicate with connected devices,
invoke external applications, or carry out automatic searches for firmware updates.
242
Reference Manual
4 LANCOM Management System (LCMS)
Extras
This dialog window allows you to make additional settings.
Set up new devices
If this option is checked, LANconfig launches the Setup Wizard whenever it finds an unconfigured device.
External programs
This item specifies the executable files for the Telnet client and the SSH client to be used by LANconfig for connections
to the devices.
Automatic retry
Attempts
Specify the number of attempts for a firmware or configuration upload. You can set a number between 1 and
9999. LANconfig always attempts to make a connection. If this fails a retry is attempted after the defined
interval. The operation is retried until LANconfig reaches the number of defined attempts or until the operation
succeeds. LANconfig may terminate the retries if a situation arises in which completion is unlikely without
external intervention. This may be when the device cannot open a file, for example.
Time interval
Enter the time interval in minutes between two attempts to upload the firmware or configuration. You can
set an interval between 1 and 9999.
Browser used to display WEBconfig
This item sets the default browser used by LANconfig to display WEBconfig. You can choose between your operating
system's default browser and LANconfig's internal browser, LCCEF (LANCOM Chromium Embedded Framework).
4.3 Group configuration with LANconfig
When managing multiple devices it can be very helpful to upload a selection of configuration parameters into a group
of devices at once, as opposed to setting each and every parameter manually in the individual devices, e.g. with identical
243
Reference Manual
4 LANCOM Management System (LCMS)
client rights in WLAN access points. Importing complete configuration files is not a viable alternative since device-specific
parameters such as the IP address are uploaded as well. Group configuration with LANconfig enables the easy import
of partial configuration files and thus makes the simultaneous administration of multiple devices a reality.
The partial configuration files with the common parameters for a group of LANCOM devices are, just like the full
configuration files, stored on hard disk or on a server. To aid the configuration of entire groups of devices, links to the
partial configuration files are created under LANconfig to provide a convenient connection between the device entries
in LANconfig and these partial configuration files.
5
Group configuration is supported only by LANCOM devices with a firmware version LCOS 5.00 or higher.
LCOS version 5.00 initially support the group configuration of WLAN devices. Later firmware versions will also support
further types of group configuration, such as the VPN parameters. Refer to the LANCOM web site www.lancom.de for
more information about the latest firmware versions and the additional possibilities of group configuration.
4.3.1 Create a group configuration
A requirement for working with group configuration to the grouping of devices within folders. These LANconfig folders
contain those device entries which are effectively managed by common partial configurations, and the group configurations
as links to the partial configuration files.
Group configuration with a new partial configuration file
1. Create a new folder and move the devices that are to be grouped into it with the mouse.
2. Then click on the folder with the right-hand mouse key and select the entry New group configuration... from the
context menu. After selecting the group type and the firmware version, the LANconfig configuration dialogue opens
up with a reduced selection of configuration options.
1. The parameters here should be set as required for the entire group. When the configuration dialogue is closed,
LANconfig will request that you save the partial configuration file to a location of your choice.
5
The group configuration then saves all parameters to a partial configuration file. Those parameters which
were not changed are also set to the standard values. Use the scripting function to read out non-standard
settings from a device and transfer them to other devices, if required.
244
Reference Manual
4 LANCOM Management System (LCMS)
2. The link to the partial configuration file appears in the list of entries and has the description 'Group Configuration'.
The name of the group configuration can be changed via the Properties. To do this, click on the entry with the
right-hand mouse key and select Properties from the context menu.
5
The group configuration is a link to the partial configuration file. Please note that changes to the partial
configuration file will lead to changes in that group configuration.
Use an existing partial configuration file
There are cases where it is more effective to use a different folder structure in LANconfig than that required for group
configuration. Devices in location-specific folders can indeed be set up with the same group configurations. To avoid
having to create the same partial configuration for every folder, links to a common partial configuration file can be
created in multiple folders.
1. To use an existing partial configuration file for a group configuration, click on the appropriate folder with the
right-hand mouse key and select Add group configuration... from the context menu.
2. In the subsequent dialog, select the existing partial configuration file to create a link to this file in the folder.
5
Please note that changes to the partial configuration file will lead to changes in that group configuration in
various folders.
4.3.2 Update device configurations
By selecting or updating a folder, LANconfig checks the configuration of the devices in this folder for agreement with
the settings in the active group configuration. In case of discrepancy from the group configuration, the device status
informs that 'Group update recommended'.
245
Reference Manual
4 LANCOM Management System (LCMS)
To load the group configuration into the WLAN device, drag the group configuration entry onto the appropriate device
entry. After successfully transferring the parameters, the device status will change to 'OK'.
5
It is also possible to use the partial configuration for a device as a group configuration. Simply drag the device
entry onto the group configuration entry.
4.3.3 Update group configurations
Apart from manually changing the parameters in a group configuration, the current configuration of a device can be
used as the basis for a group configuration. One device is thus declared as "Master" for all other devices in the same
file.
To take over the values from a current device configuration for a group configuration, simply drag the entry for this
device onto the desired group configuration. All of the parameters defined in the group configuration are then overwritten
by the values in the device configuration.
The next time that LANconfig checks the devices, it will find that the configurations in the other devices no longer agrees
with the new group configuration; this will be displayed by the device status.
4.3.4 Using multiple group configurations
Multiple group configurations can be created within a single folder. Only one of these group configurations may be
active at a time since the device status only relates to one group configuration. Active group configurations are indicated
246
Reference Manual
4 LANCOM Management System (LCMS)
by a blue tick, inactive group configurations are indicated by a red cross. To activate a group configuration, click on the
entry with the right-hand mouse key and select Active from the context menu. All other group configurations are then
deactivated automatically.
5
Different group configurations in one folder may not be linked to the same partial configuration file.
4.3.5 Transferring device configurations to similar models
When changing to a different device type, it is often necessary to adopt aspects of the configuration of the previous
model. To do this, LANconfig offers the ability to load the configuration file (*.lcf) of a source device onto a similar
destination device. All of the configuration parameters available on both source and destination devices assume the
previously used values where possible:
1
If the destination device has the appropriate parameter, and the value lies within the possible range, the value of
the source device is taken.
1
If the value of a parameter available on the destination device is not supported, the default value is used. Example:
2
The source device has four Ethernet interfaces.
2
The destination device only has two Ethernet interfaces.
2
The interface for an IP network is set to LAN-4 on the source device.
2
This value is not supported on the destination device. The value is therefore set to default value "LAN-1" on
loading the configuration file.
1
All destination-device parameters that were not available on the source device retain their respective values.
Proceed as follows to transfer the configuration onto a new device:
1. The firmware levels of the source and destination devices should be matched as closely as possible. Every new LCOS
firmware version features new parameters. Using the same firmware on the two devices allows the greatest possible
matching of available parameters.
2. Save the configuration of the source device with LANconfig , e.g. via Device / Configuration Management /
Save as File.
3. Disconnect the source device from the network to avoid address conflicts.
4. Load the configuration onto the destination device using Device / Configuration Management / Restore from
File. Messages on the conversion of the configuration are displayed in an information window.
5
Please note that this function is intended primarily for replacement devices and not for the configuration of new
devices to be operated in parallel with the source device in the same network. Because key communication
settings, such as the IP address of the device and DHCP settings, are transferred to the destination device, parallel
operation of the source and destination devices in one network may result in conflicts. The configuration of
several devices in one network is facilitated by group configuration and configuration via scripts.
247
Reference Manual
4 LANCOM Management System (LCMS)
4.3.6 Addition(s) to LCOS 8.60
Flexible group configuration with LANconfig
5
LCOS version 8.60 offers the full flexibility of the group configuration function.
Flexible group configuration helps you to manage multiple devices: You apply a carefully selected range of configuration
parameters to a group of devices, in one go. This is far more convenient than manually setting the parameters in each
individual device, e.g. identical SSID settings in WLAN access points. This helps you to avoid transferring complete
configuration files from other devices, in which case device-specific parameters such as the IP address are also included.
Group configuration with LANconfig enables the simultaneous setting of shared group-configuration parameters, thus
facilitating the simultaneous administration of multiple devices.
By collecting multiple devices into a group configuration, these devices can be a co-managed as a group. The group
configuration files with the common parameters for a group of LANCOM devices are, just like the full configuration files,
stored on hard disk or on a server. To aid the configuration of entire groups of devices, links to the group configuration
files are created under LANconfig. These links provide a convenient connection between these group-configuration files
and the device entries in LANconfig.
LANconfig provides general "group templates" as an aid to creating group configurations. You define which parameters
are to be used for a group according to your individual needs. Use this feature to add additional configuration parameters
to the group parameters, or to remove the suggested group parameters. You can store the configurations you created
either as group configurations or as a customized template for the generation of further group configurations.
5
Subsequently you can edit your own group configuration templates, but not the LANconfig basic templates.
The following templates for group configurations are available in LANconfig:
1
LANCOM Group Template WLAN: Includes the parameters that are co-managed on wireless LAN devices.
1
LANCOM Group Template WLC: Useful when operating LANCOM WLCs in a cluster, this template includes the full
range of parameters that minimize the need for individual device configuration.
1
LANCOM Group Template empty: Contains no pre-selected group parameters, and so serves as a basis for creating
your own group templates which exceed the scope of the WLAN and WLC group templates. Here, the total amount
of all available configuration parameters in all device types is available for you to choose those which you want to
use for your group configuration.
1
Alternative basic settings: The LANCOM Group Templates give you the option of including the common parameters
for different device types into the group template. However, some parameters overlap between different device types
(e.g. DSL and DSLoL). Thus the group templates are always a compromise in which some parameters may be missing.
For homogeneous groups containing just one type of device, a specific device configuration with a specific firmware
version can be used as the "alternative basic settings" as a template for the group. These basic settings thus allow
you to chose from precisely those configuration parameters that are required for this type of device.
Creating a group configuration
To work with group configurations, the devices are collected into folders. These LANconfig folders contain entries for
the devices that benefit from the co-management of shared group-configuration parameters and a link to the group
configuration.
5
A group configuration allows you to manage all device parameters that are shared by the devices in the group.
An individual device configuration refers to the parameters that are device specific.
New group configuration file
1. Create a new folder for the devices to be grouped. You have two ways to create this folder:
248
Reference Manual
4 LANCOM Management System (LCMS)
Click the right mouse button on an existing folder in the folder view. Select New folder with group
configuration. The configuration dialog initially creates a new folder as a sub-directory and then continues with
the selection of the template to be used for creating a new group configuration.
1
1
In the folder view, click the right mouse button to the directory where you wish to create the new folder. Select
the context dialog New folder and enter a name. Use the mouse to move the devices for grouping into the new
folder. Then click on the folder with the right-hand mouse key and select the context-menu entry New group
configuration.
2. Select a template and the appropriate firmware version and click on OK.
5
If you have saved your own group templates previously, these will be also displayed in the list of templates.
3. You have the option of selecting the alternative basic settings if you wish to use a specific device type as the basis
for the new group configuration. In this case, the new group configuration is created with the default values for the
selected device type.
5
In order to avoid inconsistent sets of configuration parameters, the alternative basic settings are based on
a blank template corresponding to the "LANCOM Group Template Empty".
4. A configuration dialog opens. Two alternative processing modes are available here. Select this from the list Group
Configuration:
1
Edit config. values mode.
1
Select group parameters mode.
249
Reference Manual
4 LANCOM Management System (LCMS)
1
The configuration dialog opens in the Edit config. values mode. In this view, you see only the common parameters
which are to be co-managed for the group. You can define the required values and content here. Parameters
that apply to individual devices are hidden.
250
Reference Manual
4 LANCOM Management System (LCMS)
1
In the Select group parameters mode you can select or de-select all of the parameters that you require for a
customized group configuration.
Light-blue colored items are selected for use in the group configuration. Click once with the left mouse button
on an item to change its selection status.
Please note the following:
2
For tables with statically specified rows (such as interface-related tables and logical WLAN settings) you
additionally have the option of transferring individual parameters into the group configuration. You can
access some of these parameters in LANconfig via the pull-down menus from buttons.
2
For tables with dynamically generated rows (such as the routing table, for example) you can only select or
de-select the entire table for the group configuration.
2
Similarly, it is only possible to select or de-select the entire firewall for the group configuration.
5. Then click on OK.
6. Specify the storage path for the new group configuration. The default directory is the one you specified in Tools >
Options > Backup > Backup path (default: "\ config \")
251
Reference Manual
4 LANCOM Management System (LCMS)
7. As an option you can include this group configuration into the list of templates for creating further group configurations
in future. Enable the option Provide as template and give the file a descriptive name.
5
It is also possible to use an existing group configuration to create a template at a later time. Do this by
right-clicking on the LANconfig group configuration in the appropriate folder. Then enable the context-menu
option Provide as template and give the file a descriptive name.
8. Click on Save to conclude the action.
5
The group configuration saves all parameters in a group configuration file, including parameters with preset
default values. Use the scripting function to read out only the non-default settings from a device and, if applicable,
transfer them to other devices.
The associated group configuration file appears in the list of entries and has the description Group configuration. To
change the name of the group configuration, access the file's properties. To do this, click on the entry with the right-hand
mouse key and select Properties from the context menu.
5
In LANconfig you have the option of creating multiple references to the same group configuration. A change to
this effects the devices in all of the folders if a group configuration is assigned to different LANconfig folders.
Using an existing group configuration file
In some cases it may be useful to use a different structure of devices managed with LANconfig than required by the
group configuration. For example, devices in different site-specific folders may belong to the same groups. In order to
avoid redundant group configuration files for every folder, you may want to create links to a shared file in multiple
folders.
To use an existing group configuration file for a group of devices, use the mouse to right-click on the appropriate folder.
In the context menu select Add group configuration.
In the subsequent dialog, select the existing group configuration file to create a link to this file in the folder.
5
Please note that changes to the group configuration file will lead to changes in that group configuration in
various folders.
If you create additional devices in a group folder, or if you modify an existing group configuration, LANconfig
informs you that an update to the appropriate devices is available. This update can be carried out either directly
afterwards or at any later time by using the context menu.
252
Reference Manual
4 LANCOM Management System (LCMS)
Additions to the menu system
Group
Group configurations are managed under the menu item 'Group'.
For further information please refer to section
Flexible group configuration with LANconfig
.
New group configuration
Under Group > New group configuration you create a new group configuration in the current folder.
New folder with group configuration
Under Group > New folder with group configuration you create a new sub-folder with a new group configuration
in the current folder.
Add group configuration
Under Group > Add group configuration you can save an existing group configuration to the active folder. Select the
relevant file to do this.
Edit group configuration
Under Group > Edit group configuration you have the option to edit the highlighted group configuration.
The parameters set here must be valid for the entire group. When the configuration dialog is closed, LANconfig will
request that you save the group configuration file to a location of your choice.
Refresh all devices
Under Group > Update all devices you have the option to use the selected and activated group to update all of the
devices in the current folder.
253
Reference Manual
4 LANCOM Management System (LCMS)
Update recommended devices
Under Group > Update recommended devices you have the option to use the selected and activated group to update
the recommended devices in the current folder.
Provide as template
Under Group > Provide as template you have the option to set the highlighted group configuration as a template for
future group configurations.
Active
Enable or disable the selected group configuration with the menu item Group > Active.
Delete
With Group > Delete you can delete the highlighted group configuration.
Features
Under Group > Properties you can view information about an existing group configuration. Select the relevant file to
do this.
254
Reference Manual
4 LANCOM Management System (LCMS)
The General tab displays the description of the group configuration.
The Information tab shows the name, status, and the file name of the group configuration.
4.4 LANmonitor—know what's going on
The LANmonitor includes a monitoring tool with which you can view the most important information on the status of
your routers on your monitor at any time under Windows operating systems—of all of the LANCOM routers in the
network.
Many of the internal messages generated by the devices are converted to plain text, thereby helping you to troubleshoot.
5
Explanations about the LANmonitor messages and helpful tips can be found in the appendix under .
You can also use LANmonitor to monitor the traffic on the router's various interfaces to collect important information
on the settings you can use to optimize data traffic.
255
Reference Manual
4 LANCOM Management System (LCMS)
In addition to the device statistics that can also be read out during a Telnet or terminal session or using WEBconfig, a
variety of other useful functions are also available in LANmonitor, such as the enabling of an additional charge limit.
5
With LANmonitor you can only monitor those devices that you can access via IP (local or remote). With this
program you cannot access a router via the serial interface.
4.4.1 Extended display options
Under View / Show Details you can activate and deactivate the following display options:
1
Error messages
1
Diagnostic messages
1
System information
5
Many important details on the status of the LANCOM are not displayed until the display of the system information
is activated. These include, for example, the ports and the charge management. Therefore, we recommend that
interested users activate the display of the system information.
4.4.2 Enquiry of the CPU and Memory utilization over SNMP
The load on CPU and memory in the LANCOM can be queried with SNMP or displayed in LANmonitor.
4.4.3 Monitor Internet connection
To demonstrate the functions of LANmonitor we will first show you the types of information LANmonitor provides about
connections being established to your Internet provider.
1. To start LANmonitor, go to Start / Programme / LANCOM / LANmonitor. Use File / Add Device to set up a new
device and in the following window, enter the IP address of the router that you would like to monitor. If the
configuration of the device is protected by password, enter the password too.
Alternatively, you can select the device via the LANconfig and monitor it using Device / Monitor Device.
2. LANmonitor automatically creates a new entry in the device list and initially displays the status of the transfer
channels. Start your Web browser and enter any web page you like. LANmonitor now shows a connection being
established on one channel and the name of the remote site being called. As soon as the connection is established,
256
Reference Manual
4 LANCOM Management System (LCMS)
a plus sign against the communication channel entry indicates that further information on this channel is available.
Click on the plus sign or double-click the appropriate entry to open a tree structure in which you can view various
information
1. .In this example, you can determine from the PPP protocol information the IP address assigned to your router by the
provider for the duration of the connection and the addresses transmitted for the DNS and NBNS server.
Under the general information you can watch the transmission rates at which data is currently being exchanged
with the Internet.
2. To break the connection manually, click on the active channel with the right mouse button. You may be required to
enter a configuration password.
3. If you would like a log of the LANmonitor output in file form, select Device / Device Activities Logging and go to
the 'Logging' tab. Open the dialog for the settings for the activity protocol, click on Tools / Options.
1. On the 'Protocol' tab you can define whether the following activities should be protocolled:
1
WAN connections
1
WLAN connections
1
VPN connections
1
LANCAPI connections
1
a/b port connections
1
Firewall actions
257
Reference Manual
4 LANCOM Management System (LCMS)
You can also specify whether LANmonitor should create a log file daily, monthly, or on an ongoing basis.
4.4.4 Display functions in LANmonitor
LANmonitor supports the administration of the LANCOM applications by offering a range of functions that simplify the
surveillance of devices at widely dispersed locations. The overview of devices monitored by LANmonitor already shows
the most important information about the status of the devices:
The information that can be taken from the overview includes, among others, details about active WAN connections,
the five most recent firewall messages, the current VPN connections and system information about charges and online
times.
Right-clicking with the mouse on a device in LANmonitor opens up a context menu with further information:
1
VPN connections
258
Reference Manual
4 LANCOM Management System (LCMS)
The list of VPN connections is a log of the 100 most recent VPN connections. The detailed recorded information
includes
2
Name of the remote device
2
Current status
2
Last error message
2
IP address of the gateway
2
Encryption information
1
Accounting information
The accounting information is a protocol of the connections from each station in the LAN to remote sites in the WAN.
The detailed information recorded includes
2
Name or IP address of the station
2
Remote station used to establish the connection
2
Type of connection, e.g. DSL or VPN
2
Number of connections
2
Data volume sent and received
2
Online time
1
Activity log
259
Reference Manual
4 LANCOM Management System (LCMS)
The activity log is a detailed list of the connections via WAN, WLAN, VPN, LANCAPI and a/b port, and a list of firewall
activities. The detailed information recorded includes
2
Date and time
2
Source
2
Message
1
Firewall actions log
The firewall actions log lists the last 100 actions taken by the firewall. The detailed information recorded includes
2
Time
2
Source and destination address
2
Protocol with source and destination port
2
Activated filter rule and exceeded limit
2
Action carried out
4.4.5 Connection diagnosis with LANmonitor
LANmonitor can be used to check the connection quality between stations in the LAN, WAN or WLAN. LANmonitor sends
pings from the computer on which it is installed to the remote site at regular intervals. The responses it receives are the
basis for a compiled report.
260
Reference Manual
4 LANCOM Management System (LCMS)
To enter the parameters and display the results, a dedicated dialog has been implemented in LANmonitor.
LANmonitor: Tools / Ping... or via the context menu
Configuring Ping execution
1
Host name or IP address
The remote station which is to be queried by Ping is entered here. The following information can be entered for all
of the different network devices (servers, clients, routers, printers, etc.) which can be reached via LAN, WAN or WLAN.
5
If a device is selected when the Ping dialog is opened with Device / Ping... or via the context menu in
LANmonitor, then the IP address of this device is assumed to be the remote site.
1
Ping interval
The time interval between two consecutive pings in [ms].
5
The interval between two pings cannot be less than the packet transmission time, i.e. before sending a ping,
the previous ping must have been answered or the ping timeout must have expired.
1
Ping timeout
The time waited for the response to a ping to arrive [ms]. If this time expires and no response was received then the
ping is assumed to be lost.
1
Data
The size of a ping packet [bytes]. A "ping" is an ICMP packet which is generally transmitted without any content, i.e.
it is just a header. To increase the load of the packets used for testing a connection, a payload can be created
artificially. The overall packet size then consists of an IP header (20 bytes), an ICMP header (8 bytes) and the payload.
5
The packets will be fragmented if the payload of the ICMP packets exceeds the maximum IP packet size.
1
Execution
Repeat mode for the ping command.
261
Reference Manual
4 LANCOM Management System (LCMS)
Evaluation
The right-hand portion of the Ping dialog displays the results of the ping test. The first column shows the sum values
over the entire test; the second column shows only the values collected over the evaluation period, i.e. the sum of the
most recent packets. Unanswered pings are not included in the evaluation.
5
The period evaluation considers only the pings sent during the defined period.
The following information is displayed for evaluation:
1
Test run time
2
The total run time [hr./ min./ sec.]
1
Transmitted
1
Total number of pings sent
2
Run time of the last ping [ms]
1
Received until timeout
2
The number of pings answered in the timeout period
2
Minimum runtime
2
Maximum runtime
2
Average
2
Standard deviation from the mean run time
1
Received after timeout
2
The number of pings answered after the timeout period
2
Late packets as a proportion of the total number
2
Minimum runtime
2
Maximum runtime
2
Average
1
Lost
2
The number of lost packets
2
Lost packets as a proportion of the total number
4.4.6 Addition(s) to LCOS 7.70
Setting up point-to-point connections with LANmonitor
To find the best possible alignment for point-to-point connection antennas, the current signal quality over a P2P connection
can be displayed on the device's LEDs or in LANmonitor. LANmonitor provides not only an optical display of link strength,
but an acoustic signal as well.
262
Reference Manual
4 LANCOM Management System (LCMS)
In LANmonitor the connection quality display is opened with the context menu. Right-clicking with the mouse on
'Point-to-point' activates the option 'Adjusting Point-to-Point WLAN Antennas...'
Once signal monitoring has commenced, the P2P dialog displays the absolute values for the current signal strength and
the maximum value since starting the measurement. The development of the signal strength over time and the maximum
value are displayed in a diagram, too.
Initially only one of the two antennas should be adjusted until a maximum value is achieved. This first antenna is then
fixed and the second antenna is then adjusted to attain the best signal quality.
An acoustic signal can be activated to help align the antennas precisely. With this option, the PC can emit a tone which
varies according to signal strength. Maximum signal strength over the link is signaled by a constant tone. If the signal
strength drops below the maximum, tones are emitted at intervals indicating the difference from the former maximum.
The shorter the interval, the closer the current link signal strength is to the maximum.
Performance monitoring with LANmonitor
LANmonitor logs various parameters in the devices and displays these graphically:
1
Transmit and receive rates for WAN connections
1
Transmit and receive rates for point-to-point connections
263
Reference Manual
4 LANCOM Management System (LCMS)
1
Signal reception strength for point-to-point connections
1
Link signal strength for point-to-point connections
1
Throughput for point-to-point connections
1
CPU load
1
Free memory
1
Temperature (not available on all models)
LANmonitor displays the current values directly in the corresponding groups.
A click on the Graph item in the context menu opens a new window which displays these parameters over time.
You can use the left-hand mouse key to mark any period in the graph, and these statistical values will be displayed
separately.
This dialog displays the values collected over the last 24 hours.
5
Please note that the values on display are deleted when the dialog is closed. For monitoring over a longer period,
leave the window open.
264
Reference Manual
4 LANCOM Management System (LCMS)
4.4.7 Addition(s) to LCOS 7.80
Averaging of CPU-load display
Introduction
The current CPU load for the device can be output in various ways (LANmonitor, WEBconfig, or CLI in the status area;
some models have an integrated display).
Configuration
You can set the time interval for averaging the value for the displayed CPU load.
WEBconfig: LCOS menu tree / Setup / Config
1
CPU-load interval
You can select the time interval for averaging the CPU load. The CPU load displayed in LANmonitor, in the status
area, in the display (if fitted), or by SNMP tools is a value which is averaged over the time interval set here. The status
area under WEBconfig or CLI additionally display the CPU load values for all four of the optional averaging periods.
Possible values:
2
1, 5, 60 or 300 seconds.
Default:
2
60 seconds.
5
The default period of 60 seconds is specified by the HOST-RESOURCES-MIB, which is used by many SNMP
tools to display CPU load in a tacho display. Please consider this specification when altering the CPU-load
interval.
265
Reference Manual
4 LANCOM Management System (LCMS)
4.4.8 Addition(s) to LCOS 8.50
Monitoring the input voltage for universal power adapters
Some devices feature a universal power adapter for two-pin industrial connectors, which caters for variable power supply
voltages of 10 – 28 volts.
To avoid a failure or damage to the device, these models monitor and the voltage and report over- and undershooting
of the allowed voltage range.
The displayed voltage is the actual momentary input voltage at the integrated universal power adapter. The input voltage
can have a minimum value of 10 volts and a maximum value of 28 volts. If input voltage over- or undershoots the
allowable range, the device reports the error via SNMP trap and as a SYSLOG message. Furthermore, LANmonitor logs
these states to the device activity list. In such cases you should quickly ensure that the permissible input voltage is
supplied again.
5
Configure the necessary SYSLOG server or SNMP manager in the device to ensure that messages are sent to the
appropriate monitoring systems.
Display in LANmonitor
LANmonitor displays the current input voltage in the System Information section:
266
Reference Manual
4 LANCOM Management System (LCMS)
In the case of overvoltage or undervoltage, LANmonitor displays a warning symbol for the input voltage:
Display in Webconfig
Webconfig displays the current input voltage in the section Hardware Info (Status > Hardware Info >
Wide-Range-Power-Supply-mV):
SNMP traps
Devices with a universal power adapter report the over- and undershooting of the permitted input voltage range with
the following SNMP traps:
1
TRP_VOLTMON_OVERVOLT (4500): This trap indicates that the current input voltage exceeds the permissible range.
267
Reference Manual
4 LANCOM Management System (LCMS)
1
TRP_VOLTMON_NO_OVERVOLT (4501): This trap indicates that the input voltage exceeded the permissible maximum
voltage and has returned to the permissible range.
1
TRP_VOLTMON_UNDERVOLT (4502): This trap indicates that the current input voltage is below the permissible range.
1
TRP_VOLTMON_NO_UNDERVOLT (4503): This trap indicates that the input voltage fell below the permissible minimum
voltage and has returned to the permissible range.
5
Configure the necessary SNMP manager in the device to ensure that messages are sent to the appropriate
monitoring systems.
SYSLOG messages
Devices with a universal power adapter report the over- and undershooting of the permitted input voltage range with
the following SYSLOG messages:
1
Voltage above the permissible range: <current input voltage>: This SYSLOG message indicates that the current input
voltage exceeds the permissible range.
1
Voltage within the permissible range: <current input voltage>: This trap indicates that the input voltage exceeded
or fell below the permissible voltage range and has returned to the permissible range again.
1
Voltage below the permissible range: <current input voltage>: This SYSLOG message indicates that the current input
voltage is below the permissible range.
5
Configure the necessary SYSLOG server in the device to ensure that messages are sent to the appropriate
monitoring systems.
Show the current protocol for the ADSL interface
For devices with integrated ADSL modem, LANmonitor's system information displays the ADSL standard currently being
used.
268
Reference Manual
4 LANCOM Management System (LCMS)
4.4.9 Addition(s) to LCOS 8.80
Display local IPv6 addresses
As of LCOS version 8.80, LANmonitor can display the IPv6 addresses of local networks. This display function is available
in various places within the menu.
269
Reference Manual
4 LANCOM Management System (LCMS)
Displaying PBX lines in the SIP ALG
As of LCOS version 8.80, LANmonitor displays the PBX lines separately with the registration method Options in the
section SIP ALG > Registrations.
Displaying the active Ethernet ports
As of LCOS version 8.80, LANmonitor allows you to display the operating status of the Ethernet ports.
270
Reference Manual
4 LANCOM Management System (LCMS)
The menu item System information > Interfaces > Ethernet ports shows whether ports are in operation and, if so,
which network the port is assigned to (e.g. LAN-1 after the port name).
Displaying the DHCP assignment
As of LCOS version 8.80, the LANmonitor menu item DHCP server displays the connection status of the individual DHCP
clients by the color of the corresponding device icon.
1
A blue icon shows DHCP clients which are active in the network.
1
A gray icon shows DHCP clients which are not currently active in the network (e.g. switched off or disconnected),
but which still have a valid DHCP assignment.
5
DHCP clients for some operating systems such as Android do not submit a device name. In this case, LANmonitor
displays the MAC address of the DHCP client only. This behavior may be undesirable with a large number of
271
Reference Manual
4 LANCOM Management System (LCMS)
clients. To display a device name in these cases, enter the MAC address of the DHCP client with the desired
device name into the BOOTP table on the DHCP server.
Delete all VPN connection failures
As of LCOS version 8.80, LANmonitor gives you the option of deleting all of the VPN connection errors with just one
click.
To do this, navigate to the area of LANmonitor for VPN connections, right-click on the entry Connections with error:
x and select Clear all VPN connection errors.
Display of the GPS time
As of LCOS version 8.80, LANmonitor gives you the option to display the time received from the GPS network.
Navigate to the GPS section for the device in LANmonitor. The current GPS time is displayed under Timestamp.
272
Reference Manual
4 LANCOM Management System (LCMS)
4.5 Visualization of larger WLANs with WLANmonitor
With LANCOM WLANmonitor you can centrally monitor the status of a wireless network( WLAN). It presents information
about the entire network in general and detailed information about individual access points and logged-in clients.
LANCOM WLANmonitor can also collect access points into groups. These groups may consist of access points gathered
in buildings, departments, or at particular locations. In particular with large WLAN infrastructures, this helps to keep an
overview of the entire network.
4.5.1 Start the LANCOM WLANmonitor
WLANmonitor is a component of LANmonitor. Start WLANmonitor from LANmonitor using the menu item Tools /
WLANmonitor, by using the corresponding button in the LANmonitor button bar or directly with Start / Programme
/ LANCOM / WLANmonitor.
Alternatively, WLANmonitor can be started from the console with the command
1
[installation path]lanmon -wlan
4.5.2 Search for access points
After starting WLANmonitor, commence a search for available access points via the menu item File / Find access
points. The access points found are listed in the middle column. Also shown here is the main information for each access
point such as the name, number of registered clients, the frequency band and channels being used.
1
Name of the access point
1
Number of the connected clients
1
Used frequency band
1
Used channel
1
IP address of the access point
The right-hand column (client list) lists the clients that are logged in to the selected access point. The following information
is shown for each client:
1
Connection quality as a bar chart
1
Identification: The name of the logged-in client in as far as this is entered into the access list or a RADIUS server.
LANconfig: WLAN Security / Stations / Stations
273
Reference Manual
4 LANCOM Management System (LCMS)
Telnet: Setup/WLAN/Access-List
WEBconfig: LCOS menu tree / Setup / WLAN E Access-List
1
Signal: Connection signal strength
1
Access point: Name of the access point that the client is logged on to
1
SSID: Identifier for the WLAN network
1
Encryption: Type of encryption used for the wireless connection
1
WPA version (WPA-1 or WPA-2)
1
MAC address: Hardware address of the WLAN client
1
TX rate: Transmission data rate
1
RX rate: Reception data rate
1
Last event, e.g. 'Authentification successful', 'RADIUS successful'
1
IP addresss of the WLAN clients
4.5.3 Add access points
If an access point was not recognized automatically, it can be added to the list manually with the menu item File / Add
access point. In the following window, enter the IP address or the name of the access point, the administrator name,
and the corresponding password.
.
4.5.4 Organize access points
The LANCOM WLANmonitor lets you organize all of the available access points in a manner that is independent of their
physical location. This helps to maintain an overview of the network and is particularly useful when localizing problems.
Further, WLAN information can be called up according to the groups. You can group your access points according to
their departments, locations or applications (e.g. public hotspot), for example.
The groups are shown in the left column in WLANmonitor. Starting from the top group 'WLANmonitor', you can use the
menu item File / Add group to create new sub-groups and so build up a structure. Access points found during a search
274
Reference Manual
4 LANCOM Management System (LCMS)
are assigned to the currently selected group in the group tree. Access points that have been recognized already can be
moved to the another group with drag and drop.
To aid the allocation of access points and clients, you can mark a device with the mouse. The counterpart(s) will then
be marked in the list as well:
1
If an access point is marked in the access point list, all of the clients logged in to this device will also be marked in
the client list.
1
If a client is marked in the client list, the access point that it is registered with will be marked in the access point list.
4.5.5 Rogue AP and rogue client detection with the WLANmonitor
WLAN devices that make unauthorized attempts at accessing a WLAN by posing as an access point or client are called
rogues.
1
Rogue clients are computers equipped with WLAN adapters that are located within the range of a WLAN and attempt
to log on to one of the access points, for example, in order to use the Internet connection or in order to receive access
to secured areas on the network.
1
An example of rogue APs are access points that a company's employees connect to the network without the knowledge
or permission of the system administrators, thereby consciously or unconsciously making the network vulnerable to
potential attackers via unsecured WLAN access. Not quite as dangerous, but disruptive all the same are access points
that belong to third-party networks yet are within the range of the local WLAN. If such devices also use the same
SSID and channel as the local AP (default settings), then local clients could attempt to log on to external networks.
Unidentified access points within the range of the local network frequently pose a possible threat and security gap. At
the very least they are a disturbance, and so they need to be identified to decide whether further measures in securing
the local network need to be introduced. Information about the clients within range of your network is automatically
stored to an internal table in the LANCOM Wireless Router. Once activated, background scanning records neighboring
access points and records them to the scan table. WLANmonitor presents this information visually. The access points
and clients found can be categorized in groups such as 'known', 'unknown' or 'rogue'.
5
Further information can be found under .
Rogue AP detection
The WLANmonitor sorts all of the access points found into predefined subgroups under 'Rogue AP Detection' while
displaying the following information:
1
Time of first and last detection
1
BSSID, the MAC addresse of the AP for this WLAN network
1
Network name
1
Type of encryption used
1
Frequency band used
1
Radio channel used
275
Reference Manual
4 LANCOM Management System (LCMS)
1
Use of 108Mbps mode
5
To use rogue AP detection, background scanning has to be activated in the LANCOM Wireless Router.
The WLANmonitor uses the following groups for sorting the APs that are found:
1
All APs: List of all scanned WLAN networks grouped as follows
1
New APs: New unknown and unconfigured WLAN networks are automatically grouped here (APs displayed in yellow)
1
Rogue APs: WLAN networks identified as rogue and in need of urgent observation (APs displayed in red)
1
Unknown APs: WLAN networks which are to be further analyzed (APs displayed in gray)
1
Known APs: WLAN networks which are not a threat (APs displayed in gray)
1
Own APs: New affiliated WLAN networks from access points monitored by WLANmonitor are automatically grouped
here (APs displayed in green)
The WLANs that have been found can be placed into a corresponding group depending on their status. You can set up
your own network groups within the individual groups by using the context menu (right mouse button) (except for the
group 'All APs').
5
If a parameter is changed on an AP, e.g. the security settings, then it is displayed again as a newly discovered
AP.
Rogue client detection
The WLANmonitor presents all of the clients found into predefined subgroups under 'Rogue Client Detection' while
displaying the following information:
1
Time of first and last detection
1
MAC address of the client
1
Network name
5
No configuration of the LANCOM Wireless Router is necessary to make use of rogue client detection.
The WLANmonitor uses the following groups for sorting the clients that are found:
1
All clients: List of all found clients grouped as follows (clients are colored according to their group)
1
New clients: New unknown clients are automatically grouped here (clients displayed in yellow)
276
Reference Manual
4 LANCOM Management System (LCMS)
1
Rogue clients: Clients identified as rogue and in need of urgent observation (clients displayed in red)
1
Unknown clients: Clients which are to be further analyzed (clients displayed in gray)
1
Known clients: Clients which are not a threat (clients displayed in gray)
1
Own clients: New affiliated clients associated with access points monitored by WLAN monitor are automatically
grouped here (APs displayed in green)
The clients that have been found can be placed into a corresponding group depending on their status. You can set up
your own network groups within the individual groups by using the context menu (right mouse button) (except for the
group 'All clients').
Activating rogue-AP and rogue-client detection
The functions for rogue-AP and rogue-client detection can be switched on or off in WLANmonitor.
:WLANmonitor: Tools / Options / General
1
Rogue AP detection activated
Activate this option if WLANmonitor is to display unknown or unconfigured access points.
1
Rogue client detection activated
Activate this option if WLANmonitor is to display unknown or unconfigured clients.
277
Reference Manual
4 LANCOM Management System (LCMS)
Configuring the alert function in the WLANmonitor
The WLANmonitor can inform the administrator automatically via e-mail whenever an unknown or unconfigured access
point is discovered.
WLANmonitor: Tools / Options / Alerts
1
E-mail messaging
Activate this option if you would like the WLANmonitor to report unknown or unconfigured access points via e-mail.
1
Recipient e-mail addresses
Enter the e-mail address(es) of the administrators here that should be informed in the event of rogue AP detection.
Multiple e-mail addresses should be separated by commas.
5
In order to send e-mail alerts, the computer on which WLANmonitor is running requires a standard e-mail
client (MS Outlook Express or Mozilla Thunderbird) that allows automatic mail transmission to be configured
and running.
1
Send a test e-mail
Some mail clients require a confirmation from the user before sending via third-party applications. Test the alarm
function with this button.
278
Reference Manual
4 LANCOM Management System (LCMS)
4.6 Addition(s) to LCOS 7.80
4.6.1 Deactivating Ethernet interfaces
The Ethernet interfaces on any publicly accessible LANCOM device can potentially be used by unauthorized persons to
gain physical access to a network. The Ethernet interfaces on the device can be disabled to prevent this.
LANconfig: Interfaces / LAN / Interface settings
WEBconfig: LCOS menu tree / Setup / Interfaces
1
Interface usage
Here you select how this interface is to be used.
Possible values:
2
None (power down): The interface is deactivated.
2
Idle: The interface is not allocated to any particular task, but it remains physically active.
2
LAN-1 to LAN-n: The interface is allocated to a logical LAN.
2
DSL-1 to DSL-n: The interface is allocated to a DSL interface.
2
Monitor: The port is a monitor port, i.e. everything received at the other ports is output via this port. A packet
sniffer such as Wireshark / Ethereal can be connected to this port, for example.
Default:
2
Depends on the particular interface or the hardware model.
4.7 Addition(s) to LCOS 8.84
4.7.1 Enhancements to LANconfig
Quick Rollback
As the counterpart to the automatic backup of device configurations, you can restore configuration backups with a single
click. Just highlight the device and select Device > Quick rollback. LANconfig lists all of the device configurations that
have been saved under the path for the automatic device-configuration backups. If LANconfig cannot find a backup file
for the selected device, it cancels this action with a warning message.
5
LANconfig allocates the configuration backup to the device by using the serial number stored in the meta data
of the backup. As of LCOS 8.84 the serial number is automatically written to the backup; for older configuration
279
Reference Manual
4 LANCOM Management System (LCMS)
backups without the serial number, you need to add these manually in order for Quick Rollback to recognize the
files. Please also refer to
Advanced meta data for configuration files
on page 280.
To restore a configuration backup, select an entry and click on Restore.
You also have the option to add comments to the configuration backups, or edit existing comments: The Edit description
button ( ) enables you to edit the field below it containing the comment text. Click on Save description ( ) to write
the text in the comment box back to the backup file.
4
Quick Rollback is not available for LANCOM switches.
Advanced meta data for configuration files
If a device configuration is stored manually, LANconfig provides the option to save extra meta data in addition to the
usual MAC address and/or device serial number in the configuration file (*.lcf). This extended meta-data can be taken
into account, for example when performing a quick config rollback or when loading a device configuration via USB.
To include the additional meta data into a configuration file, click the Advanced button in the LANconfig save-file dialog
and enter the data—if not entered already—into the respective fields.
280
Reference Manual
4 LANCOM Management System (LCMS)
Alternatively you can open a lcf/lcs file in a text editor and enter the advanced meta data by hand. Example:
(Configuration of 'DEVICE-01' from 12.11.2013)
(8.84.0081) (0x0000c010,IDs:4,e,f,2b;0x0c000002) (MAC:<MAC-address>;SERIAL:<Serial-number>)
Unlock firmware via the context menu
As of LCOS 8.84, in test mode you can unlock current firmware versions by using the Firmware Management in the
LANconfig context menu.
Exporting key fingerprints when commissioning CC devices
As of LANconfig 8.84, you have a convenient option to export the SSH key fingerprints when commissioning CC devices.
While the CC Start-up Wizard is running, LANconfig creates the file CCWizSummary.csv containing the IP address of
the device, the device name and its (SSH) key fingerprint. As an example, this list could be used by system administrators
who need to be certain that they are connecting to the correct device, for instance when conducting remote maintenance
or logging in to a device for the first time after a rollout.
By default, LANconfig saves this CSV file under C:\Program files
(x86)\LANCOM\LANconfig\Logging\. You have also the option to change this path in the input field
under Tools > CC Start-up Wizard > Settings > Path.
TLS/STARTTLS support and additional authentication methods with SMTP servers
As of LCOS 8.84, the device uses by default port 587 for connecting to SMTP servers. Also, connection establishment
via STARTTLS is preferred. In addition to the PLAIN authentication method, a secure alternative is now available which
enables the device to act according to the requirements of the SMTP server.
Setting up an e-mail address to send messages
A LANCOM device can send e-mail to a predefined address if certain events should occur. These events can include:
1
Information about disconnections on a WAN interface
1
Messages from the firewall or content filter
1
Sending VPN profiles
You set up the e-mail address as follows:
In LANconfig you can can configure an e-mail under Log & Trace > SMTP account.
SMTP server: In this field, enter the IP address of the SMTP server.
281
Reference Manual
4 LANCOM Management System (LCMS)
SMTP port: By default, this is set to port 587 for transmitting unencrypted e-mails.
Encryption/TLS: Here you determine if and how the device encrypts the connection. The available values have the
following meaning:
1
None: No encryption. The device ignores any STARTTLS responses from the server.
1
Encrypted (SMTPS): The device uses SMTPS, i.e. encryption is active from the connection establishment.
1
Preferred (STARTTLS): The connection establishment is not encrypted. If the SMTP server offers STARTTLS, the
device will use encryption. This is the default setting.
1
Required (STARTTLS): The connection establishment is not encrypted. If the SMTP server does not offer STARTTLS,
the device transmits no data.
Sender e-mail address: Enter a valid e-mail address for the LANCOM to use as the sender address. The specified SMTP
server will message this address in case of delivery problems, for example. If this address is not specified or not valid,
some SMTP servers may refuse to deliver any messages.
Source address: You can optionally set an alternative sender address here to be used by the LANCOM. If you have
configured loopback addresses, you can specify them here as sender address. The field accepts various input formats:
1
Name of the IP network (ARF network), whose address should be used by the device.
1
"INT" for the address of the first intranet.
1
"DMZ" for the address of the first DMZ. If there is an interface named "DMZ", then the device uses this address.
1
"LB0" … "LBF" for one of the 16 loopback addresses, or its name
1
Any IP address in the form x.x.x.x.
Authentication: Here you determine if and how the device authenticates at the SMTP server. The available values have
the following meaning:
1
None: No authentication.
1
Preferred plain text: Authentication takes place in plain text (PLAIN, LOGIN) if the server requires authentication.
If you do not want plain-text authentication, the device uses a secure authentication method.
1
Preferred encrypted: Secure authentication takes place, if possible. Otherwise the device uses either a plain text
authentication or no authentication at all, depending on the server settings.
1
Encrypted: If the server requires authentication, the password is sent in encrypted (e.g. CRAM-MD5). Plain text
authentication does not occur.
Name: Enter the user name which the LANCOM uses to login to the SMTP server.
Password: Enter the password which the LANCOM uses to login to the SMTP server.
Additions to the Setup menu
SMTP port
Enter the number of the SMTP port of the aforementioned server for unencrypted e-mail transmission. The default value
is 587.
Telnet path:
Setup > Mail
Possible values:
Max. 10 characters
Default:
587
282
Reference Manual
4 LANCOM Management System (LCMS)
SMTP-use-TLS
Here you determine if and how the device encrypts the connection. The available values have the following meaning:
1
No: No encryption. The device ignores any STARTTLS responses from the server.
1
Yes: The device uses SMTPS, i.e. encryption is active from the connection establishment.
1
Preferred: The connection establishment is not encrypted. If the SMTP server offers STARTTLS, the device will use
encryption. This is the default setting.
1
Required: The connection establishment is not encrypted. If the SMTP server does not offer STARTTLS, the device
transmits no data.
Telnet path:
Setup > Mail
Possible values:
No
Yes
Preferred
Required
Default:
Preferred
SMTP authentication method
Here you determine if and how the device authenticates at the SMTP server. The available values have the following
meaning:
1
None: No authentication.
1
Plain text: Authentication takes place in plain text (PLAIN, LOGIN) if the server requires authentication. If you do
not want plain-text authentication, the device uses a secure authentication method.
1
Encrypted: The authentication is performed without the password being sent in plain text (e.g. CRAM-MD5) if the
server requires authentication. Plain text authentication does not occur.
1
Automatic: Secure authentication takes place, if possible. Otherwise the device uses either a plain text authentication
or no authentication at all, depending on the server settings.
Telnet path:
Setup > Mail
Possible values:
None
Plain text preferred
Encrypted
Default:
Plain text preferred
283
Reference Manual
4 LANCOM Management System (LCMS)
4.8 Addition(s) to LCOS 9.00
4.8.1 Enhancements to LANconfig
Automatic authentication for read-only access to LANmonitor
As of 9.00, LANconfig offers a new user-friendly feature: With a device configuration opened in LANconfig, LANmonitor
can be started without you having to enter access credentials again.
Login information
Enter the access credentials for the external programs in this field. Click New to select one or more
application(s) and enter the corresponding access credentials. Depending on your selection, the dialog window
requests different access credentials. If you invoke the program from LANconfig, you have the option of
authenticating yourself with the username and password of your administrator login.
In the case of LANmonitor, you have the option to specify an individual SNMP community for read-only access.
By default, when LANconfig opens a device configuration it checks whether and to what extent you have
stored access credentials for external programs. If you do not have access credentials or if these credentials
have been configured in the form of an SNMP community only, then invoking LANmonitor prompts LANconfig
to take the SNMP community from the loaded device configuration. If you edit a configuration in LANconfig
and you have set an SNMP community here, LANconfig automatically saves the SNMP community for the
corresponding device. This convenient behavior reduces the scope of authentication for LANmonitor, so no
separate configuration of the read-only access is required.
4
LANconfig evaluates the setup parameter
2.9.15 Read-Only-Community
for the convenient behavior
described above. Any additional read-only SNMP communities configured in the device are ignored.
For more information about the SNMP access through single or multiple SNMP communities, see the section
Configuring SNMP read-only access
.
Display of administrator user name
In order to show which username is linked to the main password, as of version 9.00 LANconfig shows root as the
administrator user name in the device configurations and in the Wizards.
284
Reference Manual
4 LANCOM Management System (LCMS)
Authenticating against a proxy server
As of version 9.00 it is possible for LANconfig to authenticate against an external proxy.
Proxy
If you wish to use a proxy server for access to your device, you can configure this here. Activate the required protocol
and enter the address and port for accessing the proxy server.
Depending on the protocol, it may be possible to specify a list of networks or individual hosts for which the proxy settings
do not apply.
285
Reference Manual
4 LANCOM Management System (LCMS)
Use HTTP proxy
Enables the use of an HTTP proxy.
1
Address: Enter the IP address of the the HTTP proxy server.
1
Port: Enter the port used by the HTTP proxy server.
Use HTTPS proxy
Enables the use of an HTTPS proxy.
1
Address: Enter the IP address of the the HTTPS proxy server.
1
Port: Enter the port used by the HTTPS proxy server.
Perform proxy user authentication
If the proxy server requires authentication, enter the user name and password here.
5
This option is available only if the proxy setting is enabled.
No proxy for
Enter the IP addresses and the corresponding netmask to which the proxy settings do not apply.
5
This option is available only if the proxy setting is enabled.
4.8.2 Enhancements to LANmonitor
Internal IPv6 support
As of version 9.00, LANmonitor can handle IPv6 addresses internally and can thus communicate with devices via IPv6.
Displaying static WAN IPs in the Status tree
As of version 9.00, LANmonitor can optionally display a a static WAN IP in the Status tree.
Additions to the Status menu
IPv4
This table contains the list of static IPv4 stations on the WAN.
SNMP ID:
1.4.13.1
Telnet path:
Status > WAN > IP-Addresses
286
Reference Manual
4 LANCOM Management System (LCMS)
Remote site
Name of the remote device.
SNMP ID:
1.4.13.1.1
Telnet path:
Status > WAN > IP-Addresses > IPv4
Type
Type of the assigned IPv4 address
SNMP ID:
1.4.13.1.2
Telnet path:
Status > WAN > IP-Addresses > IPv4
Possible values:
static
DHCP
PPP
Autoconfig
IP address
Assigned IPv4 address.
SNMP ID:
1.4.13.1.3
Telnet path:
Status > WAN > IP-Addresses > IPv4
IP netmask
Assigned IPv4 netmask.
SNMP ID:
1.4.13.1.4
Telnet path:
Status > WAN > IP-Addresses > IPv4
287
Reference Manual
4 LANCOM Management System (LCMS)
Gateway
Assigned gateway.
SNMP ID:
1.4.13.1.5
Telnet path:
Status > WAN > IP-Addresses > IPv4
DNS default
Primary assigned DNS server.
SNMP ID:
1.4.13.1.6
Telnet path:
Status > WAN > IP-Addresses > IPv4
DNS backup
Alternative assigned DNS server.
SNMP ID:
1.4.13.1.7
Telnet path:
Status > WAN > IP-Addresses > IPv4
NBNS default
Primary assigned NBNS server.
SNMP ID:
1.4.13.1.8
Telnet path:
Status > WAN > IP-Addresses > IPv4
NBNS backup
Alternative assigned NBNS server.
288
Reference Manual
4 LANCOM Management System (LCMS)
SNMP ID:
1.4.13.1.9
Telnet path:
Status > WAN > IP-Addresses > IPv4
Domain
The assigned domain.
SNMP ID:
1.4.13.1.10
Telnet path:
Status > WAN > IP-Addresses > IPv4
IPv6
This table contains the list of static IPv6 stations on the WAN.
SNMP ID:
1.4.13.2
Telnet path:
Status > WAN > Addresses
Remote site
Name of the remote device.
SNMP ID:
1.4.13.2.1
Telnet path:
Status > WAN > IP-Addresses > IPv6
Type
Type of the assigned IPv6 address
SNMP ID:
1.4.13.2.2
289
Reference Manual
4 LANCOM Management System (LCMS)
Telnet path:
Status > WAN > IP-Addresses > IPv6
Possible values:
Unknown
static
DHCP
Autoconfig
tunnel
IP address
Assigned IPv6 address.
SNMP ID:
1.4.13.2.3
Telnet path:
Status > WAN > IP-Addresses > IPv6
Prefix length
Assigned prefix length.
SNMP ID:
1.4.13.2.4
Telnet path:
Status > WAN > IP-Addresses > IPv6
Gateway
Assigned gateway.
SNMP ID:
1.4.13.2.5
Telnet path:
Status > WAN > IP-Addresses > IPv6
DNS default
Primary assigned DNS server.
290
Reference Manual
4 LANCOM Management System (LCMS)
SNMP ID:
1.4.13.2.6
Telnet path:
Status > WAN > IP-Addresses > IPv6
DNS backup
Alternative assigned DNS server.
SNMP ID:
1.4.13.2.7
Telnet path:
Status > WAN > IP-Addresses > IPv6
Domain
The assigned domain.
SNMP ID:
1.4.13.2.10
Telnet path:
Status > WAN > IP-Addresses > IPv6
4.9 Addition(s) to LCOS 9.10
4.9.1 Proxy authentication via NTLM
As of LCOS version 9.10, proxy authentication of LANconfig via NT LAN Manager (NTLM) is now possible.
Proxy
If you wish to use a proxy server for access to your device, you can configure this here. Activate the required protocol
and enter the address and port for accessing the proxy server.
291
Reference Manual
4 LANCOM Management System (LCMS)
Depending on the protocol, it may be possible to specify a list of networks or individual hosts for which the proxy settings
do not apply.
Use HTTP proxy
Enables the use of an HTTP proxy.
1
Address: Enter the IP address of the the HTTP proxy server.
1
Port: Enter the port used by the HTTP proxy server.
Use HTTPS proxy
Enables the use of an HTTPS proxy.
1
Address: Enter the IP address of the the HTTPS proxy server.
1
Port: Enter the port used by the HTTPS proxy server.
Perform proxy user authentication
If the proxy server requires authentication, enter the user name and password here. If the NT LAN Manager
(NTLM) is to carry out the authentication, you additionally enter the NT domain and computer name.
5
This option is available only if the proxy setting is enabled.
No proxy for
Enter the IP addresses and the corresponding netmask to which the proxy settings do not apply.
5
This option is available only if the proxy setting is enabled.
4.9.2 Special LANconfig icon for devices in a cluster or using Config Sync
LANconfig has a specific icon to mark devices that share their configuration via Config Sync. Furthermore, the Config
Cluster column shows the configuration group for each device. LANconfig is thus able to sort and edit the device listing
according to cluster name.
If you try to make changes to the configuration of a cluster member, you will receive following warning:
292
Reference Manual
4 LANCOM Management System (LCMS)
"This device belongs to the Config Cluster: [cluster name]. Editing this configuration also affects the following devices:
[Listing of all devices in the same cluster]"
You can bypass this message if necessary. To do this, enable the option Don't show again in the displayed window.
293
Reference Manual
4 LANCOM Management System (LCMS)
4.9.3 Special LANmonitor icon for devices in a cluster or using Config Sync
LANmonitor has a specific icon to mark devices that share their configuration via Config Sync. Also, the name of the
configuration group (cluster name) is shown after the device name. LANmonitor thus makes it easier to see which devices
share the same configuration.
4.9.4 LANCOM "Wireless Quality Indicators" (WQI)
LANmonitor optionally displays the signal quality of the individual interfaces with the Wireless Quality Indicators.
This representation of reception and transmission quality (RX and TX) helps you to make a quick assessment of signal
294
Reference Manual
4 LANCOM Management System (LCMS)
quality. To display this information in LANmonitor, open the section System information for the device. The indicators
are displayed under Interfaces.
The WLANmonitor also displays the Wireless quality indicators. To do this click on the main folder for the group.
4.9.5 Extended number of characters for device names
The current release of LCOS allows you to assign longer device names in LANconfig and WEBconfig. The number of
characters allowed is now 64 instead of 16.
4.9.6 Different notations for MAC addresses
As of LCOS version 9.10, LANconfig allows MAC addresses to be entered in other formats.
Different notations for MAC addresses
To make it easier to enter MAC addresses by using copy and paste from other applications into LANconfig, the following
formats can be used when entering MAC addresses:
1
000000000000
1
00:00:00:00:00:00
295
Reference Manual
4 LANCOM Management System (LCMS)
1
00-00-00-00-00-00
1
000000-000000
The input is then automatically converted into the form 00:00:00:00:00:00.
4.9.7 LANconfig: Text corrections relating to access rights
As of LCOS version 9.10, the descriptions of the access rights in the configuration menu Management > Admin in the
section Configuration access ways have been corrected:
1
From a LAN interface
1
From a WLAN interface
1
From a WAN interface
LANconfig also used the new names in the section Access to web-server services > Access rights.
296
Reference Manual
4 LANCOM Management System (LCMS)
5 Diagnosis
5.1 Trace information—for advanced users
Trace outputs may be used to monitor the internal processes in the router during or after configuration. One such trace
can be used to display the individual steps involved in negotiating the PPP. Experienced users may interpret these outputs
to trace any errors occurring in the establishment of a connection. A particular advantage of this is: The errors being
tracked may stem from the configuration of your own router or that of the remote site.
5
The trace outputs are slightly delayed after the actual event, but are always in the correct sequence. This will
not usually hamper interpretation of the displays but should be taken into consideration if making precise
analyses.
5.1.1 How to start a trace
Trace output can be started in a Telnet session. Set up a Telnet connection to your device. The command to call up a
trace follows this syntax:
1
trace [code] [parameters]
The trace command, the code, the parameters and the combination commands are all separated from each other by
spaces.
5.1.2 Overview of the keys
... in combination with the trace causes the following:This code...
displays a help text?
switches on a trace output+
switches off a trace output-
switches between different trace outputs (toggle)#
displays the current status of the traceno code
5.1.3 Overview of the parameters
5
The available traces depend individually on the particular model and can be listed by entering trace with no
arguments on the command line.
... brings up the following display for the trace:This parameter...
status messages for the connectionStatus
error messages for the connectionError
IPX routingIPX-router
PPP protocol negotiationPPP
IPX Service Advertising ProtocolSAP
IPX watchdog spoofingIPX-watchdog
SPX watchdog spoofingSPX-watchdog
297
Reference Manual
5 Diagnosis
... brings up the following display for the trace:This parameter...
Least-Cost RouterLCR
script processingScript
IPX Routing Information ProtocolIPX-RIP
Firewall activitiesFirewall
IP Routing Information ProtocolRIP
Address Resolution ProtocolARP
Internet Control Message ProtocolICMP
processes in the masquerading moduleIP masquerading
Dynamic Host Configuration ProtocolDHCP
NetBIOS managementNetBIOS
Domain Name Service ProtocolDNS
display of the first 64 bytes of a package in hexadecimal formPacket dump
trace on the D channel of the connected ISDN busD-channel-dump
spoofing at the ATM packet levelATM-cell
ATM errorsATM-Error
ADSL connections statusADSL
E-mail processing of the integrated mail clientSMTP-Client
E-mail processing of the integrated mail clientMail-Client
Simple Network Time Protocol informationSNTP
Timeserver TraceNTP
Messages from the activity protocolConnact
cron tableCron
RADIUS traceRADIUS
Status of serial interfaceSerial
Status of USB interfaceUSB
Load balancing informationLoad-Balancer
Information concerning Virtual Router Redundancy ProtocolVRRP
Status of ethernet interfaceEthernet
Information concerning virtual networksVLAN
Information concerning Internet Group Management ProtocolIGMP
Information concerning wireless networksWLAN
Trace for Inter Access Point Protocol, shows information concerning WLAN roaming.IAPP
Trace for Dynamic Frequency SelectionDFS
Information concerningWLAN bridgeBridge
Trace for EAPEAP
Information concerning Spanning Tree ProtokollSpgtree
LAN authentication (e.g. Public Spot)LANAUTH
SIP information which is exchanged between a LANCOM VoIP Router and a SIP provider
or upstream SIP PBX
SIP-Packet
298
Reference Manual
5 Diagnosis
... brings up the following display for the trace:This parameter...
IPSec and IKE negotiationVPN-Status
IPSec and IKE packetsVPN-Packet
5.1.4 Combination commands
... brings up the following display for the trace:This combination command...
all trace outputsAll
status and error outputsDisplay
LANCOM and PPP outputsProtocol
IP-Rt., IP-RIP, ICMP and ARP outputsTCP-IP
IPX-Rt., RIP, SAP, IPX-Wd., SPX-Wd., and NetBIOS outputsIPX-SPX
displays the system time in front of the actual trace outputTime
includes a display of the protocol that has initiated the output in front of the traceSource
Any appended parameters are processed from left to right. This means that it is possible to call a parameter and then
restrict it.
5.1.5 Trace filters
Some traces, such as the IP router trace or the VPN trace, produce a large number of outputs. The amount of output can
become unmanageable. The trace filters allow you to sift out the information that is important to you.
A trace filter is activated by adding the parameter “@“ that induces the following filter description. In filter description
uses of the following perators:
BeschreibungOperator
OR: The filter applies if one of the operator occurs in the trace output(space)
AND: The filter applies if the operator occurs in the trace output+
Not: The filter applies if the operator does not occur in the trace output-
the output must match the search string exactly"
An operator can be entered as any string of characters, such as the name of a remote station, protocols or ports. The
trace filter then processes the output according to the operator rules, much like an Internet search engine. Examples of
the application of filters can be seen under .
5.1.6 Examples of traces
... in combination with the trace causes the following:This code...
displays all protocols that can generate outputs during the configuration, and the
status of each output (ON or OFF)
trace
switches on all trace outputstrace + all
switches off all trace outputstrace - all
switches on the output for all connection protocols together with the status and error
messages
trace + protocol display
switches on all trace outputs with the exception of the ICMP protocoltrace + all - icmp
displays the status of the PPPtrace ppp
toggles between the trace outputs for the IPX router and the display outputstrace # ipx-rt display
299
Reference Manual
5 Diagnosis
... in combination with the trace causes the following:This code...
switches on all trace outputs for IP routers related to remote site A or Btrace + ip-router @ GEGENSTELLE-A
GEGENSTELLE-B
switches on all trace outputs for IP routers related to remote site A or B that do not
use ICMP
trace + ip-router @+GEGENSTELLE-A -ICMP
switches on all trace outputs for IP routers related to remote site A or B that use ICMPtrace + ip-router @ GEGENSTELLE-A
GEGENSTELLE-B +ICMP
switches on all trace outputs from the IP router wiht TCP/IP and port 80. “port: 80”
is in quotes so that the space is recognised as a part of the string.
trace + ip-router @+TCP +"port: 80"
5.1.7 Recording traces
Traces can be conveniently recorded under Windows (e.g. as an aid to Support), and we recommend you do this as
follows:
Start the program HyperTerminal under Start / Programs / Accessories / Communications / Hyper Terminal. Enter
a name of your choice when prompted to do so.
In the window 'Connect to' use the pulldown menu 'Connect using' and select the entry 'TCP/IP'. As 'Host address' enter
the local/official IPaddress or the FQDN of the device. After confirmation, HyperTerminal dipslays a request to log in.
Enter the configuration password .
You record the traces by clicking on Transmit / Capture text. Enter the path of the directory where the text file is to
be saved. Now change back to the dialog window and enter the required trace command.
To stop the trace, click on the HyperTerminal menus Transmit / Stop text capture.
5.2 Tracing with LANmonitor
New in LCOS 7.60:
1
Saving support files with trace data, device configuration, bootlog and sysinfo
1
Automatic backup of trace data
1
Trace configuration with Wizards
1
Display of show commands
1
Display of status information and statistics
1
SSL-encrypted Telnet connection
Traces can be executed very easily with LANmonitor. Simply click on the entry for the device with the right-hand mouse
key and select Traces from the context menu.
300
Reference Manual
5 Diagnosis
5
Telnet-access to the device must be enabled to carry out trace requests with LANmonitor. When starting the
trace dialog, LANmonitor first attempts to establish an SSL-encrypted Telnet connection to the device. If the
device does not support SSL connections, LANmonitor automatically switches to unencrypted Telnet. If SNMP
access to the device is password-protected, the access data for an administrator with trace rights is also required.
5.2.1 Introduction
The trace function in LANmonitor exceeds the standard trace functions available from Telnet and offers greater convenience
in the generation and analysis of traces. For example, the current trace configuration for activating the necessary trace
commands can be stored to a configuration file. An experienced service technician can set up a trace configuration and
provide it to a less experienced user for executing specialized trace requests for a device. The trace results can also be
stored in a file and returned to the technician for analysis.
To open the trace window for a device, right-click the device entry in LANmonitor and select “Traces” from the context
menu.
LANmonitor has the following buttons for operating the trace module:
Opens a pre-defined configuration for the trace command. This allows you to carry out trace commands precisely as
required by the service technician, for example.
Stores the current trace configuration to be passed on to a user.
Opens a file with trace results for viewing in the trace module.
Saves the current trace results to a file.
Clears the current display or trace results.
Starts outputting the trace results as produced by the current configuration and automatically switches to the trace-result
display mode. As soon as the trace results are returned, the other buttons are deactivated.
Stops the output of trace results.
Switches to the mode for configuring the trace output.
301
Reference Manual
5 Diagnosis
Switches to the mode for displaying the trace output.
5.2.2 Configuring the trace dumps with the Trace Wizard.
The trace settings can be configured very easily with the Wizard. To do this, select Accompanying Configuration in
the left-hand area of the trace dialog and click Start Wizard in the main window. The trace functions can be selected
in the following dialogs (such as VPN) and the trace can be further restricted when required (such as to a particular VPN
remote site). When ending the Wizard, select whether the Wizard should replace or extend the existing trace configuration.
5
With the exception of the bootleg trace (contained automatically), all previous trace settings are deleted when
the trace configuration is replaced. Save the previous trace configuration for later use whenever required before
running the Wizard.
302
Reference Manual
5 Diagnosis
5.2.3 LCOS menu tree of the trace dumps
Going beyond the settings of the Wizard, traces and other displays can be set up precisely using the LCOS menu tree.
The LCOS menu tree is divided into three areas:
1
Show
Particular information can be retrieved for every device type using a Show command. Show commands are usually
used on the command line (Telnet). The call of this Show command is very convenient from the graphical Windows
interface in the advanced configuration of the trace.
To access the current dump of the Show command, click the name of a Show command in the left-hand area of the
trace dialog and then the Show button. You may have to/be able to specify additional parameters depending on the
entry selected. Enter a question mark in the input field and then click the Show button for information on these
parameters.
To accept the dump of the Show command into the trace data, click the appropriate checkbox to the left of the entry
name. For every Show command enabled, it is possible to set whether it is only run once on start of the trace or
whether it is run at regular intervals (set in seconds).
5
The settings of the Show commands are stored in the trace configuration together with the actual trace
settings.
1
Status
Comprehensive status information and statistics on a device can be accessed from the command line (Telnet) or via
WEBconfig. All available status information can also be shown via the trace dialog. Tables and individual values are
shown using special icons.
To display the current contents of the table or value, click the name of a status entry in the left-hand area of the
trace dialogue.
To accept the dump of the Status entry into the trace data, click the appropriate checkbox to the left of the entry
name. For every Status entry enabled, a setting defines whether it is read out once only on starting the trace or
whether it is read out at regular intervals (set in seconds).
303
Reference Manual
5 Diagnosis
5
The settings of the Status information are stored in the trace configuration together with the actual trace
settings. Status information is stored together with the actual trace data.
1
Trace settings
The traces to be dumped for the current device can be enabled in the trace settings area.
To accept the dump of the trace into the trace data, click the appropriate checkbox to the left of the entry name. A
filter can be entered for every trace. For example, if you want to display only the IP traces of a particular workstation,
enter the appropriate IP address as a filter of the IP router trace.
304
Reference Manual
5 Diagnosis
5.2.4 Display of trace data
The entire trace configuration is shown in the lower area of the dialog where all active Trace, Status and Show entries
are listed with the respective filters and parameters.
To start the dump of the trace data, change to Display mode with the Start button. The ongoing trace dumps are displayed
in this view:
1
The trace events are listed chronologically in the upper area.
1
The lower area lists the results of the events in sequence.
For easier navigation within long trace dumps, click a trace event in the upper area. The appropriate result is then enabled
in the list and highlighted green.
Right-clicking a trace event opens up a context menu from where individual trace results can be shown/hidden.
5
Trace data is collected as long as the trace dump is enabled. To prevent overloading the main workstation memory
using LANmonitor, trace data is automatically written to a backup file. The time intervals and the maximum size
of a backup file can be set with Extras / Other Settings / Trace backup.
305
Reference Manual
5 Diagnosis
5.2.5 Backing up and restoring the trace configuration
The entire configuration of the trace dump can be written to a storage medium for later re-use or for transfer to another
user. Click on File / Store trace configuration and re-open it later with File / Load trace configuration.
5.2.6 Backing up and restoring the trace data
For later editing, or for transfer to another user, the actual trace data can be written to a storage medium with File /
Store trace data and later re-opened with File / Load trace data .
5.2.7 Backup settings for traces
When starting a trace with LANmonitor, a backup file with the current trace data is automatically saved. The settings
for the trace backup can be configured with Extras / Other settings / Trace backup. Enter the following parameters:
1
Directory for the trace backups
1
Maximum size of a trace backup file. If this file size is reached with an active trace, another trace backup file is
created automatically.
1
Save interval of the trace backup file. When this time has elapsed, an updated version of the trace backup file is
saved automatically. The trace backup file therefore does not contain the information from the most recent backup
up to the current time.
1
LANmonitor can set current workstation time as a time for the trace, for example when the traced device itself does
not have valid time information.
5.2.8 Saving support file
A support file enables all information pertaining to support to be easily written to one file:
1
Trace data as configured in the current settings (such as with function “Save trace data”)
1
Current device configuration
1
Bootlog
1
Sysinfo
306
Reference Manual
5 Diagnosis
When saving the device configuration, security-related information of no relevance to support can be hidden. Use Extras
/ Other settings / Support file in the trace window to select which information is not to be saved in the support file:
5
The support file created this way contains text-based information. The file can be opened using an editor or
checked for any critical entries.
5.2.9 Addition(s) to LCOS 8.50
LANtracer: Tracing with LANconfig and LANmonitor
Traces can be executed very easily with LANconfig or LANmonitor. Simply click on the entry for the device with the
right-hand mouse key and select Traces from the context menu.
5
Telnet-access to the device must be enabled to carry out trace requests with LANconfig or LANmonitor. When
starting the trace dialog, LANconfig or LANmonitor first attempts to establish an SSL-encrypted Telnet connection
to the device. If the device does not support SSL connections, LANconfig or LANmonitor automatically switches
to unencrypted Telnet. If access to the device configuration is password-protected, the access data for an
administrator with trace rights is also required.
Introduction
The trace function in LANconfig and LANmonitor exceeds the standard trace functions available from Telnet and offers
greater convenience in the generation and analysis of traces. For example, the current trace configuration for activating
the necessary trace commands can be stored to a configuration file. An experienced service technician can set up a trace
configuration and provide it to a less experienced user for executing specialized trace requests for a device. The trace
results can also be stored in a file and returned to the technician for analysis.
To open the trace window for a device, right-click the device entry in LANconfig or LANmonitor and select “Create trace
output” from the context menu.
LANmonitor has the following buttons for operating the trace module:
Opens a pre-defined configuration for the trace command. This allows you to carry out trace commands precisely as
required by the service technician, for example.
307
Reference Manual
5 Diagnosis
Stores the current trace configuration or the trace data to be passed on to a user.
Clears the current display or trace results.
Starts outputting the trace results as produced by the current configuration and automatically switches to the trace-result
display mode. As soon as the trace results are returned, the other buttons are deactivated.
Stops the output of trace results.
Switches to the mode for configuring the trace output.
Switches to the mode for displaying the trace output.
Switches to the split-screen mode to display the trace results in two parallel windows.
Opens the window to search through the trace results.
Starts the time-stamp based synchronization of the two traces in the split-screen display.
308
Reference Manual
5 Diagnosis
Stops the synchronization of the two traces in the split-screen display.
Expert configuration of the trace dumps
Going beyond the settings of the Wizard, traces and other displays can be set up precisely using the Expert Configuration.
The Expert Configuration is divided into three areas:
Show
Particular information can be retrieved for every device type using a Show command. Show commands are usually used
on the command line (Telnet). The call of this Show command is very convenient from the graphical Windows interface
in the advanced configuration of the trace. To access the current dump of the Show command, click the name of a Show
command in the left-hand area of the trace dialog and then the Show button. You may have to/be able to specify
additional parameters depending on the entry selected. Enter a question mark in the input field and then click the Show
button for information on these parameters. To accept the dump of the Show command into the trace data, click the
appropriate checkbox to the left of the entry name. For every Show command enabled, it is possible to set whether it is
only run once on start of the trace or whether it is run at regular intervals (set in seconds).
309
Reference Manual
5 Diagnosis
5
The settings of the Show commands are stored in the trace configuration together with the actual trace settings.
Status
Comprehensive status information and statistics on a device can be accessed from the command line (Telnet) or via
WEBconfig. All available status information can also be shown via the trace dialog. Tables and individual values are
shown using special icons. To display the current contents of the table or value, click the name of a status entry in the
left-hand area of the trace dialogue. To accept the dump of the Status entry into the trace data, click the appropriate
checkbox to the left of the entry name. For every Status entry enabled, a setting defines whether it is read out once only
on starting the trace or whether it is read out at regular intervals (set in seconds).
5
The settings of the Status information are stored in the trace configuration together with the actual trace settings.
Status information is stored together with the actual trace data.
310
Reference Manual
5 Diagnosis
Trace settings
The traces to be dumped for the current device can be enabled in the trace settings area. To include the trace commands
into the trace results, click the appropriate checkbox to the left of the entry name. A filter can be entered for every trace.
For example, if you want to display only the IP traces of a particular workstation, enter the appropriate IP address as a
filter of the IP router trace.
Display of the trace results
The entire trace configuration is shown in the lower area of the dialog where all active Trace, Status and Show entries
are listed with the respective filters and parameters.
To start the dump of the trace data, change to Display mode with the Start button.
311
Reference Manual
5 Diagnosis
If you want to compare the results of two traces with one another, you can display two traces side by side in the split-screen
mode.
Start the time-stamp based synchronization of the two traces with the button. In the following window, enter a
suitable value for the offset in milliseconds and start the synchronization.
The ongoing trace dumps are displayed in this view:
1
The upper section lists the results for the executed trace commands chronologically line by line.
1
Since the results for a single trace command can be very long, the lower section shows a more detailed breakdown
of the result selected in the upper section.
For easier navigation within long trace dumps, click a trace event in the upper area. The appropriate result is then enabled
in the list and highlighted in the lower section in green. Right-clicking a trace event opens up a context menu from where
individual trace results can be shown/hidden.
5
Trace data is collected as long as the trace dump is enabled. To prevent overloading the main workstation memory
using LANconfig or LANmonitor, trace data is automatically written to a backup file. The time intervals and the
maximum size of a backup file can be set with 'Extras > Other Settings > Trace backup'.
312
Reference Manual
5 Diagnosis
Backing up and restoring the trace configuration
The entire configuration of the trace dump can be written to a storage medium for later re-use or for transfer to another
user. Click on 'File > Save trace config' and re-open it later with 'File > Load trace config'.
Backing up and restoring the trace data
For later editing, or for transfer to another user, the actual trace data can be written to a storage medium with 'File >
Save trace data/support configuration' and later re-opened with 'File > Load trace data'.
313
Reference Manual
5 Diagnosis
Alternatively, you can also use the buttons to load or to save the trace data.
Backup settings for traces
When starting a trace with LANconfig or LANmonitor, a backup file with the current trace data is automatically saved.
The settings for the trace backup can be configured with 'Extras > Other settings > Trace' backup. Enter the following
parameters:
1
Directory for the trace backups
1
Maximum size of a trace backup file. If this file size is reached with an active trace, another trace backup file is
created automatically.
1
Save interval of the trace backup file. When this time has elapsed, an updated version of the trace backup file is
saved automatically. The trace backup file therefore does not contain the information from the most recent backup
up to the current time.
314
Reference Manual
5 Diagnosis
1
LANmonitor can set current workstation time as a time for the trace, for example when the traced device itself does
not have valid time information.
Filtering traces
Trace output from the command line or the LCMS Trace dialog can often be very long, because the trace receives
information from the device at a very high frequency. To make the trace output easier to understand, you can apply
appropriate filters. The filters use a search function to analyze the trace output and present the desired information only.
In the following example, the administrator activates a simple IP router trace on a device with three Internet connections
and sends pings to different destinations. The unfiltered trace output shows all packets processed by the IP router in the
device:
root@MyDevice:/
> trace # ip-router
IP-Router ON
root@MyDevice:/
>[IP-Router] 2010/12/20 17:11:06,430
IP-Router Rx (LAN-1, INTRANET3, RtgTag: 3):
DstIP: 4.4.4.1, SrcIP: 192.168.3.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0015, seq: 0x1cde
Route: WAN Tx (INTERNET3)
[IP-Router] 2010/12/20 17:11:06,430
IP-Router Rx (LAN-1, INTRANET1, RtgTag: 1):
DstIP: 11.11.11.1, SrcIP: 192.168.1.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0016, seq: 0x1ccf
Route: WAN Tx (INTERNET1)
[IP-Router] 2010/12/20 17:11:06,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1ccf
Route: LAN-1 Tx (INTRANET1):
[IP-Router] 2010/12/20 17:11:06,430
IP-Router Rx (INTERNET3, RtgTag: 3):
DstIP: 192,168.3,100, SrcIP: 44.41, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0015, seq: 0x1cde
Route: LAN-1 Tx (INTRANET3):
[IP-Router] 2010/12/20 17:11:06,600
IP-Router Rx (LAN-1, INTRANET2, RtgTag: 2):
DstIP: 3.3.3.1, SrcIP: 192.168.2.100, Len: 84, DSCP/TOS: 0x00
315
Reference Manual
5 Diagnosis
Prot.: ICMP (1), echo request, id: 0x0014, seq: 0x1cea
Route: WAN Tx (INTERNET2)
[IP-Router] 2010/12/20 17:11:06,600
IP-Router Rx (INTERNET2, RtgTag: 2):
DstIP: 192,168.2,100, SrcIP: 33.31, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0014, seq: 0x1cea
Route: LAN-1 Tx (INTRANET2):
[IP-Router] 2010/12/20 17:11:07,430
IP-Router Rx (LAN-1, INTRANET1, RtgTag: 1):
DstIP: 11.11.11.1, SrcIP: 192.168.1.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0016, seq: 0x1cd0
Route: WAN Tx (INTERNET1)
[IP-Router] 2010/12/20 17:11:07,430
IP-Router Rx (LAN-1, INTRANET3, RtgTag: 3):
DstIP: 4.4.4.1, SrcIP: 192.168.3.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0015, seq: 0x1cdf
Route: WAN Tx (INTERNET3)
[IP-Router] 2010/12/20 17:11:07,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1cd0
Route: LAN-1 Tx (INTRANET1):
[IP-Router] 2010/12/20 5:11:07 PM,430
IP-Router Rx (INTERNET3, RtgTag: 3):
DstIP: 192,168.3,100, SrcIP: 44.41, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0015, seq: 0x1cdf
Route: LAN-1 Tx (INTRANET3):
[IP-Router] 2010/12/20 5:11:07 PM,600
IP-Router Rx (LAN-1, INTRANET2, RtgTag: 2):
DstIP: 3.3.3.1, SrcIP: 192.168.2.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0014, seq: 0x1ceb
Route: WAN Tx (INTERNET2)
[IP-Router] 2010/12/20 5:11:07 PM,600
IP-Router Rx (INTERNET2, RtgTag: 2):
DstIP: 192,168.2,100, SrcIP: 33.31, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0014, seq: 0x1ceb
Route: LAN-1 Tx (INTRANET2):
The output in just 2 seconds is enough to produce a large amount of data. For a better overview of the output, add a
filter to the trace command. The filters start with the @ symbol and enter a search criterion. In this example, the filter
reduces the output to that containing the search criterion "Internet1", in order to output only the packets from this
remote site.
5
The filter is not case-sensitive.
root@MyDevice:/
> trace # ip-router @ INTERNET1
IP-Router ON @ INTERNET1
[IP-Router] 2010/12/20 17:11:50,430
IP-Router Rx (LAN-1, INTRANET1, RtgTag: 1):
DstIP: 11.11.11.1, SrcIP: 192.168.1.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0016, seq: 0x1cfb
Route: WAN Tx (INTERNET1)
316
Reference Manual
5 Diagnosis
[IP-Router] 2010/12/20 5:11:50 PM,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1cfb
Route: LAN-1 Tx (INTRANET1):
[IP-Router] 2010/12/20 5:11:51 PM,430
IP-Router Rx (LAN-1, INTRANET1, RtgTag: 1):
DstIP: 11.11.11.1, SrcIP: 192.168.1.100, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo request, id: 0x0016, seq: 0x1cfc
Route: WAN Tx (INTERNET1)
[IP-Router] 2010/12/20 5:11:51 PM,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1cfc
Route: LAN-1 Tx (INTRANET1):
Again, the time frame of the trace is about two seconds, but the amount of data has already been reduced significantly.
The only data to be displayed is that relating to remote site "INTERNET1". However, further filter criteria can also be
specified simply by placing a space between the first and second criteria. As well as a space symbol, the symbols "+"
and "-" can also be used as operators. With a "+" both criteria must be met; with a "-" the criterion must not be fulfilled;
a space means that one or the other of the associated criteria must be fulfilled. The option to use strings containing
operators as a filter is implemented by quotation marks:
If you want to apply multiple search terms, you can separate the terms with the following operators:
1
Space: A space before a search term is a logical OR operation. The trace output is only displayed if it contains one
of the strings marked in this way.
1
+: A plus sign before a search term is a logical AND operation. The trace output is only displayed if it contains all of
the strings marked in this way.
1
-: A minus sign before a search term is a logical NOT operation. The trace output is only displayed if it contains none
of the strings marked in this way.
root@MyDevice:/
> trace # ip-router @ INTERNET1 -"echo request"
IP-Router ON @ INTERNET1 -"echo request"
[IP-Router] 2010/12/20 17:12:06,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1d0b
Route: LAN-1 Tx (INTRANET1):
[IP-Router] 2010/12/20 17:12:07,430
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0016, seq: 0x1d0c
Route: LAN-1 Tx (INTRANET1):
The trace now shows only the entries that contain the remote site 'INTERNET1', but not the string 'echo request'. This
displays only the responses to a ping as they return from the remote site.
You can use multiple traces simultaneously and filter by different criteria. In the following example, an Ethernet trace is
run in addition to the IP router trace to see the packet associated with the ping on the Ethernet:
root@MyDevice:/
> trace # ip-router @ INTERNET1 +"echo reply"
IP-Router ON @ INTERNET1 +"echo reply"
root@MyDevice:/
> trace # eth @ ICMP +“echo reply”
Ethernet ON @ icmp +"echo reply"
317
Reference Manual
5 Diagnosis
[IP-Router] 2010/12/21 14:17:21,000
IP-Router Rx (INTERNET1, RtgTag: 1):
DstIP: 192,168.1,100, SrcIP: 11.11.11.1, Len: 84, DSCP/TOS: 0x00
Prot.: ICMP (1), echo reply, id: 0x0002, seq: 0x2654
Route: LAN-1 Tx (INTRANET1):
[Ethernet] 2010/12/21 14:17:21,000
Sent 98 byte Ethernet packet via LAN-1:
HW Switch Port : ETH-1
-->IEEE 802.3 Header
Dest : 00:a0:57:12:a9:21 (LANCOM 12:a9:21)
Source : 00:a0:57:12:f7:81 (LANCOM 12:f7:81)
Type : IPv4
-->IPv4 Header
Version : 4
Header Length : 20
Type of service : (0x00) Precedence 0
Total length : 84
ID : 18080
Fragment : Offset 0
TTL : 59
Protocol : ICMP
Checksum : 24817 (OK)
Src Address : 11.11.11.1
Dest Address : 192.168.1.100
-->ICMP Header
Msg : echo reply
Checksum : 18796 (OK)
Body : 00 00 00 02 00 00 26 54 ......
7e c9 6d 8c 00 00 00 00 ~.m.....
00 01 02 03 04 05 06 07 ........
08 09 0a 0b 0c 0d 0e 0f ........
10 11 12 13 14 15 16 17 ........
18 19 1a 1b 1c 1d 1e 1f ........
20 21 22 23 24 25 26 27 !"#$%
Saving a support file
A support file enables all information pertaining to support to be easily written to one file:
1
Trace data as configured in the current settings (such as with function “Save trace data”)
1
Current device configuration
1
Bootlog
1
Sysinfo
When saving the device configuration, security-related information of no relevance to support can be hidden. Use 'Extras
> Other settings > Support file' in the trace window to select which information is not to be saved in the support file:
318
Reference Manual
5 Diagnosis
5
The support file created this way contains text-based information. The file can be opened using an editor or
checked for any critical entries.
5.3 SYSLOG
5.3.1 Introduction
The SYSLOG protocol is used to log the activities of a LANCOM device. This function is especially interesting for system
administrators as it records a a complete history of all activities in the device. The information captured in the SYSLOG
log can be viewed in different ways:
1
SYSLOG messages can be sent to a central "collection point", a so-called SYSLOG client or SYSLOG daemon. This
option is useful, for example, when messages from a large number of devices are to be logged.
2
Logging under UNIX/Linux is generally performed by the SYSLOG daemon that is set up as standard in these
operating systems. The daemon either establishes contact with the console or writes its log to an appropriate
SYSLOG file. The file /etc/syslog.conf contains a definition of which facilities (more on this term later)
should be written to which log file. Please check your daemon's configuration to see if it explicitly listens to
network connections.
2
Windows does not provide a corresponding system function. You require special software to provide the
functionality of a SYSLOG daemon.
2
Syslog in the device memory.
1
To extend the output of the SYSLOG information over an appropriate SYSLOG client, the most recent SYSLOG messages
are stored in the device's RAM. Depending on the memory fitted, this can vary from 100 to 2048 syslog messages.
These internal syslogs can be viewed in various ways:
2
In the device statistics via the command line, e.g. with telnet
2
In WEBconfig under /System information/Syslog
2
LANmonitor additionally lets you export the syslog from the device and save it to a file. Simply click on the entry
for the device with the right mouse button and select View Syslog from the context menu. A snapshot of the
current status is displayed. Clicking on Refresh exports a copy of the current syslog and this is dispayed in the
window. Save syslog... stores the current display to a file. The content of syslog files can be viewed with Load
syslog....
319
Reference Manual
5 Diagnosis
5
SYSLOG messages will only be written to the device's internal memory if the LANCOM was entered as a
SYSLOG client with the loopback address 127.0.0.1.
Alternatively you can view the current SYSLOG messages on the first page of WEBconfig on the SYSLOG tab:
5.3.2 Structure of SYSLOG messages
SYSLOG messages consist of three parts:
1
Priority
1
Header
1
Contents
Priority
The priority in a SYSLOG message contains information about the the message severity and the facility (service or
component that triggered the message).
The eight severity levels originally defined in SYSLOG have been reduced to five levels in the LANCOM. The table below
shows the correlation between the LANCOM alarm level, the meaning and the SYSLOG severities.
SYSLOG severityMeaningPriority
PANIC, ALERT, CRITThis category includes all messages requiring the system administrator's close attention.Alarm
ERRORAll error messages which can occur under normal conditions are communicated at this level;
no special attention is required by the administrator (e.g. connection errors).
Error
320
Reference Manual
5 Diagnosis
SYSLOG severityMeaningPriority
WARNINGThis level communicates messages which do not compromise normal operating conditions.Warning
NOTICE, INFORMAt this level, all messages are sent that have a purely informational character (e.g. accounting
information).
Information
DEBUGCommunication of all debug messages. Debug messages generate large data volumes and
can compromise the device's operation. For this reason they should be disabled for normal
operations and only used for troubleshooting.
Debug
The table below provides an overview of the meaning of all internal message sources that you can set in the LANCOM.
The final column in the table also provides the standard correlation between the internal sources of the LANCOM and
the SYSLOG facilities. This mapping can be changed, if necessary.
FacilityMeaningSource
KERNELSystem messages (boot events, timer system, etc.)System
AUTHMessages concerning the user's login or logout during the PPP negotiation, and any errors that
occur during this.
Logins
CRONMessages about changes to the system timeSystem time
AUTHPRIVMessages about console logins (Telnet, Outband, etc.), logouts and any errors that occurred during
this.
Console logins
LOCAL0Messages about establishment and termination of connections and any errors that occurred (display
trace)
Connections
LOCAL1Accounting information stored after termination of a connection (user, online time, transfer
volumes)
Accounting
LOCAL2Messages on changes to the configuration, remotely executed commands, etc.Administration
LOCAL3Regular statistics about the most frequently used services (breakdown per port number) and
messages about filtered packets, routing errors, etc.
Router
Header
The header contains the name or the IP address of the device which sent the SYSLOG message. The chronological sequence
is also very important for evaluating the messages. Time information is only added to the messages at the SYSLOG client
in order not to disturb their chronological consistency due to different device times.
5
The LANCOM devices must have a valid time stamp for the evaluation of the SYSLOG messages in internal memory.
Contents
The actual contents of the SYSLOG messages describe the event, for example a login occurrence, the establishment of
a WAN connection, or firewall activities.
321
Reference Manual
5 Diagnosis
5.3.3 Configuring SYSLOG using LANconfig
You can find the parameters to configure SYSLOG under LANconfig in the configuration area "Log & Trace" on the
"SYSLOG" tab.
Creating SYSLOG clients
When setting up a SYSLOG client, first define the IP address to which SYSLOG messages are to be sent. As an option,
you can define a different sending IP address. To do this, select which of the internal LANCOM sources are to send
messages to this SYSLOG client. You can further restrict the volume of messages by selecting certain priorities, for example
only alarm and error messages.
322
Reference Manual
5 Diagnosis
As of LCOS version 7.6 the table of syslog clients (factory settings) is set up to display important events which are relevant
to diagnostics, and to save these to the internal syslog memory. The following screenshot shows these pre-defined syslog
clients under LANconfig:
5
Further information about the meaning of the pre-defined syslog clients and the update options for existing
LANCOM devices are to be found in the section "Table of syslog clients" for the configuration of syslog via telnet
or WEBconfig.
Assigning internal LANCOM sources to SYSLOG facilities
The SYSLOG protocol uses certain designations for message sources, the so-called facilities. Each internal source in the
LANCOM devices that can generate a SYSLOG message must therefore be assigned to a SYSLOG facility.
The standard mapping can be changed, if necessary. So, for example, all SYSLOG messages from a LANCOM can be
sent with a certain facility (Local7). It is thus possible to collect all LANCOM messages in a common log file by configuring
the SYSLOG client appropriately.
5.3.4 Configuring SYSLOG using Telnet or WEBconfig
Path: Setup/SYSLOG
1
Active
Activates the dispatch of information about system events to the configured SYSLOG client.
1
Port
Port used for sending SYSLOG messages.
Facility mapping
Path: Setup/SYSLOG/Facility-Mapper
1
Facility
Mapping sources to specific facilities.
1
Source
Mapping sources to specific facilities.
323
Reference Manual
5 Diagnosis
Table of SYSLOG clients
As of LCOS version 7.6 the table of syslog clients (factory settings) is set up to display important events which are relevant
to diagnostics, and to save these to the internal syslog memory. The following screenshot shows these pre-defined syslog
clients under WEBconfig:
WEBconfig: LCOS menu tree/ Setup/ SYSLOG/ SYSLOG table
All pre-defined syslog clients transmit the messages to the IP address 127.0.0.1, i.e. to the LANCOM itself. The sender
IP address is the IP address from the "INTRANET" network. Individual entries have the following functions:
MeaningLevelSourceIndex
System time without a specifiied level00040001
System messages with the level alarm, error, alert or debug.17010002
Connection messages with the level error.02100003
Management messages with the level information.08400004
Logins with the level error or information.0a020005
Console logins with the level information.08080006
Accounting messages with the level information.08200007
Router messages with the level alarm.01800008
5
If you update an existing device, the settings for SYSLOG are not set to this default value, so that any existing
settings are retained. In this case you can enter the settings according to this table. Alternatively you will find a
script for automatically installing pre-defined syslog clients on the LANCOM Web site in the "KnowledgeBase".
1
Idx.
Position of the entry in the table.
1
IP address
IP address of the SYSLOG client.
1
Source
Source that caused the message to be sent. Each source is represented by a certain code.
1
Level
SYSLOG level with which the message is sent. Each level is represented by a certain code.
1
Loopback address
324
Reference Manual
5 Diagnosis
This is where you can configure an optional sender address for use instead of that automatically selected for the
destination address.
5.3.5 Addition(s) to LCOS 8.80
Configuring SYSLOG using LANconfig
For configuration with LANconfig, the SYSLOG module is located under the configuration section Log & Trace > General
on the SYSLOG pane.
Creating SYSLOG clients
When setting up a SYSLOG client, you first define the IP address to which the SYSLOG server is to send the messages.
Do this in the LANconfig configuration by clicking on Log & Trace > General, then in the SYSLOG pane click on SYSLOG
servers, and then click Add or Edit. Set the IP address and optionally specify a different source IP address. To do this,
select which of the internal LANCOM sources are to send messages to this SYSLOG client. You can further restrict the
volume of messages by selecting certain priorities, for example only alarm and error messages.
325
Reference Manual
5 Diagnosis
With the factory settings, the table of SYSLOG clients is set up to display important events which are relevant to diagnostics,
and to save these to the internal SYSLOG memory. The following screenshot shows these pre-defined SYSLOG clients
under LANconfig:
5
Further information about the meaning of the pre-defined SYSLOG clients and the update options for existing
LANCOM devices are to be found in the section "Table of SYSLOG clients" for the configuration of SYSLOG via
telnet or WEBconfig.
Assigning internal LANCOM sources to SYSLOG facilities
The SYSLOG protocol uses certain designations for message sources, the so-called facilities. Each internal source in the
LANCOM devices that can generate a SYSLOG message must therefore be assigned to a SYSLOG facility.
The standard mapping can be changed, if necessary. In this way you can, for example, send all SYSLOG messages from
a LANCOM with a specific facility (Local7). It is thus possible to collect all LANCOM messages in a common log file by
configuring the SYSLOG client appropriately.
Under Log & Trace > General in the section SYSLOG under Facility mapping, the internal LANCOM sources can be
assigned to the corresponding SYSLOG facilities.
5.3.6 Addition(s) to LCOS 8.82
SYSLOG: Configuration of the retention period for system events
As of Version LCOS 8.82 you can also enter the retention period for system events in hours, days, and months.
Additions to the Setup menu
Message age unit
This parameter determines whether the message age is specified in hours, days and months.
5
In this case, a month is 30 days.
Telnet path:
Setup > SYSLOG
326
Reference Manual
5 Diagnosis
Possible values:
Hour
Day
Month
Default:
Hour
Enhancements to LANconfig
Configuration of the retention period for system events
Under log & Trace > System events you can specify how long the device should save system events in the section
System event logging. You can specify both the quantity (0-9999) and the unit (hour, day, month).
5
In this case, a month is 30 days.
SYSLOG: Extension of log entries of the internal SYSLOG server
As of LCOS version 8.82, the internal syslog server for certain devices can store up to 23,000 entries.
This change currently applies to the following device types and series:
1
LANCOM 17xx+ series
1
LANCOM 1781 series
1
LANCOM 1780EW-4G
1
LANCOM L-460agn dual Wireless
1
LANCOM L-451agn Wireless
1
LANCOM L-452agn dual Wireless
1
LANCOM 7100+ VPN
1
LANCOM 9100+ VPN
327
Reference Manual
5 Diagnosis
1
LANCOM WLC-4006+
SYSLOG: Extended status display of the login to the cellular network
As of LCOS version 8.82, the SYSLOG displays detailed information about the status of the login process on a cellular
network (UMTS/3G+, GPRS, LTE/4G).
Extended status display of the login to the cellular network
In order to more quickly analyze connection problems in a cellular network, WWAN-capable LANCOM routers report all
logon procedures to the SYSLOG. In this manner, the user can recognize if and why the cellular service provider rejected
the connection, for example.
The device generates a SYSLOG entry for each of the following events:
Modification or problem when setting the registration status
SYSLOG severityMeaningStatus
INFORMThe modem is not registered and is not
searching for a cellular network.
not searching for network
INFORMThe modem is not registered and is not
searching for a cellular network.
searching for network
INFORMThe modem has registered on its
service provider's cellular network.
registered to home network
INFORMThe modem has successfully registered
on the cellular network of the service
provider's roaming partner.
registered to foreign network
INFORMInitial value. The modem has not yet
received a response from the radio
unknown registration
module regarding the registration
status.
ERRORThe cellular service provider has
rejected the login on the cellular
network.
network registration denied
NOTICEThe modem lost the connection to the
registered cellular network.
lost network registration
ERRORThe modem has replied to the
command to assign the network with
failed to set network
an error message. This error occurs if,
for example, the network cannot be
reached or does not exist, or an error
has occurred on the device.
ERRORThe modem has replied to the
command to assign the network mode
failed to set network mode
with an error message. This error
occurs if, for example, the network
cannot be reached or does not exist,
or an error has occurred on the device.
Problem when setting the network mode
SYSLOG severityStatus
ERRORAuto
ERRORUMTS
328
Reference Manual
5 Diagnosis
SYSLOG severityStatus
ERRORGPRS
ERRORLTE
Problem when setting the APN
SYSLOG severityMeaningStatus
ERRORAn invalid APN was selected for the
SIM or the cellular network.
Invalid APN
ERRORThe modem has replied to the
command to assign the APNs with an
failed to set APN
error message. This error occurs if, for
example, the network cannot be
reached or does not exist, or an error
has occurred on the device.
Additions to the Status menu
Network registration
This entry shows the status value of the network registration. Every status change generates an SNMP trap message for
subsequent evaluation and processing (e.g., by an SNMP manager).
Possible values include:
1
No_Network: The modem is not registered and is not searching for a cellular network.
1
Home_Network: The modem has registered on its service provider's cellular network.
1
Searching: The modem is not registered and is not searching for a cellular network.
1
Searching(Denied): The modem is not registered and is searching for a network, but was rejected at least once
during the search. This addition disappears as soon as the modem successfully registers.
1
Unknown: Initial value. The modem has not yet received a response from the radio module regarding the registration
status.
1
Roaming: The modem has successfully registered on the cellular network of the service provider's roaming partner.
1
Denied: The cellular service provider has rejected the login on the cellular network.
Telnet path:
Status > Modem-Cellular-Network
5.4 The ping command
With the ping command in Telnet or in a terminal connection an „ICMP Echo Request“ is sent to the addressed host. As
long as the recipient provides the protocol and the request is not filtered by the firewall, the addressed host answers
with an „ICMP Echo Reply“. In case the host is not available, the last router before the host answers with „Network
unreachable“ or „Host unreachable“.
The syntax of the ping commando is:
1
ping [-fnqr] [-s n] [-i n] [-c n] [-a a.b.c.d] hostaddress
The meaning of the optional parameters are listed in the following table:
329
Reference Manual
5 Diagnosis
MeaningParameter
Sets the sender address of the ping (standard: IP Adresse of the router)-a a.b.c.d
Sets the intranet address of the router as sender address-a INT
Sets the DMZ address of the router as sender address-a DMZ
Sets one of the 16 Lancom Loopback addresses as sender address. Valid for x are the hexadecimal
values 0-f
- a LBx
flood ping: Sends many ping signals in a small amount of time. Can be used e. g. to test the
broadband of the network. ATTENTION: flood ping can easily be interpretated as a DoS attack.
-f
Sends the computer name back zu the given IP address-n
Ping command does not give an output on the panel-q
Change to traceroute mode: every interstation passed by the data package is listed-r
Sets the package size to n Byte (max. 1472)-s n
Time between the packages in seconds-i n
Send n ping signals-c n
Address or hostname of the recipienthostaddress
Entering “stop” or pressing the RETURN button terminates the ping commandstop /<RETURN>
330
Reference Manual
5 Diagnosis
5.5 Monitoring the switch
The data transmission over the switch of LANCOM devices only takes place on the port the target computer is attached
to. Therefore the connections on the other ports are not visible.
For monitoring data traffic between ports, the ports must be set to monitor mode. In this state all data is issued, that is
transmitted over the switch of the devices between stations of the LAN and WAN.
For the configuration with LANconfig open the Ethernet switch settings in the configuration area 'Interfaces' on the
register 'LAN' with the button Ethernet Ports.
WEBconfig: LCOS menu tree / Setup / Interfaces / Ethernet-Ports.
5.6 Cable testing
A cabling defect might have occurred, if no data is transmitted over LAN or WAN connection, although the configuration
of the devices does not show any discernible errors.
You can test the cabling with the built-in cable tester of your LANCOM. Change under WEBconfig to menu item LCOS
menu tree / Status / Ethernet-Ports / Cable test. Enter here the name of the interface to be tested (e.g. “DSL1” or
331
Reference Manual
5 Diagnosis
“LAN-1”). Pay attention to the correct spelling of the interfaces. Start the test for the specified interface by clicking on
Execute.
Change then to menu item LCOS menu tree / Status / Ethernet-Ports / Cable test results. The results of the cable
test for the individual interfaces are show up in a list.
The following results can occur:
1
OK: Cable plugged in correctly, line ok.
1
open with distance “0m”: No cable plugged in or interruption within less than 10 meters distance.
1
open with indication of distance: Cable is plugged in, but defect at the indicated distance.
1
Impedance error: The pair of cables is not terminated with the correct impedance at the other end.
5.7 Addition(s) to LCOS 8.80
5.7.1 Trace output for the XML interface
As of LCOS version 8.80, you can use the command trace # XML-Interface-PbSpot to activate a trace
that verifies whether XML requests were successful or error messages were received.
332
Reference Manual
5 Diagnosis
...causes the following message in the trace:This parameter ...
Messages from the Public Spot XML interfaceXML-Interface-PbSpot
5.7.2 Packet capturing
In order to capture packets for the analysis of errors or problems, the command line tool lcoscap has been made available
as of LCOS version 8.60. This command enables the capture of packets and writes the results to a file that you can open
and analyze using a tool like Wireshark.
With LCOS version 8.80 an additional and more convenient method has been introduced: A new menu in WEBconfig
allows you to set various parameters and capture data packets from selected interfaces, which can then be analyzed in
a results file.
This method offers you several advantages:
1
You do not need any special software, because you can run WEBconfig on any Web browser.
1
There is no need to input any CLI commands. Instead, you work with a convenient menu.
1
If you use WEBconfig over HTTPS, the confidentiality and security of captured traffic is guaranteed.
The new feature is to be found under Extras > Packet capture. After you set the parameters and click on Go! you
create a file that you can save anywhere and open with Wireshark, for example.
Enhancements to WEBconfig
Packet capturing
The Extras > Packet capture function offers you a simple way to record data packets from different interfaces and then
analyze them. Note that the possible settings can vary depending on the device type. You have more settings for WLAN
devices than for devices without WLAN functionality.
The figure below shows the dialog for a WLAN device. In this case, there are two additional, WLAN-specific parameters.
To specify the output file the following general menu items are available:
1
Interface selection: Use this drop-down menu to choose the interface that you want to record data packets for.
1
Only include packets to/from MAC address: If you only want to record data packets for a particular physical
address within the selected interface, you can specify it here.
1
Volume limit (MiB): Enter the maximum volume of the recorded packages in Mebibytes.
1
Packet limit (#): Here you can set the maximum number of packages to be recorded.
1
Time limit (s): Enter the maximum time in seconds, after which the recording ends.
333
Reference Manual
5 Diagnosis
Click on Go! to start the recording process. After a certain period of time (depending on the connection speed), a window
opens for you to save the generated files. You can now save the file locally with the suffix .cap. By default, the file name
is composed of the description and interface associated with the device for which the data packets were recorded
(e.g. LCWLC-4025-LAN-2.cap). You can change the name when saving or later.
You can stop a recording at any time by clicking on Stop!. This can be useful, for example, if you want to correct or
customize the parameters that you already entered.
5
If you start recording without setting any limits, the device keeps recording the packets until you manually stop
the process by clicking on Stop.
5.8 Addition(s) to LCOS 8.84
5.8.1 Documenting events at the xDSL interfaces
The device generates a SYSLOG entry for each of the following xDSL interface events:
SYSLOG severityMeaningStatus
NOTICEThe modem is restarting.xDSL: Booting modem: ...
INFORMThe xDSL module establishes the
connection with the specified mode and
type. The following values are possible:
xDSL: Set up line to <line mode>/<line
type>
1
Line mode: Disabled, auto and all
modes configurable under Setup >
interface > ADSL interface or VDSL
interface.
1
Line type: POTS, ISDN
NOTICEThe modem has successfully established
the connection with the shown values.
xDSL: Line is up. DS-Rate: ..., US-Rate: ...,
DS-Margin: ..., US-Margin: ...,
DS-Attn: ..., US-Attn: ...,
Mode: ..., Profile: ....
NOTICEThe modem has successfully resynchronized
connection with the shown values.
xDSL: Line data update.
DS-Rate: ..., US-Rate: ...,
DS-Margin: ..., US-Margin: ...,
DS-Attn: ..., US-Attn: ...,
Mode: ..., Profile: ...
NOTICEAn update of the line data was carried out
after one minute.
xDSL: Line data update.
NOTICEThe connection is terminated for the shown
reason. The following values are possible:
xDSL: Line disconnected due to ....
1
modem reboot
1
retrain
1
silence
1
high line error rate
1
protocol setting
1
line type setting
1
automode line type switch
1
modem timeout
1
VC parameter change
334
Reference Manual
5 Diagnosis
SYSLOG severityMeaningStatus
INFORMThe buffer zone between the required and
actual signal-noise ratio (SNR) has changed
by more than 1dB.
xDSL: SNR margin (dB, Down/Up): .../...
5.8.2 SYSLOG: Extended status display of the login to the cellular network
As of LCOS version 8.84, the SYSLOG displays further information about the status of the login process on a cellular
network (UMTS/3G+, GPRS, LTE/4G).
Extended status display of the login to the cellular network
In order to more quickly analyze connection problems in a cellular network, WWAN-capable LANCOM routers report all
logon procedures to the SYSLOG. In this manner, the user can recognize if and why the cellular service provider rejected
the connection, for example.
The device generates a SYSLOG entry for each of the following events:
SYSLOG severityMeaningStatus
INFORMThe modem is not registered and is not
searching for a cellular network.
WWAN: Currently not searching for network
INFORMThe modem is not registered and is not
searching for a cellular network.
WWAN: Searching for network
INFORMThe modem has registered on its service
provider's cellular network.
WWAN: Registered to home network
INFORMThe modem has successfully registered on
the cellular network of the service
provider's roaming partner.
WWAN: Registered to foreign network
INFORMInitial value. The modem has not yet
received a response from the radio module
regarding the registration status.
WWAN: Unknown registration
ERRORThe cellular service provider has rejected
the login on the cellular network.
WWAN: Network registration denied
NOTICEThe modem lost the connection to the
registered cellular network.
WWAN: Lost network registration
ERRORThe modem has replied to the command
to assign the network with an error
WWAN: Failed to set network
message. This error occurs if, for example,
the network cannot be reached or does not
exist, or an error has occurred on the
device.
ERRORThe modem has replied to the command
to assign the network mode with an error
WWAN: Failed to set network mode
message. This error occurs if, for example,
the network cannot be reached or does not
exist, or an error has occurred on the
device.
WARNINGThe LANCOM is set to LTE only, but the
network does not support this mode.
WWAN: Unsupported network mode 'LTE',
ignored.
NOTICEThe LANCOM is set to one particular
network mode only, but the network does
not support this mode.
WWAN: Unsupported network mode
'UMTS-GPRS', setting 'Auto' instead.
INFORMDisplays the modem in use.WWAN: Using modem '...'.
335
Reference Manual
5 Diagnosis
SYSLOG severityMeaningStatus
INFORMModem no longer available.WWAN: Modem is gone.
WARNINGRe-init by modem resetWWAN: Resetting modem.
INFORMD-channel disconnectWWAN: Local disconnect.
INFORMD-channel releaseWWAN: Local disconnect (Release).
NOTICEModem starts the 2G fallbackWWAN: Force 2G mode at ... dB.
INFOModem ends the 2G fallbackWWAN: Ending forced 2G mode.
INFOThe 2G fallback mode is disabled.WWAN: Forced 2G mode disabled.
ERRORPIN is missing from the profile.WWAN: PIN missing in profile.
ERRORModem requires the PUK.WWAN: PUK required.
ERRORIncorrect PINWWAN: Invalid PIN.
ERRORError when setting the APN The modem
has replied to the command to assign the
WWAN: Failed to set APN
APNs with an error message. This error
occurs if, for example, the network cannot
be reached or does not exist, or an error
has occurred on the device.
NOTICEName of the profile in use.WWAN: Using profile '...'.
ERRORProfile not available.WWAN: Can not find profile '...'.
INFORMPhysical connection is terminated.WWAN: Disonnected.
INFORMThe modem has established a physical
connection to the network.
WWAN: Connected: '...'.
INFORMCell ID and country code.WWAN: Cell-ID is ..., Local Area Code is ....
INFORMNetwork (text)WWAN: Current Network is '...'.
INFORMNetwork (number)WWAN: Current Network is ....
INFORMDisplay of network mode and bandWWAN: Mode ..., Band '...'.
INFORMDisplay of network mode, band, bandwidth
and channel (transmit and receive
direction).
WWAN: Mode ..., Band '...',
Bandwith in MHz: ..., Channel (Rx/Tx): .../....
INFORMDisplay of network mode, band and
channel (transmit and receive direction).
WWAN: Mode ..., Band '...',
Channel (Rx/Tx): .../....
INFORMCurrent QoS data rate (down/upstream)WWAN: Max. Datarate (Ds/Us): .../....
INFORMCurrent mode. Possible values are:WWAN: Network mode is '...'.
1
GPRS
1
EDGE
1
UMTS
1
HSPA
1
LTE
INFORMCurrent signal strengthWWAN: Signal strength is ... dBm.
INFORMAccess point currently being used in the
network.
WWAN: Using stored APN. APN: '...', PDP
type: ....
INFORMChange of network access pointWWAN: Setting new APN. APN: '...', PDP
type: ....
INFORMCurrent temperature of the moduleWWAN: Temperature is ...°C.
336
Reference Manual
5 Diagnosis
SYSLOG severityMeaningStatus
INFORM (normal), WARNING (high
warning), CRITICAL (high critical, low
critical)
Current temperature status of the module.
Possible values are:
WWAN: Temperature status: '...'.
1
Normal
1
High warning
1
High critical
1
Low critical
INFORMThe device running the connection to the
WAN is shutting down.
WWAN: Closing device: '...'.
INFORMThe modem terminates the network
connection.
WWAN: Hangup: '...'.
ERRORAn error has occurred during the modem
reset.
WWAN: Error in modem init: '___'.
5.9 Addition(s) to LCOS 9.10
5.9.1 Advanced config version information under Status
As of LCOS version 9.10, you will find additional information about your current configuration (date, hash, version) in
WEBconfig and via the console under Status > Config.
Additions to the Status menu
Configuration date
This entry indicates when you last changed the configuration of the device.
4
The time is displayed in UTC format.
SNMP ID:
1.11.20
Telnet path:
Status > Config
Configuration hash
This entry shows you the hash value of the current configuration.
4
The displayed value is a SHA1 hash.
SNMP ID:
1.11.21
337
Reference Manual
5 Diagnosis
Telnet path:
Status > Config
Configuration version
This entry shows you the current version of the device configuration.
SNMP ID:
1.11.22
Telnet path:
Status > Config
5.9.2 SSH identifier in the event log
As of LCOS version 9.10, the device displays the SSH identifier in the event log for connections encrypted by SSH.
Additions to the Status menu
Event log
This log table is an overview of all of the logged event messages that affect the configuration of the device, such as
failed logins or firmware update history.
SNMP ID:
1.11.12
Telnet path:
Status > Config
Possible values:
Idx.
Index number of the event
System time
Time of the event
Event
Event message in abbreviated form
Access
Access protocol used, e.g. SSH or HTTPS
IP address
IP address that was used to access the device
Info1
Event code
Info2
Description of the event code
Info3
SSH identifier
338
Reference Manual
5 Diagnosis
6 Security
You certainly would not like any outsider to have easy access to or to be able to modify the data on your computer.
Therefore this chapter covers an important topic: safety. The description of the security settings is divided into the
following sections:
1
Protection for the configuration
2
Password protection
2
Login barring
2
Access verification
1
Securing ISDN access
At the end of the chapter you will find the most important security settings as a checklist. It ensures that your LANCOM
is excellently protected.
5
Some further LCOS features to enhance the data security are described in separate chapters:
6.1 Protection for the configuration
A number of important parameters for the exchange of data are established in the configuration of the device. These
include the security of your network, monitoring of costs and the authorizations for the individual network users.
Needless to say, the parameters that you have set should not be modified by unauthorized persons. The LANCOM thus
offers a variety of options to protect the configuration.
6.1.1 Password protection
The simplest option for the protection of the configuration is the establishment of a password.
5
As long as a password hasn't been set, anyone can change the configuration of the device. For example, your
Internet account information could be stolen, or the device could be reconfigured in a way that the
protection-mechanisms could by bypassed.
5
Note: If a password has not been set, the Power LED flashes, until the devices have been configured correctly.
Tips for proper use of passwords
We would like to give you a few tips here for using passwords:
1
Keep a password as secret as possible. Never write down a password. For example, the following are popular
but completely unsuitable: Notebooks, wallets and text files in computers. It sounds trivial, but it can't be repeated
often enough: don't tell anyone your password. The most secure systems surrender to talkativeness.
1
Only transmit passwords in a secure manner. A selected password must be reported to the other side. To do
this, select the most secure method possible. Avoid: Non-secure e-mail, letter, or fax. Informing people one-on-one
is preferable. The maximum security is achieved when you personally enter the password at both ends.
1
Select a secure password. Use random strings of letters and numbers. Passwords from common language usage
are not secure. Special characters such as '&“?#-*+_:;,!°' make it difficult for potential attackers to guess your
password and increase the security of the password.
339
Reference Manual
6 Security
5
Capital and small letters are distinguished in the configuration password.
1
Never use a password twice. If you use the same password for several purposes, you reduce its security effect. If
the other end is not secure, you also endanger all other connections for which you use this password at once.
1
Change the password regularly. Passwords should be changed as frequently as possible. This requires effort,
however considerably increases the security of the password.
1
Change the password immediately if you suspect someone else knows it. If an employee with access to a
password leaves the company, it is high time to change this password. A password should also always be changed
when there is the slightest suspicion of a leak.
If you comply with these simple rules, you will achieve the highest possible degree of security.
Entering the password
You will find the box to enter the password in LANconfig in the configuration area 'Management' on the 'Admin' tab.
Under WEBconfig you run the wizard Security Settings. In a terminal or Telnet session you set or change the password
with the command passwd.
LANconfig: Management / Admin / Password
WEBconfig: Tool / Change password
Protecting the SNMP access
At the same time you should also protect the SNMP read access with a password. For SNMP the general configuration
password is used.
LANconfig: Management / Admin / Password required for SNMP read permission
WEBconfig: LCOS menu tree / Setup / SNMP E Password- required-for-SNMP-read-access
6.1.2 Login barring
The configuration in the LANCOM is protected against “brute force attacks“ by barring logins. A brute-force attack is
the attempt by an unauthorized person to crack a password to gain access to a network, a computer or another device.
To achieve this, a computer can, for example, go through all the possible combinations of letters and numbers until the
right password is found.
As a measure of protection against such attacks, the maximum allowed number of unsuccessful attempts to login can
be set. If this limit is reached, access will be barred for a certain length of time.
If barring is activated on one port all other ports are automatically barred too.
The following entries are available in the configuration tools to configure login barring:
1
Lock configuration after (Login-errors)
1
Lock configuration for (Lock-minutes)
LANconfig: Management / Admin
WEBconfig: LCOS menu tree / Setup / Config
6.1.3 Restriction of the access rights on the configuration
Access to the internal functions of the devices can be restricted separately for each access method as follows:
1
ISDN administrative account
1
LAN
1
Wireless LAN (WLAN)
1
WAN e.g. ISDN, DSL or ADSL)
340
Reference Manual
6 Security
For network-based configuration access further restrictions can be made, e.g. that solely specified IP addresses or
dedicated LANCAPI clients are allowed to do so. Additionally, all following internal functions are separately selectable.
1
LANconfig (TFTP)
1
WEBconfig (HTTP, HTTPS)
1
SNMP
1
Terminal/Telnet
5
The use of the internal functions with a WAN interface of devices with VPN can be restricted merely for the VPN
connection.
Restrictions on the ISDN administrative account
As long as no MSN-configuration is entered a non-configured LANCOM accepts the calls on all MSNs. As soon as the
first change in the configuration ist saved the device only accepts calls on the configuration MSN.
5
If no configuration MSN ist entered when configuring the first time, the remote configuration ist switched off
and the device ist protected from the access over the ISDN line.
1. Change to the register card 'Admin' in the 'Management' configuration area:
1. Enter as call number within 'Device configuration' a call number of your connection, which is not used for other
purposes.
Enter alternatively the following instruction:
set /setup/config/farconfig-(EAZ-MSN) 123456
5
The ISDN administrative account is excluded as only configuration method from in the following described
restrictions of network access methods. I.e. all on the Admin MSN incoming connections are not limited by
the access restrictions of remote networks.
5
If you want to completely switch off the ISDN remote management, leave the field with Admin MSN empty.
341
Reference Manual
6 Security
Limit the network configuration access
The access to the internal functions can be controlled separately for accesses from the local or from remote networks -
for all configuration services separately. The configuration access can generally be permitted or forbidden, a pure read
access or - if your model is equipped with VPN - also can be permitted only over VPN. You can open the configuration
dialogue with the access rights from the local or from remote networks over the button access rights:
5
If you want to remove the network access to the router over the WAN completely, set the configuration access
from distant nets for all methods to 'denied'.
LANconfig: Management / Admin / access rights
WEBconfig: LCOS menu tree / Setup / Config / Access-list
342
Reference Manual
6 Security
Restriction of the network configuration access to certain IP addresses
With a special filter list the access to the internal functions of the devices can be limited to certain IP addresses. The
configuration dialog with the access rights from local or distant networks can be opened with the Button Access stations.
By default, this table does not contain entries. Thus the device can be accessed over TCP/IP from computers with arbitrary
IP addresses. With the first entry of a IP address (as well as the associated net mask) the filter is activated, and solely
the IP addresses contained in this entry are entitled to use the internal functions then. With further entries, the number
of the entitled ones can be extended. The filter entries can designate both individual computers and whole networks.
With WEBconfig for Telnet you reach the configuration of the access list with the following runs:
LANconfig: Management / Admin / access stations
WEBconfig: LCOS menu tree / Setup / TCP-IP / Access-list
6.2 Protecting the ISDN connection
For a device with an ISDN connection basically any ISDN subscriber can dial into your LANCOM. To prevent undesired
intruders, you must therefore pay particular attention to the protection of the ISDN connection.
The protection functions of the ISDN connection can be divided into two groups:
1
Identification control
2
Access protection using name and password
2
Access protection via caller ID
1
Callback to defined call numbers
6.2.1 Identification control
For identification monitoring either the name of the remote site or the so-called caller ID can be used. The caller ID is
the telephone number of the caller that is normally transmitted to the remote site with the call with ISDN.
Which “Identifier” is to be used to identify the caller is set in the following list:
343
Reference Manual
6 Security
LANconfig: Communication / Call Management
WEBconfig: LCOS menu tree / Setup / WAN / Protect
You have a choice of the following:
1
all: Calls are accepted from any remote station.
1
by number: Only calls from those remote stations whose Calling Line Identification number (CLIP) is entered in the
number list are accepted.
1
by approved number: Only calls from those remote stations whose Calling Line Identification number (CLIP) is entered
in the peer list and whose number is approved by the Central Office.
It is an obvious requirement for identification that the corresponding information is sent by the caller.
Verification of name and password
In the case of PPP, a user name (and in conjunction with PAP, CHAP or MS-CHAP, a password) is sent to the remote
station during connection establishment. When a computer dials into the LANCOM, the communications software, for
example Windows Dial-Up Network, prompts the user for the user name and password to be transferred.
If the router establishes the connection itself, for instance, to an ISP, it is using the user name and password from the
PPP list. If no user name is listed there, the device name is used in its place.
The PPP list can be found as follows:
LANconfig: Communication / Protocols / PPP list
WEBconfig: LCOS menu tree / Setup / WAN / PPP-list
In addition, the PPP protocol also permits the caller to require an authentication from the remote station. The caller then
requests a user or device name and password from the remote station.
5
Of course you will not need to use the PAP, CHAP or MS CHAP security procedures if you are using the LANCOM
to dial up an Internet service provider yourself, for example.You will probably not be able to persuade the ISP
to respond to a request for a password...
Checking the number
When a call is placed over an ISDN line, the caller's number is normally sent over the D channel before a connection is
even made (CLI – Calling Line Identifier).
Access to your own network is granted if the call number appears in the number list, or the caller is called back if the
callback option is activated. If the LANCOM is set to provide security using the telephone number, any calls from remote
stations with unknown numbers are denied access.
You can use call numbers as a security measure with any B-channel protocol (layers).
6.2.2 Callback
The callback function offers a special form of access privilege: This requires the 'Callback' option to be activated in the
peer list for the desired caller and the call number to be specified, if required.
LANconfig: Communications / Remote site / Remote Sites (ISDN/serial)
WEBconfig: LCOS menu tree / Setup / WAN / dialup-peers
Using the settings in the name and number list and the selection of the protocol (LANCOM or PPP), you can control the
callback behaviour of your router :
1
The router can refuse to call back.
1
It can call back using a preset call number.
1
First the name can be checked and then a preset telephone number can be called back.
1
The caller can opt to specify the call number to be used for callback.
344
Reference Manual
6 Security
And all the while you can use the settings to dictate how the cost of the connection is to be apportioned. The router
accepts all unit charges, except for the unit required to send the name, if call back 'With name' is set in the peer list.
The caller also accepts a unit if the caller is not identified via CLIP (Calling Line Identifier Protocol). On the other hand,
the caller incurs no costs if identification of the caller's number is possible and is accepted (callback via the D channel).
An especially effective callback method is the fast-callback procedure (patent pending). This speeds up the callback
procedure considerably. The procedure only works if it is supported by both stations. All current LANCOM routers are
capable of fast callback.
5
Additional information on callback can be found in section .
6.3 Location verification by ISDN or GPS
After being stolen, the device can theoretically be operated at another location by unauthorized persons.
Password-protected device configurations offer no protection from the operation of the RAS access, LAN coupling or
VPN connections that are set up in the device; a thief could gain access to a protected network.
The device’s operation can be protected by various means; for example, it will cease to function if there is an interruption
to the power supply, or if the device is switched on in another location.
6.3.1 GPS location verification
GPS location verification enables a geographical position to be defined within the device. After being switched on the
device automatically activates the GPS module and checks if it is located at the "correct" position. The router module is
only switched on if the check is positive. After location verification has been carried out the GPS module is deactivated
again, unless it was switched on manually.
6.3.2 ISDN location verification
ISDN location verification can prevent the misuse of a router. Each time it is switched on, the router carries out a check
by making an ISDN telephone call to itself to ensure that it is installed at the intended location. Only after successful
location verification is the router module activated.
Prerequisites for successful ISDN location verification:
1
The device must be reachable from the public ISDN telephone network.
1
The device needs two free B channels for the duration of the check. If just one channel is free, e.g. one channel at
a point-to-multipoint connection with two B channels is being used for a telephone call, then the device cannot make
a call to itself via ISDN.
6.3.3 Configuring location verification
Parameters for location verification are to be found in LANconfig in the configuration area 'Management' on the 'Location'
tab.
345
Reference Manual
6 Security
5
You can enable the GPS module on the 'GPS' tab independently from the location verification e. g. for monitoring
the current GPS coordinates using LANmonitor.
1
Activate location verification with the 'Enable location check' option.
1
Select the method for the location check:
2
'Self call' for a check via ISDN by means of a return call.
2
'Call forwarding check' via ISDN by requesting the call number from the exchange. No call-back is necessary in
this case.
2
'GPS verification' for a check on the geographical coordinates.
5
For a location check by GPS an appropriate GPS antenna must be connected to the AUX connector on the
device. Additionally, a SIM card for mobile telephone operation has to be inserted and the device must be
logged on to a mobile phone network.
1
For the location check enter 'Self call' or 'Call forwarding check' and enter the destination number as the telephone
number to be used for the check.
1
For location verification by GPS enter the necessary parameters:
2
Degrees latitude and longitude
2
Deviation from the intended position in meters
5
The device is itself able to determine the geographical coordinates for its current position by activating the
'Get reference coordinates via GPS' checkbox. Once the configuration is written back to the device, the current
longitude and latitude are entered automatically, assuming that location verification is activated and a valid
GPS position is available. Subsequently this option is automatically deactivated again.
346
Reference Manual
6 Security
As an alternative you can determine the geographical coordinates from tools such as Google Maps.
5
When the current geographical coordinates are displayed in LANmonitor, you can right-click with the mouse
on the entry 'GPS' to call up that location in Google maps.
Under WEBconfig, Telnet or a terminal program, you will find the settings for location verification under the following
paths:
LANconfig: communication / remote sites / remote sites (ISDN/serial)
347
Reference Manual
6 Security
WEBconfig: LCOS menu tree / Setup / Config / Location verification
Location verification status request
The status of location verification can be viewed under LANmonitor:
348
Reference Manual
6 Security
With WEBconfig (LCOS menu tree / Status / Config / Location verification) or Telnet
(Status/Config/Location verification) you can view the status of the location verification:
Only when the location verification has the status 'Successful' will the router data be transferred over the WAN interfaces.
1
Location verification via ISDN is successful when the number 'Expect call from' agrees with the number 'Last call
from'. This call is not picked up by the router. The status also displays whether a call was accepted at all.
1
Location verification via GPS is successful when the GPS position is valid and within the tolerated range deviation
from the known position.
6.4 The security checklist
The following checklists provide an overview of all security settings that are important to professionals. Most of the
points in this checklist are uncritical for simple configurations. In these cases, the security settings in the basic configuration
or that were set with the Security Wizard are sufficient.
5
Detailed information about the security settings mentioned here are to be found in the reference manual.
1
Have you secured your wireless network with encryption and access control lists?
With the help of 802.11i, WPA or WEP, you can encrypt the data in your wireless network with different encryption
methods such as AES, TKIP or WEP. LANCOM Systems recommends the strongest possible encryption with 802.11i
and AES. If the WLAN client adapters do not support these, then you should use TKIP or at least WEP. Make sure
that the encryption function in your device is activated, and that at least one passphrase or WEP key has been entered
and selected for application.
349
Reference Manual
6 Security
5
For security reasons, LANCOM Systems strongly advises you not to use WEP! You should only ever use WEP
under exceptional circumstances. When using WEP encryption, use additional security mechanisms additionally.
To check the WEP settings, open LANconfig, go to the configuration area and select ‘WLAN security’ on the '802.11i/WEP'
tab to view the encryption settings for the logical and physical WLAN interfaces.
With the access control list (ACL) you can permit or prevent individual clients accessing your wireless LAN. The decision
is based on the MAC address that is permanently programmed into wireless network adapters. To check the access-control
list, go to the configuration area in LANconfig and select ‘WLAN security’ on the ‘Stations’ tab.
The LANCOM Enhanced Passphrase Security (LEPS) uses an additional column in the ACL to assign an individual passphrase
consisting of any 4 to 64 ASCII characters to each MAC address. The connection to the access point and the subsequent
encryption with IEEE 802.11i or WPA is only possible with the right combination of passphrase and MAC address.
1
Have you protected the configuration with a password?
The simplest way of protecting the configuration is to agree upon a password. If no password has been agreed for
the device, the configuration is open to be changed by anybody. The field for entering the password is to be found
in LANconfig in the 'Management' configuration area on the 'Security' tab. It is absolutely imperative to assign a
password to the configuration if you want to enable remote configuration!
1
Have you permitted remote configuration?
If you do not require remote configuration, please ensure to switch it off. If you need to make use of remote
configuration, ensure that you do not fail to password-protect the configuration (see the section above). The field
for disenabling remote configuration is to be found in LANconfig in the 'Management' configuration area on the
'Security' tab. Under ‘Access rights – From remote networks’ select the option ‘denied’ for all methods of configuration.
1
Have you allowed configuration from the wireless LAN?
If you do not need to configure the device from the wireless LAN, switch this function off. The field for disenabling
configuration from the wireless LAN is to be found in LANconfig in the 'Management' configuration area on the
'Admin' tab. Under ‘Access rights – From the wireless LAN’ select the option ‘denied’ for all methods of configuration.
1
Have your password-protected the SNMP configuration?
Protect the SNMP configuration with a password too. The field for password-protecting the SNMP configuration is
also to be found in LANconfig in the 'Management' configuration area on the 'Security' tab.
1
Have you activated the firewall?
The stateful inspection firewall of LANCOM devices ensures that you local network cannot be attacked from the
outside. Activate the firewall in LANconfig under 'Firewall/QoS' on the 'General' tab.
5
Note that firewall security mechanisms (incl. IP masquerading, port filters, access lists) are active only for
data connections that are transmitted via the IP router. Direct data connections via the bridge are not
protected by the firewall!
1
Are you using a 'deny all' firewall strategy?
Maximum security and control is initially achieved by denying all data traffic from passing the firewall. The only
connections to be accepted by the firewall are those that are to be explicitly permitted. This ensures that Trojan
horses and certain types of e-mail virus are denied communication to the outside. Activate the firewall rules in
LANconfig under 'Firewall/QoS' on the 'Rules' tab. Instructions on this are to be found in the reference manual.
1
Have you activated IP masquerading?
IP masquerading refers to the concealment of local computers while they access the Internet. All that is revealed to
the Internet is the IP number of the router module of the device. The IP address can be fixed or dynamically assigned
by the provider. The computers in the LAN then use the router as a gateway and are not visible themselves. The
router separates the Internet from the intranet like a wall. The application of IP masquerading is set in the routing
table for every route individually. The routing table can be found in the LANconfig in the configuration area 'IP router'
on the 'Routing' tab.
1
Have you used filters to close critical ports?
350
Reference Manual
6 Security
The firewall filters in LANCOM devices offer filter functions for individual computers or entire networks. It is possible
to set up source and destination filters for individual ports or port ranges. Furthermore, filters can be set for individual
protocols or any combination of protocols (TCP/UDP/ICMP). It is especially convenient to set up the filters with the
aid of LANconfig. Under 'Firewall/QoS', the 'Rules' tab contains the functions for defining and editing filter rules.
1
Have you excluded certain stations from accessing the device?
A special filter list can be used to limit access to the device's internal functions via TCP/IP. The phrase "internal
functions" refers to configuration sessions via LANconfig, WEBconfig, Telnet or TFTP. As standard this table contains
no entries, meaning that computers with any IP address can use TCP/IP and Telnet or TFTP to commence accessing
the device. The first time an IP address is entered with its associated netmask, the filter is activated and only the IP
addresses contained in this entry are entitled to make use of internal functions. Further entries can be used to extend
the circle of authorized parties. The filter entries can describe individual computers or even entire networks. The
access list can be found in the LANconfig in the configuration area 'TCP/IP' on the 'General' tab.
1
Do you store your saved LANCOM configuration to a safe location?
Protect your saved configurations in a location that is safe from unauthorized access. Otherwise, by way of example,
an unauthorized person may load your stored configuration file into another device and they can access the Internet
at your expense.
1
Concerning the exchange of your particularly sensitive data via wireless LAN; have you set up the functions offered
by IEEE 802.1x?
If you move especially sensitive data via wireless LAN you can provide even stronger security by using the IEEE 802.1x
technology. To check or activate the IEEE 802.1x settings in LANconfig select the configuration area '802.1x'.
1
Have you activated the protection of your WAN access in case the device is stolen?
After being stolen, the device can theoretically be operated at another location by unauthorized persons.
Password-protected device configurations do not stop third parties from operating RAS access, LAN connectivity or
VPN connections that are set up in the device: A thief could gain access to a protected network.
The device’s operation can be protected by various means; for example, it will cease to function if there is an
interruption to the power supply, or if the device is switched on in another location.
With the ISDN location verification, the device can only be operated at one particular ISDN connection. After being
switched on, the device calls itself at the corresponding telephone number to check that it is still connected to the
“correct” ISDN connection (for further information see the reference manual).
GPS location verification enables a geographical position to be defined within the device. After being switched on
the device automatically checks if it is located at the "correct" position. Only after a positive check is the router
module activated.
The scripting function can store the entire configuration in RAM only so that restarting the device will cause the
configuration to be deleted. The configuration is not written to the non-volatile flash memory. A loss of power because
the device has been relocated will cause the entire configuration to be deleted (for further information see the
reference manual).
For self-sufficient operations, the configuration for a WLAN interface being managed by a LANCOM WLAN Controller
is stored in flash memory for a certain time only, or even in the RAM only. This device configuration is deleted if
contact to the WLAN-Controller is lost or if the power supply is interrupted for longer than the set time period.
1
Have you ensured that the reset button is safe from accidental configuration resets?
Some devices simply cannot be installed under lock and key. There is consequently a risk that the configuration will
be deleted by mistake if a co-worker presses the reset button too long. The behavior of the reset button can be set
so that a press is either ignored or it causes a re-start, depending on the time for which it is held pressed.
351
Reference Manual
6 Security
6.5 Addition(s) to LCOS 8.60
6.5.1 Support for TLS 1.1 / 1.2
The encryption protocol SSL or TLS ("Secure Sockets Layer" or "Transport Layer Security") supports secure data
communication between two communication partners. For this purpose, SSL or TLS uses, for example, encryption,
authentication and verification of certificates that have been sent. Although it is mainly used to secure HTTP connections
(as "HTTPS" or "HTTP over SSL"), SLS or TLS serve as a basis for secure communications for many other transfer protocols.
LCOS uses the TLS protocol in the following modules:
1
HTTP over SSL
1
Telnet over SSL
1
RADSEC
1
CAPWAP/DTLS
1
EAP-TLS/PEAP/TTLS
The TLS encryption protocol has been under development since 1999 and up to the current version TLS 1.2. To use the
enhanced functionality of clients and web browsers, LANCOM devices support the TLS protocol of the versions 1.0, 1.1
and 1.2 for secure data transmission.
In the LCOS versions prior to 8.60, the encryption protocols SSL 3.0 and TLS 1.0 were always enabled by default. As of
LCOS version 8.60 you can also select between the TLS versions 1.1 or 1.2 for HTTPS connections.
Additions to the menu system
SSL versions
This setting allows you to opt for the latest encryption protocols for HTTPS connections.
5
Please note that the encryption protocols set here only apply for HTTPS connections. For other protocols, the
available encryption algorithms are fixed:
1
EAP/TLS/TTLS/PEAP is set to TLS 1.0
1
CAPWAP is set to DTLS 1.0 (which is based on TLS 1.1)
1
Telnet/SSL is set to 'SSL 3.0+TLS 1.0 + TLS 1.1 + TLS 1.2'
1
RADSEC is set to 'SSL 3.0+TLS 1.0'
Telnet path:
Setup > HTTP > SSL-Versions
Possible values:
SSLv3
TLSv1
TLSv1.1
TLSv1.2
Default:
SSLv3
TLSv1
352
Reference Manual
6 Security
7 Routing and WAN -connections
This chapter describes the most important protocols and configuration entries used for WAN connections. It also shows
ways to optimize WAN connections.
7.1 General information
WAN connections are used for the following applications.
1
Internet access
1
LAN to LAN coupling
1
Remote access
7.1.1 Bridges for standard protocols
WAN connections differ from direct connections (for example, via the LANCAPI) in that the data in the WAN are transmitted
via standardized network protocols also used in the LAN. Direct connections, on the other hand, operate with proprietary
processes that have been specially developed for point-to-point connections.
Via WAN connections a LAN is extended, and with direct connections only one individual PC establishes a connection
to another PC. WAN connections form a kind of bridge for the communication between networks (or for connecting
individual computers to the LAN).
Which protocols are used for WAN connections?
WAN connections over highspeed ports (e.g. DSL connections) use the IP standard for transmitting packets. Devices with
an ISDN interface provide beside IP additionally IPX.
Close cooperation with router modules
Characteristic of WAN connections is the close cooperation with the router modules in the LANCOM. The router modules
(IP and IPX) provide the connection to LAN and WAN. They make use of the WAN modules to respond requests from
PCs within the LAN for external resources.
7.1.2 What happens in the case of a request from the LAN?
Initially the router modules only determine the remote station to which a data packet is to be sent to. The various
parameters for all required connections must be arranged so that a given connection can be selected and established
as required. These parameters are stored in a variety of lists, whose interaction permits the correct conections.
353
Reference Manual
7 Routing and WAN -connections
A simplified example will clarify this process. Here we assume that the IP address of the computer being searched for is
known in the Internet.
INTERNET
PROVIDER
DSL / ISDN /
ADSL
INTERNET USER
Data packet with
IP target address
LANCOM
IP address -> remote station nameIP routing tab
peer list
remote station -> interface,
connection parameters (ISDN,
telephone number),
communications layer
PPP-list remote station -> user name and
password
1. Selecting the correct route A data packet from a computer initially finds the path to the Internet through the IP
address of the receiver. The computer sends the packet with this address over the LAN to the router. The router
determines the remote station in its IP routing table via which the target IP address can be reached, e.g. 'Provider_A'.
2. Connection data for the remote station Using these names, the router checks the remote station list and finds
the necessary connection data for the provider. Included in these connection data are, for instance, the WAN interface
(DSL, ISDN) through which the provider is connected to, protocol information, or the necessary number for an ISDN
call connection. The router also obtains the user name and password required for login from the PPP list.
3. Establishing the WAN connection The router can then establish a connection to a provider via a WAN interface.
It authenticates itself with a user name and password.
4. Transmission of data packets As soon as the connection is established, the router can send the data packet to
the Internet.
7.2 IP routing
An IP router works between networks which use TCP/IP as the network protocol. This only allows data transmissions to
destination addresses entered in the routing table. This section explains the structure of the IP routing table of an
LANCOM Systems router, as well as the additional functions available to support IP routing.
7.2.1 The IP routing table
The IP routing table is used to tell the router which remote station (which other router or computer) it should send the
data for particular IP addresses or IP address ranges to. This type of entry is also known as a “route“ since it is used to
describe the path of the data packet. This procedure is also called “static routing” since you make these entries yourself
and they remain unchanged until you either change or delete them yourself. Naturally, “dynamic routing” also exists.
The routers use the routes in this way to exchange data between themselves and continually update it automatically.
The IP router uses the static and the dynamic routing table when the IP RIP is activated.
You also use the IP routing table to tell the router the length of this route's path so that it can select the most suitable
route in conjunction with IP RIP where there are several routes to the same destination. The default setting for the
distance to another router is 0, i.e. the router can be reached directly. All devices which can be reached locally, such as
other routers in the same LAN or workstation computers connected via proxy ARP are entered with the distance 0. The
“quality level” of this route will be reduced if the entry addressed has a higher distance (up to 14). “Unfavorable” routes
like this will only be used if no other route to the remote station in question can be found.
Configuration of the routing table
LANconfig: IP-Router / Routing / Routing-Table
WEBconfig: LCOS menu tree / Setup / IP-Router / IP-Routing-Table
An IP routing table can, for example, look like this
:
354
Reference Manual
7 Routing and WAN -connections
ActiveMasqueradingDistanceRouterRouting-TagNetmaskIP address
yesOff2MAIN0255.255.255.0192.168.120.0
yesOff3NODE10255.255.255.0192.168.125.0
yesOff0191.168.140.1230255.255.255.0192.168.130.0
What do the various entries on the list mean?
1
IP addresses and netmasks
This is the address of the destination network to which data packets may be sent and its associated network mask.
The router uses the network mask and the destination IP address of the incoming data packets to check whether the
packet belongs to the destination network.
The route with the IP address '255.255.255.255' and the network mask '0.0.0.0' is the default route. All data packets
that cannot be routed by other routing entries are sent over this route.
1
Routing Tag
With the routing tag the selection of the target route can be controlled more precisely. Therefore not only the target
IP address for the selection of the route is detected but also other information, which is joined to the data packets
by the firewall. With the routing tag “0” the routing entry is valid for all packets.
1
Router
The router transmits the appropriate data packets to the IP address and network mask to this remote station.
2
If the remote station is a router in another network or an individual workstation computer, this is the name of
the remote station.
2
If the router on the network cannot address the remote station itself, then the IP address of another router which
knows the path to the destination network is entered.
The router name indicates what should happen with the data packets that match the IP address and network mask.
2
Routes with the entry '0.0.0.0' identify exclusion routes. Data packets for this “zero route“ are rejected and are
not routed any further. That way routes which are forbidden on the Internet (private address spaces, e. g.
'10.0.0.0'), for example, are excluded from transmission.
2
If an IP address is input as router name, this is a locally available router, which is responsible for transfer of the
relevant data packets.
1
Distance
Number of routers between your own and the destination router. This value is often equated with the cost of the
transmission and used to distinguish between inexpensive and expensive call paths for wide-area connections. The
distance values entered are propagated as follows:
2
All networks which can be reached while a connection exists to a destination network are propagated with a
distance of 1.
2
All non-connected networks are propagated with the distance entered in the routing table (but with a minimum
distance of 2) as long as a free transmitting channel is still available.
2
The remaining networks are propagated with a distance of 16 (= unreachable) if there are no longer any channels
available.
2
Remote stations connected using proxy ARP are an exception to this. These “proxy hosts“ are not propagated at
all.
1
Masquerading
Use the 'Masquerade' option in the routing table to inform the router which IP addresses to use when transferring
packets from local networks.
For further information see the section .
355
Reference Manual
7 Routing and WAN -connections
7.2.2 Policy-based routing
Policy-based routing does not rely exclusively upon the destination IP address to define the destination route (meaning
the remote device that is to be used to transfer the data). Further information can be used-such as the service or the
protocol used, sender addresses or the destination for the data packets-for the selection of the destination route.
Policy-based routing can be used to achieve a significantly finer-grained routing behavior, such as in the following
application scenarios:
1
The LAN's entire Internet traffic is diverted to a proxy without entering the proxy address into the browsers. As the
users do not notice the proxy routing, the scenario is named "transparent" proxy.
INTERNET
PC
server
Source: local Network
Destination: all
Port: 80
Action: Transfer
Tag:1
Source: Proxy
Destination: all
Port: 80
Action: Transfer
Tag: 0
Data packet with target
address in Internet
Data packet with destination
address and IP routing tag ‘1’
Data packet with destination
address and IP routing tag ‘0’
Data packet routed
to the internet
IP address Netmask Rt-Tag Router
255.255.255.255
255.255.255.255 0.0.0.0
0.0.0.0
1
0
Proxy
Extract of IP routing table
Firewall rules
Firewall rules
Internet
1
With load balancing, the data traffic for selected protocols is diverted over a certain DSL port that uses an additional
external ADSL modem.
1
A server in the local network is only supposed to be accessible from the WAN via a fixed IP address; this is routed
via a certain WAN interface.
1
VPN traffic is forwarded to a VPN tunnel with dynamic end points by using the routing tag '0'; the company's
remaining Internet traffic is diverted to another firewall by means of another suitable routing tag.
Suitable entries can be made in the firewall to select channels according to information other than just the destination
IP address. These entries are supplemented with a special routing tag that is used to control the channel selection with
the routing table. For example, a rule adds the routing tag '2' to the entire data traffic for a local group of computers
(defined by an IP address range). Alternatively, certain protocols receive a different supplementary routing tag.
The diagram demonstrates the application of policy-based routing with load balancing:
PC
Data packet with IP
destination address
Firewall rules
Data packet with IP
destination address,
IP routing tag
Data packet with
IP destination
address, IP routing
tag and DSL port
IP router
IP routing
table
IP address -> routing tag ->
remote station
peer list remote station -> DSL port,
connection parameters,
communication layer
1
When establishing a connection, the firewall initially checks if the packets for transmission fit to a rule which contains
a routing tag. The routing tag is entered into the data packet.
1
The IP routing table combines the routing tag and destination IP address to determine the appropriate remote station.
The IP routing table is processed from top down in the usual fashion.
1
If an entry is found corresponding to the network, then the second step is to check the routing tag. The required
remote station can be found with the help of the appropriate routing tag.
5
If the routing tag has a value of "0" (default) then the routing entry applies to all packets.
1
Internal services implicitly use the default tag. If the user wishes to direct the default route through a VPN tunnel
with a dynamic tunnel endpoint, for example, then the VPN module uses the default route with the routing tag "0"
as standard.
To direct the default route through the VPN tunnel anyway, create a second default route with routing tag "1" and
the VPN remote station as router names. With the appropriate firewall rule you can transfer all services from all
source stations to all destination stations with routing tag "1".
356
Reference Manual
7 Routing and WAN -connections
1
Routing tags and RIP: The routing tag is also transmitted in RIP packets for processing upon reception, so that, for
example, the change in distances in the proper route can be changed.
Routing tags for VPN and PPTP connections
Routing tags are used on the LANCOM in order to evaluate criteria relevant to the selection of the target route in addition
to the IP address. In general, routing tags are added to the data packets using special firewall rules. However, in some
cases, it is desirable to assign the tags directly.
1
Routing tags for VPN connections
The VPN name list can be used to enter the routing tag for every VPN connection. The routing tag is used in order to
determine the route to the remote gateway (default '0').
In addition, every gateway can be assigned a specific routing tag in the gateway table. The tag 0 has a special function
in this table: If the tag is set at 0 on a gateway, then the tag from the VPN name list table is used.
The VPN routing tag parameters can be found under Setup/VPN/VPN Peers or Setup/VPN/Additional Gateways and under
LANconfig in the configuration area 'VPN' on the 'General' tab by clicking on 'Connection List' and 'Other remote
gateways' in the list.
1
Routing tags for PPTP connections
In the PPTP table, a routing tag can be entered in addition to the IP address of the PPTP server. Using this routing tag,
two or more DSL modems that use a single IP address can be operated on different DSL ports.
SH timePortRtg tagIP AddressPeer
99991723110.0.0.138PEER01
99991723210.0.0.138PEER02
In the IP routing table, two appropriately tagged routes are required:
MasqueradingdistancePeer or IPRtg tagIP netmaskIP address
No0PEER02 PPTP2255.255.255.25510.0.0.138
No0PEER01 PPTP1255.255.255.25510.0.0.138
No00.0.0.00255.255.0.0192.168.0.0
No00.0.0.00255.240.0.0172.16.0.0
No00.0.0.00255.0.0.010.0.0.0
No00.0.0.00224.0.0.0224.0.0.0
yes0PEER LB00.0.0.0255.255.255.255
Using these settings and the corresponding entry in the load balancing table, load balancing can be performed that
would also work in Austria.
Bundle Peer 3Bundle Peer 2Bundle Peer 1Peer
PEER02PEER01PEER LB
7.2.3 Local routing
You know the following behavior of a workstation within a local network: The computer searches for a router to assist
with transmitting a data packet to an IP address which is not on its own LAN. This router is normally introduced to the
operating system with an entry as standard router or standard gateway. It is often only possible to enter one default
router which is supposed to be able to reach all the IP addresses which are unknown to the workstation computer if
there are several routers in a network. Occasionally, however, this default router cannot reach the destination network
itself but does know another router which can find this destination.
357
Reference Manual
7 Routing and WAN -connections
How can you assist the workstation computer now?
By default, the router sends the computer a response with the address of the router which knows the route to the
destination network (this response is known as an ICMP redirect). The workstation computer then accepts this address
and sends the data packet straight to the other router.
Certain computers, however, do not know how to handle ICMP redirects. To ensure that the data packets reach their
destination anyway, use local routing. In this way you instruct the router itself in your device to send the data packet to
other routers. In addition, in this case no more ICMP redirects will be sent. The setting is made under:
LANconfig: IP router / General / Forward packets within the local network
WEBconfig: LCOS menu tree / Setup / IP-router / Loc.-routing
Local routing can be very helpful in isolated cases, however, it should also only be used in isolated cases. For local routing
leads to a doubling of all data packets to the desired target network. The data is first sent to the default router and is
then sent on from here to the router which is actually responsible in the local network.
Addition(s) to LCOS 7.80
Setting the routing tag for local routes
The definition of interface tags in Advanced Routing and Forwarding (ARF) facilitates the use of virtual routers, which
only use a part of the overall routing table. The interface tag for a packet received from another local router is set
according to the following procedure:
1. If the a packet's sender address is recognized as coming from an IP network which is defined in the device, then the
interface tag for that IP address is used.
2. If the interface receiving the packet is connected to just one IP network, then the interface tag for that IP network
is used.
3. If there is no unique result from steps 1 and 2, the device attempts to use the MAC address to determine the IP
address of the next hop (reverse ARP lookup). The devices uses this IP address in an attempt to identify the relevant
IP network, and thus the corresponding interface tag.
4. If there is no unique result from options 1 to 3, then the device attempts to identify the relevant IP network (and
interface tag) from the routing table.
7.2.4 Dynamic routing with IP RIP
In addition to the static routing table, LANCOM Systems routers also have a dynamic routing table. Unlike the static
table, you do not fill this out yourself, but leave it to be dealt with by the router itself. It uses the Routing Information
Protocol (RIP) for this purpose. All devices that support RIP use this protocol to exchange information on the available
routes.
What information is propagated by IP RIP?
A router uses the IP RIP information to inform the other routers in the network of the routes it finds in its own static
table. The following entries are ignored in this process:
1
Rejected routes with the '0.0.0.0' router setting.
1
Routes referring to other routers in the local network.
1
Routes linking individual computers to the LAN by proxy ARP.
Although the entries in the static routing table are set manually, this information changes according to the connection
status of the router and so do the RIP packets transmitted.
1
If the router has established a connection to a remote station, it propagates all the networks which can be reached
via this route in the RIPs with the distance '1'. Other routers in the LAN are thus informed by these means that a
connection to the remote station has been established on this router which they can use. The establishment of
additional connections by routers with dial-up connections can be prevented, thus reducing connection costs.
358
Reference Manual
7 Routing and WAN -connections
1
If this router cannot establish a further connection to another remote station, all other routes are propagated with
the distance '16' in the RIP. The '16' stands for “This route is not available at the moment”. A router may be prevented
from establishing a connection in addition to the present one may be due to one of the following causes:
2
Another connection has already been established on all the other channels (also via the LANCAPI).
2
Y connections for the S0 port have been explicitly excluded in the interface table.
2
The existing connection is using all B channels (channel bundling).
2
The existing connection is a leased-line connection. Only a few ISDN providers enable a dial-up connection to
be established on the second B channel in addition to a permanent connection on the first B channel.
Which information does the router take from received IP RIP packets?
When the router receives such IP RIP packets, it incorporates them in its dynamic routing table, which looks something
like this:
RouterDistanceTimeIP netmaskIP address
192.168.110.121255.255.255.0192.168.120.0
192.168.110.235255.255.255.0192.168.130.0
192.168.110.351255.255.255.0192.168.140.0
What do the entries mean?
IP address and network mask identify the destination network, the distance shows the number of routers between the
transmitter and receiver, the last column shows which router has revealed this route. This leaves the 'Time'. The dynamic
table thus shows how old the relevant route is. The value in this column acts as a multiplier for the intervals at which
the RIP packets arrive. A '1', therefore, stands for 30 seconds, a '5' for about 2.5 minutes and so on. New information
arriving about a route is, of course, designated as directly reachable and is given the time setting '1'. The value in this
column is automatically incremented when the corresponding amount of time has elapsed. The distance is set to '16'
after 3.5 minutes (route not reachable) and the route is deleted after 5.5 minutes.
Now if the router receives an IP RIP packet, it must decide whether or not to incorporate the route contained into its
dynamic table. This is done as follows:
1
The route is incorporated if it is not yet listed in the table (as long as there is enough space in the table).
1
The route exists in the table with a time of '5' or '6'. The new route is then used if it indicates the same or a better
distance.
1
The route exists in the table with a time of '7' to '10' and thus has the distance '16'. The new route will always be
used.
1
The route exists in the table. The new route comes from the same router which notified this route, but has a worse
distance than the previous entry. If a device notifies the degradation of its own static routing table in this way (e.g.
releasing a connection increases the distance from 1 to 2, see below), the router will believe this and include the
poorer entry in its dynamic table.
5
RIP packets from the WAN will be ignored and will be rejected immediately. RIP packets from the LAN will be
evaluated and will not be propagated in the LAN.
The interaction of static and dynamic tables
The router uses the static and dynamic tables to calculate the actual IP routing table it uses to determine the path for
data packets. In doing so, it includes the routes from the dynamic table which it does not know itself or which indicate
a shorter distance than its own (static) route with the routes from its own static table.
359
Reference Manual
7 Routing and WAN -connections
Scaling with IP RIP
If you use several routers in a local network with IP RIP, you can represent the routers outwardly as one large router.
This procedure is also known as “scaling”. As a result of the constant exchange of information between the routers, such
a router theoretically has no limits to the transmission options available to it.
Configuration of IP-RIP function
You can fill in the corresponding remote stations in the WAN-RIP-table, to declare the static defined routes over the
WAN, which are learned over RIP, or to learn routes from the WAN.
WEBconfig: Setup / IP-router / RIP / WAN table
LANconfig: IP-Router / General / WAN RIP
5
Routers with RIP capabilities dispatch the RIP packets approximately every 30 seconds.The router is only set up
to send and receive RIPs if it has a unique IP address.The IP RIP module is deselected in the default setting using
the IP address xxx.xxx.xxx.254.
RIP filter
Routes learned from RIP can be filtered by their routing tag according to the settings for LAN and WAN RIP. Routes can
additionally be filtered by specifying network addresses (e. g. "Only learn routes in the network 192.168.0.0/255.255.0.0").
First of all a central table is used to define the filters that can then be used by entries in the LAN and WAN RIP table.
Initially the filters are defined in a central table; these can then used by entries in the LAN and WAN RIP table.
LANconfig: IP-Router / General/ RIP filter sets
WEBconfig: Setup / IP-Router / RIP / filter
Set up RIP for separate networks
Most of the time it is not required (as well as for NetBIOS-Proxy), that the local network structure is propagated over
RIP to the DMZ. Furthermore it is sometimes required, to propagate the known routes to a certain network, but not to
learn routes from the network (eg. in the WAN). Therefore the RIP functionality can be set up for every network separately.
360
Reference Manual
7 Routing and WAN -connections
LANconfig: IP-Router / General / RIP networks
WEBconfig: LCOS-menu tree / Setup / IP-Router / RIP / LAN-table
Timer settings
The Routing Information Protocol (RIP) regularly provides neighboring routers with updates on the available networks
and the associated metrics (hops). RIP uses various timers to control the exchange of routing information.
1
WEBconfig: Setup/ IP-router/ RIP/ Parameters
Triggered update in the LAN
With a triggered update, changes to the metrics are immediately reported to the neighboring router. The system does
not wait until the next regular update. An update delay stops faulty configurations from causing excessive update
messages.
1
Update delay
The update delay starts as soon as the routing table, or parts of it, are propagated. As long as this delay is running,
new routing information is accepted and entered into the table but it is not reported any further. The router actively
reports its current entries only after expiry of this delay.
The value set here sets the upper limit for the delay—the actual delay is a random value between one second and
the value set here.
Triggered update in the WAN
Other than in the LAN, WAN bandwidth limitations may make regular updates every 30 seconds undesirable. For this
reason, RFC 2091 requires that routes are transmitted to the WAN once only when the connection is established. After
this, updates only are transmitted.
Because updates are explicitly requested here, broadcasts or multicasts are not to be used for delivering RIP messages.
Instead, the the subsidiary device must be statically configured with the IP address of the next available router at the
central location. Due to these requests, the central router knows which subsidiary routers it has received update requests
from; it then sends any messages on route changes directly to the subsidiary device.
The WAN-RIP table has been extended for configuring the triggered update in the WAN.
Poisoned reverse
Poisoned reverse prevents routing loops from forming. An update is sent back to the router that propagated the route
to inform it that the network is unreachable at the associated interface.
However, this has a significant disadvantage over WAN connections: The central location transmits a high number of
routes which would then suffer from route poisoning, so leading to a heavy load on the available bandwidth. For this
reason, poisoned reverse can be manually activated for every LAN/WAN interface.
The LAN and WAN RIP tables have been extended for the configuration of poisoned reverse.
361
Reference Manual
7 Routing and WAN -connections
Static routes for constant propagation
Routers use RIP to propagate not only dynamic routes but statically configured routes as well. Some of these static routes
may not be constantly available, for example when an Internet connection or dial-up access is temporarily unavailable.
For a static route, the setting for "Active" in the routing table defines whether it should be propagated constantly or
only when it is actually reachable.
1
WEBconfig: Setup/ IP-Router/ IP-Routing-Table
7.2.5 SYN/ACK speedup
The SYN/ACK speedup method is used to accelerate IP data traffic. With SYN/ACK speedup IP check characters (SYN for
synchronization and ACK for acknowledge) a given preference within the transmission buffer over simple data packets.
This prevents the situation that check characters remain in the transmission queue for a longer time and the remote
station stop sending data as a result.
The greatest effect occurs with SYN/ACK speedup with fast connections (e. g. ADSL) when data quantities are
simultaneously transferred in both directions at high speed.
The SYN/ACK speedup is activated at the factory.
Switching off in case of problems
Due to the preferred handling of individual packets, the original packet order is changed. Although TCP/IP does not
ensure a certain packet order, problems may result in a few isolated applications. This only concerns applications that
assume a certain order that differs from the protocol standard. In this case the SYN/ACK speedup can be deactivated:
LANconfig: IP router / General / Pass on TCP SYN and ACK packets preferentially
WEBconfig: LCOS menu tree / Setup / IP router / Routing method / SYN/ACK speedup
7.3 Advanced Routing and Forwarding
7.3.1 Introduction
Up until LCOS version 6.30, LANCOM Routers supported two local networks only: The intranet and the DMZ. For some
applications, however, it may be desirable to realize more than one intranet and one DMZ with a LANCOM Router, for
example to provide multiple IP networks with Internet access via a central router. As of LCOS version 7.00, LANCOM
Routers support up to 64 different IP networks, depending on the model.
Various scenarios are possible when realizing multiple IP networks:
1
One network per interface.
1
Multiple networks per interface.
1
Multiple VLANs per interface; one or more networks per VLAN (which corresponds with a combination of the first
two scenarios).
The realization of these scenarios is facilitated by advanced routing and forwarding (ARF), which provides very flexible
options in the definition of IP networks and the assignment of these networks to the interfaces. The diagram below
362
Reference Manual
7 Routing and WAN -connections
illustrates the network/interface assignment at various levels. The configuration options applied here are described in
the following chapters.
Physical interfaces Logical interfaces
Logical interfaces
with VLAN tags,
bridge groups
IP networks
Network-1
ETH - 2
ETH - 3
ETH - 4
WLAN - 1
WLAN - 2
LAN - 1
LAN - 2
LAN - 3
LAN - 4
WLAN-1-1
WLAN-1-2
LAN - 1
LAN - 1
LAN - 1
LAN - 1
P2P-1-6
P2P-2-6
ETH - 1
to
to
Multi-SSID, P2P
Ethernet port mapping
Virtual LANs (VLAN)
LAN bridge
Advanced Routing and Forwarding
BRG - 1
BRG - 8
P2P-2-6
P2P-1-6
WLAN-1-1
VLAN ID 10
WLAN-2-1
VLAN ID 19
Network-64
The assignment of IP networks to interfaces proceeds as follows:
1
The various models have different numbers of physical interfaces, i.e. Ethernet ports or WLAN modules.
1
The logical interface(s) is/are assigned to the physical interface:
2
For the Ethernet ports, Ethernet port mapping assigns the physical ETH-1 to ETH-4 to the logical LAN-1 to LAN-4.
5
For some but not all models, the number of logical LAN interfaces corresponds to the number of physically
available Ethernet ports.
2
In the case of the WLAN modules, the establishment of point-to-point connections (P2P) and/or the use of
Multi-SSID can mean that multiple WLAN interfaces are assigned to each physical WLAN module: Per module
this may be up to eight WLAN networks and up to six P2P connections.
1
These logical interfaces are further specified and grouped in the next stage:
2
For devices supporting VLAN, multiple VLANs can be defined for each logical interface simply by using VLAN-IDs.
Although the data traffic for the various VLANs flows via a common logical interface, the VLAN-ID ensures that
the different VLANs remain strictly separated. From the perspective of the LANCOM Router the VLANs are
completely separate interfaces, meaning that a single logical interface becomes multiple logical interfaces for
the LANCOM Router, and each of these interfaces can be addressed individually.
2
For devices with WLAN modules, the individual logical interfaces can be grouped together. This is handled by
the LAN bridge which regulates data transfer between the LAN and WLAN interfaces. The formation of bridge
groups (BRG) allows multiple logical interfaces to be addresses at once and they appear as a single interface to
the LANCOM Router—in effect achieving the opposite of the VLAN method.
1
In the final stage, the ARF forms a connection between the logical interfaces with VLAN tags and the bridge groups
on the one side, and the IP networks on the other. For this reason, an IP network is configured with a reference to
a logical network (with VLAN-ID, if applicable) or to a bridge group. Furthermore, for each IP network an interface
tag can be set, with which the IP network can be separated from other networks without having to use firewall rules.
The definition of routing tags for IP networks as described above is one of the main advantages of Advanced Routing
and Forwarding. This option allows "virtual routers" to be realized. A virtual router only takes up a portion of the rounting
table by using interface tags for a IP-network and therefore configures routing individually for this particular IP-network.
This method allows, for example, several default routes to be defined in the routing table, each of which is given a
routing tag. Virtual routers in the IP networks use the tags to select the default route which applies to the IP network
with the appropriate interface tag. The separation of IP networks via virtual routers even permits multiple IP networks
with one and the same address range to be operated in parallel in just one LANCOM Router without problem.
For example: Within an office building, a number of companies have to be connected to the Internet via a central LANCOM
Router, even though each of these companies has its own Internet provider. All of the companies want to use the popular
IP network '10.0.0.0' with the netmask '255.255.255.0'. To implement these requirements, each company is given an
IP network '10.0.0.0/255.255.255.0' with a unique name and a unique interface tag. In the routing table, a default
route with the corresponding routing tag is created for each Internet provider. This allows the clients in the different
company networks, all of which use the same IP addresses, to access the Internet via their own provider. Employing
363
Reference Manual
7 Routing and WAN -connections
VLANs enables logical networks to be separated from one another even though they use the same physical medium
(Ethernet).
The differences between routing tags and interface tags
Routing tags as assigned by the firewall and interface tags as defined by the IP networks have a great deal in common,
but also some important differences:
1
The router interprets both tags in the same way. Packets with the interface tag '2' are valid for routes with the routing
tag set to '2' in the routing table (and all routes with the default route tag '0'). The same routes apply for packets
which the firewall has assigned with the routing tag '2'.
Thus the interface tag is used in the same way as a routing tag.
1
Interface tags have the additional ability to delimit the visibility (or accessibility) between different networks:
2
In principle, only networks with the same interface tag are "visible" to one another and thus able to interconnect.
2
Networks with the interface tag '0' have a special significance; they are in effect supervisor networks. The networks
can see all of the other networks and can connect to them. Networks with an interface tag not equal to '0' cannot
make connections to supervisor networks, however.
2
Networks of the ’DMZ’ type can be seen by all other networks independentlly of their interface tag - which makes
sense, since the DMZ often contains servers which are open to the public, like webservers etc.. The DMZ-networks
only see networks with the same interface tag (and of course all other DMZ-networks).
Networks of the ’DMZ’ type with the interface tag '0' have a special significance: As "supervisor networks" they can see
all other networks, and they are also visible to all other networks.
PC
server
PC
server
Router
PROVIDER A
PROVIDER B
IP network:
Company A
10.0.0.0/255.255.255.0
Interface tag 1
IP network:
Company B
10.0.0.0/255.255.255.0
Interface tag 2
Routing table
RouterInterface tagNetzmaskeIP address
Provider A10.0.0.0255.255.255.255
Provider B20.0.0.0255.255.255.255
5
For cases which do not allow IP addresses to be uniquely assigned by interface tag, the Advanced Routing and
Forwarding can be supported by firewall rules. In the above example, this would be the case if each of the
networks were to support a public web or mail server, all of which use the same IP address.
7.3.2 Defining networks and assigning interfaces
When defining a network, the first setting is for the IP-address range which is to be valid for a certain local interface on
the LANCOM Router. "Local interfaces" are logical interfaces which are assigned either to a physical Ethernet port (LAN)
or a wireless port (WLAN). To realize the scenarios outlined above, it is possible for several networks to be active on one
interface: Conversely, a network can also be active on multiple interfaces (via bridge groups or with the interface
assignment 'Any').
The networks are defined in a table. A unique name for the networks is set along with definitions for the address range
and interface assignment. The network name allows the identification of networks in other modules (DHCP server, RIP,
NetBIOS, etc.) and to enable control over which services are available in which networks.
364
Reference Manual
7 Routing and WAN -connections
TCP/IP / General / IP networks
7.3.3 Assigning logical interfaces to bridge groups
Particular properties of the logical interfaces are defined in the port table.
LANconfig: Interfaces / LAN / Port table
WEBconfig: LCOS menu tree / Setup / LAN Bridge / Port Data
1
Active
This option activates or deactivates the logical interface.
1
Bridge group
Assigns the logical interface to a bridge group to enable bridging from/to this logical interface via the LAN bridge.
If assigned to a common bridge group, several logical interfaces can be addressed at once and they appear to the
LANCOM Router to be a single interface. This can then be used for Advanced Routing and Forwarding, for example.
If the interface is removed from all bridge groups by setting 'none', then there is no communication between the
LAN and WLAN via the LAN bridge (isolated mode). With this setting, LAN/WLAN data transfers over this interface
are only possible via the router.
5
A requirement for data transfer from/to a logical interface via the LAN bridge is the deactivation of the global
"isolated mode" which applies to the whole of the LAN bridge. Furthermore, the logical interface must be
assigned to a bridge group. With the setting 'none', no transfers can be made via the LAN bridge.
1
Priority
Sets the priority for the logical interface where the spanning-tree protocol is being used. Where multiple connections
are available, the interface with the highest priority is used. The smaller the value, the higher the priority. If priorities
are the same then the interface with lower transmission fees is chosen or, alternatively, the interface which is highest
in the table.
1
DHCP limit
Number of clients which can be handled by DHCP. If the limit is exceeded, the oldest entry is dropped. This feature
can be used in combination with the protocol filer table to limit access to just one logical interface.
365
Reference Manual
7 Routing and WAN -connections
7.3.4 Interfaces tags for remote sites
By defining interfaces tags, virtual routers can be used as part of Advanced Routing and Forwarding (ARF) that only use
part of the overall routing table. For inbound data packets from the WAN, the assignment of interfaces tags can be
regulated in different ways:
1
By using appropriate firewall rules that only capture data packets from particular remote sites, IP addresses or ports
1
Based on the routing table
1
Via an explicit assignment of tags to remote sites.
This assignment of tags to the remote sites to separate ARF networks can also be conveniently used for packets received
at the WAN-side (which by default contain Tag 0). Without controlling the assignment of tags explicitly with the firewall,
the virtual router can be determined directly from the remote site or source route from the form of the interface tag.
Inbound and outbound communication can thus be easily divided between virtual routers bidirectionally.
5
The interface tags determined via the tag table and on the basis of the routing table can be overwritten with an
appropriate entry in the firewall.
Assignment of interface tags via the tag table
LANconfig: Communication / Remote sites / WAN tag table
WEBconfig: Setup / IP router
1
WAN tag generation
WAN tag generation defines the source for the assignment of interfaces tags. Besides assignment via the firewall or
direct assignment via the tag table, the interface tag can also be selected based on the source route in the effective
routing table (static routing entries plus routes learned via RIP). The source IP and the name of the remote site used
to establish the IP connection is compared with the routing information. The routing tag of this source route is
assigned for further processing to the packets received at the WAN-side of this connection. If the effective routing
table contains more than one entry for a remote site with the same network, the smallest tag is used.
Example: The following ARF networks have been defined:
PortRtg tagIP addressNetwork
LAN -11192.168.1.1/24PRIVATE
LAN -210192.168.10.1/24HOME-OFFICE
PRIVATE is to have Internet access only, HOME-OFFICE is to have a VPN tunnel to the remote site VPN-COMPANY
only. The corresponding effective routing table appears as follows:
MaskingDistanzRemote siteRtg tagIP netmaskIP address
No0VPN-COMPANY10255.255.255.0192.168.10.0
No0INTERNET10.0.0.0255.255.255.255
2
Data packet coming from network 192.168.10.x: Tag = 10
2
Data packet coming from network 192.168.1.x: Tag = 1
2
Data packet coming from any other network: Tag = 0
366
Reference Manual
7 Routing and WAN -connections
Possible values:
2
Manual: With this setting, the interface tags are determined solely by an entry in the tag table. The routing table
has no significance in the assignment of interfaces tags.
2
Auto: With this setting, the interface tags are determined initially by an entry in the tag table. If no matching
entry is located there, the tag is determined based on the routing table.
5
The interface tags determined via the tag table and on the basis of the routing table can be overwritten with
an appropriate entry in the firewall.
7.3.5 Virtual routers
With interface-dependent filtering in combination with policy-based routing, virtual routers can be defined for every
interface.
Example:
Two separate IP networks are used by the Development and Sales departments. Both networks are connected to different
switch ports although they use the same network '10.1.1.0/255.255.255.0'. Sales should be able to enter the Internet
only, whereas Development should also have access to a partner company's network ('192.168.1.0/255.255.255.0').
The result is the following routing table (where the Development dept. has tag 2, Sales has tag 1):
ActiveMaskingDistanzPeer or IPRtg tagIP netmaskIP address
yesNo0PARTNER2255.255.255.0192.168.1.0
yesNo00.0.0.00255.255.0.0192.168.0.0
yesyes2INTERNET20.0.0.0255.255.255.255
yesyes2INTERNET10.0.0.0255.255.255.255
If Development and Sales were in IP networks with different address ranges, then it would be no problem to assign the
routing tags with firewall rules. Since both departments are in the same IP network, the only available method of
assignment is with network names.
Tag assignment can be carried out directly in the network definition
:
Rtg tagTypeSource checkInterfaceVLAN IDNetzmaskeIP addressNetwork name
2IntranetstrictLAN -10255.255.255.010.1.1.1DEVELOPMENT
1IntranetstrictLAN -20255.255.255.010.1.1.1SALES
Alternatively the assignment of tags can be carried out with a combination of network definitions and firewall rules. The
networks are defined as follows:
Rtg tagTypeSource checkInterfaceVLAN IDNetzmaskeIP addressNetwork name
0IntranetstrictLAN -10255.255.255.010.1.1.1DEVELOPMENT
0IntranetstrictLAN -20255.255.255.010.1.1.1SALES
Routing tags can be used to define the following firewall rules:
Rtg tag(...)PrioLinkedActionDestinationSourceProtocolName
2255yes%aANYHOST%LdevelopmentANYDEVELOPMENT
1255yes%aANYHOST%LsalesANYSALES
367
Reference Manual
7 Routing and WAN -connections
Important for these rules is the maximum priority (255) so that these rules are always checked first. Since filtering is still
possible by services, the option "Linked" has to be set in the firewall rule.
7.3.6 NetBIOS proxy
For security reasons, the behavior of the NetBIOS proxy has to be adjusted to the relevant networks, for example because
it normally is not to be active within the DMZ. For this reason, the NetBIOS proxy can be configured separately for each
network.
LANconfig: NetBIOS / General / NetBIOS networks
WEBconfig: LCOS menu tree / Setup / NetBIOS / networks
1
Network name
Name of the network that the NetBIOS proxy is to be activated for.
1
NetBIOS proxy operating for the network
This option shows if the NetBIOS-proxy is activated for the selected network.
1
Workgroup
The workgroup or domain used by the network clients. With multiple workgroups, mentioning one workgroup suffices.
5
In the default setting 'Intranet' and 'DMZ' are entered into this table; the NetBIOS proxy is activated for the
intranet and deactivated for the DMZ.
As soon as a network has an interface tag, then the only names (hosts and groups) visible from this network are those
in a network with the same tag, or which are accessible via a suitably tagged (with the same tag) WAN route. An untagged
network sees all names. Similarly, all names learned from untagged networks are visible to all networks.
The DNS server considers the interface tags when resolving names, i.e. the only names resolved by DNS are those learned
from a network with the same tag. The special role played by untagged networks applies here too.
The workgroup/domain enables networks to be scanned for NetBIOS names when a device is started. The workgroup is
different for every network and has to be defined everywhere. In networks without domains, the name of the largest
workgroup should be defined here.
7.4 Configuration of remote stations
Remote stations are configured in two tables:
1
In the peer list(s) all information is set that applies individually to only one remote station.
1
Parameters for the lower protocol levels (below IP or IPX) are defined in the communication layer table.
5
The configuration of the authentication (protocol, user name, password) is not covered in this section.Information
on authentication is contained in the section .
368
Reference Manual
7 Routing and WAN -connections
7.4.1 Peer list
The available remote stations are created in the peer list with a suitable name and additional parameters. For every WAN
interface exists a separate peer list. The peer list reached as follows: For every WAN interface exists a separate peer list.
The peer list reached as follows.LANconfig: Communication / Remote sites / Remote Sites (DSL)
WEBconfig: LCOS menu tree / Setup / WAN / DSL-Broadband-Peers
For the remote stations following parameters are required:
MeaningParameterPeer list
With this name the remote stations are identified in the router modules. As soon as the
router module has detected the remote station (using the IP address of the destination),
the connection parameters are located in the peer list.
NameDSL
This time indicates how long the connection is kept if no data is being transmitted
anymore.
Short hold
If zero is entered, the connection does not terminate automatically. If 9999 seconds are
entered a broken off connection is rebuild automatically.
The Access concentrator (AC) is a server, which can be accessed by the remote station.
If several ADSL providers are listed, select the provider that is responsible for the remote
station (using the name of the AC).
Access concentrator
The value for the AC is advised to you by your provider. If no value is entered for the AC,
every AC is accepted that provides the demanded service.
Enter the service you would like to use from your provider. The service can be e.g. internet
surfing or even video downstream.
Service
The value for the service is advised to you by your provider. If no value is entered, every
Service is accepted that is provided by the AC.
Select the layer name for the connection. The configuration of this layer is described in
the following section.
Layer name
Virtual Path Identifier.VPI
Virtual Channel Identifier. The value for VCI and VPI are advised to you by your provider.
Standard values for the combination of VPI and VCI are: 0/35, 0/38, 1/32, 8/35, 8/48.
VCI
See DSL-Broadband-PeersNameDialup-Peers
A Phonenumber is only then required, if the remote station must be called. This field
can remain empty if only incoming calls should be accepted. Several phonenumbers for
the same remote station can be entered in the RoundRobin list.
Phonenumber
See DSL-Broadband-PeersShort hold
The second B channel is cut down, if it is not used for the set duration.Short hold 2
See DSL-Broadband-PeersLayer name
The automatic callback provides a secure connection and decreases the costs for the
caller. Further information can be found in the next section .
Callback
5
Please note following points when editing the peer list:
1
If two identical peer lists (e.g. DSL-Broadband-Peers list and Dialup-Peers list) are entered, the LANCOM when
connecting to the remote station uses the “faster” interface. The other interface is then used as a backup.
2
If nor the access concentrator neither the service is specified the router connects to the first AC that answers the
query.
2
In the occasion of a DSLoL interface the same entries as for the DSL interface are valid. The entries are made in
the Broadband-Peers list.
369
Reference Manual
7 Routing and WAN -connections
7.4.2 Layer list
With a layer, a collection of protocol settings are defined, which should be used when connecting to specific remote
stations. The list of the communication layers can be found under:
LANconfig: Communication / General / Communication layers
WEBconfig: LCOS menu tree / Setup / WAN / Layer-list
In the communication layer list the common protocol combinations are already predefined. Changes or additions should
only be made when remote stations are incompatible to the existing layers. The possible options are contained in the
following list.
5
Please note that the parameters located in LANCOM depend upon the functionality of the unit. It is possible that
your unit does not offer all of the options described here
.
MeaningParameter
The layer is selected in the peer list under this name.Layer name
Additional encapsulations can be set for data packets.Encapsulation
No additional encapsulations.'Transparent'
Encapsulation in the form of ethernet frames.'Ethernet'
Multiplexing via ATM with LLC/SNAP encapsulation according to RFC 2684. Several protocols can
be transmitted over the same VC (Virtual Channel).
'LLC-MUX'
Multiplexing with ATM by establishing additional VCs according to RFC 2684.'VC-MUX'
The following options are available for the switching layer or network layer:Layer-3
No additional header is inserted.'Transparent'
The connection is established according to the PPP protocol (in the synchronous mode, i.e.
bit-oriented). The configuration data are taken from the PPP table.
'PPP'
Like 'PPP', only the asynchronous mode is used. This means that PPP functions character-oriented.'AsyncPPP'
All options can be run with their own script if desired. The script is specified in the script list.'... with script'
Assignment of the network parameters via DHCP.'DHCP'
In this field the upper section of the security layer (Data Link Layer) is configured. The following options are
available:
Layer-2
No additional header is inserted.'Transparent'
Encapsulation of the PPP protocol information in ethernet frames.'PPPoE'
The PPP negotiation runs via Ethernet. The PPP packets are encapsulated in Ethernet frames for
this purpose. This process is frequently used for DSL connections.
'PPPoE'
Here you can activate the compression of the data to be transmitted and the bundling of channels. The selected
option only becomes active when it is supported by both the ports used and the selected Layer-2 and Layer-3
protocols. For further information see section .
Options
In this field the lower section of the security layer (Data Link Layer) is configured. The following options are available:Layer-1
ATM adaptation layer'AAL-5'
Transparent Ethernet as per IEEE 802.3.'ETH-10'
Securing and synchronization of the data transfer as per HDLC (in the 7 or 8-bit mode).'HDLC'
Transmission as per V.110 with a maximum of 38,400 bps.'V.110'
Modem transmission (requires Fax Modem option)Modem
370
Reference Manual
7 Routing and WAN -connections
7.5 IP masquerading
One of today's most common tasks for routers is connecting the numerous workstation computers in a LAN to the network
of all networks, the Internet. Everyone should have the potential to access, for example, the WWW from his workstation
and be able to fetch bang up-to-date information for his work. ´
So that not every single computer with it's IP address in known on the entire internet “IP masquerading” is used to hide
all computers located in an intranet. IP masquerading demands two points from a router: On the one hand a valid IP
address in the local network, on the other hand a valid and public IP address in the internet (static or assigned by the
provider).
Because these two addresses are not allowed to exist in one logical net, the router must have two IP addresses:
1
the intranet IP address to communicate with computers in the LAN
1
the public IP address to communicate with remote stations in the Internet
The computers in the LAN use the router as a gateway but are not recognizable themselves. The router divides the intranet
from the internet.
7.5.1 Simple masquerading
How does IP masquerading work?
Masquerading makes use of a characteristic of TCP/IP data transmission, which is to use port numbers for destination
and source as well as the source and destination addresses. When the router receives a data packet for transfer it now
notes the IP address and the sender's port in an internal table. It then gives the packet its unique IP address and a new
port number, which could be any number. It also enters this new port on the table and forwards the packet with the
new information.
PC
Source: 10.0.0.100
Target: 80.123.123.123
IP: 10.0.0.100
Source: 80.146.74.146, Port 3456
Target: 80.123.123.123
INTERNET
Router
server
Source IP Port
10.0.0.100 3456
internal IP: 10.0.0.1
public IP 80.146.74.146
The response to this new packet is now sent to the IP address of the router with the new sender port number. The entry
in the internal table allows the router to assign this response to the original sender again.
PC
Source: 80.123.123.123
Target: 10.0.0.100
IP: 10.0.0.100
Source: 80.123.123.123
Target:80.146.74.146, Port 3456
INTERNET
Router
server
Source IP Port
10.0.0.100 3456
internal IP: 10.0.0.1
public IP 80.146.74.146
Which protocols can be transmitted using IP masquerading?
IP masquerading for all IP protocols that are based on TCP, UDP, or ICMP and communicate exclusively through ports.
One example of this type of uncomplicated protocol is the one the World Wide Web is based on: HTTP.
Individual IP protocols do use TCP or UDP, but do not, however communicate exclusively through ports. This type of
protocol calls for a corresponding special procedure for IP masquerading. Among the group of protocols supported by
IP masquerading in the LANCOM are:
1
FTP (using the standard ports)
371
Reference Manual
7 Routing and WAN -connections
1
H.323 (to the same extent as used by Microsoft Netmeeting)
1
PPTP
1
IPSec
1
IRC
Configuration of IP masquerading
The use of IP masquerading is set individually for each route in the routing table. The routing table can be reached as
follows:
LANconfig: IP router / Routing / Routing table
WEBconfig: LCOS menu tree / Setup / IP-router / IP-routing-table
7.5.2 Inverse masquerading
Simple masquerading has the effect, that all IP addresses in the local network are masked behind the IP address of the
router. But when using simple masquerading if a certain computer on the LAN is supposed to be available for stations
on the internet (e.g. FTP server) the IP address of the FTP server is not visible either. A connection to this FTP server from
the internet in not possible.
To enable the access to such a server (’exposed host’) in the LAN, the IP address of the FTP server must be entered with
all services that are also supposed to be available from outside the LAN. If a computer sends a packet from the Internet
to, for example, an FTP server on the LAN , from the point of view of this computer the router appears to be the FTP
server. The router reads the IP address of the FTP server in the LAN from the entry in the service table. The packet is
forwarded to this computer. All packets that come from the FTP server in the LAN (answers from the server) are hidden
behind the IP address of the router.
PC
PC
server
Router
INTERNET
IP 10.0.0.10
Target IPPorts
20 to 21
10.0.0.10
Source: 80.123.123.123
Target: 80.146.74.146, Port 21
The only small difference is that:
1
Access to a service (port) in the intranet from outside must be defined in advance by specifying a port number. The
destination port is specified with the intranet address of, for example, the FTP server, in a service table to achieve
this.
1
When accessing the Internet from the LAN, on the other hand, the router itself makes the entry in the port and IP
address information table.
5
The table concerned can hold up to 2048 entries, that is it allows 2048 simultaneous transmissions between
the masked and the unmasked network.
After a specified period of time, the router, however, assumes that the entry is no longer required and deletes it
automatically from the table.
5
Stateful Inspection and inverse masquerading: If in the Masquerading module a port is exposed (i.e.
all packets received on this port should be forwarded to a server in the local area network), then this requires
with a Deny All Firewall strategy an additional entry in the Stateful Inspection Firewall, which enables the
access of all stations to the respective server.
On occasion it is desirable for the "exposed" host not to be contacted over this standard port, e.g. when security reasons
demand the use of another port.
In this case not only the implementation of ports to an IP address is necessary, but as well the implementation to other
ports (port mapping). Another example of use for this port implementation is the implementation of several ports of the
WAN to a shared port in the LAN, which can be assigned to different IP addresses (N-IP-Mapping).
372
Reference Manual
7 Routing and WAN -connections
The configuration of port mapping involves the assignment of a port or port range (start port to end port) to an IP address
from the LAN as the target and the port (map port) to be used in the LAN.
LANconfig: IP-Router / Masquerading / Port-Forwarding table
WEBconfig: LCOS-menu tree / Setup / IP-Router / 1-N-NAT / Service table
1
Start port
D-port from (start port)
1
End port
D-port to (end port)
1
Remote site
Remote site which applies for this entry.
2
The use of virtual routers requires for the port forwarding a specific selection of the remote station. If no peer is
entered then the entry applies to all peers.
1
Intranet-Adresse
Internet address that a packet within the port range is forwarded to.
1
Map port
Port used for forwarding the packet.
5
If "0" is entered for the map port, the ports used in the LAN will be the same as those used in the WAN. If
a port range is to be mapped, then the map port identifies the first LAN port to be used. For example, mapping
the port range '1200' to '1205' to the internal map port '1000' means that the ports 1000 to 1005 will be
used for data transfer in the LAN.
5
Port mapping is static, meaning that two ports or port ranges cannot be mapped to the same map port of
a target computer in the LAN. The same port mapping can be used for different target computers.
1
Protocol
Protocol which applies for this entry.
1
WAN address
WAN address which applies for this entry. If the device has more than one static IP address, then this allows port
forwarding to be limited to certain connections.
1
Entry active
Switches the entry on or off.
1
Comment
Comment on the defined entry (64 characters)
373
Reference Manual
7 Routing and WAN -connections
7.6 Demilitarized Zone (DMZ)
A demilitarized zone (DMZ) makes certain stations in a network accessible from the Internet. These computers in the
DMZ are generally used to offer Internet services such as e-mail or similar services. The rest of the network should of
course be unaccessible for attackers on the Internet.
In order to allow this architecture, data traffic between the three zones Internet, DMZ and LAN must be analyzed by a
firewall. The firewall's tasks can also be consolidated in a single device (router). For this, the router needs three interfaces
that can be monitored separately from each other by the firewall:
1
LAN interface
1
WAN interface
1
DMZ interface
5
The table lists which devices support this functionality.
7.6.1 Assigning interfaces to the DMZ
To configure the DMZ the corresponding interface is defined as the DMZ interface.
LANconfig: Interfaces / LAN / Ethernet-Ports
WEBconfig: LCOS-menu tree / Setup / Interfaces / LAN
374
Reference Manual
7 Routing and WAN -connections
7.6.2 Assigning network zones to the DMZ
Various network zones (address ranges) are assigned to the DMZ and the LAN using the address settings. Depending
on availability, WLAN interfaces can also be selected.
LANconfig: TCP/IP / General
WEBconfig: LCOS-menu tree / Setup / TCP-IP
7.6.3 Address check with DMZ and intranet interfaces
To shield the DMZ (demilitarized zone) and the Intranet from unauthorized attacks, you can activate an additional address
check for each interface using the firewall's Intrusion Detection System (IDS).
The relevant buttons are called 'DMZ check' or 'Intranet check' and can have the values 'loose' or 'strict':
1
If the button is set to 'loose', then every source address is accepted if the LANCOM is addressed directly.
1
If the switch is set to 'strict', then a return route has to be explicitly available so that no IDS alarm is triggered. This
is usually the case if the data packet contains a sender address to which the relevant interface can also route data.
Sender addresses from other networks, to which the interface cannot route, or sender adresses from the own address
range will therefore trigger an IDS-alarm.
5
For all devices, the default is 'loose'. The default is set to 'strict' for LANCOM 7011 VPN only, as a more precise
address check has already been used for this device.
375
Reference Manual
7 Routing and WAN -connections
You will find the button for activating the DMZ and Intranet address check in LANconfig in the 'TCP-IP' configuration
area on the 'General' tab page.
LANconfig: TCP/IP / General
WEBconfig: LCOS-menu tree / Setup / TCP-IP
7.6.4 Unmasked Internet access for server in the DMZ
While the inverse masquerading described in the proceeding paragraph allows to expose at least one service of each
type (e.g. one Web, Mail and FTP server), this method is bound to some restrictions.
1
The masquerading module must support and ’understand’ the particular server service of the ’exposed host’. For
instance, several VoIP servers use proprietary, non-standard ports for extended signalling. Thus such server could be
used on unmasked connections solely.
1
From a security point of view, it must be considered that the ’exposed host’ resides within the LAN. When the host
is under control of an attacker, it could be misused as a starting point for further attacks against machines in the
local network.
5
In order to prevent attacks from a cracked server to the local network, some LANCOM provide a dedicated DMZ
interface (LANCOM 7011 VPN) or are able to separate their LAN ports on Ethernet level by hardware (LANCOM
821 ADSL/ISDN, LANCOM 1511 DSL, LANCOM 1521 ADSL, LANCOM 1621 ADSL/ISDN, LANCOM 1711 VPN,
LANCOM 1811 DSL and LANCOM 1821 ADSL).
Two local networks - operating servers in a DMZ
This feature requires an Internet access with multiple static IP addresses. Please contact you ISP for an appropriate offer.
Example: You are assigned the IP network address 123.45.67.0 with the netmask 255.255.255.248 by your provider.
Then you can assign the IP addresses as follows:
Meaning/useDMZ IP address
network address123.45.67.0
LANCOM as a gateway for the Intranet123.45.67.1
376
Reference Manual
7 Routing and WAN -connections
Meaning/useDMZ IP address
Device in the LAN which is to receive unmasked access to the Internet, e.g. web server connected at
the DMZ port
123.45.67.2
broadcast address123.45.67.3
All computers and devices in the Intranet have no public IP address, and therefore appear with the IP address of the
LANCOM (123.45.67.1) on the Internet.
Separation of Intranet and DMZ
5
Although Intranet and DMZ may be already separated on a Ethernet level by distinct interfaces, an appropriate
Firewall rule must be set up in any case so that the DMZ is being separated from the LAN on the IP level as well.
Thereby, the server service shall be available from the Internet and from the Intranet, but any IP traffic from the DMZ
towards the Intranet must be prohibited. For the above example, this reads as follows:
1
With a ’Allow All’ strategy (default): Deny access from 123.45.67.2 to “All stations in local network“
1
With a ’Deny All’ strategy : Allow access from "All stations in local network" to 123.45.67.2
7.7 Multi-PPPoE
In most cases just one connection at a time is established over a DSL or ADSL WAN interface. However, there are
applications where it makes sense to use multiple parallel connections on the WAN interface. LANCOM devices with a
DSL or ADSL interface can establish up to eight different channels in parallel in the WAN using the same physical interface.
7.7.1 Example application: Home-Office with private Internet access
One possible application is the home office used by sales personnel who need access to the network at the headquarters
via a VPN connection. The company pays for the VPN connection, the employee in the home office pays for Internet
access privately.
MAIN OFFICE
server
VPN GATEWAY VPN Router PC
HOME OFFICE
INTERNET
Fixed IP-address
213.217.69.57
company access
VPN connection via the internet
provider used by the headquarters
all other IP-addresses
Private Internet connection
Connection via the private
Internet provider
To ensure a clean separation of the data links, two Internet connections are established, one to each provider. In the IP
routing table, the default route is assigned to the private provider; the network with the headquarters via the VPN
connection is routed over the headquarters' provider.
7.7.2 Configuration
The configuration of this scenario involves the following steps with the home-office router:
1
Configuration of the private Internet access, for example with the LANconfig Wizard or with WEBconfig.
1
Configuration of the Internet access that is invoiced to the headquarters.
1
Selection of the private provider for the default route in the IP routing table (e.g. manually with LANconfig or with
the Wizard for selecting Internet providers in WEBconfig.
1
Configuration of the VPN connection to the network at the headquarters.
1
Allocation of the VPN connection to the headquarters' provider.
377
Reference Manual
7 Routing and WAN -connections
To ensure that the data traffic for the headquarters is routed via the desired Internet provider, one more entry in the
IP routing table is required. Here, the VPN gateway at the headquarters is entered along with its fixed IP address
and appropriate netmask, and is forwarded to the remote site used by the headquarters' provider.
5
It is important that the route to the Internet provider used by the headquarters is masked; otherwise the
LANCOM would apply the LAN address and not the WAN address, and the connection would never be
established.
Further information about these steps in the configuration are to be found in the documentation for your LANCOM
device.
5
Administrator rights for the employee in the home office: To avoid the employee making accidental changes
to the settings for the Internet provider or VPN access, he should be assigned with the WEBconfig function rights
for the "Internet connection" and "Selection of Internet provider" Wizards only. Information about the configuration
of special user rights can be found in this addendum under .
5
Use the necessary filter rules in the area 'Firewall/QoS' to ensure that the Internet traffic is not accidentally
directed via the network at the headquarters.
7.8 Load balancing
Despite the ever increasing bandwidth of DSL connections, these remain the communications bottle-neck. In some cases
it can be advisable to combine multiple DSL connections. There are a number of possibilities to realize this, some of
which need active support from the Internet provider:
1
DSL channel bundling (Multilink-PPPoE – MLPPPoE)
The availability of direct bundling depends on the Internet provider's product range. If available, the user has access
to the sum of the bandwidths of all of the bundled channels. Multilink-PPPoE can also be used for bundling PPP
connections.
5
This version of channel bundling provides bandwidths that are a multiple of the smallest bundled channel.
This means that it is especially efficient when channels are all of the same bandwidth. The direct bundling
of different bandwidths means that the channels with the higher data rates suffer from a loss in effective
bandwidth.
When bundling MLPPPoE for DSL channels behaves in the same way as the well known MLPPP for ISDN channel bundling.
server
VPN GATEWAY
PC
PC
One TCP connection divided
between two DSL ports
External ADSL
Modem
1
Load balancing
Load balancing involves the dynamic division of TCP connections between independent DSL connections. The user has
access to the sum of the bandwidths of the bundled channels, but the individual TCP connections are limited to the
bandwidth offered by the DSL connection allocated to it.
server
External ADSL
Modem
VPN GATEWAY
PC
PC
Two TCP connections divided
between two DSL ports
378
Reference Manual
7 Routing and WAN -connections
5
Unlike direct channel bundling, load balancing offers the true sum of all bundled bandwidths. This version is
thus highly effective for combining different bandwidths.
7.8.1 DSL port mapping
A basic requirement for DSL channel bundling is the support of more than one DSL interface per device. This means that
one or more external DSL modems are connected to the switch of a LANCOM router.
5
Please refer to the feature table in the appendix to see if your device supports the connection of external DSL
modems.
Allocation of switch ports to the DSL ports
Depending on the model, devices with an integrated switch can enable some of the LAN ports to be used as additional
WAN ports for connecting to external DSL modems. These ports are listed in the interface table as separate DSL interfaces
(DSL-1, DSL-2, etc.). The DSL ports are activated as DSL interfaces in teh WAN interfaces list, configured with the up-
and downstream rates and allocated to the switch ports in the LAN interfaces list (example: LANCOM Wireless 1811DSL)
Private modeMDI modeConnectionsAllocationPort
NoAutoAutoLAN -1LAN -1
NoAutoAutoLAN -1LAN -2
NoAutoAutoLAN -1LAN -3
NoAutoAutoLAN -1LAN -4
NoAutoAutoDSL-1WAN
1
The column 'Port' contains the description of the associated port as marked on the back cover of the device.
1
The utilization of the port is listed In the column 'Allocation':
2
None: The port is deactivated
2
LAN-1: The port is allocated to the LAN
2
DSL-1, DSL-2, ... : The port is allocated to one of the DSL interfaces
2
Monitor: The port is a monitor port, i.e. everything received at the other ports is output via this port. A packet
sniffer such as Ethereal can be connected to this port, for example.
The allocation of DSL ports to the Ethernet ports can be chosen freely. A well-arranged assignment can be achieved by
assigning the DSL ports in reversed order to the ports on the switch (for example: LANCOM Wireless 1811 DSL):
Reset
AC 12 V
LAN 3LAN 4 LAN 2 LAN 1 ISDN S
0
WAN
10/100Mbit/s
Config (COM)
Antenna MainAntenna Aux
1. LAN4 / DSL-2
2. LAN3 / DSL-3
3. LAN2 / DSL-4
4. LAN1 / LAN-1: This port remains reserved for the LAN.
5. WAN / DSL-1: (dedicated WAN port for the device)
If the device is equipped with more than one DSL port, the DSL port to be used is entered in the DSL-Broadband-Peers
list:
1. If no port is defined (or port "0"), the LANCOM selects the port after the one chosen for the connection's
communication layer.
1
If Layer-1 is set with 'AAL-5', then the ADSL interface is chosen.
2
If Layer-1 is set with 'ETH', then the first DSL port (i.e. DSL-1) is chosen.
379
Reference Manual
7 Routing and WAN -connections
1
If a particular port is defined (not "0"), then it will be used for the connection.
5
Observe that the communication layer set for the connection over this port in Layer 1 is set to 'ETH'.
1
To enable channel bundling via multiple DSL interfaces, the appropriate ports are entered into the peer list for
the remote station (as a comma-separated port list '1,2,3' or as a port range '1-3'). With a port list, the bundled
channels will be established in the given order; only in case of error will the channels be tested in ascending
order. With a port range, the channels are always established in ascending order.
2
In the list of Ethernet ports, the ports must be switched to DSL port.
2
The DSL ports have to be activated as DSL interfaces in the list of the WAN interfaces and need to be
configurated with the correct up- and downstreams.
2
In the layer used for the connection, a bundling method has to be activated that is also supported at the
remote site.
2
To configure channel bundling for an internal ADSL interface, the ADSL port '0' is entered into the list of
ports at the top of the list (e.g. '0,1,2,3' as port list or '0-3' as port range). In the remote device, the
communications layer must be set to Layer 1 'AAL-5'.
5
An entry in the peer list can contain various ports (e.g. ADSL and Ethernet), but it can only reference
one communications layer in which just one layer-1 protocol can be defined. For bundled
communications over ADSL and Ethernet ports, however, two different layer-1 protocols are required.
For this reason, layer 1 is set to 'AAL-5' in these cases. As only one ADSL interface can exist in the
devices, all of the interfaces bundled into this are automatically changed to layer 1 with 'ETH' for
Ethernet DSL ports. This automatic change of the layer can only succeed if the ADSL interface is the
first one to be selected for bundled connections.
2
For devices with a built-in ADSL modem and an additional Ethernet interface (DSL or DSLoL), it is clear which
ports are used for bundling. In this case it is not necessary to enter the ports into the remote site list. These
devices always internally assume a port list '0,1' so that the internal ADSL interface is the first one to be used
for bundling.
5
For Multi-PPPoE, multiple PPPoE connections share one physical DSL connection. With Multi-DSL, several
PPPoE connection are divided between the available DSL interfaces. The maximum possible number of
parallel connections is limited to 8 channels.
Allocation of MAC addresses to the DSL ports
If a LANCOM uses switch ports to gain access to multiple DSL (WAN) interfaces, an appropriate number of MAC addresses
must be used to differentiate the DSL ports. As there are cases where the required MAC address depends upon the
remote site which, for example, uses the MAC address to determine the DSL access charge, the MAC addresses are
defined for the logical DSL remote sites and not for the physical DSL ports.
The following options are available for setting the MAC address:
1
Global: Global system MAC address
1
Local: The unique, locally managed MAC address is calculated from the global address
1
User defined: A MAC address that can be freely defined by the user
5
Every DSL connection contains its own MAC address. If two remote stations are configured with identical MAC
addresses, the first connection uses the configured MAC address. For the second connection a "locally managed",
unambiguous MAC address will be calculated from the user-defined MAC address.
When using channel bundling, the configured MAC address is used for the first connection, for all other bundle connections
the locally managed MAC addresses based on the user-defined MAC address will be calculated.
If one of your connections is charged via the MAC address, configure this MAC address for the separately charged
connection only. For all other connections you should use another address.
380
Reference Manual
7 Routing and WAN -connections
7.8.2 DSL-channel bundling (MLPPPoE)
The used DSL ports are registered in the list of the DSL broadband remote stations to bundle DSL links. Therefore the
number of the DSL port is indicated, for several ports in a by comma seperated list (1,2,4) or as a region (1-4).
All that is required for PPPoE bundling is to activate bundling in the relevant layer and to use the port list to assign the
relevant ports.
7.8.3 Dynamic load balancing
If the Internet provider does not directly support bundling, then multiple normal DSL connections can be coupled with
a load balancer. First of all, the DSL accesses are set up for the necessary DSL ports. These are then coupled with a
load-balancing table. This list assigns a virtual balancing connection (the connection that is entered into the routing
table) to the other real DSL connections (bundle connections). Depending on the number of available DSL ports, several
bundle connections can be assigned to one balancing connection.
5
The balancing connection is entered as a "virtual" connection. No access data or similar has to be entered for
this connection. The entry merely serves as a "distributor" which uses the load-balancing table to assign several
"real" bundled connections to an entry in the routing table.
5
DSL bundling is a static bundling. Any additional channels are not opened or closed according to the demand
from data transfer volumes.
With load balancing, decisions about the routing of data packets can no longer be made simply based on the IP addresses
because the individual bundled DSL connections all have different IP addresses. Thus load balancing also considers the
information in the firewall connection list. This list has an entry for every established TCP connection, and for load
balancing the list is supplemented with information about the DSL port used.
Connection establishment
A request for data transmission to a balancing remote site initially prompts the first bundle connection from the load
balancing table to be established. Further progress depends upon the success of this connection establishment:
1
If the connection is successfully established, the first step is the assignment of all pending TCP connections to this
channel. Subsequently, all of the configured bundle connections will successively be established. As soon as at least
two bundle connections are active, new TCP connections will be divided among the active bundle connections.
1
Should establishment of the bundling connection fail, then attempts will be made to establish other bundle connections
one after the other. As soon as one of the bundle connections is established, all of the pending TCP connections will
be directed to this channel.
Spreading the data load
Two basic methods are available for balancing the data load:
1
If the channel's bandwidth is known, then the connections will be assigned to the channel with the lowest workload
(in percent).
1
If the bandwidth is not known, then a differentiation is made according to the type of connection required; a TCP
connection; or VPN or PPTP connections from the LANCOM.
2
If a TCP connection requests a channel, then the one with the lowest absolute workload will be chosen.
2
If a VPN or PPTP connection requests a channel, then the connections will be equally spread between all available
channels.
5
For the most effective use of load balancing, the bandwidth should be entered into the list of WAN interfaces
under LANconfig in the configuration area 'Interface' on the 'WAN' tab under the button Interface settings
(Telnet: /Setup/Interfaces/DSL, WEBconfig: LCOS menu tree / Setup / Interfaces / DSL).
381
Reference Manual
7 Routing and WAN -connections
7.8.4 Static load balancing
Apart from the dynamic choice of connection outlined in the previous section, there are possible scenarios where certain
TCP connections should always make use of the same DSL connection. Two cases are to be considered here:
1
A server with a fixed IP address can only be contacted via a dedicated connection. All that is required for the selection
here is the destination IP address.
1
A server uses a protocol that requires a control channel and other channels for data transfer (e.g. FTP, H.323, PPTP).
In establishing the data channels, servers accept only the same IP address as used by the control channel.
Destination-based channel selection
Destination-based channel selection is handled by an entry in the routing table that directly uses one of the bundle
connections to reach the destination instead of using the virtual balancing connection.
Policy-based Routing
Suitable entries can be made in the firewall to select channels according to the destination port or the source address.
These entries are supplemented with a special routing tag that is used to control the channel selection with the routing
table. Please refer to for further information.
7.8.5 Configuration of load balancing
5
For the following configurations we assume that the remote devices are already set up with all necessary access
data.
Direct channel bundling via PPPoE
The following method is for the configuration of channel bundling via PPPoE:
1. Assign the DSL ports to the required Ethernet ports, in LANconfig via Interfaces / LAN / Ethernet-Ports. Telnet:
/Setup/Interfaces/Ethernet-ports WEBconfig: LCOS menu tree / Setup / Interfaces /
Ethernet ports
2. Activate the additional DSL interfaces in LANconfig via Interfaces / WAN / Interface settings. Enter the data
rates for up- and downstream. Telnet: /Setup/Interfaces/DSL WEBconfig: LCOS menu tree / Setup
/ Interfaces / DSL
3. For the required remote site, enter the DSL ports that are to be used in LANconfig via Communication / Remote
sites / Remote sites (DSL). Telnet: /Setup/WAN/DSL-broadband-peers WEBconfig: LCOS menu
tree / Setup / WAN / DSL broadband peers
4. Activate channel bundling for the relevant layers in LANconfig via Communication / General / Communication
layers. Telnet: /Setup/WAN/Layer WEBconfig: LCOS menu tree / Setup / WAN / Layer
Dynamic load balancing with multiple DSL connections
The first step in setting up dynamic load balancing is to define the Internet accesses, e.g. 'INET1' and 'INET2', with the
aid of the LANconfig Wizard.
382
Reference Manual
7 Routing and WAN -connections
1. To distribute Internet traffic across different DSL interfaces, the individual remote sites are assigned to different DSL
ports in LANconfig under Communication / Remote sites / Remote sites (DSL). Telnet:
/Setup/WAN/DSL-broadband-peers WEBconfig: LCOS menu tree / Setup / WAN / DSL broadband
peers
1. The two DSL remotes are the assigned to a new virtual remote site 'INTERNET' in the load balancing list in LANconfig
via IP router / Routing / Load balancing. Telnet: /Setup/IP-router/Load-balancer WEBconfig:
LCOS menu tree / Setup / IP router / Load balancer
1. The virtual remote site is entered into the routing table as the router for the default route in LANconfig via IP router
/ Routing / Routing table. Telnet: /Setup/IP-router/IP-routing-table WEBconfig: LCOS
menu tree / Setup / IP router / IP routing table
5
The virtual remote site 'INTERNET' is now to be used for Internet access. When data are routed over this connection,
the load balancing table will cause the "real" DSL connections to be established and the data will be transmitted
over the selected DSL ports.
Routing tags can be used for the application-dependent direction of data traffic to specific DSL ports. If i.e outbound
E-Mail traffic ought to be routed via a particular DSL-interface with a particular IP-address, a fitting rule must be
established via LANconfig under Firewall/QoS / Rules, which reroutes all data traffic of all local station’s E-Mail services
to the mail server and sets the routing tag ’1’.
Telnet: /Setup/IP-router/Firewall/Rules WEBconfig: LCOS menu tree / Setup / IP router /
Firewall/ Rules.
383
Reference Manual
7 Routing and WAN -connections
7.9 N:N mapping
Network Address Translation (NAT) can be used for several different matters:
1
for better utilizing the IP4 addresses ever becoming scarcer
1
for coupling of networks with same (private) address ranges
1
for producing unique addresses for network management
In the first application the so-called N:1 NAT, also known as IP masquerading is used. All addresses (“N”) of the local
network are mapped to only one (“1”) public address. This clear assignment of data streams to the respective internal
PCs is generally made available by the ports of the TCP and UDP protocols. That’s why this is also called NAT/PAT (Network
Address Translation/Port Address Translation).
Due to the dynamic assignment of ports, N:1 masquerading enables only those connections, which have been initiated
by the internal network. Exception: an internal IP address is statically exposed on a certain port, e.g. to make a LAN
server accessible from the outside. This process is called “inverse masquerading”.
A N:N mapping is used for network couplings with identical address ranges. This transforms unambiguously multiple
addresses (“N”) of the local network to multiple (“N”) addresses of another network. Thereby, an address conflict can
be resolved.
Rules for this address translation are defined in a static table in the LANCOM. Thereby new addresses are assigned to
single stations, parts of the network, or the entire LAN, by which the stations can contact other networks then.
Some protocols (FTP, H.323) exchange parameters during their protocol negotiation, which can have influence on the
address translation for the N:N mapping. For a correct functioning of the address translation, the connection information
of these protocols are tracked appropriately by functions of the firewall in a dynamic table, and are additionally considered
to the entries of the static table.
5
The address translation is made “outbound”, i.e. the source address is translated for outgoing data packets and
the destination address for incoming data packets, as long as the addresses are located within the defined
translation range. An “inbound” address mapping, whereby the source address is translated (instead of the
destination address), needs to be realized by an appropriate “outbound” address translation on the remote side.
7.9.1 Application examples
The following typical applications are described in this section:
1
Coupling of private networks utilizing the same address range
1
Central remote monitoring by service providers
Network coupling
An often appearing scenario is the coupling of two company networks which internally use the same address range (e.
g. 10.0.0.x). This is often the case, when one company should get access to one (or more) server(s) of the other one:
PC
PC
PC
server
server
PC
PC
GATEWAY
VPN TUNNEL
GATEWAY
server
server
PC
Network of company A
10.0.0.x
Network of company B
10.0.0.x
N:N mapping to 192.168.2.x
N:N mapping to 192.168.1.x
Target: 192.168.2.1
Server_B1: 10.0.0.1
Server_B2. 10.0.0.2
Server_A1: 10.0.0.1
Server_A2. 10.0.0.2
In this example network servers of company A and B should have access over a VPN tunnel to the respective other
network. All stations of the LAN should have access to the server of the remote network. For the time being, there is no
access possible to the other network, because both networks use the same address range. If one station of the network
384
Reference Manual
7 Routing and WAN -connections
of company A wants to access server 1 of company B, the addressee (with an address from the 10.0.0.x network) will
be searched within the own local network, and the inquiry even does not reach the gateway.
With the help of N:N mapping, all addresses of the LAN can be translated to a new address range for the coupling with
the other network. The network of company A e. g. will be translated to 192.168.1.x, the network of company B to
192.168.2.x. Under these new addresses the two LANs are now reachable for the respective other network. The station
from the network of company A is now addressing server 1 of company B under the address 192.168.2.1. The addressee
does not reside any more within the own network, the inquiry is now passed on to the gateway, and the routing to the
other network is working as desired.
Remote monitoring and remote control of networks
Remote maintenance and control of networks become more and more important because of the possibilities given by
VPN. With the use of the nearly ubiquitous broadband Internet connections, the administrator of such management
scenarios is no longer dependent of the different data communication technologies or expensive leased lines.
Router
GATEWAY
GATEWAY
LAN
Router
INTERNET
GATEWAY
GATEWAY
GATEWAY
ACCESS POINT
ACCESS POINT
Router
Router
PC
PC
server server
Customer A, office 1:
10.1.2.x, 255.255.0.0
Customer A, office
2:
Customer A, headquarters
10.1.x.x, 255.255.0.0
Gateway,e.g.
10.1.2.1
Customer B, office 1:
10.1.2.x, 255.255.0.0
Customer B, office
2:
Customer B, headquarters
10.1.x.x, 255.255.0.0
Customer D
172.16.10.x
255.255.255.
Customer C
172.16.10.x
255.255.255.0
Hot Spot
172.16.10.11
Gateway, e.g.
80.123.123.123 (public)
and 172.16.10.11 (intern)
Serviceprovider
172.16.10.x
255.255.255.0
VPN TUNNEL
VPN TUNNEL
VPN TUNNEL
VPN TUNNEL
In this example, a service provider monitors the networks of different clients out of a central control. For this purpose,
the SNMP-capable devices should send the respective traps of important events automatically to the SNMP trap addressee
(e. g. LANmonitor) of the network of the service provider. So the LAN administrator of the service provider has an
up-to-date view of the state of the devices at any time.
The individual networks can be structured very differently: Clients A and B integrate their branches with own networks
via VPN connections to their LAN, client C operates a network with several public WLAN base stations as hot spots, and
client D has got an additional router for ISDN dial-up accesses in his LAN.
5
The networks of client A and B use different address ranges in the respective head office and the connected
branches. A standard network coupling via VPN is therefore possible between these networks.
In order to avoid the effort to building up its own VPN tunnel to each individual subnetwork of the clients A and B, the
service provider makes only one VPN connection to the head office, and uses the existing VPN lines between head office
and branches for communication with the branches.
Traps from the networks report to the service provider whether e. g. a VPN tunnel has been build up or cut, if an user
has been tried to log in three times with a wrong password, if an user has been applied for a hot spot, or if somewhere
a LAN cable has been pulled out of a switch.
5
A complete list of all SNMP traps supported by LANCOM can be found in the appendix of this reference manual.
Routing of these different networks reaches very fast its limiting factors, if two or more clients use same address ranges.
Additionally, if some clients use the same address range as the service provider as well, further address conflicts are
added. In this example, one of the hot spots of client C has got the same address as the gateway of the service provider.
There are two different variants to resolve these address conflicts:
1
In the decentralized variant, alternative IP addresses for communicating with the SNMP addressee are assigned to
each of the monitored devices by means of an 1:1 mapping. This address is in technical language also known as
“loopback address”, the method accordingly as “loopback method”.
385
Reference Manual
7 Routing and WAN -connections
5
The loopback addresses are valid only for communication with certain remote stations on the connections
belonging to them. Thus a LANCOM is not generally accessible via this IP address.
1
Even more appealing is the solution of a central mapping: instead of configuring each single gateway in the branch
networks, the administrator configures solely one central address translation in the gateway of the head office. On
this occasion, also all subnetworks located “behind” the head office are supplied with the needed new IP addresses.
In this example, the administrator of the service provider selects 10.2.x.x as central address translation for the network
of client B, so that both networks with actual same address range looks like two different networks for the gateway of
the service provider.
The administrator selects the address ranges 192.168.2.x and 192.168.3.x for client C and D, so that the addresses of
these networks do differ from the own network of the service provider.
In order to enable the gateway of the provider to monitor the networks of clients C and D, the administrator sets up an
address translation to 192.168.1.x also for the own network.
7.9.2 Configuration
Setting up address translation
Configuration of N:N mapping succeeds with only few information. Since a LAN can be coupled with several other
networks via N:N, different destinations can have also different address translations for a source IP range. The NAT table
can contain 64 entries at maximum, including the following information:
1
Index: Unambiguous index of the entry.
1
Source address: IP address of the workstation or network that should get an alternative IP address.
1
Source mask: Netmask of source range.
1
Remote station: Name of the remote station over that the remote network is reachable.
1
New network address: IP address or address range that should be used for the translation.
For the new network address, the same netmask will be used as the source address already uses. For assignment of
source and mapping addresses the following hints apply:
1
Source and mapping can be assigned arbitrarily for the translation of single addresses. Thus, for example, it is possible
to assign the mapping address 192.168.1.88 to a LAN server with the IP address 10.1.1.99.
1
For translation of entire address ranges, the station-related part of the IP address will be taken directly, only appended
to the network-related part of the mapping address. Therefore, in an assignment of 10.0.0.0/255.255.255.0 to
192.168.1.0, a server of the LAN with IP address 10.1.1.99 will get assigned the mapping address 192.168.1.99.
5
The address range for translation must be at minimum as large as the source address range.
5
Please notice that the N:N mapping functions are only effective when the firewall has been activated.
Additional configuration hints
By setting up address translation in the NAT table, the networks and workstations become only visible under another
address at first in the higher network compound. But for a seamless routing of data between the networks some further
settings are still necessary:
1
Entries in the routing tables for packets with new addresses to find the way to their destination.
1
DNS forwarding entries, in order that inquiries about certain devices in the respective other networks can be resolved
into mapped IP addresses.
1
The firewall rules of the gateways must be adjusted such that (if necessary) authorized stations resp. networks from
the outside are permitted to set up connections.
1
VPN rules for loopback addresses in order to transmit the newly assigned IP addresses through an according VPN
tunnel.
386
Reference Manual
7 Routing and WAN -connections
5
The IP address translation takes place in the LANCOM between firewall and IP router on one hand, and the VPN
module on the other hand. All rules related to the own network use therefore the “unmapped” original addresses.
The entries of the remote network use the “mapped” addresses of the remote side, valid on the VPN connection.
VPN services
connection via LAN/Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
Firewall / IDS / DoS / QoS
IP router
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
IPX over PPTP/VPN
Encryption:
802.11i/WPA/WEP
Target address
Source address
Configuration with different tools
LANconfig: IP router / N:N-Mapping
WEBconfig: LCOS menu tree / Setup / IP router / NAT table
387
Reference Manual
7 Routing and WAN -connections
When starting a new entry under WEBconfig, the NAT table shows up as follows:
7.10 Establishing connection with PPP
LANCOM Systems routers also support the point-to-point protocol (PPP). PPP is a generic term for a whole series of WAN
protocols which enable the interaction of routers made by different manufacturers since this protocol is supported by
practically all manufacturers.
Due to the increasing importance of this protocol family and the fact that PPP is not associated with any specific operating
mode of the routers, we will be introducing the functions of the devices associated with the PPP here in a separate
section.
7.10.1 The protocol
What is PPP?
The point-to-point protocol was developed specifically for network connections via serial channels and has asserted itself
as the standard for connections between routers. It implements the following functions:
1
Password protection according to PAP, CHAP or MS CHAP
1
Callback functions
1
Negotiation of the network protocol to be used over the connection established (IP or IPX, for example). Included in
this are any parameters necessary for these protocols, for example IP addresses. This process is carried out using
IPCP (IP Control Protocol).
1
Negotiation of the connection parameters, e.g. the MTU (Maximum Transmission Unit, ).
1
Verification of the connection through the LCP (Link Control Protocol)
1
Combining several ISDN or DSL channels (MultiLink PPP resp. MultiLink PPPoE)
PPP is the standard used by router connections for communication between devices or the WAN connection software
of different manufacturers. Connection parameters are negotiated and a common denominator is agreed using standardized
control protocols (e.g. LCP, IPCP, CCP) which are contained in PPP, in order to ensure successful data transfer where
possible.
What is PPP used for?
It is best to use the point-to-point protocol in the following applications:
388
Reference Manual
7 Routing and WAN -connections
1
for reasons of compatibility when communicating with external routers, for example
1
remote access from remote workstations with ISDN cards
1
Internet access (when sending addresses)
The PPP which is implemented by LANCOM can be used synchronously or asynchronously not only via a transparent
HDLC connection, but also via an X.75 connection.
The phases of PPP negotiation
Establishment of a connection using PPP always begins with a negotiation of the parameters to be used for the connection.
This negotiation is carried out in four phases which should be understood for the sake of configuration and troubleshooting.
1
Establish phase
Once a connection has been made at the data communication level, negotiation of the connection parameters begins
through the LCP.
This ascertains whether the remote site is also ready to use PPP, and the packet sizes and authentication protocol
(PAP, CHAP, MS-CHAP or none) are determined. The LCP then switches to the opened state.
1
Authenticate phase
Passwords will then be exchanged, if necessary. The password will only be sent once if PAP is being used for the
authentication process. An encrypted password will be sent periodically at adjustable intervals if CHAP or MS CHAP
is being used.
Perhaps a callback is also negotiated in this phase via CBCP (Callback Control Protocol).
1
Network phase
LANCOM, supports the protocols IPCP and IPXCP.
After the password has been successfully transmitted, the IPCP and/or IPXCP network layer can be established.
IP and/or IPS packets can be transferred from the router modules to the opened line if the negotiation of parameters
is successful for at least one of the network layers.
1
Terminate phase
In the final phase the line is cleared, when the logical connections for all protocols are cleared.
PPP negotiation in the LANCOM
The progress of a PPP negotiation is logged in the devices' PPP statistics and the protocol packets listed in detail there
can be used for checking purposes in the event of an error.
The PPP trace outputs offer a further method of analysis. You can use the command
1
trace + ppp
to begin output of the PPP protocol frames exchanged during a terminal session. You can perform a detailed analysis
once the connection has been broken if this terminal session has been logged in a log file.
7.10.2 Everything o.k.? Checking the line with LCP
The devices involved in the establishment of a connection through PPP negotiate a common behavior during data transfer.
For example, they first decide whether a connection can be made at all using the security procedure, names and passwords
specified.
The reliability of the line can be constantly monitored using the LCP once the connection has been established. This is
achieved within the protocol by the LCP echo request and the associated LCP echo reply. The LCP echo request is a query
in the form of a data packet which is transferred to the remote station along with the data. The connection is reliable
and stable if a valid response to this request for information is returned (LCP echo reply). This request is repeated at
defined intervals so that the connection can be continually monitored.
389
Reference Manual
7 Routing and WAN -connections
What happens when there is no reply? First a few retries will be initiated to exclude the possibility of any short-term line
interference. The line will be dropped and an alternative route sought if all the retries remain unanswered. If, for example,
the high-speed connection refuses to work, an existing ISDN port can open the way to the Internet as a backup.
5
During remote access of individual workstations with Windows operating systems, we recommend switching off
the regular LCP requests since these operating systems do not reply to LCP echo requests.
5
The LCP request behavior is configured in the PPP list for each individual connection. The intervals at which LCP
requests should be made are set by the entries in the 'Time' and 'Retr.' fields, along with the number of retries
that should be initiated without a response before the line can be considered faulty. LCP requests can be switched
off entirely by setting the time at '0' and the retries at '0'.
7.10.3 Assignment of IP addresses via PPP
In order to connect computers using TCP/IP as the network protocol, all participating computers require a valid and
unique IP address. If a remote station does not have its own IP address (such as the individual workstation of a
telecomputer), the LANCOM assigns it an IP address for the duration of the connection, enabling communications to
take place.
This type of address assignment is carried out during PPP negotiation and implemented only for connections via WAN.
In contrast, the assignment of addresses via DHCP is (normally) used within a local network.
5
Assignment of an IP address will only be possible if the LANCOM can identify the remote station by its call number
or name when the call arrives, i.e. the authentication process has been successful.
Examples
1
Remote access
Address assignment is made possible by a special entry in the IP routing table. 255.255.255.255 is specified as the
network mask as the IP address to be assigned to the remote site in the 'Router-name' field. In this case, the router
name is the name, with which the remote site must identify itself to the LANCOM.
In addition to the IP address, the addresses of the DNS and NBNS servers (Domain Name Server and NetBIOS Name
Server) including the backup server from the entries in the TCP/IP module are transmitted to the remote station during
this configuration.
So that everything functions properly, the remote site must also be adjusted in such a way that it can obtain the IP
address and the name server from the LANCOM. This can be accomplished with Windows dial-up networking through
the settings in the 'TCP settings' under 'IP address' and 'DNS configuration'. This is where the options 'IP address
assigned by server' and 'Specify name server addresses' are activated.
1
Internet access
If Internet access for a local network is realized via the LANCOM, the assignment of IP addresses can occur in a
reverse manner. Configurations are possible in which the LANCOM does not have a valid IP address in the Internet
and is assigned one by the Internet provider for the duration of the connection. In addition to the IP address, the
LANCOM also receives information via the DNS server of the provider during the PPP negotiation.
In the local network, the LANCOM is only known by its internal valid intranet address. All workstations in the local
network can then access the same Internet account and also reach e.g. the DNS server.
Windows users are able to view the assigned addresses via LANmonitor. In addition to the name of the remote station,
the current IP address as well as the addresses of DNS and NBNS servers can be found there. Options such as channel
bundling or the duration of the connection are also displayed.
7.10.4 Settings in the PPP list
In the PPP list, you are able to specify you own definition of PPP negotiation for every remote site contacting your network.
390
Reference Manual
7 Routing and WAN -connections
The authentication of point-to-point connections in the WAN commonly relies on one of the protocols PAP, CHAP,
MSCHAP or MSCHAPv2. The protocols here have a "hierarchy" amongst themselves, i. e. MSCHAPv2 is a "higher-level"
protocol than MSCHAP, CHAP and PAP (higher protocols provide higher security). Many dial-in routers at Internet
providers allow up-front authentication using a higher-level protocol such as CHAP, but only support the use of PAP
further down the line. If the setting for the protocol for authentication is fixed in the LANCOM, the connection may fail
because no common authentication protocol can be negotiated.
5
In principle authentication can be repeated while the connection is being negotiated. Another protocol can be
selected if, for example, it can only be recognized from the username at the earliest. However, this repeat
negotiation is not supported in all scenarios. In particular when dialing in over UMTS, the LANCOM must explicity
refuse the provider's request for CHAP to be able to provide PAP user data for requests to be forwarded by the
provider.
A flexible setting for the authentication protocols in the LANCOM ensures that the PPP connection is established as
required. In addition, one or more protocols can be defined that are accepted for authentication of remote sites in the
LANCOM (inbound connections) and on login of the LANCOM into other remote sites (outbound connections).
1
When establishing inbound connections, the LANCOM requires the lowest of the permitted protocols, but where
possible it also permits the remote site to use one of the higher-level protocols (enabled in the LANCOM).
1
When establishing outbound connections, the LANCOM offers all enabled protocols, but only permits a selection
from precisely these protocols. It is not possible to negotiate one of the disabled, possibly higher-level, protocols.
The PPP authentication protocols are set in the PPP list.
LANconfig: Communication / Protocols / PPP list
WEBconfig: Setup / WAN / PPP
7.10.5 The meaning of the DEFAULT remote site
During PPP negotiations, a remote site dialing-in to the LANCOM logs on with its name. The LANCOM can use the name
to retrieve the permitted values for authentication from the PPP table. At the start of the negotiation, the remote site
occasionally cannot be identified by call number (ISDN dial-in), IP address (PPTP dial-in ) or MAC address (PPPoE dial-in).
It is thus not possible to determine the permitted protocols in this first step. In these cases, authentication is performed
first with those protocols enabled for the remote site with name DEFAULT. If the remote site is authenticated successfully
with these settings, the protocols permitted for the remote site can also be determined.
391
Reference Manual
7 Routing and WAN -connections
If authentication uses a protocol entered under DEFAULT, but which is not permitted for the remote site, then
authentication is repeated with the permitted protocols.
7.10.6 RADIUS authentication of PPP connections
PPP connections can also be authenticated by an external RADIUS server. However, these external RADIUS servers do
not necessarily support all available protocols. For this reason, the permitted protocols can also be selected in the
configuration of the RADIUS authentication. LCP negotiation is restarted with the permitted protocols if the RADIUS
server does not support the negotiated protocol.
WAN RADIUS table
LANconfig: Communication / RADIUS
WEBconfig: Setup / WAN / RADIUS
7.11 DSL dial-in over PPTP
Some DSL providers enable dial-in over PPTP (Point-to-Point Tunneling Protocol) instead of PPPoE. PPTP is an extension
of PPP, partly developed by Microsoft.
With PPTP it is possible to build up a “tunnel” over IP nets to a remote station. A tunnel is a logical shielded connection,
that protects the transferred data from unauthorized access. For this purpose the encoding algorithm RC4 is used.
7.11.1 Configuration of PPTP
As soon as the internet access over PPTP is selected the LANCOM enquires all needed PPTP parameters with the Internet
Access Wizard. Additionally to the entries for PPPoE access the IP address of the gateway must be specified. A PPTP
gateway is often a DSL modem. Detailed information is available from your DSL provider.
The configuration can be changed in the PPTP list:
392
Reference Manual
7 Routing and WAN -connections
LANconfig: communication / protocols / PPTP list
WEBconfig: LCOS menu tree / Setup / WAN / PPTP list
The PPTP configuration consists of three parameters:
1
'Remote site'—the entry from the DSL-Broadband-Peers list.
1
'IP address'—IP address of the PPTP gateway, often the address of the DSL modem.
1
'Port'—IP port the PPTP protocol runs on. For conformity with the protocol standard enter the port '1.723'.
7.11.2 Addition(s) to LCOS 7.80
32 additional gateways for PPTP connections
Introduction
Up to 32 additional gateways can be configured to assure the availability of any PPTP remote station. Consequently,
each PPTP remote station can use a total of up to 33 gateways.
Configuration
The additional PPTP gateways are defined in a separate list.
LANconfig: Communication / Protocols / Further remote gateways
WEBconfig: LCOS menu tree / Setup / WAN E Additional PPTP gateways
1
Name of connection
Here you select the PPTP remote site that this entry applies to.
Possible values:
2
Select from the list of defined PPTP remote stations.
Default:
2
Empty.
1
Begin with
Here you select the order in which the entries are to be tried.
Possible values:
2
Last used: Selects the entry for the connection which was successfully used most recently.
2
First: Selects the first of the configured remote sites.
393
Reference Manual
7 Routing and WAN -connections
2
Random: Selects one of the configured remote sites at random. This setting provides an effective measure for
load balancing between the gateways at the headquarters.
Default:
2
Last used
1
Gateway 2 to 33
Enter the IP addresses of the additional gateways to be used for this PPTP remote station.
Possible values:
2
IP address or 63 alphanumerical characters.
Default:
2
Empty.
1
Routing tag
Enter the routing tag for setting the route to the relevant remote gateway.
Possible values:
2
Maximum 5 characters.
Default:
2
0.
5
If you do not specify a routing tag here (i.e. routing tag is 0), then the routing tag configured for this remote
station in the PPTP connection list will be taken for the associated gateway.
7.12 Extended connection for flat rates—Keep-alive
The term flat rate is used to refer to all-inclusive connection rates that are not billed according to connection times, but
instead as a flat fee for fixed periods. With flat rates, there is no longer any reason to disconnect. On the contrary: New
e-mails should be reported directly to the PC, the home workplace is to be continuously connected to the company
network and users want to be able to reach friends and colleagues via Internet messenger services (ICQ etc.) without
interruption. This means it is desirable to continuously maintain connections.
With the LANCOM the Keep-alive function ensures that connections are always established when the remote station has
disconnected them.
7.12.1 Configuration of Keep-alive function
The keep alive procedure is configured in the peer list.
If the holding time is set to 0 seconds, a connection is not actively disconnected by the LANCOM. The automatic
disconnection of connections over which no data has been transmitted for a longer time is deactivated with a holding
time of 0 seconds then. However, connections interrupted by the remote site are not automatically re-established with
this setting.
With a holding time of 9,999 seconds the connection is always re-established after any disconnection. Additionally, the
connection is re-established after a reboot of the device (’auto reconnect’).
394
Reference Manual
7 Routing and WAN -connections
7.13 Callback functions
LANCOM models with ISDN interface support the automatic callback function.
In addition to callback via the D channel, the CBCP (Callback Control Protocol) specified by Microsoft and callback via
PPP as per RFC 1570 (PPP LCP extensions) are also offered. There is also the option of a particularly fast callback using
a process developed by LANCOM. PCs with Windows operating system can be called back only via the CBCP.
7.13.1 Callback for Microsoft CBCP
With Microsoft CBCP, the callback number can be determined in various ways.
1
The party called does not call back.
1
The party called allows the caller to specify the callback number itself.
1
The party called knows the callback numbers and only calls these back.
Via CBCP, it is possible to establish connection to the LANCOM from a PC with Windows operating system and also to
be called back by this PC. Three possible settings are selected in the remote sites list via the callback entry as well as the
calling number entry.
No callback
For this setting, the callback entry must be set to 'off' when configuring via WEBconfig or in the console.
Callback number specified by caller
For this setting the callback entry must be set to 'Call back the remote site after name verification' (or must have the
value 'Name' in WEBconfig or in the console). In the peer list no telephone number may be specified.
After the Authentication an input window appears on the caller's screen in Windows that requests the ISDN telephone
number of the PC.
The calling number is determined in the LANCOM
For this setting the callback entry must be set to 'Call back the remote site after name verification' (or must be set to the
value 'Name' in WEBconfig or in the console). In the peer list one telephone number must be specified.
395
Reference Manual
7 Routing and WAN -connections
Some Windows versions (especially Windows 98) prompt the user to confirm the callback to the telephone number stored
in the LANCOM ('Administrator Specified') with an input window. Other Windows versions only inform the user that the
PC is waiting for the callback from the LANCOM.
The callback to a Windows workstation occurs approx. 15 seconds after the first connection has been dropped. This time
setting cannot be decreased since it is a Windows default setting.
7.13.2 Fast callback
This fast process is ideal if two LANCOM are to communicate with one another via callback.
1
The caller who may wish to be called back can activate the function 'Wait for callback from remote site' in the peer
list (or 'Looser' when configuring via WEBconfig, terminal program or Telnet).
1
The callback party selects 'Call back the remote site (fast procedure)' in the peer list and enters the calling number
('fast' when configuring via WEBconfig, terminal program or Telnet).
5
For fast callback using the LANCOM Systems method, the number list for answering calls must be kept up to
date at both ends.
7.13.3 Callback with RFC 1570 (PPP LCP extensions)
The callback as per 1570 is the standard method for calling back routers of other manufacturers. This protocol extension
describes five possibilities for requesting a callback. All versions are recognized by LANCOM. All versions will be processed
in the same way, however:
The LANCOM drops the connection after authenticating the remote station and then calls back the station a few seconds
later.
Configuration
For callback as per PPP you select the option 'Call back the remote site' in LANconfig or 'Auto' with configuration via
WEBconfig, terminal program or Telnet.
5
For callback as per PPP the number list for answering calls in the LANCOM must be up to date.
7.13.4 Overview of configuration of callback function
The following options are available in the peer list under WEBconfig and terminal program/telnet for the callback function:
... you set up the callback in this manner:With this entry ...
No callback occurs.'Off'
The remote station will be called back if so specified in the peer list. At first, the call is denied
and as soon as the channel is clear again, it is called back (duration is approx. 8 seconds). If
'Auto' (not for Windows operating
systems, see below)
the remote station is not found in the numerical list, it is first accepted as the DEFAULT remote
station, and the callback is negotiated during the protocol negotiation. A charge of one unit
is incurred for this.
Before a callback occurs, a protocol negotiation is always carried out even when the remote
station was found in the numerical list (e.g. for computers with Windows having direct dialing
on the device). Here only minor charges result.
'Name'
396
Reference Manual
7 Routing and WAN -connections
... you set up the callback in this manner:With this entry ...
When the remote station is found in the numerical list, a quick callback is carried out, i.e., the
LANCOM sends a special signal to the remote station and calls back immediately when the
'fast'
channel is clear again. After approx. 2 seconds, the connection is established. If the remote
station does not take back the call immediately after the signal, then after two seconds the
situation reverts back to normal callback procedures (duration is once again approx. 8 seconds).
This process is only available for DSS1 connections.
Use the 'Looser' option when a callback is expected from the remote station. This setting carries
out two functions simultaneously. On the one hand, it ensures that a custom connection setup
'Looser'
is taken back when there is an incoming call from the called remote station, and on the other
hand, the function is activated with this setting to be able to react to the rapid callback
procedure. In other words, in order to be able to use rapid callback, the caller must be in the
'Looser' mode while the party being called must discontinue callback with 'LANCOM'.
5
The setting 'Name' offers the greatest security when an entry is made into the number list as well as the PPP
list. The setting 'LANCOM' offers the fastest callback method between two LANCOM Systems routers.
5
With Windows remote stations, the 'Name' setting must be selected.
7.14 ISDN Channel bundling with MLPPP
When establishing an ISDN connection to a remote station with PPP capability, you can transmit data more quickly. Data
can be compressed and/or several B channels can be used for data transmission (channel bundling).
Connecting with cable bundling is distinguished from “normal” connections in that not only one, but rather several B
channels are used parallel for data transmission.
MLPPP (Multilink PPP) is used for channel bundling. This procedure is of course only available when PPP is used as the
B-channel protocol. MLPPP is used e.g. for Internet access via Internet provider, which also operate remote stations with
MLPPP capability from your direct dialing nodes.
5
Bundling over MLPPPoE can also be arranged for DSL channels.
7.14.1 Two methods of channel bundling
1
Static channel bundling
If a connection is established with static channel bundling, the LANCOM tries to establish the second B channel
immediately after setting up the first B channel. If this does not work because, for example, this channel is already
taken by another device or a different connection within the LANCOM, the connection attempt is automatically and
regularly repeated until the second channel is available for it.
1
Dynamic channel bundling
In the case of a connection with dynamic channel bundling, the LANCOM first only establishes one B channel and
begins transmitting data. If, during this connection, it determines that the throughput rate lies above a certain
threshold value, it tries to add the second channel.
If the second channel is established and the data throughput rate drops below the threshold value, the LANCOM
waits for the set B2 timeout period and then automatically closes the channel again. In this way, the per minute
charges are fully utilized so long as rate information is communicated during the connection. Therefore, the LANCOM
only uses the second B channel if and as long as it really needs it.
397
Reference Manual
7 Routing and WAN -connections
7.14.2 Here's how to configure your system to combine channels
The configuration of channel bundling for a connection is made up of three settings.
1. Select a communication layer for the remote station from the layer list that has bundling activated in the Layer-2
options. Select from the following Layer-2 options:
1
compr. according to the LZS data compression procedure (Stac) reduces the amount of data if the data hasn't
already been compressed. This procedure is also supported by routers of other manufacturers and by ISDN
adapters under Windows operating systems.
1
bundle uses two B channels per connection.
1
bnd+cmpr uses both (compression and channel bundling) and provides the maximum possible data transmission
performance.
2. Now create a new entry in the peer list. When doing so, watch the holding times for the connection. Please observe
the following rules:
1
Depending on the type of application, the B1 hold time should be increased to such a level so that the connection
is not dropped prematurely because of packets not being transmitted for a short time. Experience has shown
that values between 60 and 180 seconds are a good basis which can be adapted as required during operation.
1
The B2 holding time determines whether static or dynamic channel bundling will be used (see above). A B2
holding time of '0' or '9999' ensures that the bundling will be static; values in between permit dynamic channel
bundling. The B2 holding time defines how long the data throughput may lie below the threshold for dynamic
channel bundling without the second B channel automatically being disconnected.
3. Use the entry for the Y connection in the Router interface list to determine what should happen if a second connection
to a different remote station is requested during an existing connection using channel bundling.
WEBconfig: LCOS menu tree / Setup / WAN / Router-interface-list
1. Y connection On: The router interrupts the bundled connection to establish a connection to the other remote station.
When the second channel is free again, the originally bundled connection automatically takes the channel back
(always in the case of static bundling, only as required when using dynamic bundling).
1
Y connection Off: The router maintains the existing bundled connection; the establishment of the new connection
must wait.
5
Please note that if channel bundling is used, the cost of two connections is charged.Here no additional
connections via the LANCAPI are possible! So you should only use channel bundling if the double transmission
capacity can really be used in full.
7.15 Operating a modem over the serial interface
5
This section refers only to devices with a serial configuration interface.
7.15.1 Introduction
Internationally, analog telephone connections are just as common in the business world as the predominant ISDN
connections in Germany. The operation of international networks thus places particular demands on remote maintenance
options and for high-availability of the gateways and thus requires different interfaces than the ISDN common in Germany.
Apart from conventional analog telephone lines, mobile telephone networks such as GSM or GPRS may, in certain cases,
represent the only way of providing remote maintenance without broadband or other cabled access.
398
Reference Manual
7 Routing and WAN -connections
In response to these requirements, most LANCOM models with a serial interface can be extended with an additional
WAN interface with the use of analog modems, GSM or GPRS. The following functions are available with a suitable
modem in combination with the LANCOM Modem Adapter Kit:
1
Internet access via modem with all of the router functions such as firewall, automatic connection establishment and
termination, etc.
1
Remote maintenance (e.g. dial-in to international sites)
1
Backup connection (e.g. high-availability through GSM/GPRS modem connection)
HEADQUARTER VPN GATEWAY
Home Office
VPN Router
INTERNET
GSM / GPRS
ANALOGUE
PHONE LINE
DSLDSL
MODEM
MODEM
7.15.2 System requirements
The following are required to set up a backup connection over the serial interface:
1
LANCOM with serial configuration interface and support for LANCOM modem adapter kit. For devices with serial
configuration interface please refer to the table to see, whether your model supports the modem operation at serial
interface.
1
LANconfig or alternatively a web browser or Telnet
1
Serial configuration cable (supplied with the device)
1
Analog modem, Hayes compatible, with access to a suitable analog telephone connection (D-sub9 or D-sub25
connector)
1
LANCOM modem adapter kit to connect the modem over the serial configuration cable
7.15.3 Installation
The installation simply involves the connection of the modem with the LANCOM Modem Adapter Kit with the serial
configuration interface of the LANCOM.
5
Please do not use any other adapters than the original LANCOM Modem Adapter Kit! The contact assignment
of the LANCOM Modem Adapter Kit differs from other commercial adapters like “null modem cables” or the like.
The use of uncompliant accessories will cause serious damage on the LANCOM and/or the modem. For further
details please refer to the .
7.15.4 Set the serial interface to modem operation
The operation of the serial interface requires the operating mode and bitrate to be set.
1
Operating mode [default: outband]
2
Outband: In this mode, the serial interface is only used for configuration with a terminal program.
2
Modem: In the 'Modem' setting, the device attempts to find a modem connected to the serial interface. If this
is successful then the modem can be used as an additional WAN interface. If a computer running a terminal
program is detected, then the device automatically switches the interface into outband mode.
2
Interlink: Direct connection between two LANCOM devices
1
Bitrate [default: 115,200 bps.]
399
Reference Manual
7 Routing and WAN -connections
Set the maximum bitrate supported by your modem. The serial interfaces of LANCOM devices support data rates of
19,200 bps, 38,400 bps, 57,600 bps up to a maximum of 115,200 bps.
LANconfig: Interfaces / WAN / V.24-Interface
WEBconfig: LCOS menu tree / Setup / Interfaces / V.24-Interface
5
As long as the LANCOM is set to modem mode, a terminal program operating over the serial interface will display
the AT commands that the LANCOM device transmits while attempting to identify a connected modem. In the
terminal program, press the return key repeatedly until the modem identification is interrupted and start the
configuration session.
7.15.5 Configuration of modem parameters
The operation of a modem at the serial interface requires the following settings:
1
Request modem ID [Default: ATI6]
1
Reset command [default: AT&F]
1
Initialize command [default: ATL0M1X1S0=0]
2
L0: Loudspeaker quiet
2
M1: Loudspeaker on while connecting
2
X1: Operation at an extension
2
S0=0: Disable auto answering
1
Deactivate modem echo [default: ATE0]
1
AT polling cycle time [Default: 1 in seconds]
1
AT polling count [Default: 5]
1
Ring count [Default: 1]
1
Initialize answer command
1
Answer command [Default: ATA]
1
Initialize dial command
1
Dial command [default: ATDT]
400
Reference Manual
7 Routing and WAN -connections
1
Escape sequence to terminate data phase resp. to return to command phase [Default: +++]
1
Hold time after escape sequence [Default: 1000 in milliseconds]
1
Disconnect: command to hang up during data phase [Default: ATH]
5
The modem parameters are set with values that should suit most modems. Thus changes are generally not
necessary. Refer to the documentation for your modem for settings that vary from these.
Setting up a GPRS backup connection
If the connection is to use a GPRS-capable modem at the serial interface, you will need the APN name and the dial-up
telephone number. The following init-strings for the configuration apply to T-Mobile and Vodafone:
1
T-Mobile
2
Init-string: L0X1M1S0=0+CGDCONT=1, “IP”, “internet.t-d1.de”
2
Dial-up number: *99#
1
Vodafone
2
Init-string: L0X1M1S0=0+CGDCONT=1, “IP”, “web.vodafone.de”
2
Dial-up number: *99# or *99***1#
Setting up a GPRS backup connection
If the connection is to use a GPRS-capable modem at the serial interface, you will need the APN name and the dial-up
telephone number. The following init-strings for the configuration apply to T-Mobile and Vodafone:
1
T-Mobile
2
Init-string: L0X1M1S0=0+CGDCONT=1, “IP”, “internet.t-d1.de”
2
Dial-up number: *99#
1
Vodafone
2
Init-string: L0X1M1S0=0+CGDCONT=1, “IP”, “web.vodafone.de”
2
Dial-up number: *99# or *99***1#
LANconfig: Interfaces / WAN or / Modem
401
Reference Manual
7 Routing and WAN -connections
WEBconfig: LCOS menu tree / Setup / Interfaces / Modem-Parameters
Entering special characters in the console
For a GPRS dial-up, the initialisation strings require the entry of inverted commas and equal signs. Certain special
characters can be correspondingly marked with a leading backslash:
1
*
1
"
1
=
1
space
1
Example: +cgdcont\=1,\”IP\”,\”internet.t-d1.de\”
As an alternative, the entire command sequence can be enclosed within inverted commas. In this case, those inverted
commas which are inside the surrounding inverted commas must be preceded by a backslash.
1
Example: ”+cgdcont=1,\”IP\”,\”internet.t-d1.de\””
7.15.6 Direct entry of AT commands
The command
1
sendserial "AT..."
allows you to use Telnet to send a character string directly to a modem that is connected to the LANCOM. This function
allows you to send any AT commands to the modem.
5
Sending AT commands ist possible in the internal modem state 'idle' or 'Modem ready' only. The responses can
be found in the serial trace.
7.15.7 Statistics
Statistics about activities of the serial interface can be accessed with a terminal program or Telnet under:
Status/Modem-Status
The statistics show the following states:
1
the type of modem identified
1
the status of its last connection, e.g. the transfer rate, the transfer protocol used or the error-detection method used
1
internal state of modem management, e.g.
2
device detection
2
interface deactivated
2
modem initialization
2
modem ready
2
connection establishment
2
modem in data mode
These messages may be very helpful for debugging purposes.
7.15.8 Trace output
The command
1
trace + serial
allows you to start the trace output for the serial interface in a Telnet session when a LANCOM has a modem connected.
The output shows all messages exchanged up until the establishment of data transfer between the modem and the
LANCOM.
402
Reference Manual
7 Routing and WAN -connections
7.15.9 Configuration of remote sites for V.24 WAN interfaces
To establish a connection to a remote station via the modem connected to the serial interface, a corresponding entry in
the remote site list (ISDN/serial) must be generated. The remote sites list (ISDN/serial) contains the following information:
1
Name: Name of the remote site
1
Telephone number: Telephone number that reaches the remote site. The field can be left empty if calls are to be
received only.
1
Hold time: This time defines how long a connection is kept active even if no more data is being transferred. If a zero
is entered, the connection will not be interrupted automatically. A hold time of "9999" means that the connection
is permanently held open. If it is interrupted, then the connection will be actively opened up again. This behavior is
known as keep alive.
1
2. Hold time: Is ignored.
1
Layer name: The layer 'V.24_DEF' is selected for the connection over the serial WAN interface. The layer is preset
and does not need further configuration. The layer 'V.24_DEF' uses the following settings:
2
Encapsulation: Transparent
2
Layer 3: APPP (asynchronous PPP)
2
Layer 2: Transparent
2
Options: none
2
Layer 1: SERIAL (shows that the serial interface is being used for connections via the layer 'V.24_DEF')
The remote site list with the remote sites for the modem at the serial interface can be found under the following paths:
LANconfig: Communication / Remote sites / Remote sites (ISDN/serial)
WEBconfig: LCOS menu tree / Setup / WAN E Dialup-Peers
Once an entry in the remote site list has been generated for the WAN interface, this remote station can be used just like
any other for routing and WAN connections.
403
Reference Manual
7 Routing and WAN -connections
7.15.10 Configuration of a backup connection on the serial interface
The configuration of a backup connection via a modem at the serial interface requires first of all an entry in the Dialup-Peers
list so that the required remote site can be reached. The following entries will also be required for the configuration of
the LANCOM:
1
Entry in the backup table
In the backup table, generate an entry for the remote site that is to be used for the backup connection. This remote
site is to be allocated to the remote site that is to be called by the modem at the serial interface.
The backup table is to be found under the following paths:
LANconfig: Communication / Call Management / Backup Table
WEBconfig: LCOS menu tree / Setup / WAN E Backup table
1
Entry in the polling table
If the link to the remote station that is to be backed up cannot be checked by LCP polling (with PPP only) then an
additional entry in the polling table is required. This involves assigning the remote site with an IP address that can
be regularly tested with a ping command. The IP address should typically be a computer directly at the opposite end
of the connection being tested, e.g. a DNS server in your provider's network.
The polling table is to be found under the following paths:
LANconfig: Communication / Remote Sites / Polling Table
WEBconfig: LCOS menu tree / Setup / WAN E Polling table
7.15.11 Contact assignment of modem adapter kit
D-Sub9 plugDevice or modem signalD-Sub9 plugDevice signal
2RxD3TxD
3TxD2RxD
8CTS7RTS
7RTS8CTS
1DCD4DTR
4DTR1DCD
5GND5GND
7.16 Manual definition of the MTU
Many Internet providers operate their own backbone; however, their customers dial in to the network over the access
nodes provided by third-party telecommunications providers. The two-stage dail-in procedure can lead to problems with
the realized data rate:
1
When dialing into the nodes of Deutsche Telekom, for example, a LANCOM negotiates a permissible maximum
transmission unit (MTU), which defines the greatest possible size of unfragmented data packet. This MTU is then
used by the LANCOM.
1
When the data packets are forwarded to the actual provider, an additional header is added which increases the size
of the data packets again. For the data packets to meet with the permitted size, they must now be fragmented into
smaller units. This additional fragmentation can cause losses in the data-transfer speeds.
This problem can be avoided by entering a fixed MTU for each remote site.
404
Reference Manual
7 Routing and WAN -connections
7.16.1 Configuration
WEBconfig: LCOS-menu tree / Setup / WAN / MTU list
The table contains the following entries:
1
Device name: Name of the remote device. It can be a physical or a virtual (PPTP/VPN) remote site
1
MTU: MTU to be used for the connection
7.16.2 Statistics
Under Status / WAN-statistics you will find the MTU statistics recorded for all current connections. The table is partially
dynamic and begins with 16 entries. Like the MTU-list under Setup / WAN it includes two columms in which the device
name and the MTU are stored.
RemarkMTURemote site
The INET remote site is the Internet connection and a forced MTU of 1200 bytes.1200INET
MULTI is a PPPoE connection, for which the MTU was negotiated (and is consequently
1492 bytes).
1492MULTI
TESTVPN is a VPN connection established via the Internet. An assumed overhead of
100 bytes is taken for VPN connections, and consequently the MTU here is 1100 bytes.
1100TESTVPN
TESTVPN-PPTP is a PPTP connection established over the VPN connnection TESTVPN.
The overhead for PPTP connections is 40 bytes, and consequently the MTU here is 1060
bytes.
1060TESTVPN-PPTP
5
MTU lists and MTU statistics are only available for devices with a DSL or ADSL interface.
7.17 WAN RIP
In order for routes learned from RIP to be broadcast across the WAN, the respective remote sites can be entered into
the WAN RIP table. The WAN RIP table contains the following values:
1
Remote site: The name of the remote site is listed in the 'Remote site' column
1
RIP type: The column RIP type details the RIP version with which the local routes are propagated
1
RIP accept: The column RIP accept lists whether RIP from the WAN is to be accepted. The RIP type must be set for
this.
1
Masquerade: The column Masquerade lists whether or not masquerading is performed on the connection and how
it is carried out. This entry makes it possible to start WAN RIP even with an empty routing table. The following values
are possible:
2
Auto: The masquerade type is taken from the routing table (value: 0). If there is no routing entry for the remote
site, then masquerading is not performed.
2
On: All connections are masqueraded (value: 1).
2
Intranet: IP masquerading is used for connections from the intranet, connections from the DMZ pass through
transparently (value: 2).
1
Default tag: The column Default tag lists the valid "Default routing tag" for the WAN connection. All untagged
routes are tagged with this tag when sent on the WAN.
1
Routing tags list: The column Routing tags list details a comma-separated list of the tags that are accepted on the
interface. If this list is empty, then all tags are accepted. If at least one tag is in the list, then only the tags in this list
are accepted. When sending tagged routes on the WAN, only routes with valid tags are propagated.
405
Reference Manual
7 Routing and WAN -connections
All learned routes from the WAN are treated internally as untagged routes and propagated on the LAN with the
default tag (0). In the WAN, they are propagated with the tag with which they were learned.
LANconfig: IP-Router / General
WEBconfig: LCOS-menu tree / Setup / IP-Router / RIP / WAN-Sites
7.18 The rapid spanning tree protocol
In networks with many switches and bridges, many physical connections can exist between two stations that are connected
to the network. These redundant data paths are desirable because they can offer alternative paths to the desired
destination in case individual network paths fail. On the other hand, these multiple connections can also lead to loops
or cause network stations to receive multiple frames. Both occurrences negatively impact free data traffic performance
in the network.
The Spanning Tree Protocol (STP) enables an analysis of the network at the layer 2 level and, as such, offers solutions
for intelligent path selection between two network stations below the routing layer. By discovering redundant paths
between network stations, STP builds a unique structure in which loops and double packets can be avoided. To this end,
so-called Bridge Protocol Data Units (BPDUs) are sent as a multicast to a specific MAC address. The BPDUs allow redundant
paths to be discovered as well as the distance and the data rate available on this connection. Using these values, the
Spanning Tree Protocol calculates a priority (also called route or path costs) with which the various connections are to
be treated. The low-priority connections are disabled and are therefore no longer available for clients. Through the
reduction of non-redundant connections between the clients, the protocol builds a tree which unambiguously defines
all of the connections that arise from a central switch (root bridge).
The BPDUs are sent regularly in the network in order to check the availability of the connections. If a connection fails,
then the network analysis is triggered again; the possible paths and the corresponding priorities are redefined.
After initialisation all ports will initially be in the “blocking” state, in which only BPDUs are transmitted. The ports
subsequently switch to the states of "listening" and then "learning" before reaching "forwarding" which allows payload
data to be exchanged via the ports.
7.18.1 Classic and rapid spanning tree
The early version of the spanning-tree protocol compliant with IEEE 802.1D, here referred to as classic spanning tree,
had the problem that changes to topology after a connection failure were implemented very slowly: Depending on the
complexity of the network, the classic spanning tree takes between 20 seconds and a minute to establish new routes.
For many network services a failure of this length of time is unacceptable.
The spanning tree protocol was improved and published as the "Rapid Spanning Tree Protocol" (RSTP), initially as the
IEE 802.1t/w standard and later as a part of the newly published IEEE 802.1D. Even though the classic spanning tree
protocol was thus withdrawn, it continues to be supported by LCOS.
406
Reference Manual
7 Routing and WAN -connections
7.18.2 Improvements from rapid spanning tree
As mentioned above, the primary aim of RSTP is to accelerate the activation of network paths once an active connection
has failed. RSTP achieves this by dispensing with the states "blocking" and "listening" to reduce the time required to
update the network paths to just a few seconds. In case of a network path failure, not all of the links are blocked until
the new topology has been calculated; instead, only the failed connections are unavailable for use.
RSTP also enables the administrator to configure information on network topology.
1
A bridge port can be defined as an edge port. An edge port is the only bridge port leading to the connected LAN
segment, i.e. no other bridges are connected to the LAN segment, but workstations or servers only, for example. As
these ports cannot lead to loops, they change immediately into the forwarding state without waiting for the network
topology to be determined. However, RSTP continues to monitor these ports. Should BPDUs be unexpectedly received
at an edge port due to another bridge being connected to the LAN, the ports automatically return to their normal
state.
1
A bridge port can also operate as a point-to-point link. In this case the port is directly connected with an additional
bridge. Since no additional stations can occur between the two bridges, the switch into the forwarding state can
take place faster.
In the ideal case, RSTP immediately resorts to familiar alternative network paths in case of connection failure.
7.18.3 Configuring the Spanning Tree Protocol
The following parameters are available for configuring RSTP or STP functionality in LANCOM:
LANconfig: Interfaces / Span. Tree
WEBconfig: LCOS-menu tree / Setup / LAN-Bridge / Spanning-Tree
General parameters
1
Spanning tree operating
407
Reference Manual
7 Routing and WAN -connections
When Spanning Tree is turned off, a LANCOM does not send any Spanning Tree packets and passes received packets
along instead of processing them itself.
1
Protocol version
2
Classic: Uses the classical STP to determine network topology.
2
Rapid: Uses the RSTP method to determine network topology.
5
RSTP is compatible with STP. Network components which only support classical STP continue to be supported
where RSTP is operational.
1
Path Cost Computation
2
Classic: Uses the classical STP method to compute path costs.
2
Rapid: Uses the RSTP method to compute path costs.
1
Bridge priority
Defines the priority of the bridge in the LAN. This can influence which bridge should preferably be made root bridge
by the Spanning Tree Protocol.
5
So as to maintain compatibility with RSTP, this value should only be adjusted in steps of 4096 owing to the
fact that RSTP uses the lower 12-bits of this 16-bit value for other purposes.
1
Maximum Age
This value defines the time (in seconds) after which a bridge drops messages received through Spanning Tree as
'outdated'. This parameter defines how quickly the Spanning Tree algorithm reacts to changes, for example due to
failed bridges.
1
Hello Time
This parameter defines (in seconds) in which intervals a device selected to be the root bridge sends Spanning Tree
information into the LAN.
1
Forward-Delay
This time (in seconds) determines how much time must pass at a minimum before a Spanning Tree port can change
the status (listening, learning, forwarding).
5
When using RSTP the forwarding delay often has no effect because RSTP has suitable mechanisms of its own
to prompt a rapid switching into the forwarding state.
5
Modifying any of these three time values is only recommended for those with exact knowledge of the Spanning
Tree protocol.
1
Transmit-Hold-Count
Number of BPDUs which can be transmitted by RSTP before a one second pause commences.
5
When using classical STP the transmit-hold count has no effect.
Port table
The port table can be used to set the following values separately for all available ports (LAN, wireless LAN, point-to-point
connections).
1
Mark as edge port
Marks the port as an edge port which is not connected to any further bridges but to workstations or servers only.
Edge ports switch immediately into the forwarding state.
5
Edge ports continue to be monitored by RSTP. If a port of this type receives BPDUs, then its status as an edge
port is removed.
408
Reference Manual
7 Routing and WAN -connections
1
Priority
Defines the priority of the port. In the case of multiple network paths with identical path costs, the priority value
decides which port is used. If priority values are identical then the port to be taken is the first in the list.
5
So as to maintain compatibility with RSTP, this value may only be adjusted in steps of 16 owing to the fact
that RSTP uses only the upper 4-bits of this 16-bit value.
1
Path-Cost-Override
This parameter controls the priority of paths with equal value. The value set here is used to make the selection instead
of the computed path costs.
2
Special values: 0 switches path-cost override off.
2
Default: 0
7.18.4 Status reports via the Spanning Tree Protocol
The current STP values can be viewed via Telnet or WEBconfig in the LAN Bridge Status.
WEBconfig: LCOS-menu tree / Status / LAN-Bridge / Spanning-Tree
General status information
1
Bridge ID
This is the ID for the device that is being used by the Spanning Tree algorithm. It is composed of the user-defined
priority (upper 16 bits) and the device MAC address (lower 48 bits).
1
Root Bridge
The ID for the device that is currently elected root bridge.
1
Root Port
The port that can be used to reach the root bridge from this device. If the device itself is the root bridge, it is displayed
with the special value '255'.
1
Root Path Cost
The path costs of all hops added together in order to reach the root bridge from this device.
1
Protocol version
The protocol version currently set for determining network topology.
1
Path Cost Computation
The protocol version currently set for computing path cost.
1
Bridge priority
Current setting for bridge priority.
Information in the port table
The port table can be used to inspect the following values for all available ports (LAN, wireless LAN, point-to-point
connections).
1
Priority
The priority of this port taken from the port configuration
1
Status
The current status of the port:
409
Reference Manual
7 Routing and WAN -connections
2
Disabled: no packets can be sent or received through this port. This occurs when the port has either been disabled
manually or when it has a negative link status.
2
Listening: Intermediate state on the way to enabling. Only Spanning Tree packets are listened to, data packets
are ignored and are also not forwarded to this port.
2
Learning: Further intermediate state. As opposed to 'listening' additional MAC addresses from data packets
entering this port are learned but data packets are still not forwarded.
2
Forwarding: the port is completely active, data packets are received and forwarded in both directions.
2
Blocking: Spanning Tree has identified this port to be redundant and disabled it for data traffic.
1
Root
The ID of the root bridge that can be reached through this port.
1
Bridge
This is the ID of the bridge through which the root bridge can be reached.
1
Costs
This value defines the 'costs' for this port. The value is determined by the port technology (Ethernet, WLAN, etc.) and
the bandwidth. Examples of values used are:
Costs of Rapid Spanning TreeCosts of Classic Spanning TreeTransfer technology
2000000100Ethernet 10 MBit
20000019Ethernet 100 MBit
2000004Ethernet 1000 MBit
12500000500WLAN 2 MBit
4000000140WLAN 11 MBit
90000035WLAN 54 MBit
45000025WLAN 108 MBit
5
If path costs for a port were manually entered, then the configured value appears in this column.
Information in the RSTP port statistics
The RSTP port table can be used to inspect the following values for all available ports (LAN, wireless LAN, point-to-point
connections).
1
Role
Root or Non-root bridge
1
Learning
Port in learning state.
1
Forwarding
Port in forwarding state.
1
Edge port
Port defined as an edge port.
1
Protocol version
Classic or Rapid
1
Costs
Setting for this port's cost
410
Reference Manual
7 Routing and WAN -connections
7.19 The Action table
7.19.1 Introduction
The action table controls actions triggered when there is a change in status of WAN connections. WAN connections
include direct connections to an Internet provider, and also VPN connections based on this, such as those used to connect
a branch office to a main office. Every action is linked with a condition that describes the change in status of the WAN
connection (establishment, termination, failure or establish failure). Actions can be any of the commands available at
the Telnet console. Furthermore, actions can transmit messages by e-mail or SYSLOG, send an HTTP request, or transmit
a DNS request. Different variables allow information such as the current IP address, the name of the device, or an error
message to be integrated into the action.
7.19.2 Actions for Dynamic DNS
Systems with dynamic IP addresses can be made available for access via the WAN, for example via the Internet, by using
the services of commercially available dynamic DNS servers. Servers offering these services can assign the current IP
address of a device to its FQDN name (Fully Qualified Domain Name, e. g. “http://MyLANCOM.dynDNS.org”).
The advantage is obvious: If you wish to carry out remote maintenance via WEBconfig/HTTP, the only information you
need is the dynamic DNS name. Also, a DynDNS name can be used to establish VPN connections between remote stations
that have changing IP addresses.
In order for the current IP address to match with the DynDNS name at all times, the IP address recorded on the DynDNS
server must be constantly updated. This change is triggered by a dynamic DNS client.
1
The DynDNS server, maintained by a DynDNS service provider on the Internet, is in contact with the Internet DNS
servers.
1
The Dynamic DNS client can run on a workstation as a separate client program. As an alternative, a dynamic DNS
client is integrated into the LANCOM. It can make contact to any one of a number of dynamic-DNS service providers
and, assuming that a user account has been set up, automatically update its current IP address for the DNS name
translation.
Dynamic DNS client on the workstation
Dynamic DNS providers support a range of PC client programs that use various methods to determine the IP address
currently assigned to a LANCOM . A change in IP address is communicated to the appropriate dynamic DNS server .
INTERNET
server
Router
PC
B
A
DynDNS client program
DynDNS provider
The current WAN-side IP address of a LANCOM can be read from the following address and entered into a client program:
411
Reference Manual
7 Routing and WAN -connections
http://<Address of the LANCOM>/config/1/6/8/3/
Dynamic-DNS client in the LANCOM via HTTP
Alternatively the LANCOM can transmit the current WAN IP to the DynDNS provider directly:
PC
INTERNET
LANCOMserver
DynDNS provider
An action is defined for this which, for example, automatically sends an HTTP request to the DynDNS server each time
a connection is established. The necessary information is transferred via the DynDNS account, so triggering an update
of the registration. An HTTP request of this type from DynDNS.org appears as follows:
1
http://Username:Password@members.dyndns.org/nic/update?system=dyndns&hostname=%h&myip=%a
The host name of the action and the LANCOM's current IP address are sent to an account at DynDNS.org as specified
by a username and password, and the appropriate entry is updated.
The settings necessary for this can be adjusted easily by using the Setup Wizards in LANconfig:
412
Reference Manual
7 Routing and WAN -connections
The Setup Wizard supplements the basic action with further provider-specific parameters, which are not described here.
Apart from that, the Setup Wizard creates additional actions that control the LANCOM in case the update does not
success the first time.
Dynamic-DNS client in the LANCOM via GnuDIP
As an alternative to using a simple HTTP request to update DynDNS information, some services make use of the GnuDIP
protocol. The GnuDIP protocol is based on a challenge-response mechanism:
1. The client opens the connection to the GnuDIP server.
2. The server responds with a random value calculated for the session.
3. The client uses the random value and the password to create a hash value, which is returned to the server.
4. The server checks this hash value and reports its result by sending a number back to the client.
The GnuDIP protocol can exchange the messages between the client and server either via a simple TCP connection
(standard port 3495) or as a CGI script running on an Internet server. The version using an HTTP request from a CGI
script has the advantage that no additional ports have to be opened on the GnuDIP, and also that HTTP offers protection
from passive interception and offline dictionary attacks.
Requests to a GnuDIP server are triggered by the LANCOM with an action in the following form:
1
gnudip://<srv>[:port][/path]?<parameter>
2
<srv> – The GnuDIP server address.
2
[:port] – Specifiying the port is optional. If it is not defined, default values are taken instead (3945 for TCP, 80
or 443 for HTTP/HTTPS).
2
[/path] – Path information is only required by HTTP/HTTPS to define the location where the CGI script is stored.
The following parameters are extensions to the request:
2
method=<tcp|http|https> – Selects the protocol to be used for the transmission between the GnuDIP server and
client. Only one protocol can be selected here.
2
user=<username> – Specifies the user name for the account on the GnuDIP server.
2
pass=<password> – Specifies the password for the account on the GnuDIP server.
2
domn=<domain> – Specifies the DNS domain containing the DynDNS entry.
2
reqc=<0|1|2> – Defines the action that is triggered by the request. Action <0> sends the server a dedicated IP
address that is to be used for the update. Action <1> deletes a DynDNS entry. Action <2> triggers an update,
although no IP address is transmitted to the server. Instead, the server carries out the update with the IP address
of the GnuDIP client.
2
addr=<address> – Specifies the IP address that an action with the parameter <0> is to use for updating the
DynDNS entry. If this is unspecified in a <0> action, the request is treated as a <2> action.
With the GnuDIP protocol, the host name that is to be registered corresponds to the user name sent to the server.
If, for example, the username is "myserver" and the DNS domain is "mydomain.org", then the DNS name
"myserver.mydomain.org" is registered.
For example, the following action executed via the GnuDIP protocol updates the DynDNS entry at a DynDNS provider
with the current IP address of the LANCOM (%a) as soon as a connection is established:
2
gnudip://gnudipsrv?method=tcp&user=myserver&domn=mydomain.org &pass=password&reqc=0&addr=%a
Use the following action to delete a DynDNS entry, for example once the connection has been terminated:
2
gnudip://gnudipsrv?method=tcp&user=myserver&domn=mydomain.org &pass=password&reqc=1
The line-break is for legibility only and is not to be entered into the action.
In response ot the request, the GnuDIP server returns one of the following values to the GnuDIP client (assuming that
the connection between server and client was established):
1
0 – The DynDNS entry was updated successfully.
1
0:address – The DynDNS entry was successfully updated with the specified address.
413
Reference Manual
7 Routing and WAN -connections
1
1 – Authentication at the GnuDIP server failed.
1
2 – The DynDNS entry was deleted successfully.
These responses can be processed by the LANCOM's actions to trigger further actions if necessary.
7.19.3 Further example actions
Broken connection alert as an SMS to a mobile telephone
The placeholder %t allows the current time of an event to be incorporated into a message. For example, an alert about
the interruption of an important VPN connection can be sent by e-mail or as an SMS to a system administrator's mobile
telephone.
The following requirements have to be met for messaging:
1
The status of the VPN connection must be monitored, for example by means of "dead-peer-detection" (DPD).
1
The LANCOM has to be configured as an NTP client in order to have the current system time.
1
An SMTP account must be set up for transmitting e-mails.
Once these requirements are fulfilled, messaging can be set up. This is done with a new entry in the action table; e. g.
with LANconfig under Communication / General / Action table.
Select the remote site for the relevant connection. As Condition select 'Broken' and enter the action as the transmission
of an e-mail.
mailto:admin@mycompany.com?subject=VPN connection broken at %t?body=VPN
connection to Subsidiary 1 was broken.
If the connection is broken, this action sends an e-mail to the administrator with the time of the event in the subject
line.
5
If the mail is sent to an appropriate Mail2SMS gateway the alert can be sent directly to a mobile telephone.
5
For complex scenarios with several subsidiaries, each of the remote sites is given a corresponding entry in the
central LANCOM. For monitoring the central device itself, an action is entered into a device at one of the
subsidiaries. In this way the administrator receives an alert even if the VPN gateway at the central location fails,
which could potentially prevent any messages from being transmitted.
Example: Suppress messaging in case of re-connects with a DSL connection
Some providers interrupt the DSL connection used for the VPN connections once every 24 hours. To avoid informing the
administrator of these regular interruptions, messaging can be disabled at the time when the re-connect occurs.
414
Reference Manual
7 Routing and WAN -connections
First of all an action is required to force the re-connect to occur at a fixed time; generally at night when the Internet
connection is not in use. The entry defines, for example, 03:00h and the Internet connection is broken with the command
do other/manual/disconnect internet.
With two more cron commands set /setup/wan/action-table/1 yes/no the corresponding entry in
the action table is switched off three minutes before 03:00h and switched on again three minutes after 03:00h. The
number 1 following the path to the action table is an index that stands for the first entry in the table.
7.19.4 Configuration
Changes with LCOS 7.6:
1
"Failure" as a condition for a change in status of the WAN connection
1
"Establish failure" as a condition for a change in status of the WAN connection
1
GnuDIP protocol support
With the action table you can define actions that are executed when the status of a WAN connection changes.
LANconfig: Communication / General / Action table
WEBconfig: Setup / WAN / Action table
1
Index
The index gives the position of the entry in the table, and thus it must be unique. Entries in the action table are
executed consecutively as soon as there is a corresponding change in status of the WAN connection. The entry in
the field "Check for" can be used to skip lines depending on the result of the action. The index sets the position of
the entries in the table (in ascending order) and thus significantly influences the behavior of actions when the option
"Check for" is used. The index can also be used to actuate an entry in the action table via a cron job, for example to
activate or deactivate an entry at certain times.
1
Active
Activates or deactivates this entry.
1
Host name
415
Reference Manual
7 Routing and WAN -connections
Action name. This name can be referenced in the fields "Action" and "Check for" with the place holder %h (host
name).
1
Remote site
A change in status of this remote site triggers the action defined in this entry.
1
Lock time (max. 10 characters)
Prevents this action from being repeated within the period defined here in seconds.
1
Condition
The action is triggered when the change in WAN-connection status set here occurs.
Possible values:
2
Establish – The action is triggered when the connection has been established successfully.
2
Disconnect – The action is triggered when the device itself terminates the connection (e.g. by manual disconnection
or when the hold time expires).
2
End – The action is triggered on disconnection (whatever the reason for this).
2
Failure – This action is triggered on disconnects that were not initiated or expected by the device.
2
Establish failure – This action is triggered when a connection establishment was started but not successfully
concluded.
1
Action (max. 250 characters)
Here you describe the action that should be executed when there is a change in the status of the WAN connection.
Only one action can be triggered per entry.
Possible values for the actions (max. 250 characters):
2
exec: – This prefix initiates any command as it would be entered at the Telnet console. For example, the action
“exec:do /o/m/d” terminates all current connections.
2
dnscheck: – This prefix initiates a DSN name resolution. For example, the action “dnscheck:myserver.dyndns.org”
requests the IP address of the indicated server.
2
http: – This prefix initiates an HTTP-get request. For example, you can use the following action to execute a
DynDNS update at dyndns.org:
http://username:password@members.dyndns.org/nic/update?system=dyndns&hostname=%h&myip=%a The
meaning of the place holders %h and %a is described below.
2
https: – Like “http:”, except that the connection is encrypted.
2
gnudip: – This prefix initiates a request to the corresponding DynDNS server via the GnuDIP protocol. For example,
you can use the following action to use the the GnuDIP protocol to execute a DynDNS update at a DynDNS
provider: gnudip://gnudipsrv?method=tcp&user=myserver&domn=mydomain.org
&pass=password&reqc=0&addr=%a The line-break is for legibility only and is not to be entered into the action.
The meaning of the place holder %a is described below.
2
repeat: – This prefix together with a time in seconds repeats all actions with the condition "Establish" as soon
as the connection has been established. For example, the action "repeat:300" causes all of the establish actions
to be repeated every 5 minutes.
2
mailto: – This prefix causes an e-mail to be sent. For example, you can use the following action to send an e-mail
to the system administrator when a connection is terminated: mailto:admin@mycompany.de?subject=VPN
connection broken at %t?body=VPN connection to Branch Office 1 was terminated.
Optional variables for the actions:
2
%a – WAN IP address of the WAN connection relating to the action.
2
%H – Host name of the WAN connection relating to the action.
2
%h – Like %H, except the hostname is in small letters
2
%c – Connection name of the WAN connection relating to the action.
2
%n – Device name
2
%s – Device serial number
416
Reference Manual
7 Routing and WAN -connections
2
%m – Device MAC address (as in Sysinfo)
2
%t – Time and date in the format YYYY-MM-DD hh:mm:ss
2
%e – Description of the error that was reported when connection establishment failed.
The result of the actions can be evaluated in the "Check for" field.
Default:
2
Blank
1
Check for
The result of the action can be evaluated here to determine the number of lines to be skipped in the processing of
the action table.
Possible values for the actions (max. 50 characters):
2
contains= – This prefix checks if the result of the action contains the defined string.
2
isequal= – This prefix checks if the result of the action is exactly equal to the defined string.
2
?skipiftrue= – This suffix skips the defined number of lines in the list of actions if the result of the "contains" or
"isequal" query is TRUE.
2
?skipiffalse= – This suffix skips the defined number of lines in the list of actions if the result of the "contains" or
"isequal" query is FALSE.
Optional variables for the actions:
2
As with the definition of the action.
Example:
2
A DNS check queries the IP address of an address in the form "myserver.dyndns.org". The check
“contains=%a?skipiftrue=2” allows the two following entries in the action table to be skipped if the IP address
found by the DNS check agrees with the current IP address (%a) of the device.
1
Owner
Owner of the action. The exec actions are executed with the rights of the owner. If the owner does not have the
necessary rights (e.g. administrators with write access) then the action will not be carried out.
7.20 Using the serial interface in the LAN
7.20.1 Introduction
In the IT field, COM port servers (also known as serial port servers) are devices that transport data between TCP and
serial connections. There are many applications.
1
Networking of devices with a serial interface but without a network interface.
1
Remote maintenance of devices that can only be configured via a serial interface.
1
Virtual extension of a serial connection between two devices with serial interfaces over a network.
Most LANCOM devices feature a serial interface that can be used to carry out configurations or to connect to a modem.
In some cases the interface is used for neither of these scenarios, and yet a COM port server is required in the vicinity
of the device. In such cases the LANCOM can use its serial interface as a COM port server, thus saving the costs for an
external COM port server. If this application focuses on the serial configuration interfaces of these devices, additional
serial interfaces can be provided by some models in combination with suitable CardBus or USB adapters. This enables
multiple instances of the COM port server to be operated in one device.
417
Reference Manual
7 Routing and WAN -connections
7.20.2 Operating modes
A COM port server has two operating modes:
1
Server mode: The COM port server waits for requests from a defined TCP port to establish TCP connections. The mode
is used for remote maintenance, for example.
1
Client mode: As soon as a device connected to the serial interface becomes active, the COM port client opens a TCP
connection to a preset remote site. This operating mode is used, for example, for devices that have just one serial
interface but requiring network access.
In both of these cases a transparent connection is set up between the serial interface and the TCP connection. Data
packets received at the serial interface are forwarded to the TCP connection, and vice versa. A common server-mode
application is to install a virtual COM port driver at the remote site which connects to the COM port server. Drivers of
this type allow applications running at the remote site to use the TCP connection as if it were an additional COM port.
The IETF RFC 2217 standard sets down the Telnet WILL/DO protocol extensions, which transmit the negotiations for the
serial connection (bitrate, data and stop bits, handshake) to the COM port server. The use of this protocol is optional,
so practical default values can be set in the COM port server.
7.20.3 Serial interface configuration
The serial interfaces in the LANCOM can be used for various applications, for example for the COM port server or as a
WAN interface. The Devices table allows individual serial devices to be assigned to certain applications. As soon as a
HotPlug-capable USB adapter is detected, a new entry for the serial interface provided by this USB adapter is created
automatically in this table. This automation simplifies the configuration of the serial devices. An exception is the built-in
serial interface, which is used for configuration purposes as standard. Entries can be added to the Devices table manually
to use this interface for the COM port server or WAN applications.
LANconfig: COM ports / Devices / Device operating mode
WEBconfig: Setup / COM-Ports / Devices
1
Device type
418
Reference Manual
7 Routing and WAN -connections
Selects a serial interface from the list of those available in the device.
1
Service
Activation of the port in the COM port server.
7.20.4 Configuring the COM port server
Configuring the COM port server involves three tables. What all three tables have in common is that a certain port at a
serial interface is identified by the values for device type and port number. Because some serial devices such as a CardBus
card have multiple ports, the port to be used must be specified explicitly. For a device with just one port, such as with
the serial configuration interface, the port number is set to zero.
Operational settings
This table activates the COM port server at a port of a certain serial interface. Add an entry to this table to start a new
instance of the COM port server. Delete an entry to stop the corresponding server instance. The switch Operating can
be used to deactivate a server instance in the table.
When a server instance is created or activated, the other tables in the COM port configuration are searched for matching
device type and port number values. If no suitable entry is found, the server instance takes workable default values.
LANconfig: COM ports / Server / Device ports
WEBconfig: Setup / COM-Ports / COM-Port-Server / Devices
1
Device type
Selects a serial interface from the list of those available in the device.
1
Port number
Some serial devices such as the CardBus have more than one serial port. Enter the number of the port on the serial
interface that is to be used for the COM-port server.
419
Reference Manual
7 Routing and WAN -connections
1
Operating
Activates the COM port server on the selected port of the selected interface.
COM-port settings
This table contains the settings for data transmission over the serial interface.
5
Please note that all of these parameters can be overwritten by the remote site if the RFC2217 negotiation is
active. Current settings can be viewed in the status menu.
LANconfig: COM ports / Server / Serial interface
WEBconfig: Setup / COM-Ports / COM-Port-Server / COM-Port-Settings
1
Device type
Selects a serial interface from the list of those available in the device.
1
Port number
Some serial devices such as the CardBus have more than one serial port. Enter the number of the port on the serial
interface that is to be used for the COM-port server.
1
Bitrate
Bitrate used on the COM port
1
Data bits:
Number of data bits.
1
Parity
420
Reference Manual
7 Routing and WAN -connections
The checking technique used on the COM port.
1
Stop bits
Number of stop bits.
1
Handshake
The data-flow control used on the COM port.
1
Ready condition
The ready condition is an important property of any serial port. The COM port server transmits no data between the
serial port and the network if the status is not "ready". Moreover, the transition from the "ready" to the "not ready"
states is used to establish and cancel TCP connections in client mode. There are two ways of determining whether
the port is ready or not. In DTR mode (default) only the DTR handshake is monitored. The serial interface is considered
to be ready for as long as the DTR line is active. In data mode, the serial interface is considered to be active for as
long as it receives data. If no data is received during the timeout period, the port reverts to its not-ready status.
1
Ready-Data-Timeout
The timeout switches the port back to the not-ready status if not data is received. This function is deactivated when
timeout is set to zero. In this case the port is always ready if the data mode is selected.
Network settings
This table contains all settings that define the behavior of the COM port in the network.
5
Please note that all of these parameters can be overwritten by the remote site if the RFC2217 negotiation is
active. Current settings can be viewed in the status menu.
421
Reference Manual
7 Routing and WAN -connections
LANconfig: COM ports / Server / Network interface
WEBconfig: Setup / COM-Ports / COM-Port-Server / Network settings
1
Device type
Selects a serial interface from the list of those available in the device.
1
Port number
Some serial devices such as the CardBus have more than one serial port. Enter the number of the port on the serial
interface that is to be used for the COM-port server.
1
TCP mode
Each instance of the COM port server in server mode monitors the specified listen port for incoming TCP connections.
Just one active connection is permitted per instance. All other connection requests are refused. In client mode, the
instance attempts to establish a TCP connection via a defined port to the specified remote site, as soon as the port
is ready. The TCP connection is closed again as soon as the port becomes unavailable. In both cases a LANCOM
closes any open connections when the device is restarted.
1
Listen port
The TCP port where the COM port in TCP server mode expects incoming connections.
1
Connect host name
The COM port in TCP client mode establishes a connection to this host as soon as the port is in "Ready" status.
1
Connect port
The COM port in TCP client mode uses this TCP port to establish a connection as soon as the port is in "Ready" state.
1
Loopback address
The COM port can be reached at this address. This is its own IP address that is given as the source address when
establishing connections. This is used to define the IP route to be used for the connection.
1
RFC2217 extensions
The RFC2217 extensions can be activated for both TCP modes. With these extensions activated, the LANCOM uses
the IAC DO COM-PORT-OPTION sequence to signal that it will accept Telnet control sequences. The COM port
subsequently works with the corresponding options; the configured default values are overwritten. The port also
attempts to negotiate the local echo and line mode for Telnet. Using the RFC2217 extensions with incompatible
remote sites is not critical. Unexpected characters may be displayed at the remote site. A side effect of using the
FRC2217 extensions may be that the port regularly carries out an alive check as Telnet NOPs are transmitted to the
remote site.
422
Reference Manual
7 Routing and WAN -connections
7.20.5 WAN device configuration
The table with WAN devices is a status table only. All Hotplug devices (connected via USB or CardBus) enter themselves
into this table.
LANconfig: COM ports / WAN / Device operating state
WEBconfig: Setup / COM ports / WAN / Devices
1
Device type
List of serial interfaces available in the device.
1
Active
Status of connected device:
7.20.6 Serial connection status information
Various statistics and status values are recorded for every instance of the COM-port server. The serial port using the
instance is indicated in the first two columns of the table—the values for device type and port number as entered during
the configuration are displayed here.
Network status
Telnet: Status / COM-Ports / COM-Port-Server / Network status
This table contains information on current and recent TCP connections.
1
Device type
List of serial interfaces available in the device.
1
Port number
423
Reference Manual
7 Routing and WAN -connections
The port number used for the COM port server on the serial interface.
1
Connection status
Possible values:
2
Connected: An active connection exists (server or client mode).
2
Listening: This instance is working in server mode; no TCP connection is currently active.
2
Not listening: In server mode, the specified TCP port could not be reserved for inbound connections, e.g. because
it is already occupied by another application.
2
Blank: This instance is working in client mode and the port is not ready. No TCP connection will be established
now.
2
Transfer: The port has reached the "ready" state; a connection is being established.
1
Last error
In client mode this displays the reason for the last connection error. In server mode this value has no significance.
1
Remote address:
Displays the IP address of the remote site for a successful TCP connection.
1
Local port
Displays the local TCP port used for a successful TCP connection.
1
Remote port
Displays the remote TCP port used for a successful TCP connection.
COM-port status
This table displays the serial port status and the settings currently used by this port.
1
Device type
List of serial interfaces available in the device.
1
Port number
The port number used for the COM port server on the serial interface.
1
Port status
2
Possible values: Not available: The serial port is currently not available to the COM port server, for example
because the USB or CardBus adapter has been removed or because it is being used by other functions in the
LANCOM. Not ready: The serial port is available to the COM port server but is currently not ready for data transfer,
for example because the DTR line is inactive. In the client state, no attempt is made to establish a connection as
long as the port is in this state. Ready: The serial port is available and ready for data transfer. In the client state,
an attempt is made to establish a TCP connection as soon as the port is in this state.
5
Please note that the port status is relevant in server mode, too. All TCP connection requests are accepted,
although the COM port instance will only transfer data between the serial port and the network when the
serial port has reached the "ready" state. The following columns display the settings that are currently in use
on the serial port. These are either the values as configured or as set by the negotiations via the RFC2217
extensions.
1
Bitrate
Bitrate used on the COM port
1
Data bits:
Number of data bits.
1
Parity
The checking technique used on the COM port.
424
Reference Manual
7 Routing and WAN -connections
1
Stop bits
Number of stop bits.
1
Handshake
The data-flow control used on the COM port.
Byte counters
This table displays the inbound and outbound data packets at the serial port and on the network side.
5
These values are not reset when the connection is opened or closed.
1
Device type
List of serial interfaces available in the device.
1
Port number
The port number used for the COM port server on the serial interface.
1
Serial-Tx
Number of bytes sent over the serial interface.
1
Serial-Rx
Number of bytes received over the serial interface.
1
Network-Tx
Number of bytes sent to the network.
1
Network-Rx
Number of bytes received from the network.
Port-Errors
This table displays the serial port errors. These errors may indicate a faulty cable or errors in the configuration.
1
Device type
List of serial interfaces available in the device.
1
Port number
The port number used for the COM port server on the serial interface.
1
Parity errors
Number of errors due to a checksum mismatch.
1
Framing errors
Number of erroneous data packets.
Connections
This table displays successful and failed TCP connections in both server mode and client mode.
1
Device type
List of serial interfaces available in the device.
1
Port number
The port number used for the COM port server on the serial interface.
1
Server granted
425
Reference Manual
7 Routing and WAN -connections
Number of connections granted by the COM port server.
1
Server rejected
Number of connections rejected by the COM port server.
1
Client succeeded
Number of connections successfully established by the COM port client.
1
Client DNS error
Number of connections that the COM port client could not establish due to DNS errors.
1
Client TCP error
Number of connections that the COM port client could not establish due to TCP errors.
1
Client-remote disconnects
Number of connections where the COM port was disconnected from the remote site.
Delete values
This action deletes all values in the status tables.
7.20.7 COM-port adapters
Devices with serial interfaces can be connected to a LANCOM in the following ways:
LANCOM devicesAdapter
All those with a serial configuration interfaceCOM-port adapters
All those with a USB interfaceUSB serial adapter
All those with a CardBus slotCardBus serial adapter
All those with a serial configuration interfaceLANCOM modem adapter kit
The COM port adapter must be a two-way D-sub plug with the following PIN assignment:
PinSignalSignalPin
3TxDRxD2
2RxDTxD3
6DSRDTR4
5GNDGND5
4DTRDSR6
8CTSRTS7
7RTSCTS8
7.20.8 Addition(s) to LCOS 7.80
Serial COM-port enhancements
Introduction
The COM-port configuration has been enhanced with a number of parameters.
426
Reference Manual
7 Routing and WAN -connections
Configuration
The additional parameters are located in the network settings for the COM port.
WEBconfig: LCOS menu tree / Setup / COM ports / COM-port server / Network settings
1
Assume binary mode
Some network devices connected to a serial COM port transmit data structures which may be interpreted as control
characters (CR/LF – carriage return / line feed). In the default setting, the COM-ports in LANCOM devices process
this information to control the data flow. "Binary mode" instructs a COM port to forward the data in binary format
and ignore any control characters.
Possible values:
2
Yes, No.
Default:
2
No.
1
Newline conversion
Here you select the character to be output by the serial port when binary mode is activated.
This setting is independent of the application communicating via the serial port. If the port is connected to another
LANCOM device, you can either enter CRLF here or just CR. This is because the outband interface of these devices
expects a "carriage return" for the automatic determination of data-transfer speed. However, some Unix applications
interpret CRLF as a prohibited double line feed character. In these cases enter either CR or LF.
Possible values:
2
CRLF, CR, LF
Default:
2
CRLF
5
This setting is only relevant if binary mode is deactivated for this port.
1
TCP keepalive
The RFC 1122 sets down a method of checking the availability of TCP connections, called TCP keepalive. An inactive
transmitter queries the receive status from the remote station. If the TCP session to the remote site is available, then
the remote responds with its receive status. If the TCP session to the remote site is not available, then the query is
repeated for as long as it takes for the remote to respond with its receive status (after which a longer interval comes
into play). As long as the basic connection functions, but the TCP session to the remote station is not available, then
the remote station sends an RST packet which triggers the establishment of the TCP session by the requesting
application.
Possible values:
2
Inactive: TCP keepalive is not used.
2
Active: TCP keepalive is active; only RST packets cause the disconnection of TCP sessions.
2
Proactive: TCP keepalive is active, but the request for the receive status from the remote site is only repeated for
the number of times defined under "TCP retry count". If this number of requests expires without a response with
the receive status, then the TCP sessions is classified as "not available" and the application is informed. If an RST
packet is received during the wait time, the TCP session will be disconnected prematurely.
Default:
2
Inactive
5
The setting "active" is recommended for server applications.
427
Reference Manual
7 Routing and WAN -connections
1
TCP keepalive interval
This value defines the interval between sending requests for receive status if the first request is not affirmed. The
associated timeout is defined as being interval/3 (max. 75 sec.).
Possible values:
2
Maximum 10 characters
Default:
2
0
Special values:
2
0 activates the RFC 1122 default values (interval 7200 seconds, timeout 75 seconds).
1
TCP retransmit timeout
Maximum time for the retransmission timeout. This timeout defines the the interval between checking TCP-connection
status and reporting the result to the application using the TCP connection.
Possible values:
2
0 to 99 seconds.
Special values:
2
0 activates the RFC 1122 default value (60 seconds).
Default:
2
0
5
The maximum duration of the TCP-connection check is the product of TCP-retransmit-count and TCP-retry-count.
The TCP application is only informed after the timeout for all attempts has expired. With the default values
of 60 seconds timeout and max. 5 attempts, it can take up to 300 seconds before the application is informed
about an inactive TCP connection.
1
TCP retry count
The maximum number of attempts for checking TCP-connection status and reporting the result to the application
using the TCP connection.
Possible values:
2
0 to 9
Special values:
2
0 activates the RFC 1122 default value (5 attempts).
Default:
2
0
5
The maximum duration of the TCP-connection check is the product of TCP-retransmit-count and TCP-retry-count.
The TCP application is only informed after the timeout for all attempts has expired. With the default values
of 60 seconds timeout and max. 5 attempts, it can take up to 300 seconds before the application is informed
about an inactive TCP connection.
428
Reference Manual
7 Routing and WAN -connections
7.21 Addition(s) to LCOS 7.80
7.21.1 Routing of local services/ARP handling switchable
Introduction
Response packets for internal services (such as telnet, http/https, tftp, etc.) from the LANCOM to recipients in the Ethernet
(LAN or WAN) were, prior to LCOS version 7.80, always sent directly to the corresponding requester. This meant, among
other things, that devices could be detected from within any LAN.
As of LCOS version 7.80, a switch provides the option to initiate an ARP request to determine a specific route, instead
of using the direct address.
If, for example, a LANCOM router should be detected by LANconfig without any knowledge of the LAN topology, then
the older method would be preferable. In this case, the sender of the TFTP broadcast (in this case LANconfig/device
search) receives a direct unicast response from the router.
In scenarios where LANs use changing virtual MAC and IP addresses (e.g. when VRRP components are used in the LAN),
direct addressing may lead to errors if the redundancy protocol has adjusted the MAC/IP assignments. In such cases it
is preferable to activate the "route internal services" option.
Configuration
The appropriate settings for IP routing can be used to route the LANCOM's internal services via the router.
WEBconfig: LCOS menu tree / Setup / IP router / Routing method
1
Route internal services
This is where you select whether the internal services are to be directed via the router.
Possible values:
2
Yes: Packets for internal services are directed via the router.
2
No: Packets are returned straight to the sender.
Default:
2
No
7.22 Addition(s) to LCOS 8.20
7.22.1 VDSL
Introduction
Some of the models in the LANCOM series of routers are equipped with a VDSL interface, which offers much higher
data-transmission speeds than ADSL2+.
5
Required for this is a VDSL2 connection as per ITU G.993.2.
429
Reference Manual
7 Routing and WAN -connections
Configuration
To configure the operation of VDSL, the VDSL interface and the remote station are set up with the help of the corresponding
WAN layers.
Follow these steps to prepare the device for VDSL2-based data communications:
1. Under /Setup/Interfaces/VDSL, set the VDSL-interface protocol to the VDSL protocol or automatic protocol selection.
2. Optionally: Go to /Setup/WAN/Layer and define a new WAN layer with the value "VDSL" in the field
"Lay-1".Alternatively, you can use one of the predefined WAN layers for VDSL operation.
3. Under /Setup/WAN/DSL broadband peers, define a new remote site that uses the new WAN layer or one of the
predefined WAN layers for VDSL operation.
5
Setting the values "ATM-VPI" and "ATM-VCI" is meaningless for VDSL operation.
Predefined WAN layer for VDSL
Devices with VDSL interfaces have predefined WAN layers for the configuration of the remote peers.
You can find the WAN layers under /Setup/WAN/Layer. The WAN layers for VDSL operation are set to the value "VDSL"
in the "Lay-1" field.
Lay-1L2-Opt.Lay-2Lay-3Encaps.WAN layer
VDSLNonePPPoEPPPTRANST-VDSL
VDSLNonePPPoEPPPTRANSPPPOEOV
VDSLNoneTRANSTRANSETHERIPOEOV
VDSLNoneTRANSDHCPETHERDHCPOEOV
4
The abbreviation *OEOV stands for "over Ethernet over VDSL".
2.2.4.6 Layer 1
In this field the lower section of the security layer (Data Link Layer) is configured.
Telnet path: /Setup/WAN/Layer
Possible values:
1
AAL-5: ATM adaptation layer
1
ETH: Transparent Ethernet as per IEEE 802.3.
1
HDLC64K: Securing and synchronization of data transmission as per HDLC (in 7 or 8-bit mode).
1
HDLC56K: Securing and synchronization of data transmission as per HDLC (in 7 or 8-bit mode).
1
V110_9K6: Transmission as per V.110 at max. 9,600 bps, e.g. for dialing in by HSCSD mobile phone
1
V110_19K2: Transmission as per V.110 at max. 19,200 bps
1
V110_38K4: Transmission as per V.110 at max. 38,400 bps
1
Serial: For connections by analog modem or cellular modem with AT interface. The modem can be connected to the
device at its serial interface (outband) or to a USB interface by means of a USB-to-serial adapter. Some models feature
a CardBus slot that accommodates suitable cards. Some models have an internal integrated modem.
1
Modem: For connections via the internal modem emulation when operating as a V.90 host modem over ISDN.
Operation of the internal modem may require an additional software option for the device.
1
VDSL: VDSL2 data transmission as per ITU G.993.2
Default: HDLC64K
430
Reference Manual
7 Routing and WAN -connections
5
The range of available values depends on the hardware model at hand.
2.23.8 VDSL
This table contains an entry for each VDSL interface available in the device with the choice of protocol.
Telnet path: Setup/Interfaces/
2.23.8.1 Interface
Select a VDSL interface for configuration.
Telnet path: /Setup/Interfaces/VDSL
Possible values:
1
Select from the VDSL interfaces available in the device.
2.23.8.2 Protocol
This item allows you to select the protocol for the VDSL interface.
Telnet path: /Setup/Interfaces/VDSL
Possible values:
1
Auto: VDSL and all ADSL modes
1
VDSL: VDSL only
1
ADSL: All ADSL modes
1
ADSL2+: ADSL2+ (G.992.5) only
1
ADSL2: ADSL2 (G.992.3) only
1
ADSL1: G.DMT (G.992.1) and also T1.413 with Annex-A
Default: Auto
VDSL traces
The following traces enable you to check the status of the VDSL connections:
1
trace + VDSL-Status: Information on the state of the VDSL connection.
1
trace + VDSL-Data: Information about data communications over the VDSL connection.
1
trace + VDSL-CTRL: Information on the communications between LCOS and the integrated VDSL modem.
1
trace + VDSL: Starts all VDSL traces at once.
VDSL status messages
The following tables contain the status messages relating to VDSL operation:
1
The tables /Status/Connection, /Status/Info connection, /Status/Layer connection, /Status/Call information and
/Status/Channel, and also various other tables under /Status/WAN and /Status/PPP, contain information about the
device's connections. The interface referred to by these tables is indicated in the "Ifc" field. A connection in VDSL
mode is indicated by "Ifc" fields containing the values "VDSL-1" to "VDSL-8". In case of error, the channel statistics
contain the value "VDSL-ERR".
1
The layer-1 setting being used is indicated by the entries in the field "Lay-1" of the table /Status/Layer connection.
A connection in VDSL mode is indicated by the value "VDSL" in the "Lay-1" field.
The VDSL status messages are described in separate sections.
431
Reference Manual
7 Routing and WAN -connections
1.75 VDSL
This menu contains the following values for information about VDSL operation:
1
Line status
1
Line type
1
VDSL profile
1
Standard
1
ATM-VPI
1
ATM-VCI
1
ATM mux mode
1
Downstream rate (kbps)
1
Upstream rate (kbps)
1
Downstream SNR (dB)
1
Upstream SNR (dB)
1
Downstream attenuation (dB)
1
Upstream attenuation (dB)
1
INP downstream symbols
1
INP upstream symbols
1
Interleave downstream (ms)
1
Interleave upstream (ms)
1
Attainable downstream data rate (kbps)
1
Attainable upstream data rate (kbps)
1
DSLAM chip set vendor
1
DSLAM vendor
1
DSLAM version
1
DSLAM serial number
Telnet path: /Status
5
The command "retrain" triggers a resynchronization of the VDSL interface.
1.75.12 Connection history
This table contains information about current VDSL connections and previous VDSL connections since the device was
last booted. It has the following columns:
1
Index
1
Sync time
1
Disconnect time
1
Standard
1
VDSL profiles
1
Reason
1
DS data rate
1
US data rate
1
DS-SNR
1
US-SNR
1
DS attenuation
1
US attenuation
Telnet path: /Status/VDSL/
432
Reference Manual
7 Routing and WAN -connections
1.75.25 Advanced
This menu contains the following values for advanced information about VDSL operation:
1
Line state
1
Standard
1
VDSL profiles
1
DSLAM chip set manufacturer
1
DSLAM manufacturer
1
DSLAM version
1
DSLAM serial number
1
DS data rate (kbps)
1
DS attainable data rate (kbps)
1
DS SNR margin (dB)
1
DS line attenuation (dB)
1
DS INP symbols
1
DS interleave (ms)
1
DS CRC errors
1
DS FEC errors
1
DS ATM HEC errors
1
DS data path CRCP errors
1
DS data path CRCnp errors
1
DS data path CVP errors
1
DS data path CVnp errors
1
DS ATM idle bit errors
1
DS received ATM cells
1
US data rate (kbps)
1
US attainable data rate (kbps)
1
US SNR margin (dB)
1
US line attenuation (dB)
1
US INP symbols
1
US interleave (ms)
1
US CRC errors
1
US FEC errors
1
US ATM HEC errors
1
US data path CRCp errors
1
US data path CRCnp errors
1
US data path CVp errors
1
US data path CVnp errors
1
US ATM idle bit errors
1
US received ATM cells
1
Transmitted ATM cells
Telnet path: /Status/VDSL/
5
The command "retrain" triggers a resynchronization of the VDSL interface.
1.75.500 Modem
This menu contains the following values for information about the status of the integrated VDSL modem:
1
Modem status
433
Reference Manual
7 Routing and WAN -connections
1
Options
1
Memory test
1
Link
1
Last error
1
VDSL firmware
1
ADSL POTS firmware
1
ADSL ISDN firmware
1
DSL API version
1
DSP firmware version
1
Hardware version
1
Chip set type
1
Driver version
Telnet path: /Status/VDSL/
5
You can restart the integrated VDSL modem with the command "reboot modem".
7.23 Addition(s) to LCOS 8.80
7.23.1 Default mode in the DSLoL interface
As of LCOS version 8.80, the DSLoL interface is set to the default mode 'Exclusive'.
Additions to the Setup menu
Mode
This item selects the mode in which the WAN interface is operated. In automatic mode, all PPPoE frames and all data
packets belonging to a connection established over the DSLoL interface (as configured in the IP parameter list) are routed
via the DSLoL interface (WAN). All other data packets are treated as normal LAN packets. In exclusive mode, the LAN
interface operates as a WAN interface only.
Telnet path:
Setup > Interfaces > DSLoL-Interface
Possible values:
Auto
Exclusive
Default:
Exclusive
434
Reference Manual
7 Routing and WAN -connections
7.24 Addition(s) to LCOS 8.84
7.24.1 Volume budget
As of LCOS 8.84 the device records the volume of data sent and received over all WAN interfaces. This may be useful if
you wish to react to throttled data rates, for example.
Data volumes on the WAN interface
Depending on your tariff plan, mobile or landline operators may activate bandwidth throttling if a certain data volume
is exceeded, also for flatrate plans. The device captures the amount of data sent over each WAN interface, archives the
values for up to 12 months, and can perform actions when a specified threshold is reached. The budgets also apply to
VPN, PPTP, or all other kinds of connection.
At the change of the month, the device archives the data for the previous month and resets the counter to zero for the
current month. You can view the current data volume and the archived information in LANmonitor or in the WEBconfig
status menu.
The archive contains data from the last 12 months. In the 13th month, the device automatically overwrites the archive
data of the 1st month.
5
Currently, this feature is only available for the following device types and series:
LANCOM L-45x series
1
1
LANCOM 1781 series
1
LANCOM 1780EW-3G, 1780EW-4G
1
LANCOM WLC-4006+, WLC-4025+, WLC-4100
1
LANCOM 7100 VPN, 7100+ VPN, 9100 VPN, 9100+ VPN
1
LANCOM IAP-321, IAP-321-3G, IAP-3G
1
LANCOM OAP-322, OAP-321, OAP-321-3G, OAP-3G
Configuring data volume budgets
The following section describes how you can use LANconfig to manage the data volumes exchanged with remote stations.
1. Start LANconfig with Start > Programs > LANCOM > LANconfig and open the configuration of the device for
which you want capture the data volumes.
For information on configuring devices with LANconfig refer to the LCMS section of the Reference Manual.
2. In the configuration dialog, navigate to the item Management > Budget.
If the device should send an e-mail when your data volume is exceeded, you can enter the required address into the
field E-mail address.
435
Reference Manual
7 Routing and WAN -connections
3. Click on Volume budgets and then on Add.
The item Peer lets you select the remote station which requires a volume budget. With Select you can choose from
the available remote stations or manage new ones.
Specify the data volume in the Budget field. In most cases this value is the permitted data volume specified by the
provider before the data rate is throttled.
Further, you can specify actions that the device should perform when the budget is reached:
1
Send SYSLOG notification: The device stores a SYSLOG message (with the flag "Critical") that you can analyze
with LANmonitor or a special SYSLOG client.
1
Send e-mail notification: The device sends a message to the e-mail address that you specified above.
1
Disconnect: The device disconnects from the remote station.
5
The disconnect action activates the charge limiter. The device can no longer connect to this remote until
the end of the month unless you increase the volume budget for this remote site.
You can also specify that the device should perform multiple actions. If they include the action disconnect, the
device performs this action as the last one.
4. Click OK to add this entry to the table, and then click OK to add the entries to the configuration of the device.
5. If data transfer to certain networks does not affect the volume budget for a remote site, you can exclude these
networks from the budgeting. To do this, click on Free networks and then on Add.
The item Peer lets you select the remote station which is to be excluded. With Select you can choose from the
available remote stations or manage new ones.
5
You can make multiple entries for each remote by suffixing the name of the remote station with the # character
and adding a number (e.g. "INTERNET", "INTERNET#1", "INTERNET#2", etc.). This is useful if you explicitly
wish to define an exception that is only temporarily active. When this exception is no longer valid, you delete
only the entry with the correspondingly numbered remote station.
In the Networks field you can specify IPv4 and IPv6 addresses and also whole networks in prefix notation (for
example "192.168.1.0/24"). Separate each entry with a comma. Here too you can add the # character and a digit
to the remote station name.
6. Click OK to add this entry to the table, and then click OK to add the entries to the configuration of the device.
7. You can set the day and time when the device should start each monthly billing period under Billing period.
436
Reference Manual
7 Routing and WAN -connections
8. If you want to change the preset values, select the line containing the peer named "*" and click on Edit; otherwise
click on Add.
The item Peer lets you select the remote station for which you want to set the time when the period starts. With
Select you can choose from the available remote stations or manage new ones.
5
You can use wildcards for the names of the remote stations. The wild card "*" in this case applies for all
remote stations.
In the fields Day, Hour and Minute you set the day of the month and the time at which the device resets the budget
for this peer.
5
By default the device resets the budget for all peers on the first day of the month at 00:00h.
5
If you enter the value "31" in the field Day, the device does not reset the budget in months with fewer days
(e.g. February or November).
9. Click OK to add this entry to the table, and then click OK to add the entries to the configuration of the device.
10. Finally click on OK to load the configuration into the device.
Additions to the Setup menu
Reset budgets
You can manually reset units, time and volume budgets.
Enter the name of the WAN connection as the parameter. You can reset all volume budgets with the parameter '*'. If
you do not specify a parameter, you reset only the unit- and time counters.
5
By resetting the current budget, you remove any charge limiter that may be in effect.
Telnet path:
Setup > Charges
Activate additional budget
Some providers allow you an additional data volume or time limit if your budget is reached. This action can be used to
increase the volume- or time budget by an appropriate amount.
Specify the name of the WAN connection as well as the amount of the budget in MB as additional parameters. If you
do not specify a budget, you approve the full amount of the budget specified for this WAN connection.
5
By activating an additional budget, you remove any charge limiter that may be in effect.
437
Reference Manual
7 Routing and WAN -connections
Telnet path:
Setup > Charges
Volume budgets
Depending on your tariff plan, mobile or landline operators may activate bandwidth throttling if a certain data volume
is exceeded, also for flatrate plans. This directory allows you to set a data volume for each remote station, and also to
define an action for the device to perform when this limit is exhausted.
Telnet path:
Setup > Charges
Peer
Name of the remote station for which this data volume applies.
Telnet path:
Setup > Charges > Volume-budgets
Possible values:
Select from the list of defined peers.
Max. 16 characters
Default:
Blank
Limit-MB
Data volume in megabytes that applies to the specified remote station.
Telnet path:
Setup > Charges > Volume-budgets
Possible values:
0 - 4294967295 MB
Max. 10 characters
Special values:
0: No monitoring of data volume
Default:
0
Action
Action to be executed by the device when the budget is exhausted. Possible actions are:
1
syslog: The device stores a SYSLOG message (with the flag "Critical") that you can analyze with LANmonitor or a
special SYSLOG client.
1
mail: The device sends a message to the e-mail address that you specified in Setup > Charges > Charging-Email.
1
disconnect: The device disconnects from the remote station.
438
Reference Manual
7 Routing and WAN -connections
5
The disconnect action activates the charge limiter. The device can no longer connect to this remote until
the end of the month unless you increase the volume budget for this remote site.
You can also specify that the device should perform multiple actions. If they include the action disconnect, the device
performs this action as the last one.
Telnet path:
Setup > Charges > Volume-budgets
Possible values:
SYSLOG
Mail
Disconnect
Default:
Blank
Free networks
If data transfer to certain networks does not affect the volume budget for a remote site, you can exclude these networks
from the budgeting.
Telnet path:
Setup > Charges
Peer
Name of the remote station for which this exception applies.
5
You can make multiple entries for each remote by suffixing the name of the remote station with the # character
and adding a number (e.g. "INTERNET", "INTERNET#1", "INTERNET#2", etc.). This is useful if you explicitly wish
to define an exception that is only temporarily active. When this exception is no longer valid, you delete only
the entry with the correspondingly numbered remote station.
Telnet path:
Setup > Charges > Free -Networks
Possible values:
Select from the list of defined peers.
Max. 20 characters
Default:
Blank
Free networks
This parameter allows you to specify individual IPv4- and IPv6 addresses, or even entire networks (using prefix notation,
for example "192.168.1.0/24"), which are exempt from the budget.
Telnet path:
Setup > Charges > Free -Networks
439
Reference Manual
7 Routing and WAN -connections
Possible values:
Valid IPv4- and IPv6 address(es), max. 100 characters. Multiple values can be provided in a comma-separated
list.
Default:
Blank
Budget control
This table defines when the monthly recordings should begin.
Telnet path:
Setup > Charges
Peer
Name of the remote station for which this time applies.
5
You can use wildcards for the names of the remote stations. The wild card "*" in this case applies for all remote
stations.
Telnet path:
Setup > Charges > Budget-Control
Possible values:
Select from the list of defined peers.
Max. 16 characters
Default:
Blank
Day
Day of the month for resetting the data-volume budget.
Telnet path:
Setup > Charges > Budget-Control
Possible values:
1 - 31
Default:
1
Hour
Hour of the day for resetting the data-volume budget.
Telnet path:
Setup > Charges > Budget-Control
440
Reference Manual
7 Routing and WAN -connections
Possible values:
0 - 23
Default:
0
Minute
Minute of the hour for resetting the data-volume budget.
Telnet path:
Setup > Charges > Budget-Control
Possible values:
0 - 59
Default:
0
Charging e-mail
If the device is to send an e-mail when the data volume is exhausted, you specify the e-mail address here.
Telnet path:
Setup > Charges
Possible values:
Valid e-mail address with a maximum of 255 characters.
Default:
Blank
Additions to the Status menu
Delete values
This action deletes all values in the charging statistics.
5
By resetting the current budget, you remove any charge limiter that may be in effect.
5
The archive table for recording the data volumes remains unaffected. Use the separate action Clear archive to
delete the contents of this table.
Telnet path:
Status > Charging
Volume budgets
This table stores the volume of data used for each remote station in the current time interval.
441
Reference Manual
7 Routing and WAN -connections
Telnet path:
Status > Charging
Peer
Name of the remote device
Data-MB
Data volume exchanged with the peer to date, in MB.
Data-KB
Data volume exchanged with the peer to date, in kB.
Limit-MB
Data budget for exchanging data with the peer in the current time interval.
Percent
Budget consumed at the current time in percent.
Flags
Note when the set limit is exhausted. The following values are possible:
1
Alarm not acknowledged: This indicates that LANmonitor has not yet acknowledged the alarm.
1
Limit exceeded: The data budget for this connection has been exceeded. The connection remains intact,
however.
1
Charge limiter: The data budget for this connection has been exceeded and the connection is interrupted
until the beginning of the next billing period.
Month
Month of the current recording interval.
Year
Year of the current recording interval.
Archive
This table stores the budget data saved over the last 12 months. In the 13th month, the device automatically overwrites
the archive data of the 1st month.
Telnet path:
Status > Charging
Peer
Name of the remote device
curr-Month
Displays the volume of data transmitted in the current month.
curr-Year
Displays the volume of data transmitted in the current year.
curr-Limit
Displays the data budget for the current time interval.
curr-Flags
Displays a notice when the data volume with the peer has been exceeded for the current recording period.
442
Reference Manual
7 Routing and WAN -connections
MB-<Month>
Displays the data volume recorded for the corresponding month in MB.
KB<Month>
Displays the data volume recorded for the corresponding month in kB.
Clear archive
This action deletes all entries in the archive.
Telnet path:
Status > Charging
Activate additional budget
Some providers allow you an additional data volume if your budget is reached. This action can be used to increase the
budget by an appropriate amount.
Specify the name of the WAN connection as well as the amount of the budget in MB as additional parameters. If you
do not specify a budget, you approve the full amount of the budget specified for this WAN connection.
5
By activating an additional budget, you remove any charge limiter that may be in effect.
Telnet path:
Status > Charging
Enhancements to LANconfig
Budget monitoring
Depending on your tariff plan, mobile or landline operators may activate bandwidth throttling if a certain data volume
is exceeded, also for flatrate plans. The device captures the amount of data sent over each WAN interface, archives the
values for up to 12 months, and can perform actions when a specified threshold is reached. The budgets also apply to
VPN, PPTP, or all other kinds of connection.
At the change of the month, the device archives the data for the previous month and resets the counter to zero for the
current month. You can view the current data volume and the archived information in LANmonitor or in the WEBconfig
status menu.
You can configure budget monitoring under Management > Budget.
443
Reference Manual
7 Routing and WAN -connections
If the device should send an e-mail when your data volume is exceeded, you can enter the required address into the
field E-mail address.
Volume budgets
To set a data volume for communications with a remote site, click on Volume budgets and then Add.
The item Peer lets you select the remote station which requires a volume budget. With Select you can choose from the
available remote stations or manage new ones.
Specify the data volume in the Budget field. In most cases this value is the permitted data volume specified by the
provider before the data rate is throttled.
Further, you can specify actions that the device should perform when the budget is reached:
1
Send SYSLOG notification: The device stores a SYSLOG message (with the flag "Critical") that you can analyze with
LANmonitor or a special SYSLOG client.
1
Send e-mail notification: The device sends a message to the e-mail address that you specified above.
1
Disconnect: The device disconnects from the remote station.
5
The disconnect action activates the charge limiter. The device can no longer connect to this remote until
the end of the month unless you increase the volume budget for this remote site.
You can also specify that the device should perform multiple actions. If they include the action disconnect, the device
performs this action as the last one.
Free networks
If data transfer to certain networks does not affect the volume budget for a remote site, you can exclude these networks
from the budgeting. To do this, click on Free networks and then on Add.
The item Peer lets you select the remote station which is to be excluded. With Select you can choose from the available
remote stations or manage new ones.
5
You can make multiple entries for each remote by suffixing the name of the remote station with the # character
and adding a number (e.g. "INTERNET", "INTERNET#1", "INTERNET#2", etc.). This is useful if you explicitly wish
to define an exception that is only temporarily active. When this exception is no longer valid, you delete only
the entry with the correspondingly numbered remote station.
In the Networks field you can specify IPv4 and IPv6 addresses and also whole networks in prefix notation (for example
"192.168.1.0/24"). Separate each entry with a comma. Here too you can add the # character and a digit to the remote
station name.
444
Reference Manual
7 Routing and WAN -connections
Billing period
You can set the day and time when the device should start each monthly billing period under Billing period.
The item Peer selects the remote station for which you want to set the time when the period starts. The Select button
lets you choose from the available peers or manage new peers.
5
You can use wildcards for the names of the remote stations. The wild card "*" in this case applies for all remote
stations.
In the fields Day, Hour and Minute you set the day of the month and the time at which the device resets the budget
for this peer.
5
By default the device resets the budget for all peers on the first day of the month at 00:00h.
5
If you enter the value "31" in the field Day, the device does not reset the budget in months with fewer days (e.g.
February or November).
Enhancements to LANmonitor
Show volume budget archive
Displays the volume budget archive of all WAN interfaces.
Budget analysis
Depending on your tariff plan, mobile or landline operators may activate bandwidth throttling if a certain data volume
is exceeded, also for flatrate plans. The device captures the amount of data sent over each WAN interface, archives the
values for up to 12 months, and can perform actions when a specified threshold is reached. The budget also apply to
VPN, PPTP, or all other kinds of connection.
445
Reference Manual
7 Routing and WAN -connections
At the change of the month, the device archives the data for the previous month and resets the counter to zero for the
current month. You can view the current data volume and the archived information in LANmonitor or in the WEBconfig
status menu.
By right-clicking on Volume budget, you can reset all of the displayed volume budgets or display the volume budget
archive.
You can right click on a WAN interface to reset its budget or unlock an additional volume budget.
7.24.2 Script variable for dynamic IPv6 addresses
As of LCOS version 8.84, the variable %a for dynamic IPv4 addresses in DynDNS scripts or action-table scripts is now
complemented by the variable %z for dynamic IPv6 addresses.
5
Using the variable %z requires that you specify the IPv6 address. If you do not supply an address, the device
will not execute the script.
446
Reference Manual
7 Routing and WAN -connections
New in the action table is the action prefix dnscheck6:, with which you initiate an IPv6 DNS name resolution. For
example, the action dnscheck6:myserver.dyndns.org requests the IPv6 address of the indicated server.
7.24.3 Assign actions from the action table of a WAN connection
As of LCOS 8.84, actions in the action table can be executed on certain types of WAN connections from the LANCOM.
Thus makes it possible, for example, for each WAN connection to use its own DynDNS provider.
Configuration
With the action table you can define actions that the LANCOM is to execute when the status of a WAN connection
changes.
In LANconfig, the action table is located under Communication > General > Action table
1
Entry active: Activates or deactivates this entry.
1
Name: Action name. This name can be referenced with the wildcard %h (hostname) in the fields Action and Result
check.
1
Remote site: A change in status of this remote site triggers the action defined in this entry.
1
Routing tag: You can use the routing tag to specify which remote site is used when the action is applied. Of course,
this site must be equipped with the appropriate routing tag.
1
Lock time: Prevents this action from being repeated within the period defined here in seconds (max. 10 characters).
1
Condition: Various changes in WAN-connection status can be set here, and the action is triggered when this condition
occurs. Possible values are:
2
Establish – the action triggers if the device has successfully established the connection.
2
Disconnect without failure – the action triggers if the device itself terminates the connection (e.g. through manual
disconnection or expiry of a holding time).
2
End (disconnect or broken) – the action triggers as soon as the connection terminates (regardless of the reason).
2
Establish failure – the action triggers if connection establishment was unsuccessful.
2
Volume budget exhausted – this action executes when the specified volume is reached.
2
Volume budget released – this action occurs after a state change from 'Volume exceeded' to 'Volume no longer
exceeded', e.g. when you reset an exceeded volume or when the device enters a new billing period. If the volume
has not been exceeded at the time of the reset, no action takes place.
1
Action: This item describes the action to be executed by the device when there is a change in the status of the WAN
connection. You can specify only one action per entry (max. 250 characters). Possible values are:
447
Reference Manual
7 Routing and WAN -connections
exec: – This prefix initiates any command as you would enter it at the Telnet console. For example, the action
exec:do /o/m/d terminates all current connections.
2
2
dnscheck: – This prefix initiates an IPv4 DSN name resolution. For example, the action
dnscheck:myserver.dyndns.org requests the IPv4 address of the indicated server.
2
dnscheck6: – This prefix initiates an IPv6 DSN name resolution. For example, the action
dnscheck6:myserver.dyndns.org requests the IPv6 address of the indicated server.
2
http: – This prefix initiates an HTTP-get request. For example, you can use the following action to execute a
DynDNS update at dyndns.org:
http://username:password@members.dyndns.org/nic/update?
system=dyndns&hostname=%h&myip=%a
(The line-break is for legibility only and is not to be entered into the action.) The meaning of the place holders
%h and %a is described below.
2
https: – Like http:, except that the connection is encrypted.
2
gnudip: – This prefix initiates a request to the corresponding DynDNS server via the GnuDIP protocol. For
example, you can use the following action to use the GnuDIP protocol to execute a DynDNS update at a DynDNS
provider:
gnudip://gnudipsrv?method=tcp&user=myserver&domn=mydomain.org&pass=password&reqc=0&addr=%a.
The meaning of the place holder %a is described below.
2
repeat: – This prefix together with a time in seconds repeats all actions with the condition "Establish" as
soon as the connection has been established. For example, the action repeat 300 causes all of the establish
actions to be repeated every 5 minutes.
2
mailto: – This prefix causes an e-mail to be sent. For example, you can use the following action to send an
e-mail to the system administrator as soon as a connection is terminated:
mailto:admin@mycompany.com?subject=VPN connection broken at
%t?body=VPN connection to branch office 1 was broken.
Optional variables for the actions:
3
%a – WAN IPv4 address of the WAN connection relating to the action.
5
Using the variable %z requires that you specify the IPv6 address. If you do not supply an address,
the device will not execute the script.
3
%z – WAN IPv6 address of the WAN connection relating to the action.
3
%H – Host name of the WAN connection relating to the action.
3
%h – Like %h, except the hostname is in small letters
3
%c – Connection name of the WAN connection relating to the action.
3
%n – Device name
3
%s – Device serial number
3
%m – Device MAC address (as in Sysinfo)
3
%t – Time and date in the format YYYY-MM-DD hh:mm:ss
3
%e – Description of the error that was reported when connection establishment failed.
You can inspect the outcome of the actions in the field Result check.
Default: Blank
1
Result check: You can evaluate the result of the action here to determine the number of lines to be skipped in the
processing of the action table. Possible values for the actions (max. 50 characters):
2
contains= – This prefix checks if the result of the action contains the defined string.
2
isequal= – This prefix checks if the result of the action is exactly equal to the defined string.
2
?skipiftrue= – This suffix skips the defined number of lines in the list of actions if the result of the
"contains" or "isequal" query is TRUE.
2
?skipiffalse= – This suffix skips the defined number of lines in the list of actions if the result of the
"contains" or "isequal" query is FALSE.
448
Reference Manual
7 Routing and WAN -connections
Optional variables for the actions:
2
As with the definition of the action.
Example:
2
A DNS check queries the IP address of an address in the form "myserver.dyndns.org". The check
contains=%a?skipiftrue=2 allows you to skip the two following entries in the action table if the IP
address found by the DNS check agrees with the current IP address (%a) of the device.
1
Owner: Owner of the action. The exec actions are executed with the rights of the owner. If the owner does not have
the necessary rights (e.g. administrators with write access) then the device cannot execute the action.
Additions to the Setup menu
Routing tag
A routing tag is used to map actions in the action table to a specific WAN connection. The LANCOM performs the action
over the connection indicated by this routing tag.
Telnet path:
Setup > WAN > Action-Table
Possible values:
Max. 5 characters from 0123456789
Default:
0
7.24.4 Selecting frequency bands in LTE cellular networks
As of LCOS 8.84, you can set the frequency bands to be used by a LANCOM 4G router for data transmissions in the LTE
mobile network.
449
Reference Manual
7 Routing and WAN -connections
Enhancements to LANconfig
Selecting frequency bands in LTE cellular networks
Mobile profiles enable you to set which frequency bands the LTE/4G modem should use. Navigate to Interfaces >
WAN > Mobile settings, .
If unfavorable environmental conditions cause the router to constantly switch between two frequency bands, instabilities
in the transmission may be the result.
The selection under LTE bands allows you to control which frequency bands the mobile router can or should use. The
following frequency bands are available:
1
2100 MHz (B1): 2.1GHz band is enabled.
1
1800 MHz (B3): 1.8GHz band is enabled.
1
2600 MHz (B7): 2.6GHz band is enabled.
1
900 MHz (B8): 900MHz band is enabled.
1
800 MHz (B20): 800MHz band is enabled.
1
All: All frequency bands are enabled.
5
This option applies only to the LTE standard frequency bands. All bands can be used for UMTS and GPRS.
Additions to the Setup menu
LTE bands
If unfavorable environmental conditions cause the router to constantly switch between two frequency bands, instabilities
in the transmission may be the result. This selection allows you to control which frequency bands the mobile router can
or should use. The following frequency bands are available:
1
B1_2100: 2.1GHz band is enabled.
1
B3_1800: 1.8GHz band is enabled.
1
B7_2600: 2.6GHz band is enabled.
1
B8_900: 900MHz band is enabled.
1
B20_800: 800MHz band is enabled.
1
All: All frequency bands are enabled.
450
Reference Manual
7 Routing and WAN -connections
5
This option applies only to the LTE standard frequency bands. All bands can be used for UMTS and GPRS.
Telnet path:
Setup > Interfaces > Mobile > Profiles
Possible values:
All
B1_2100
B3_1800
B7_2600
B8_900
B20_800
Default:
All
7.25 Addition(s) to LCOS 9.00
7.25.1 Revised flow control
Until now, it was only possible to view the flow-control status for two network partners. As of LCOS 9.00, flow control
can be viewed in the Status section of the mode (symmetrical, asymmetrical).
Additions to the Status menu
Flow control
Displays the current flow-control status. Possible values are:
SNMP ID:
1.5.51.6
Telnet path:
Status > LAN > Interfaces
Possible values:
No
Flow control is disabled.
Yes
Flow control is enabled (symmetrical operation).
TX only
Flow control is enabled (asymmetrical operation, send only).
RX only
Flow control is enabled (asymmetrical operation, receive only).
451
Reference Manual
7 Routing and WAN -connections
Flow control
Displays the current flow-control status. Possible values are:
SNMP ID:
1.51.1.8
Telnet path:
Status > Ethernet-Ports > Ports
Possible values:
No
Flow control is disabled.
Yes
Flow control is enabled (symmetrical operation).
TX only
Flow control is enabled (asymmetrical operation, send only).
RX only
Flow control is enabled (asymmetrical operation, receive only).
Additions to the Setup menu
Flow control
Using flow control, you can prevent the loss of data packets if a partner network cannot process incoming data packets,
for example due to a memory overflow. In this case, the receiver signals the sender to pause the data transmission for
a certain period of time.
SNMP ID:
2.23.21.11
Telnet path:
Setup > Interfaces > Ethernet-ports
Possible values:
Auto
If auto-negotiation is enabled, the flow control is performed automatically according to the capabilities
of the partner (symmetric, asymmetric).
4
If auto-negotiation is disabled, no flow control takes place.
On
Enables symmetrical flow control when auto-negotiation is disabled.
Off
Disables the flow control when auto-negotiation is enabled.
452
Reference Manual
7 Routing and WAN -connections
Flow control
Using flow control, you can prevent the loss of data packets if a partner network cannot process incoming data packets,
for example due to a memory overflow. In this case, the receiver signals the sender to pause the data transmission for
a certain period of time.
SNMP ID:
2.23.30.9
Telnet path:
Setup > Interfaces > LAN-Interfaces
Possible values:
Auto
If auto-negotiation is enabled, the flow control is performed automatically according to the capabilities
of the partner (symmetric, asymmetric).
4
If auto-negotiation is disabled, no flow control takes place.
On
Enables symmetrical flow control when auto-negotiation is disabled.
Off
Disables the flow control when auto-negotiation is enabled.
7.25.2 AC name configurable for PPPoE server
As of LCOS 9.00, you have the option of assigning an AC name to a PPPoE server (Access Concentrator Name).
Server name
This input field provides the option to give the PPPoE server a name that is independent of the device name
(AC-Name = access concentrator name). If you leave this field blank, the PPPoE server uses the device name
as the server name.
Additions to the Setup menu
AC name
This input field provides the option to give the PPPoE server a name that is independent of the device name (AC-Name
= access concentrator name).
SNMP ID:
2.31.6
453
Reference Manual
7 Routing and WAN -connections
Telnet path:
Setup > PPPoE-Server
Possible values:
Max. 32 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Special values:
empty
If you leave this field blank, the PPPoE server uses the device name as the server name.
Default:
empty
7.25.3 Dual-SIM support for mobile devices
As of LCOS 9.00 you have the option to assign each of the mobile profiles created on the device directly to a SIM card.
LANmonitor is used to switch between these profiles or SIM cards.
Configuring WWAN access
The following tutorial shows how you manually configure devices with an internal cellular modem to use access via
mobile networks (WWAN). First you either create a mobile profile for your provider or edit an existing profile, and then
you assign this profile to the WAN interface of the device.
Alternatively, a simpler and faster way of configuration is available with a Setup Wizard (Set up Internet access).
1. In LANconfig, open the configuration dialog for your device and navigate to the section Interfaces > WAN.
2. Select an existing profile to be edited or add a new profile for your provider in the Mobile profiles table.
In the interests of completeness this tutorial explains the creation of a new profile.
3. Under Name type in a unique label for the mobile profile.
4. Under PIN enter the 4-digit PIN of the mobile phone SIM card. The device needs this information to operate the
mobile modem.
454
Reference Manual
7 Routing and WAN -connections
5
The SIM card logs every failed attempt with an incorrect PIN. The number of failed attempts remains stored
even when the device is temporarily disconnected from the mains. After 3 failed attempts, the SIM card is
locked from further access attempts. If this occurs, you usually need the 8-digit PUK or SuperPIN to unlock
it.
5. If your device accommodates several SIM cards, use SIM slot to select the SIM card that you want to associate with
this profile.
The item Profile disabled switches this mobile profile off. This option is useful if you wish to create a profile template
only and complete the mobile setup at a later time.
4
Only enabled profiles are visible for selection in LANmonitor.
6. Under APN, enter the name of the access server for the data services of your mobile provider.
The APN (access point name) is specific to each mobile phone provider. You will usually find this information in the
documentation provided with your mobile phone contract.
7. Under PDP type you specify the type of the PDP context for the mobile profile.
The PDP context describes the support of the address spaces which the backbone of the corresponding cellular
network provider offers for connections from the cellular network to the Internet. This can be either IPv4 or IPv6
alone, or can include support for both address spaces (dual stack). Clients that want to use the corresponding cellular
network provider must support at least one of the specified address spaces.
8. Set the preferred Network selection mode:
Automatic
The mobile modem automatically connects to one of the available and permitted mobile phone networks.
Manual
The mobile modem connects to the specified mobile phone network only.
5
Manual mobile network selection is especially suitable when the device is in stationary operation and
you wish to prevent it from connecting to another undesirable or more expensive mobile phone
network.
9. If you have selected manual network selection, enter the exact name of your desired network under Network name.
10. Specify the preferred transfer mode within the mobile network under Transmission mode:
Automatic
Automatic selection of transmission mode
LTE
LTE/4G mode only
UMTS + GPRS
Combined UMTS/3G & GPRS mode
UMTS
UMTS/3G mode only
GPRS
GPRS mode only
11. Under Downstream rate and Upstream rate you specify the transfer rates for the mobile phone connection. This
is important for the QoS (quality-of-service) feature and the functioning of the firewall.
If the value is set to 0, the mobile interface in the corresponding direction is considered to be unlimited and the QoS
mechanisms will not take effect.
455
Reference Manual
7 Routing and WAN -connections
12. If unfavorable environmental conditions cause the router to constantly switch between two frequency bands,
instabilities in the transmission may be the result. The selection under LTE bands allows you to control which
frequency bands are used by the mobile modem.
All
All frequency bands are enabled.
2100 MHz (B1)
2.1GHz band is enabled.
1800 MHz (B3)
1.8GHz band is enabled.
2600 MHz (B7)
2.6GHz band is enabled.
900 MHz (B8)
900MHz band is enabled.
800 MHz (B20)
800MHz band is enabled.
4
This option applies only to the LTE standard frequency bands. All bands can be used for UMTS and GPRS.
13. Click OK to save the settings.
14. In the dialog Interfaces > WAN, click Interface settings and select V.24/Mobile.
15. Set the V.24/Mobile interface to Mobile.
16. Under Mobile profiles, select the profile you created earlier for your mobile phone provider.
17. Click OK to save the settings.
18. In the view Communication > Remote sites, click Rem. (Mobile /...) and add a new profile.
19. Enter a unique name for the profile under Name, e.g. WWAN.
20. Under Phone number, enter the dial-in number of your mobile phone provider. If your provider has not given you
a dial-in phone number, enter *99#.
456
Reference Manual
7 Routing and WAN -connections
21. Under Short hold time, enter the time after which the device disconnects from the remote site if no packets are
transmitted
Enter a value in seconds to find a balance between the costs arising from idle time those of connection establishment,
for example 300. A value of 0 causes the device to stay connected until it is broken and terminated. With a value
of 9999 the device automatically reconnects every time.
22. For Layer name select the presetting UMTS.
23. Click OK to save the settings.
24. In the view Communication > Protocols, open the PPP list and add a new remote site.
25. Under Remote site, select the profile that you created previously, e.g. WWAN.
26. Deselect any settings under Authentication of the remote site (request).
27. Click OK to save the settings.
28. In the view IP Router > Routing, click IPv4 routing table and add the Default route (255.255.255.255).
29. Under Router, select the profile created earlier under Rem. sites (Mobile /...).
30. Set the IP masquerading to Masking intranet and DMZ (default).
31. Click OK to save the settings.
457
Reference Manual
7 Routing and WAN -connections
32. Write the changes back to the device.
This concludes the configuration of the WWLAN access.
Switching between mobile profiles or SIM cards
If you have created different mobile profiles for a SIM card or one mobile profile for several SIM cards, LANmonitor
allows you to toggle between these profiles or SIM cards. The following steps show you how to select an alternate profile
or an alternate SIM card.
1. Select your device in LANmonitor.
2. On the entry Mobile network, open the context menu and select the option Disconnect and switch mobile
profile.
3. Select the mobile profile that you want to switch to.
The device then disconnects from the mobile network and reconnects using the selected mobile profile.
Additions to the Status menu
Simstatus-Refresh
Using this action, you manually trigger the update of the SIM card status in the Simstatus table.
SNMP ID:
1.49.44
Telnet path:
Status > Modem-Mobile
Possible arguments:
none
Additions to the Setup menu
SIM-Slot
This parameter selects the SIM card slot that you want to link with the mobile profile.
458
Reference Manual
7 Routing and WAN -connections
SNMP ID:
2.23.41.1.12
Telnet path:
Setup > Interfaces > Mobile > Profiles
Possible values:
0
Profile inactive
1
SIM slot 1
2
SIM slot 2
Default:
0
7.25.4 Combined UMTS-GPRS operation for LTE devices
LCOS9.00 allows LTE/4G devices operating in areas without LTE/4G coverage to use a combined mode with both UMTS/3G
and GPRS. Thus it is no longer necessary to manually set either UMTS/3G or GPRS.
Additions to the Setup menu
Mode
Select the mobile networking transmission mode here.
SNMP ID:
2.23.41.1.6
Telnet path:
Setup > Interfaces > Mobile > Profiles
Possible values:
Auto
Automatic selection of transmission mode
UMTS
UMTS/3G mode only
GPRS
GPRS mode only
UMTS-GPRS
Combined UMTS/3G & GPRS mode
LTE
LTE/4G mode only
459
Reference Manual
7 Routing and WAN -connections
Default:
Auto
7.26 Addition(s) to LCOS 9.10
7.26.1 Client binding
As of LCOS version 9.10, load balancing additionally features client binding.
Client binding
The use of load balancing leads to problems for servers that use an IP address to identify a logged-on user. If a user is
logged in to a web site, for example, and the load balancer then takes a different Internet connection, then the server
interprets this as a connection attempt by a user who is not logged on. In the best case the user sees a new login dialog,
but not the desired web page.
One possible workaround would be to use a firewall rule (policy based routing) to direct the traffic to this server over a
specific Internet connection. However, this would limit all of the traffic to that server to the bandwidth of a single
connection. What's more, there is no way to establish a backup if the first connection should fail.
In contrast to this, client binding does not monitor the individual TCP/IP sessions but the client that opened an Internet
connection in the initial session. It directs all subsequent sessions through this Internet connection, which corresponds
in principle to the policy-based routing mentioned above. How this is done depends on the protocol, i.e. it transports
only data of the same protocol type (e.g. HTTPS) over this Internet connection. If the client loads additional data via an
HTTP connection, it probably does this with a different connection.
To prevent data from being bottle-necked into this one Internet connection when it could easily be transferred via parallel
connections, a timer ensures that the load balancer distributes additional sessions between the available Internet
connections for a specified period. After the timer expires, the client binding forces a new session over the original
Internet connection and the timer is restarted. The server thus continues to recognize the login status for the user due
to the current IP address.
Load balancing with client binding
In LANconfig, client binding is configured under IP router > Routing in the section Load balancing.
Binding minutes
Here you specify the time in minutes for the binding entries to be valid for a client.
460
Reference Manual
7 Routing and WAN -connections
Balance seconds
To prevent data from flowing the this main-session Internet connection when it could easily be transferred
via parallel connections, a timer ensures that the load balancer distributes additional sessions between the
available Internet connections for a specified period. After the timer expires, the client binding forces a new
session over the original Internet connection and the timer is restarted. The server thus continues to recognize
the login status for the user due to the current IP address.
Here you specify the time in seconds, following the start of the main session, during which the load balancer
is free to distribute new sessions to other Internet connections.
Client binding is protocol-oriented. You set the corresponding protocols under Client binding protocols. The table
already contains the default entries
1
HTTPS
1
HTTP
1
ANY
Name
Contains a descriptive name for this entry.
Protocol
Contains the IP protocol number.
4
Learn more about IP protocol numbers in the IANA
Online database
.
Port
Contains the port of the IP protocol.
Activated
Activates or deactivates this entry.
Client binding can be activated or deactivated for each of the entries under Load balancing.
461
Reference Manual
7 Routing and WAN -connections
Enhancements in the menu system
Additions to the Setup menu
Client binding
In this menu, you can configure the client binding.
The use of load balancing leads to problems for servers that use an IP address to identify a logged-on user. If a user is
logged in to a web site, for example, and the load balancer then takes a different Internet connection, then the server
interprets this as a connection attempt by a user who is not logged on. In the best case the user sees a new login dialog,
but not the desired web page.
One possible workaround would be to use a firewall rule (policy based routing) to direct the traffic to this server over a
specific Internet connection. However, this would limit all of the traffic to that server to the bandwidth of a single
connection. What's more, there is no way to establish a backup if the first connection should fail.
In contrast to this, client binding does not monitor the individual TCP/IP sessions but the client that opened an Internet
connection in the initial session. It directs all subsequent sessions through this Internet connection, which corresponds
in principle to the policy-based routing mentioned above. How this is done depends on the protocol, i.e. it transports
only data of the same protocol type (e.g. HTTPS) over this Internet connection. If the client loads additional data via an
HTTP connection, it probably does this with a different connection.
To prevent data from being bottle-necked into this one Internet connection when it could easily be transferred via parallel
connections, a timer ensures that the load balancer distributes additional sessions between the available Internet
connections for a specified period. After the timer expires, the client binding forces a new session over the original
Internet connection and the timer is restarted. The server thus continues to recognize the login status for the user due
to the current IP address.
SNMP ID:
2.8.20.3
Telnet path:
Setup > IP-Router > Load-Balancer
Protocols
In this table, you specify the protocols and the associated ports for monitoring by the client binding.
4
The table already contains the default entries
HTTPS
1
1
HTTP
1
ANY
SNMP ID:
2.8.20.3.1
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
462
Reference Manual
7 Routing and WAN -connections
Name
Enter a descriptive name for this entry.
SNMP ID:
2.8.20.3.1.1
Telnet path:
Setup > IP-Router > Load-Balancer > Client-Binding > Protocols
Possible values:
Max. 16 characters from [A-Z][a-z][0-9]
Default:
empty
Protocol
Select the IP protocol number.
4
Learn more about IP protocol numbers in the
online database
of the IANA.
SNMP ID:
2.8.20.3.1.2
Telnet path:
Setup > IP-Router > Load-Balancer > Client-Binding > Protocols
Possible values:
Max. 3 characters from [0-255]
Special values:
0
All protocols
Default:
0
Port
Select the port.
SNMP ID:
2.8.20.3.1.3
Telnet path:
Setup > IP-Router > Load-Balancer > Client-Binding > Protocols
463
Reference Manual
7 Routing and WAN -connections
Possible values:
Max. 5 characters from [0-65535]
Special values:
0
All ports
Default:
0
Operating
Here you enable or disable the client binding for this entry.
SNMP ID:
2.8.20.3.1.4
Telnet path:
Setup > IP-Router > Load-Balancer > Client-Binding > Protocols
Possible values:
Yes
Enables the entry
No
Disables the entry
Default:
Yes
Binding minutes
Specify the time in minutes for the binding entries to be valid for a client.
SNMP ID:
2.8.20.3.2
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
Possible values:
Max. 3 characters from [0-999]
464
Reference Manual
7 Routing and WAN -connections
Special values:
0
Default:
30
Balance seconds
To prevent data from flowing through this main-session Internet connection when it could easily be transferred via
parallel connections, a timer ensures that the load balancer distributes additional sessions between the available Internet
connections for a specified period. After the timer expires, the client binding forces a new session over the original
Internet connection and the timer is restarted. The server thus continues to recognize the login status for the user due
to the current IP address.
Here you specify the time in seconds, following the start of the main session, during which the load balancer is free to
distribute new sessions to other Internet connections.
SNMP ID:
2.8.20.3.3
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
Possible values:
Max. 3 characters from [0-999]
Special values:
0
The timer is deactivated. All sessions are bound to the existing Internet connection.
Default:
10
Client binding
Here you enable or disable the client binding for each load balancer.
SNMP ID:
2.8.20.2.10
Telnet path:
Setup > IP-Router > Load-Balancer > Bundle-Peers
Possible values:
Yes
Client binding is enabled.
No
Client binding is disabled.
465
Reference Manual
7 Routing and WAN -connections
Default:
No
Additions to the Status menu
Client binding
This table shows the details of current client bindings.
SNMP ID:
1.10.32.3
Telnet path:
Status > IP-Router > Load-Balancer
Source-IP
This entry shows the source IP addresses of the client.
SNMP ID:
1.10.32.3.1
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
Bundle-Peer
This entry shows the name of the selected Internet connection.
SNMP ID:
1.10.32.3.2
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
Timeout
This entry indicates the remaining time until the load balancer deletes this entry.
SNMP ID:
1.10.32.3.3
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
466
Reference Manual
7 Routing and WAN -connections
Balance
This entry indicates whether the timer is enabled for allowing further Internet connections.
SNMP ID:
1.10.32.3.4
Telnet path:
Status > IP-Router > Load-Balancer > Client-Binding
7.26.2 Interface binding "Any" removed in IPv4
As of LCOS version 9.10 it is no longer possible to select "Any" when assigning interfaces to IPv4 networks.
4
The new default setting is "LAN-1" or "BRG-1".
Defining networks and assigning interfaces
When defining a network, the first setting is for the IP address range which is to be valid for a certain local interface on
the router. “Local interfaces” are logical interfaces which are assigned either to a physical Ethernet port (LAN) or to a
wireless port (WLAN). To realize the scenarios outlined above, it is possible for several networks to be active on one
interface: Conversely, a network can also be active on multiple interfaces (via bridge groups or with the interface
assignment 'Any').
The networks are defined in a table under IPv4 > General > IP networks. A unique name for the networks is set along
with definitions for the address range and interface assignment. The network name allows the identification of networks
in other modules (DHCP server, RIP, NetBIOS, etc.) and to enable control over which services are available in which
networks.
Additions to the Setup menu
Interface
Here you select the interface that is to be allocated to the network.
4
The values for 'x' in the list vary per model.
SNMP ID:
2.7.30.5
467
Reference Manual
7 Routing and WAN -connections
Telnet path:
Setup > TCP-IP > Network-List
Possible values:
LAN-1
LAN-x
WLAN-x-x
P2P-x-x
BRG-x
Default:
LAN-1
7.26.3 Generic routing encapsulation (GRE)
As of LCOS version 9.10 it is possible to transmit data packets of any transmission protocol as IP packets within GRE
tunnels.
The trace command has an additional parameter in case of issues with GRE tunnels:
Table 3: Overview of all possible traces
...causes the following message in the trace:This parameter ...
Messages to GRE tunnels
GRE
Understanding the generic routing encapsulation (GRE) protocol
GRE is a tunneling protocol that encapsulates any layer-3 data packets (including IP, IPSec, ICMP, etc.) into virtual
point-to-point network connections. This is very useful, among other things, when the two communication partners wish
to use a particular transport protocol (for example, IPSec) that is unavailable on the transmission path. Since GRE itself
does not encrypt the tunneled data, the two communication partners themselves must ensure that the data is protected.
Configuring a GRE tunnel
To configure a GRE tunnel with LANconfig, navigate to Communication > Remote sites > GRE tunnel and click GRE
tunnel.
Remote site
The name of the remote station for this GRE tunnel. Use this name in the routing table in order to send data
through this GRE tunnel.
468
Reference Manual
7 Routing and WAN -connections
Server address
Address of the GRE tunnel endpoint (valid IPv4 or IPv6 address or FQDN).
Routing-Tag
Routing tag for the connection to the GRE tunnel endpoint. The device maps data packets to this GRE tunnel
by means of the routing tag.
Checksum
Here you specify whether the GRE header should contain a check sum.
With the check sum function enabled, the device calculates a checksum for the transmitted data and attaches
this to the GRE tunnel header. If the GRE header of incoming data contains a checksum, the device checks
this against the transmitted data. The device discards any data received with an erroneous or missing check
sum.
With the checksum function disabled, the device sends all tunnel data without a checksum and it expected
data packets without a checksum. Incoming data packets with a checksum in the GRE header are discarded.
Key present
Here you specify whether the GRE header should contain a key for data-flow control.
If you enable this feature, the device inserts the value set in the key field into the GRE header for this GRE
tunnel. The device only maps incoming data packets to this GRE tunnel if their GRE header contains an identical
key value.
With this feature disabled, the GRE header of outgoing data packets does not contain a key value. The device
only maps incoming data packets to this GRE tunnel if their GRE header similarly does not contain a key value.
Key
The key that assures data-flow control in this GRE tunnel. Two devices connected via several GRE tunnels use
this key to map the data packets to the appropriate GRE tunnel.
Sequencing
Here you specify whether the GRE header contains information about the sequence of the data packets.
With this feature enabled, the device includes a counter in the GRE header of outgoing data packets in order
to communicate the sequence of the data packets to the GRE tunnel endpoint. The device analyses the
sequence of incoming data packets and drops packets with an incorrect or missing packet sequence.
Source address
Here you can optionally specify a source address for the device to use as the target address instead of the
one that would normally be selected automatically. Possible values are:
1
Name of the IP networks whose addresses are to be used.
1
"INT" for the address of the first intranet
1
"DMZ" for the address of the first DMZ
1
LB0 to LBF for the 16 loopback addresses
1
Any valid IP address
4
If the list of IP networks or source addresses contains an entry named 'DMZ', then the associated IP
address will be used.
To use IPv6 as the GRE tunnel transport protocol, navigate to IPv6 > WAN interfaces and create a new entry named
"IPV6GRE", for example. When you subsequently configure the GRE tunnel, you set this interface as the Remote site.
If you need to specify an IP address for the tunnel interface, proceed as follows:
469
Reference Manual
7 Routing and WAN -connections
IPv4 address
Create a new entry under Communication > Protocols > IP parameters and set the name of the remote
site as the name of the GRE tunnel remote site. Finally, enter the necessary values for the IP address and
Netmask.
IPv6
Create a new entry under IPv6 > General > IP addresses and set the network name as the name of the
GRE tunnel remote site. Finally, enter the necessary values for the Address/Prefix length.
Additions to the Setup menu
GRE-Tunnel
GRE is a tunneling protocol that encapsulates any layer-3 data packets (including IP, IPSec, ICMP, etc.) into virtual
point-to-point network connections. You configure the various GRE tunnels here.
SNMP ID:
2.2.51
Telnet path:
Setup > WAN
Remote site
The name of the remote station for this GRE tunnel. Use this name in the routing table in order to send data through
this GRE tunnel.
SNMP ID:
2.2.51.1
Telnet path:
Setup > WAN > GRE-Tunnel
IP address
Address of the GRE tunnel endpoint (valid IPv4 or IPv6 address or FQDN).
SNMP ID:
2.2.51.3
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
Max. 64 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
470
Reference Manual
7 Routing and WAN -connections
Default:
empty
Routing-Tag
Routing tag for the connection to the GRE tunnel endpoint.
SNMP ID:
2.2.51.4
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
0 … 65535
Default:
0
Key present
Here you specify whether the GRE header should contain a key for data-flow control.
If you enable this feature, the device inserts the value set in the key field into the GRE header for this GRE tunnel. The
device only maps incoming data packets to this GRE tunnel if their GRE header contains an identical key value.
With this feature disabled, the GRE header of outgoing data packets does not contain a key value. The device only maps
incoming data packets to this GRE tunnel if their GRE header similarly does not contain a key value.
SNMP ID:
2.2.51.5
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
Yes
No
Default:
No
Key value
The key that assures data-flow control in this GRE tunnel.
471
Reference Manual
7 Routing and WAN -connections
SNMP ID:
2.2.51.6
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
0 … 4294967295
Default:
0
Checksum
Here you specify whether the GRE header should contain a check sum.
With the check sum function enabled, the device calculates a checksum for the transmitted data and attaches this to
the GRE tunnel header. If the GRE header of incoming data contains a checksum, the device checks this against the
transmitted data. The device discards any data received with an erroneous or missing check sum.
With the checksum function disabled, the device sends all tunnel data without a checksum and it expected data packets
without a checksum. Incoming data packets with a checksum in the GRE header are discarded.
SNMP ID:
2.2.51.7
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
Yes
No
Default:
No
Sequencing
Here you specify whether the GRE header contains information about the sequence of the data packets.
With this feature enabled, the device includes a counter in the GRE header of outgoing data packets in order to
communicate the sequence of the data packets to the GRE tunnel endpoint. The device analyses the sequence of incoming
data packets and drops packets with an incorrect or missing packet sequence.
SNMP ID:
2.2.51.8
Telnet path:
Setup > WAN > GRE-Tunnel
472
Reference Manual
7 Routing and WAN -connections
Possible values:
Yes
No
Default:
No
Source address
Here you can optionally specify a source address for the device to use as the target address instead of the one that would
normally be selected automatically.
4
If the list of IP networks or loopback addresses contains an entry named 'DMZ', then the associated IP address
will be used.
SNMP ID:
2.2.51.9
Telnet path:
Setup > WAN > GRE-Tunnel
Possible values:
Valid entry from the list of possible addresses.
Name of the IP networks whose addresses are to be used.
"INT" for the address of the first intranet
"DMZ" for the address of the first DMZ
LB0 to LBF for the 16 loopback addresses
Any valid IP address
empty
Default:
Additions to the Status menu
GRE-Tunnel
This table shows the status values of the GRE tunnel.
SNMP ID:
1.86
Telnet path:
Status
473
Reference Manual
7 Routing and WAN -connections
Remote site
This column contains the name of each GRE tunnel remote station.
SNMP ID:
1.86.1
Telnet path:
Status > GRE-Tunnel
Server address
This column contains the addresses of the GRE tunnel endpoints (valid IP address or FQDN).
SNMP ID:
1.86.3
Telnet path:
Status > GRE-Tunnel
Routing-Tag
This column contains the routing tags for the connections to each of the GRE tunnel endpoints.
SNMP ID:
1.86.4
Telnet path:
Status > GRE-Tunnel
Key present
This column indicates whether the GRE header of the respective tunnel contains a key.
SNMP ID:
1.86.5
Telnet path:
Status > GRE-Tunnel
Key
This column contains the key if one is present in the GRE header of the corresponding tunnel.
474
Reference Manual
7 Routing and WAN -connections
SNMP ID:
1.86.6
Telnet path:
Status > GRE-Tunnel
Checksum
This column indicates whether the GRE header of the corresponding tunnel contains a checksum.
SNMP ID:
1.86.7
Telnet path:
Status > GRE-Tunnel
Sequencing
This column indicates whether the GRE header of the corresponding tunnel contains packet sequencing.
SNMP ID:
1.86.8
Telnet path:
Status > GRE-Tunnel
Source address
This column contains the source address specified for the respective GRE tunnel.
SNMP ID:
1.86.9
Telnet path:
Status > GRE-Tunnel
7.26.4 Ethernet-over-GRE tunnel (EoGRE)
As of LCOS version 9.10 it is possible to transmit Ethernet packets as IP packets within EoGRE tunnels.
The trace command has an additional parameter in case of issues with GRE tunnels:
Table 4: Overview of all possible traces
...causes the following message in the trace:This parameter ...
Messages to GRE tunnels
GRE
475
Reference Manual
7 Routing and WAN -connections
Ethernet-over-GRE (EoGRE)
4
For more information about the GRE protocol, see
Understanding the generic routing encapsulation protocol
(GRE)
.
The current version of LCOS provides a number of “Ethernet over GRE” tunnels (EoGRE) to transmit Ethernet packets via
GRE. Since these Ethernet packets move on OSI layer 2 only, the EoGRE tunnel only functions as a bridge.
This can be used to implement L2VPN (VPN as a simple level-2 bridge) or a transparent Ethernet bridge over WAN.
Configuring an EoGRE tunnel
To configure an EoGRE tunnel with LANconfig, navigate to Communication > Remote sites > GRE tunnel, click EoGRE
tunnel and select the appropriate tunnel.
Interface
Name of the selected EoGRE tunnel.
Operating
Activates or deactivates the EoGRE tunnel. Deactivated EoGRE tunnels do not send or receive any data.
Server address
Address of the EoGRE tunnel endpoint (valid IPv4 or IPv6 address or FQDN).
Routing-Tag
Routing tag for the connection to the EoGRE tunnel endpoint. The device maps data packets to this EoGRE
tunnel by means of the routing tag.
Checksum
Here you specify whether the GRE header should contain a check sum.
With the check sum function enabled, the device calculates a checksum for the transmitted data and attaches
this to the GRE tunnel header. If the GRE header of incoming data contains a checksum, the device checks
this against the transmitted data. The device discards any data received with an erroneous or missing check
sum.
With the checksum function disabled, the device sends all tunnel data without a checksum and it expected
data packets without a checksum. Incoming data packets with a checksum in the GRE header are discarded.
Key present
Here you specify whether the GRE header should contain a key for data-flow control.
If you enable this feature, the device inserts the value set in the key field into the GRE header for this EoGRE
tunnel. The device only maps incoming data packets to this EoGRE tunnel if their GRE header contains an
identical key value.
476
Reference Manual
7 Routing and WAN -connections
With this feature disabled, the GRE header of outgoing data packets does not contain a key value. The device
only maps incoming data packets to this EoGRE tunnel if their GRE header similarly does not contain a key
value.
Key
The key that assures data-flow control in this EoGRE tunnel. Two devices connected via several EoGRE tunnels
use this key to map the data packets to the appropriate EoGRE tunnel.
Sequencing
Here you specify whether the GRE header contains information about the sequence of the data packets.
With this feature enabled, the device includes a counter in the GRE header of outgoing data packets in order
to communicate the sequence of the data packets to the EoGRE tunnel endpoint. The device analyses the
sequence of incoming data packets and drops packets with an incorrect or missing packet sequence.
Connecting a local interface to an EoGRE tunnel
Connecting a local interface to an EoGRE tunnel involves the following steps:
1. Create a new entry under Communication > Remote sites > GRE tunnel > EoGRE tunnel.
Activate the tunnel and, under Server address, enter the address of the remote device to which the EoGRE tunnel
is to connect (IPv4 address, IPv6 address, or FQDN).
2. Add a bridge group for the activated EoGRE tunnel under Interfaces > LAN > Port table.
Enable the port and select the required bridge group.
477
Reference Manual
7 Routing and WAN -connections
3. Again under Interfaces > LAN > Port table, supplement the same bridge group with the local interface that you
want to connect through the EoGRE tunnel (e.g. WLAN-1).
Enable the port and select from the list the bridge group that contains the EoGRE tunnel.
Additions to the Status menu
EoGRE-Tunnel
This table shows you information about the EoGRE tunnels.
SNMP ID:
1.87
Telnet path:
Status
Additions to the Setup menu
EoGRE-Tunnel
The current version of LCOS provides a number of "Ethernet over GRE" tunnels (EoGRE) to transmit Ethernet packets via
GRE. You configure the various EoGRE tunnels here.
SNMP ID:
2.2.50
Telnet path:
Setup > WAN
Interface
Name of the selected EoGRE tunnel.
SNMP ID:
2.2.50.1
Telnet path:
Setup > WAN > EoGRE-Tunnel
478
Reference Manual
7 Routing and WAN -connections
Operating
Activates or deactivates the EoGRE tunnel. Deactivated EoGRE tunnels do not send or receive any data.
SNMP ID:
2.2.50.2
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
Yes
No
Default:
No
IP address
Address of the EoGRE tunnel endpoint (valid IPv4 or IPv6 address or FQDN).
SNMP ID:
2.2.50.3
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
Max. 64 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Routing-Tag
Routing tag for the connection to the EoGRE tunnel endpoint.
SNMP ID:
2.2.50.4
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
0 … 65535
479
Reference Manual
7 Routing and WAN -connections
Default:
0
Key present
Here you specify whether the GRE header should contain a key for data-flow control.
If you enable this feature, the device inserts the value set in the key field into the GRE header for this EoGRE tunnel. The
device only maps incoming data packets to this EoGRE tunnel if their GRE header contains an identical key value.
With this feature disabled, the GRE header of outgoing data packets does not contain a key value. The device only maps
incoming data packets to this EoGRE tunnel if their GRE header similarly does not contain a key value.
SNMP ID:
2.2.50.5
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
Yes
No
Default:
No
Key value
The key that assures data-flow control in this EoGRE tunnel.
SNMP ID:
2.2.50.6
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
0 … 4294967295
Default:
0
Checksum
Here you specify whether the GRE header should contain a check sum.
480
Reference Manual
7 Routing and WAN -connections
With the check sum function enabled, the device calculates a checksum for the transmitted data and attaches this to
the GRE tunnel header. If the GRE header of incoming data contains a checksum, the device checks this against the
transmitted data. The device discards any data received with an erroneous or missing check sum.
With the checksum function disabled, the device sends all tunnel data without a checksum and it expected data packets
without a checksum. Incoming data packets with a checksum in the GRE header are discarded.
SNMP ID:
2.2.50.7
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
Yes
No
Default:
No
Sequencing
Here you specify whether the GRE header contains information about the sequence of the data packets.
With this feature enabled, the device includes a counter in the GRE header of outgoing data packets in order to
communicate the sequence of the data packets to the EoGRE tunnel endpoint. The device analyses the sequence of
incoming data packets and drops packets with an incorrect or missing packet sequence.
SNMP ID:
2.2.50.8
Telnet path:
Setup > WAN > EoGRE-Tunnel
Possible values:
Yes
No
Default:
No
481
Reference Manual
7 Routing and WAN -connections
7.26.5 Loopback addresses for RIP
As of LCOS version 9.10 it is possible to specify a loopback address for WAN RIP.
Source address (opt.)
This is where you can configure an optional sender address to be used instead of the one otherwise
automatically selected for the destination address.
If you have configured loopback addresses, you can specify them here as source address. You can enter an
address in various forms:
1
Name of the IP network (ARF network), whose address should be used.
1
“INT” for the address of the first intranet.
1
“DMZ” for the address of the first DMZ (Note: If there is an interface named “DMZ”, its address will be
taken).
1
LB0…LBF for one of the 16 loopback addresses or its name.
1
Furthermore, any IP address can be entered in the form x.x.x.x.
4
If the source address set here is a loopback address, these will be used unmasked on the remote
client.
Additions to the Setup menu
Loopback address
Enter a loopback address here. Possible values are:
1
The name of an ARF network
1
Configured loopback address
1
IPv4 address
SNMP ID:
2.8.8.4.13
Telnet path:
Setup > IP-Router > RIP > WAN-Table
482
Reference Manual
7 Routing and WAN -connections
Possible values:
Specify a valid IPv4 address here.
Default:
empty
7.26.6 PPPoE snooping new
As of LCOS version 9.10 PPPoE snooping is also implemented.
PPPoE snooping
PPPoE snooping enables devices that receive and forward PPPoE discovery (PPPoED) packets to analyze these packets
and to supplement them with additional information. This information can be used by a PPPoE access concentrator (AC)
to process the PPPoED data packets accordingly. This role is called the “PPPoE-Intermediate-Agent”.
PPPoE snooping in the LCOS processes the following PPPoED packets:
1
PADI (PPPoE Active Discovery Indication)
1
PADR (PPPoE Active Discovery Request)
1
PADT (PPPoE Active Discovery Terminate)
The PPPoE intermediate agent, which is responsible for the PPPoE snooping, supplements the PPPoED packet with
manufacturer-specific attributes (circuit ID and remote ID), and any existing IDs in received packets are replaced with
its own values.
1
The remote ID: Uniquely identifies the client making a PPPoE request.
1
Circuit ID: Uniquely identifies the interface used by a client to make a PPPoE request.
PPPoE snooping is configured for each LAN/WLAN interface.
Additions to the Setup menu
PPPoE snooping
Here you configure PPPoE snooping for each interface.
SNMP ID:
2.20.43
Telnet path:
Setup > LAN-Bridge
Port
Indicates the physical or logical interface to which this PPPoE-snooping configuration applies.
SNMP ID:
2.20.43.1
Telnet path:
Setup > LAN-Bridge > PPPoE-Snooping
483
Reference Manual
7 Routing and WAN -connections
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
WLC-TUNNEL-x
All virtual WLC tunnels
GRE-TUNNEL-x
All virtual GRE tunnels
Add agent info
Here you decide whether the PPPoE intermediate agent gives incoming PPPoE packets a manufacturer-specific PPPoE
tag with the vendor ID “3561” before forwarding the request to a PPPoE server.
This option allows the PPPoE intermediate agent to deliver additional information to the PPPoE server about the interface
used by the client to make the request.
The PPPoE tag is composed of values for the Remote ID and the Circuit ID.
4
If these two fields are empty, the PPPoE intermediate agent does not add a PPPoE tag to the data packets.
SNMP ID:
2.20.43.2
Telnet path:
Setup > LAN-Bridge > PPPoE-Snooping
Possible values:
Yes
Adds “relay agent info” to the PPPoE packets.
No
This setting disables PPPoE snooping for this interface.
Default:
No
Remote ID
The remote ID is a sub-option of the PPPoE intermediate agent option. It uniquely identifies the client making a PPPoE
request.
484
Reference Manual
7 Routing and WAN -connections
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface where the PPPoE intermediate agent received the PPPoE request. If a
WLAN-SSID is involved, then this is the corresponding BSSID.
1
%c: Inserts the name of the interface where the PPPoE intermediate agent received the PPPoE request.
1
%n: Inserts the name of the PPPoE intermediate agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the PPPoE request packet. This VLAN ID is sourced either from the VLAN header of the
PPPoE data packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the PPPoE data packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the PPPoE packet originates from a WLAN client. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the PPPoE relay agent, to be found for example under Status > Hardware-Info >
Serial number.
SNMP ID:
2.20.43.3
Telnet path:
Setup > LAN-Bridge > PPPoE-Snooping
Possible values:
Max. 30 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Circuit ID
The circuit ID is a sub-option of the PPPoE intermediate agent info option. It uniquely identifies the interface used by
the client to make a PPPoE request.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface where the PPPoE intermediate agent received the PPPoE request. If a
WLAN-SSID is involved, then this is the corresponding BSSID.
1
%c: Inserts the name of the interface where the PPPoE intermediate agent received the PPPoE request.
1
%n: Inserts the name of the PPPoE intermediate agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the PPPoE request packet. This VLAN ID is sourced either from the VLAN header of the
PPPoE data packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the PPPoE data packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the PPPoE packet originates from a WLAN client. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the PPPoE relay agent, to be found for example under Status > Hardware-Info >
Serial number.
485
Reference Manual
7 Routing and WAN -connections
SNMP ID:
2.20.43.4
Telnet path:
Setup > LAN-Bridge > PPPoE-Snooping
Possible values:
Max. 30 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Discard server packets
Here you decide whether the PPPoE intermediate agent retains or discards any existing PPPoE tags.
SNMP ID:
2.20.43.5
Telnet path:
Setup > LAN-Bridge > PPPoE-Snooping
Possible values:
Yes
The PPPoE intermediate Agent removes existing PPPoE tags and leaves both the “Circuit ID” and the
“Remote ID” empty.
No
The PPPoE intermediate agent takes over any existing PPPoE tags.
Default:
No
7.26.7 Default settings in the access table for WAN connections
As of LCOS version 9.10, all protocols for WAN connections are disabled in the access table.
Additions to the Setup menu
Telnet
Use this option to set the access rights for configuring the device via the TELNET protocol. This protocol is required for
text-based configuration of the device with the Telnet console, which is independent of the operating system.
SNMP ID:
2.11.15.2
Telnet path:
Setup > Config > Access-Table
486
Reference Manual
7 Routing and WAN -connections
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
TFTP
Use this option to set the access rights for configuring the device via the TFTP protocol (Trivial File Transfer Protocol).
This protocol is required, for example, for configuration using the LANconfig application.
SNMP ID:
2.11.15.3
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
487
Reference Manual
7 Routing and WAN -connections
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
HTTP
Use this option to set the access rights for configuring the device via the HTTP protocol (Hypertext Transfer Protocol).
This protocol is required for configuring the device via the implemented web-based browser interface independent of
the operating system.
SNMP ID:
2.11.15.4
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
488
Reference Manual
7 Routing and WAN -connections
No
SNMP
Use this option to set the access rights for configuring the device via the SNMP protocol (Simple Network Management
Protocol). This protocol is required, for example, for configuring the device using the LANmonitor application.
SNMP ID:
2.11.15.5
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
HTTPS
Use this option to set the access rights for configuring the device via the HTTPS protocol (Hypertext Transfer Protocol
Secure or HTTP via SSL). This protocol is required for configuring the device via the implemented web-browser interface
independent of the operating system.
SNMP ID:
2.11.15.6
489
Reference Manual
7 Routing and WAN -connections
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
Telnet-SSL
Use this option to set the access rights for configuring the device via the TELNET protocol. This protocol is required for
text-based configuration of the device with the Telnet console, which is independent of the operating system.
SNMP ID:
2.11.15.7
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
490
Reference Manual
7 Routing and WAN -connections
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
SSH
Use this option to set the access rights for configuring the device via the TELNET/SSH protocol. This protocol is required
for configuring the device securely via the implemented Telnet console from text-based systems independent of the
operating system.
SNMP ID:
2.11.15.8
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
491
Reference Manual
7 Routing and WAN -connections
Default:
Yes
No
Config Sync
Indicates whether a config sync is possible (restricted) via this interface.
SNMP ID:
2.11.15.10
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
492
Reference Manual
7 Routing and WAN -connections
8 Firewall
For most companies and many private users a work without the Internet is no longer conceivable. E-mail and web are
indispensable for communication and information search. But each connection of the workstations from the own, local
network to the Internet represents however a potential danger: Unauthorized users can try to see your data via this
Internet connection, to modify it or to manipulate your PCs.
Therefore this chapter covers an important topic: the firewall as defensive measure against unauthorized access. Besides
a brief introduction to the topic of Internet security, we show you which protection a LANCOM is able to offer you by
right configuration and how to make the needed specific settings.
8.1 Threat analysis
To plan and to realize suitable measures to guarantee security, it is advisable to know first all possible sources of danger:
1
Which imminent dangers exist for the own LAN resp. the own data?
1
Which are the ways intruders take for the access to your network?
5
We denote the intrusion into protected networks in the following as “attack” according to the general usage,
and the intruder thus as “attacker”.
8.1.1 The dangers
The dangers in the Internet arise in principle from completely different motives. On the one hand the perpetrators try to
enrich themselves personally or to damage the victims systematically. By the ever increasing know-how of the perpetrators,
the “hacking” became already a kind of sports, in which young people often measure who takes at first the hurdles of
Internet security.
Regardless of the individual motivation, the intention of the perpetrators mostly leads to the following aims:
1
Inspect confidential information such as trade secrets, access information, passwords for bank accounts etc.
1
Use of LAN workstations for purposes of the attackers, e. g. for the distribution of own contents, attacks to third
workstations etc.
1
Modify data of LAN workstations, e. g. to obtain even further ways for access.
1
Destroy data on the workstations of the LAN.
1
Paralyze workstations of the LAN or the connection to the Internet.
5
We restrict ourselves in this section to the attacks of local networks (LAN) resp. to workstations and servers in
such LANs.
8.1.2 The ways of the perpetrators
In order to undertake their objectives, the perpetrators need at first a way to access your PCs and data. In principle, the
following ways are open as long as they are neither blocked nor protected:
1
Via the central Internet connection, e. g. via routers.
1
Via decentral connections to the Internet, e. g. modems of single PCs or mobile phones on notebooks.
1
Via wireless networks operating as a supplement to wired networks.
5
In this chapter we only deal with the ways via the central Internet connection, via the router.
493
Reference Manual
8 Firewall
5
For hints on the protection of wireless networks, please refer to the respective chapters of this reference manual
resp. of the appropriate device documentation.
8.1.3 The methods
Normally strangers have of course no access to your local area network or to the workstations belonging to it. Without
the appropriate access data or passwords nobody can thus access the protected area. If spying out of these access data
is not possible, the attackers will try another way to achieve their goals.
A fundamental starting point is to smuggle data on one of the allowed ways for data exchange into the network, which
opens from the inside the access for the attacker. Small programs can be transferred on a computer by appendices in
e-mails or active contents on web pages, e.g., in order to lead afterwards to a crash. The program uses the crash to
install a new administrator on the computer, which can then be used from distance for further actions in the LAN.
If the access via e-mail or www is not possible, the attacker can also look out for certain services of servers in the LAN,
which are useful for his purposes. Because services of the servers are identified over certain ports of the TCP/IP protocol,
the search for open ports is also called “port scanning”. On the occasion, the attacker starts an inquiry for particular
services with a certain program, either generally from the Internet, or, only on certain networks and unprotected
workstations, which in turn will give the according answer.
A third possibility is to access an existing data connection and use it as a free-rider. The attacker observes here the
Internet connection of the victim and analyses the connections. Then he uses e. g. an active FTP connection to smuggle
his own data packets into the protected LAN.
A variant of this method is the “man-in-the-middle” attack. The attacker observes here first the communication of two
workstations, and gets then in between.
8.1.4 The victims
The question about the degree of exposure for an attack influences to a considerable degree the expenditure one wants
to or must meet for defending. In order to assess whether your network would be particularly interesting for an attacker
as a potential victim, you can consult the following criteria:
1
Particularly endangered are networks of common known enterprises or institutions, where valuable information is
suspected. Such information would be e.g. the results of research departments, which are gladly seen by industrial
spies. Or, on the other hand, bank servers, on which big money is distributed.
1
Secondly, also networks of smaller organizations are endangered, which perhaps are only interesting to special
groups. On the workstations of tax consultants, lawyers or doctors do slumber certainly some information quite
interesting for third persons.
1
Last but not least also workstations and networks are victims of attackers, which obviously offers no use for the
attackers. Just the “script kiddies” testing out their possibilities by youthful ambition are sometimes just searching
for defenceless victims in order to practise for higher tasks.
The attack against an unprotected, apparently not interesting workstation of a private person can also serve the
purpose to prepare a basis for further attacks against the real destination in a second step. The workstation of “no
interest” becomes source of attacks in a second step, and he attacker can disguise his identity.
All things considered, we can resume that the statistical probability for an attack to the network of a global player of
the industry may be higher than to a midget network of the home office. But probably it is only a matter of time that a
defenceless workstation installed in the Internet will - perhaps even accidentally - become the victim of attacks.
8.2 What is a Firewall?
The term “Firewall” is interpreted very differently. We want to define at this point the meaning of “Firewall” within the
boundaries of this reference manual.
494
Reference Manual
8 Firewall
A Firewall is a compilation of components, which monitors at a central place the data exchange between two networks.
Mostly the Firewall monitors the data exchange between an internal, local network (LAN), and an external network like
the Internet.
The Firewall can consist of hard and/or software components:
1
In pure hardware systems the Firewall software often runs on a proprietary operating system.
1
The Firewall software can also run on a conventional workstation, which is dedicated to this task under Linux, Unix
or Windows.
1
As a third and frequently used alternative, the Firewall software runs directly within the router, which connects the
LAN to the Internet.
In the following sections we only look at the Firewall in a router.
5
The functions “Intrusion Detection” and “DoS protection“ are part of the content of a Firewall in some applications.
The LANCOM contains these functions also, but they are realised as separate modules beside the Firewall. Further
information can be found in the section and .
8.2.1 Tasks of a Firewall
Checking data packets
How does the Firewall supervises the data traffic? The Firewall works in principle like a door keeper for data packets:
Each packet will be checked, whether it may pass the door of the network (Firewall) in the desired direction or not. For
such a checking different criteria are used, in common language of Firewalls called “rules” or “guidelines”. Depending
on the kind of information, which are used for creation of the rules and which are checked during the operation of the
Firewall, one distinguishes different types of Firewalls.
Above all, the aspect of the “central” positioning is very Important: Only when the entire data traffic between “inside”
and “outside” goes through the Firewall, it can fulfil its task reliably under any circumstances. Each alternative way can
reduce or even turn off the security of the Firewall. This central position of the Firewall simplifies by the way also the
maintenance: One Firewall as common passage between two networks is certainly easier to maintain than a “Personal
Firewall” on each of the workstations belonging to the LAN.
5
In principle, Firewalls operate at the interconnection between two or more networks. For the following explanation,
we only look as example at the passage between a local network of a company and the Internet. These
explanations can be transferred however in a general manner also to other network constellations, e.g. for the
protection of a subnetwork of the personnel department of a company against the remaining network users.
Logging and alerting
An important function of the Firewall is beside the checking of data packets and the right reaction to the results of this
checking also the logging of all actions triggered by the Firewall. By analyzing these protocols, the administrator can
draw conclusions from the occurred attacks and on the basis of this information he can, if necessary, go on to improve
the configuration of the Firewall.
But sometimes, logging alone comes too late. Often, an immediate intervention of the administrator can prevent a major
danger. That is why Firewalls have mostly an alerting function, by which the Firewall notifies the administrator e.g. by
e-mail.
8.2.2 Different types of Firewalls
During the last years, the operating principles of Firewalls have more and more evolved. Under the generic term “Firewall”,
a whole range of different technical concepts is offered to protect the LAN. Here we introduce the most important ones.
495
Reference Manual
8 Firewall
Packet filters
One speaks about a packet filter-based Firewall, if the router only checks the details in the header of the data packets
and decides on the basis of this information, whether the packet may pass or not. The following details belong to the
analyzed information:
1
IP address of source and destination
1
Transfer protocol (TCP, UDP or ICMP)
1
Port numbers of source and destination
1
MAC address
The rules defined in a packet filter-orientated Firewall determine e.g., whether the packets may pass on by a special IP
address range into the local network, or whether packets should be filtered for special services (i.e. with special port
numbers). By these measures, the communication with certain workstations, entire networks or via special services can
be reduced or even prevented. Besides, the rules are combinable, so that e.g. only workstations with special IP addresses
get access to the Internet via the TCP port 80, while this services remains blocked for all other workstations.
The configuration of packet filtering Firewalls is quite simple, and the list with the permitted or forbidden packets can
be extended very easily. Because also the performance requirements of a packet filter can be address with quite little
means, the packet filters are often directly implemented in routers, which operate as interface between the networks
anyway.
An unfavorable effect on the packet filters is, that the list of rules becomes uncomfortable after a while. Besides, for
some services the connection ports are negotiated dynamically. To enable communication then, the administrator has
to leave open all possibly used ports, which is contrary to the basic orientation of most security concepts.
One example for a process, which is quite problematical for simple packet filters, is the establishing of a FTP connection
from a workstation of the own LAN to a FTP server in the Internet. By the generally used active FTP, the client (of the
protected LAN) sends an inquiry from a port of the upper range (>1023) to port 21 of the server. The client informs the
server, over which port it is expecting the connection. The server will establish as a result from its port 20 a connection
to the desired port of the client.
INTERNET
Client
server
Source port 4321 Destination port 21
Source port 20Destination port 4322
To enable this process, the administrator of the packet filter must open all ports for incoming connections, because he
does not know in advance for which port the client will inquire the FTP connection. An alternative is to use passive FTP.
Thereby, the client establishes the connection itself to the server over a particular port, which was told to the server
before. This process is, however, not supported by all clients/servers.
If we furthermore compare the Firewall with a porter, this door keeper only checks, whether he knows or not the courier
with the packet at the door. If the courier is known and came ever into the building before, he has the permission to go
in without hindrance and without being checked also for all following orders up to the workplace of the addressee.
Stateful Packet Inspection
Stateful Packet Inspection (SPI), or briefly Stateful Inspection, enhances the packet filter approach by checking further
connection state information. Beside the more static table with the permitted ports and address ranges, a dynamic table
will be kept up in this variant, in which information about the connection state of the individual connections is held.
This dynamic table enables to first block all endangered ports, and to selectively open only if required a port for a
permitted connection (adjusted by source and destination address). The opening of ports is always made from the
protected network to the unprotected one, that means mostly from LAN to WAN (Internet). Data packets that do not
belong to one of the tracked session of the connection state table will be automatically discarded
496
Reference Manual
8 Firewall
Stateful Inspection: direction-dependent checking
The filter sets of a Stateful Inspection Firewall are - contrary to classical port filter Firewalls - dependent on their direction.
Connections can only be established from source to their destination point. The other direction would require an explicit
filter entry as well. Once a connection has been established, only the data packets belonging to this connection will be
transmitted - in both directions, of course. So you can block in a reliable way all traffic not belonging to a known session,
not coming from the local network.
Additionally, the Stateful Inspection is able to track from the connection set up, whether additional channels are negotiated
for data exchange or not. Some protocols like e.g. FTP (for data transfer), T.120, H.225, H.245 and H.323 (for netmeeting
or IP telephony), PPTP (for VPN tunnels) or IRC (for chatting) signalize when establishing the connection from the LAN
to the Internet by a particular used source port whether they are negotiating further ports with the remote station. The
Stateful Inspection dynamically adds also these additional ports into the connection state list, of course limited to the
particular source and destination addresses only.
Let’s have once again a look at the FTP download example. When starting the FTP session, the client establishes a
connection from source port '4321' to the destination port '21' of the server. The Stateful Inspection allows this first set
up, as long as FTP is allowed from local workstations to the outside. In the dynamic connection state table, the Firewall
enters source and destination and the respective port. Simultaneously, the Stateful Inspection can inspect the control
information, sent to port 21 of the server. These control signals indicate that the client requires a connection of the server
from its port 20 to port 4322 of the client. The Firewall also enters these values into the dynamic table, because the
connection to the LAN has been initiated from the client. Afterwards, the server can send so the desired data to the
client.
INTERNET
PC
PC
server
Destination port 4322
Destination port 4322
outgoing connection
permitted incoming connection
unauthorized incoming
connection
Source port 20
IP: 80.146.204.15
Source IP Des IP Sc. port Sc. port
21
4322
4321
20
80.190.240.17
10.0.0.1
10.0.0.1
80.190.240.17
But if another workstation from the Internet tries to use the just opened port 4322 of the LAN to file itself data from its
port 20 on the protected client, the Firewall will stop this try, because the IP address of the attacker does not fit to the
permitted connection!
5
After the successful data transfer, the entries disappear automatically from the dynamic table and the ports will
be closed again.
Moreover, a Firewall with Stateful Inspection is mostly able to re-assemble the received data packets, that means to
buffer the individual parts and to assemble them again to an complete packet. Therefore, complete IP packets can be
checked by the Firewall, rather than individual parts only.
This porter is making a definite better job. When somebody in this company orders a courier, he must also inform the
porter that he is expecting a courier, when he will be arriving and what information should be found on the delivery
note. Only when this information matches the logbook entries of the porter, the courier may pass. If the courier brings
not only one packet, but rather two, only the one with the correct delivery note will pass. Likewise, a second courier
demanding access to the employee will be rejected, too.
Application Gateway
By checking of contents on application level, Application Gateways increase the address checking of the packet filters
and the connection monitoring of the Stateful Packet Inspection. The Application Gateway runs mostly on a separate
workstation, because of the high demands to the hardware performance. This workstation is between the local network
497
Reference Manual
8 Firewall
and the Internet. Seen from both directions, this workstation is the only possibility to exchange data with the respective
other network. There doesn’t exist any direct connection between these two networks, but just to the Application Gateway.
INTERNET
server
Local Network
Local Network
Local Network
Application gateway
The Application Gateway is thus a kind of proxy for each of the two networks. Another term for this constellation is the
“dualhomed gateway”, because this workstation is so to speak at home in two networks.
For each application to be allowed through this gateway, an own service will be set up, e.g. SMTP for mail, HTTP for
surfing the Internet or FTP for data downloads.
Local Network
Local Network
Local Network
server
HTTP
SMTP
FTP
Mail
This service accepts data received by either one of the two sides and depicts it to the respective other side. What seems
to be at first sight a needless mirroring of existing data, is on closer examination the far-reaching concept of Application
Gateways: It never exists a direct connection e.g. between a client of the local network and a server of the Internet. The
LAN workstations only see the proxy, the workstations of the Internet likewise. This physical separation of LAN and WAN,
makes it quite difficult for attackers to intrude into the protected network.
Applied to the porter example, the packet will be left at the gate, the courier is not allowed to enter the company
premises. The porter takes the packet, will open it after checking address and delivery note and will control also the
content. When the packet has taken these hurdles successfully, then the company internal courier will bring it himself
to the addressee of the company. He became proxy of the courier on company premises. The other way around, all
employees, wanting to send a packet, have to inform the porter, which has to collect the packet at the workstation place
and which will hand over the packet to the ordered courier at the gate.
5
Functions of Application Gateways are not supported by the LANCOM, mainly because of the high hardware
demands.
8.3 The LANCOM Firewall
After general explanations concerning the dangers of the Internet and the tasks and types of Firewalls, this chapter
describes special functions of the LANCOM Firewall and concrete configurations.
For LANCOM devices with VoIP functions that were already integrated or added in with a software option, the ports
required for voice connections are activated automatically.
498
Reference Manual
8 Firewall
8.3.1 How the LANCOM Firewall inspects data packets
The Firewall filters only those data packets out of the entire data stream running through the IP router of the LANCOM,
for which a special treatment has been defined.
VPN services
connection via LAN/Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
Router
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
Firewall / IDS / DoS / QoS
IP router
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
LAN / Switch
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
IPX over PPTP/VPN
Encryption:
802.11i/WPA/WEP
The Firewall only checks routed data packets!
The Firewall only checks data packets routed by the IP router of the LANCOM. In general, these are the data packets,
which are exchanged between one of the WAN interfaces and the internal networks (LAN, WLAN, DMZ).
For example, the communication between LAN and WLAN is normally not carried out by the router, as long as the LAN
bridge allows a direct exchange. Thus the Firewall rules do not apply here. The same applies to the so-called “internal
services” of the LANCOM like Telnet, TFTP, SNMP and the web server for the configuration with WEBconfig. The data
packets of these services do not run through the router, and therefore aren’t influenced by the Firewall.
5
Due to the positioning behind the masquerading module (seen from the WAN), the Firewall operates with the
“real” internal IP addresses of the LAN stations, and not with the outside known Internet address of the LANCOM.
The LANCOM Firewall uses several lists for checking data packets, which are automatically generated from Firewall rules,
resulting Firewall actions or by active data connections:
1
Host block list
1
Port block list
1
Connection list
1
Filter list
When a data packet should be routed via the IP router, the Firewall uses the lists as follows:
1. The first check is, whether the packet was coming from a workstation belonging to the host block list. If the sender
is blocked, the packet will be discarded.
2. If the sender is not blocked in this list, the port block list will be checked, if the used port/protocol combination on
the destination PC is closed. In this case the packet will be discarded.
3. If sender and destination are not blocked in the first two lists, then it will be checked whether a connection entry
exists for this packet in the connection list. If such an entry exists, then the packet will be handled as noted in this
list.
499
Reference Manual
8 Firewall
4. If no entry has been found for the packet, then the filter list will be searched, whether a suitable entry exists and
the action indicated in this list will be carried out. If the action intends to accept the packet, then an entry is made
in the connection list, as well as for any further actions.
VPN services
connection via LAN/Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
IP router
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
LAN / Switch
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
IPX over PPTP/VPN
Encryption:
802.11i/WPA/WEP
The Firewall proves with several lists!
Host blocked?
Port blocked?
Active connection?
Filter list?
5
If no explicit Firewall rule exists for a data packet, the packet will be accepted (’Allow-All’). That grants a
backward-compatibility for existing installations. For maximum protection by the Stateful Inspection, please note
the section .
The four lists obtain their information as follows:
1
In the host block list are all those stations listed, which are blocked for a certain time because of a Firewall action.
The list is dynamic, new entries can be added continuously with appropriate actions of the Firewall. Entries
automatically disappear after exceeding the timeout.
1
In the port block list those protocols and services are filed, which are blocked for a certain time because of a Firewall
action. This list is likewise a dynamic one, new entries can be added continuously with the appropriate Firewall
actions. Entries automatically disappear after exceeding the timeout.
1
For each established connection an entry is made in the connection list, if the checked packet has been accepted by
the filter list. In the connection list is noted from which source to which destination, over which protocol and which
port a connection is actually allowed. The list contains in addition, how long an entry will stay in the list and which
Firewall rule is responsible for the entry. This list is very dynamic and permanently “moving”.
1
The filter list is made of the Firewall rules. The containing filters are static and only changed when Firewall rules are
added, edited or deleted.
Thus all lists, which are consulted by the Firewall to check data packets, finally base on the Firewall rules.
8.3.2 Special protocols
One important point during the connection tracking is the treatment of protocols that dynamically negotiate ports and/or
addresses, over which further communication is done. Examples of these kinds of protocols are FTP, H.323 or also many
UDP-based protocols. Thereby it is necessary that further connections must be opened, additionally to the first connection.
See also .
UDP connections
UDP is actually a stateless protocol, nevertheless one can speak regarding UDP-based protocols also of a (only short
term) connection, since UDP mostly carries Request/Response based protocols, with which a client directs its requests
to a well known port of a server (e.g. 53 for DNS), which in turn sends its responds to the source port selected by the
client
:
500
Reference Manual
8 Firewall
Server portConnectionClient port
53Request12345
53Response12345
However, if the server wants to send larger sets of data (e.g. TFTP) and would not like or can not differentiate on the
well known port between requests and acknowledges, then it sends the response packets to the source port of the sender
of the original request, but uses as its own source port a free port, on which it reacts now only to those packets, which
belong to the data communication:
Server portConnectionClient port
69Request12345
54321Response12345
54321Ack/Data12345
54321Data/Ack12345
While the data communication takes place now over the ports 12345 and 54321, the server on the well-known port (69)
can accept further requests. If the LANCOM pursues a "Deny All" strategy, the answer packets of an entry of the port
filter Firewall, which permits only a connection to port 69 of the server, would simply be discarded. In order to prevent
this, when creating the entry in the connection state database, the destination port of the connection is kept free at first,
and set only with the arrival of the first answer packet, whereby both possible cases of an UDP connection are covered.
TCP connections
TCP connections cannot be tracked only by examination of the ports. With some protocols (e.g. FTP, PPTP or H.323)
examinations of the utilizable data are necessary to open all later negotiated connections, and to accept only those
packets belonging really to the connections. This corresponds to a simplified version of IP masquerading, but without
addresses or ports to be re-mapped here. It is sufficient to pursue the negotiation to open appropriate ports, and link
them with the main connection, so that these ports are closed likewise with the closing of the main connection, and
traffic on the secondary connection keeping open also the main connection.
ICMP connections
For ICMP two cases must be differentiated: The ICMP request/reply connections, like to be used with "ping", and the
ICMP error messages, which can be received as an answer to any IP packet.
ICMP request/reply connections can be clearly assigned to the identifier used by the initiator, i.e. in the status database
an entry will be provided with the sending of an ICMP request, which lets through only ICMP replies with the correct
identifier. All other ICMP replies will get discarded silently.
In ICMP error messages, the IP header and the first 8 bytes of the IP packet (on behalf UDP or TCP headers) can be found
within the ICMP packet. With the help of this information, the receipt of an ICMP error message triggers automatically
the search for the accessory entry in the status database. The packet passes only if such an entry exists, otherwise it is
discarded silently. Additionally, potentially dangerous ICMP error messages (redirect route) are filtered out.
501
Reference Manual
8 Firewall
Connections of other protocols
For all other protocols no related connections can be followed up, i.e. with them only a connection between involved
hosts can occur in the status database. These can be initiated also only from one side, unless, in the port filter Firewall
exists a dedicated entry for the "opposite direction".
8.3.3 General settings of the Firewall
Apart from individual Firewall rules, which ensure the entries in the filter, connection and block lists, some settings apply
generally to the Firewall:
1
Firewall/QoS enabled
1
Administrator email
1
Fragments
1
Re-establishing of the session
1
Ping blocking
1
Stealth mode
1
Mask authentication port
Firewall/QoS enabled
This option switches on or off the entire Firewall, including Quality of Service functions.
5
Please notice that the N:N mapping functions are only active when the Firewall has been switched on!
Administrator email
One of the actions a Firewall can trigger is alerting of an network administrator via email. The “administrator email” is
the email account, to which the alerting mails are sent to.
Fragments
Some attacks from the Internet try to outsmart the Firewall by fragmented packets (packets split into several small units).
One of the main features of a Stateful Inspection like in the LANCOM is the ability to re-assemble fragmented packets
in order to check afterwards the entire IP packet.
You can centrally adjust the desired behavior of the Firewall. The following options are available:
1
Filter: Fragmented packets are directly discarded by the Firewall.
1
Route: Fragmented packets are passed on without any further checking by the Firewall, as long as permitted by
valid filter settings.
1
Re-assemble: Fragmented packets are buffered and re-assembled to complete IP packets. The re-assembled packets
will then be checked and treated according to the valid filter settings.
Session recovery
The Firewall enters all actual permitted connections into the connection list. Entries disappear automatically from the
connection list after a certain time (timeout), when no data has been transmitted over this connection any more
re-triggering the timeout.
Sometimes connections are ended according to the general TCP aging settings, before data packets requested by an
inquiry have been received by the remote station. In this case perhaps an entry for a permitted connection still exists in
the connection list, but the connection itself is no more existing.
The parameter “Session recovery” determines the behavior of the Firewall for packets that indicate a former connection:
1
Always denied: The Firewall re-establishes the session under no circumstances and discards the packet.
1
Denied for default route: The Firewall re-establishes the session only if the packet wasn’t received via the default
route (e.g. Internet).
502
Reference Manual
8 Firewall
1
Denied for WAN: The Firewall re-establishes the session only if the packet wasn’t received over one of the WAN
interfaces.
1
Always allowed: The Firewall re-establishes the connection in principle if the packet belongs to a former connection
of the connection list.
5
The function of the virtual routers is based on the analysis of the interface-tag, that is why in addition to the
untagged default routes, as well other routes are included as default routes:
1
When a packet is received at a WAN interface, then the WAN interface is considered by the firewall to be a default
route if either a tagged or an untagged default route refers to this WAN interface.
2
If a packet is received at a LAN interface and is to be routed to a WAN interface, then this WAN interface is
considered to be a default route if either the untagged default route or if a default route tagged with the interface
tag refers to this WAN interface.
Default route filter are as well effective if the default route is in the LAN. Here it applies that the filter takes effect when:
1
A packet was received over a tagged LAN interface and is to be sent over a default route tagged with the interface,
or
2
A packet from another router was received at a tagged LAN interface and there is a default route with the interface
tag to the packet's source address, or
2
A packet was received from the WAN and is to be sent to the LAN via a default route with any tag
Ping blocking
One - not undisputed - method to increase security is hiding the router. Based loosely on the method: “Who doesn’t see
me neither tries to attack me...”. Many attacks begin with the searching for workstations and/or open ports by actual
harmless inquiries, e. g. with the help of the “ping” command or with a portscan. Each answer to these inquiries, even
the answer “I’m not here” indicates to the attacker that he has found a potential destination. Because anybody who
answers must be existing, too. In order to prevent this conclusion, the LANCOM is able to suppress the answers to these
inquiries.
In order to achieve this, the LANCOM can be instructed not to answer ICMP echo requests any more. At the same time
TTL-exceeded messages of a "trace route" are also suppressed, so that the LANCOM cannot be found, neither by "ping"
nor by "trace route".
Possible settings are:
1
Off: ICMP answers are not blocked.
1
Always: ICMP answers are always blocked.
1
WAN only: ICMP answers are blocked on all WAN connections.
1
Default route only: ICMP answers are blocked on default route (usually Internet).
5
The hints for the chapter Session recovery consider as well the choice of the default routes.
TCP Stealth mode
Apart from ICMP messages, also the behavior in case of TCP and UDP connections gives information on the existence
or non-existence of the addressed workstation. Depending on the surrounding network it can be useful to simply reject
TCP and UDP packets instead of answering with a TCP RESET resp. an ICMP message (port unreachable), if no listener
for the respective port exists. The desired behavior can be adjusted in the LANCOM.
5
If ports without listener are hidden, this generates a problem on masked connections, since the "authenticate"
- resp. "ident" service does no longer function properly (resp. do no longer correctly reject). The appropriate port
can so be treated separately.
Possible settings are:
503
Reference Manual
8 Firewall
1
Off: All ports are closed and TCP packets are answered with a TCP reset.
1
Always: All ports are hidden and TCP packets are silently discarded.
1
WAN only: On the WAN side all ports are hidden and on the LAN side closed.
1
Default route only: Ports are hidden on the default route (usually Internet) and closed on all other routes.
Mask authentication port
When TCP or UDP ports are hidden, inquiries of mail servers to authenticate users can no more be answered correctly.
Inquiries of the servers run into a timeout, and delivery of mails will be considerably delayed.
Also when the TCP Stealth mode is activated, the Firewall detects the intention of a station in the LAN to establish a
connection to a mail server. As a result, the needed port will be opened for a short time (20 seconds) solely for the
authentication inquiry.
This behavior of the Firewall in TCP Stealth mode can be suppressed specifically with the parameter “Always mask
authentication port, too“.
5
The activation of the option “Mask authentication port“ can lead to considerable delays for the dispatch and
receipt of e. g. emails or news!
A mail or a news server, which requests any additional information from the user with the help of this service, runs first
into a disturbing timeout, before it begins to deliver the mails. This service needs thus its own switch to hide and/or to
hold it “conformingly”.
The problem thereby is however that a setting, which hides all ports, but rejects the ident port is unreasonable - alone
by the fact that rejecting the ident port would make the LANCOM visible.
The LANCOM offers now the possibility to reject ident inquiries only by mail and news servers, and to discard those of
all other PCs. For this, the ident inquiries of the respective servers are rejected for a short time (20 seconds) when a mail
(SMTP, POP3 IMAP2) or a news server (NNTP) is calling up.
When the timeout is exceeded, the port will be hidden again.
8.3.4 Parameters of Firewall rules
In this section we describe the components of Firewall rules and the available options to set up the different parameters.
5
Information regarding definition of Firewall rules with the different kinds of configuration tools (LANconfig,
WEBconfig or Telnet) can be found in chapter and .
Components of a Firewall rule
A Firewall rule is at first defined by its name and some further options:
1
On/Off switch: Is the rule active for the Firewall?
1
Priority: Which is the priority of the rule?
1
Observe further rules: Should further Firewall rules be observed when this rule applies to a data packet?
1
Create VPN rule: Is this Firewall rule also used to create a VPN rule?
1
Routing Tag: When applying the routing tag further information about for instance the used service or protocol can
be used for selecting the target route. With this so called policy based routing a much better control of the routing
behaviour is possible.
Priority
When setting up the filter list of the Firewall rules, the LANCOM will automatically sort the entries. Thereby the “grade
of detail“ will be considered: All specified rules are observed at first, after that the general ones (e. g. Deny All).
If after the automatic sorting the desired behavior of the Firewall does not turn out, it is possible to change the priority
manually. The higher the priority of the Firewall rule, the earlier it will be placed in the according filter list.
504
Reference Manual
8 Firewall
5
For complex rule types please check the filter list as described in section .
Observe further rules
There are requirements to a Firewall, which cannot be covered by a single rule. If the Firewall is used to limit the Internet
traffic of different departments (in own IP subnetworks), individual rules cannot e.g. illustrate the common upper limit
at the same time. If to everyone of e.g. three departments should be granted a bandwidth of maximal 512 kbps, but the
entire data rate of the three departments should not exceed a limit of 1024 kbps, then a multi-level checking of the data
packets must be installed:
1
In a first step it will be checked, if the actual data rate of the individual department does not exceed the limit of 512
kbps.
1
In a second step it will be checked, if the data rate of all departments together does not exceed the overall limit of
1024 kbps.
Normally the list of the Firewall rules is applied sequentially to a received data packet. If a rule applies, the appropriate
action will be carried out. The checking by the Firewall is terminated then, and no further rules will be applied to the
packet.
In order to reach a two-stage or multi-level checking of a data packet, the “Observe further rules option“ will be activated
for the rules. If a Firewall rule with activated observation of further rules applies to a data packet, the appropriate action
will be carried out at first, but then the checking in the Firewall will continue. If one of the further rules applies also to
this data packet, the action being defined in this rule will also be carried out. If also for this following rule the observe
further rules option is activated, the checking will be continued until
1
either a rule applies to the packet, for which observe further rules is not activated.
1
or the list of the Firewall rules has been completely worked through without applying a further rule to the packet.
To realize this aforementioned scenario it is necessary to install for each subnetwork a Firewall rule that rejects from a
data rate of 512 kbps up additional packets of the protocols FTP and HTTP. For these rules the observe further rules
option will be activated. Defined in an additional rule for all stations of the LAN, all packets will be rejected which exceed
the 1024 kbps limit.
VPN rules
A VPN rule can receive its information about source and destination network from Firewall rules.
By activating the option “This rule is used to create VPN rules” for a Firewall rule, you determine that a VPN rule will be
derived from this Firewall rule.
If more than one local network is used (see ARF), the automatic extraction of the VPN rules has to be set up individually
for every network. The definition of networks with automatically generated VPN rules uses the interface tag which is
given for every network. This tag enables the allocation of local network to VPN route: Every packet received at a local
interface is marked with the interface tag and forwarded along a route with the same tag or with the default tag (0).
For automatic VPN rule generation, all networks are taken up that
1
Have the tag '0' or
1
Fulfill the two conditions as follow:
2
The network has the same interface tag as the IP-routing-table entry for the VPN connection (not to be confused
with the routing tag for the remote gateway).
2
The network is of the type 'Intranet'.
5
VPN rules for a DMZ also have to be manually created just as for networks with an interface tag which does
not fit to the routing tag of the VPN route.
505
Reference Manual
8 Firewall
Application of the firewall rules
Apart from this basic information, a Firewall rule answers the question when and/or on what it should apply to and
which actions should be executed:
1
Stations / Service: To which stations/networks and services/protocols does the rule refer to?
1
Conditions: Is the effectiveness of the rule reduced by other conditions?
1
Trigger: On exceeding of which threshold shall the rule being triggered?
1
Action: What should happen to the data packets when the condition applies and the limit is reached?
1
Further measures: Should further measures be initiated apart from the packet action?
1
Quality of Service (QoS): Are data packets of certain applications or with the corresponding markings transferred
preferentially by assurance of special Quality of Services?
5
Condition, limit, packet action and other measures form together a so-called “action set”. Each Firewall rule can
contain a number of action sets. If the same trigger is used for several action sets, the sequence of action sets
can be adjusted.
In section we have already described that in the end the lists for checking data packets are created from Firewall rules.
Thus the extension of the block diagram looks like as follows:
VPN services
connection via LAN/Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
IP router
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
LAN / Switch
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
PPTP/VPN
Encryption:
802.11i/WPA/WEP
Structure of the Firewall rules
Host?
Port?
Connection?
Filter?
Connection
Condition
Limit/trigger
Packet action
QoS
Other
Firewall rules
Connection
The connection of a Firewall rule defines to which data packets the rule should refer to. A connection is defined by its
source, its destination and the used services. The following details can be used to specify the source or destination:
1
All stations
1
The entire local network (LAN)
1
Certain remote stations (described by the name of the remote site list)
1
Certain stations of the LAN described by the host name)
1
Certain MAC
1
addresses
1
Ranges of IP addresses
1
MAC is the abbreviation for Media Access Control and it is the crucial factor for communication inside of a LAN. Every network
device has its own MAC address. MAC addresses are worldwide unique, similar to serial numbers. MAC addresses allow distinguishing
between the PCs in order to give or withdraw them dedicated rights on an IP level. MAC addresses can be found on most networking
devices in a hexadecimal form (e.g. 00:A0:57:01:02:03).
506
Reference Manual
8 Firewall
1
Complete IP networks
You can only operate with host names, when your LANCOM is able to transform the names into IP addresses. For that
purpose the LANCOM must have learned the names via DHCP or NetBIOS, or the assignment must be entered statically
in the DNS or IP routing table. An entry in the IP routing table can therefore assign a name to a whole network.
5
If the source or the destination for a Firewall rule has not been determined at greater detail, the rule applies
generally to data packets “from all stations” resp. “to all stations”.
The service is determined by the combination of an IP protocol with respective source and/or destination port. For
frequently used services (www, mail, etc.) the appropriate combinations are already predefined in the LANCOM, others
can be compiled additionally as required.
Condition
The effectiveness of a Firewall rule is also reduced with additional conditions. The following conditions are available:
1
Only packets with certain ToS and/or DiffServ markings.
1
Only, if the connection does not yet exist.
1
Only for default route (Internet).
1
Only for VPN routes.
Limit / Trigger
The limit or trigger describes a quantified threshold value that must be exceeded on the defined connection before the
filter action gets executed for a data packet. A limit is composed by the following parameters:
1
Unit (kbit, kbyte or packets)
1
Amount, that means data rate or number.
1
Reference value (per second, per minute, per hour or absolute)
Additionally, you can adjust for the limit whether it refers to a logical connection or to all connections together, which
exist between the defined destination and source stations via the corresponding services. Thus it is controlled whether
the filter takes effect, if e.g. all HTTP connections of the users in the LAN exceed the limit in sum, or whether it is sufficient
that only one of the parallel established HTTP connections exceeds the threshold value.
For absolute values it is additionally possible to specify whether the counter belonging to it will be reset to zero when
the limit has been reached.
5
In any case, data will be transferred if a limit has not been reached yet! With a trigger value of zero a rule becomes
immediately active, as soon as data packets arrive for transmission on the specified connection.
Packet action
The Firewall has three possibilities to treat a filtered packet:
1
Transmit: The packet will be transferred normally.
1
Drop: The packet will be discarded silently.
1
Reject: The packet will be rejected, the addressee receives an appropriate message via ICMP.
507
Reference Manual
8 Firewall
Further measures
The Firewall does not only serve to discard or accept the filtered data packets, but it can also take additional measures
when a data packet has been registered by the filter. The measures here are divided into the fields
“protocolling/notification” and “prevent further attacks”:
1
Send a Syslog message: Sends a message via the SYSLOG module to a SYSLOG client, as defined in configuration
field “Log & Trace”.
1
Send an email message: Sends an email message to the administrator, using the account specified in the
configuration field “Log & Trace”.
1
SNMP/LANmonitor: Sends a SNMP trap, that will be analyzed e. g. by LANmonitor.
5
Each of these three message measures leads automatically to an entry in the Firewall event table.
1
Disconnect: Cuts the connection, over which the filtered packet has been received.
5
On the occasion, the physical connection will be cut off (e. g. the Internet connection), not only the logical
connection between the two involved PCs!
1
Lock source address: Blocks the IP address from that the filtered packet has been received for a given time.
1
Lock target port: Blocks the destination port to that the filtered packet has been sent for a given time.
Quality of Service (QoS)
Apart from the restrictions for the transfer of data packets, the Firewall can also concede a “special treatment” to certain
applications. QoS settings use features of the Firewall to specifically identify data packets of certain connections or
services.
5
For further information about QoS and the appropriate configuration please see chapter .
8.3.5 Alerting functions of the Firewall
This paragraph describes the Firewall alerts in detail that are sent on security-relevant events. The following message
types are available:
1
Email notification
1
SYSLOG report
1
SNMP trap
Alerts are triggered either separately by the intrusion detection system, by the denial of service protection or by arbitrary
trigger conditions specified in the Firewall. The specific parameters for the different alerting types such as the relevant
email account can be set at the following places:
LANconfig: Log & TraceE/ SMTP Account E/ SNMP E/ SYSLOG
WEBconfig: LCOS menu tree E/ Setup / SMTP E/ SNMP Module / SYSLOG Module
An example:
Let us assume a filter named 'BLOCKHTTP', which blocks all access to a HTTP server 192.168.200.10. In case some station
would try to access the server nevertheless, the filter would block any traffic from and to this station, and inform the
administrator via SYSLOG also.
SYSLOG notifications
If the Firewall drops an appropriate packet, a SYSLOG notification is created as follows:
508
Reference Manual
8 Firewall
PACKET_ALERT: Dst: 192.168.200.10:80 {}, Src: 10.0.0.37:4353 {} (TCP):
port filter
Ports are printed only for port-based protocols. Station names are printed, if the LANCOM can resolve them directly
(without external DNS request).
If the SYSLOG flag is set for a filter entry (%s action), then this notification becomes more detailed. Then the filter name,
the exceeded limit and the filter action carried out are printed also. For the example above this should read as:
PACKET_ALERT: Dst: 192.168.200.10:80 {}, Src: 10.0.0.37:4353 {} (TCP):
port filter
PACKET_INFO:
matched filter: BLOCKHTTP exceeded limit: more than 0 packets transmitted
or received on a connection actions: drop; block source address for 1
minutes; send syslog message;
Notification by email
If the email system of the LANCOM is activated, then you can use the comfortable notification by email. The device sends
an email to the administrator as soon as the firewall executes the appropriate action:
FROM: LANCOM_Firewall@MyCompany.com TO: Administrator@MyCompany.com
SUBJECT: packet filtered
Date: 9/24/2002 15:06:46
The packet below
Src: 10.0.0.37:4353 {cs2} Dst: 192.168.200.10:80 {ntserver} (TCP)
45 00 00 2c ed 50 40 00 80 06 7a a3 0a 00 00 25 | E..,.P@. ..z....% c0
a8 c8 0a 11 01 00 50 00 77 5e d4 00 00 00 00 | .......P .w^..... 60 02
20 00 74 b2 00 00 02 04 05 b4 | `. .t... ....
matched this filter rule: BLOCKHTTP and exceeded this limit: more than
0 packets transmitted or received on a connection
because of this the actions below were performed: drop block source
address for 1 minutes send syslog message send SNMP trap send email to
administrator
509
Reference Manual
8 Firewall
Sending the email from the LANCOM to the administrator only works if the right email address is entered.
LANconfig: Firewall/QoS / General
WEBconfig: LCOS menu tree / Setup / IP Router / Firewall
For sending an email there needs to be set up an email account.
LANconfig: Log & Trace E SMTP Account
WEBconfig: LCOS menu tree / Setup / SMTP
Notification by SNMP trap
If as notification method dispatching SNMP traps was activated (see also ), then the first line of the logging table is sent
away as enterprise specific trap 26. This trap contains additionally the system descriptor and the system name from the
MIB-2.
510
Reference Manual
8 Firewall
For the example the following trap is thus produced:
SNMP: SNMPv1; community = public; SNMPv1 Trap; Length = 443 (0x1BB)
SNMP: Message type = SNMPv1
SNMP: Version = 1 (0x0)
SNMP: Community = public
SNMP: PDU type = SNMPv1 Trap
SNMP: Enterprise = 1.3.6.1.4.1.2356.400.1.6021
SNMP: Agent IP address = 10.0.0.43
SNMP: Generic trap = enterpriseSpecific (6)
SNMP: Specific trap = 26 (0x1A)
SNMP: Time stamp = 1442 (0x5A2)
SNMP: OID = 1.3.6.1.2.1.1.1.0 1.
5
System descriptor
SNMP: String Value = LANCOM Business 6021 2.80.0001 / 23.09.2002
8699.000.036
SNMP: OID = 1.3.6.1.2.1.1.5.0 2. System-Name
5
Device string
SNMP: String Value = LANCOM Business 6021
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.2.1 3.
5
Time stamp
SNMP: String Value = 9/23/2002 17:56:57
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.3.1 3.
5
Source address
SNMP: IP Address = 10.0.0.37
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.4.1 4.
5
Destination address
SNMP: IP Address = 192.168.200.10
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.5.1 5.
5
Protocol (6 = TCP)
SNMP: Integer Value = 6 (0x6) TCP
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.6.1 6.
5
Source port
511
Reference Manual
8 Firewall
SNMP: Integer Value = 4353 (0x1101)
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.7.1 7.
5
Destination port (80 = HTTP)
SNMP: Integer Value = 80 (0x50)
SNMP: OID = 1.3.6.1.4.1.2356.400.1.6021.1.10.26.1.8.1 8.
5
Name of the filter rule
SNMP: String Value = BLOCKHTTP
5
This trap and all different in the LANCOM generated traps are sent to all manually configured trap receivers, just
like to each registered LANmonitor, which can evaluate this and possibly all other traps.
8.3.6 Strategies for Firewall settings
Firewalls are the interface between networks, and they restrict to a smaller or larger extent an unhindered data exchange.
Thus Firewalls have opposite objectives than networks, although they are a part of them: networks should connect
workstations, Firewalls should prevent the connection.
This contradiction shows the dilemma of the responsible administrators who have developed subsequently different
strategies to solve this problem.
Allow All
The Allow All strategy favours unhindered communication of the employees compared over security. Any communication
is allowed at first, the LAN is still open for attackers. The LAN becomes gradually more secured by configuration of the
administrator, by settings of more and more new rules, which restrict or prevent parts of communication.
Deny All
The Deny All strategy proceeds at first according to the method “Block all!”. The Firewall blocks completely the
communication between the protected network and the rest of the world. In a second step, the administrator opens
address ranges or ports, which are necessary e.g. for daily communication with the Internet.
This approach ensures superior security for the LAN security compared to the Allow All strategy, but may lead especially
in its initial stages to difficulties for the users. After activation of the Deny All strategy, some things just may behave
differently than before, some stations may not reached any more etc.
Firewall with DMZ
The demilitarized zone (DMZ) is a special range of the local network, which is shielded by a Firewall both against the
Internet and against the normal LAN. All stations or servers that should be accessible from the unsecured network
(Internet) should be placed into this network. These include for example own FTP and web servers.
The Firewall protects at first the DMZ against attacks from the Internet. Additionally, the Firewall protects also the LAN
against the DMZ. To do so, the Firewall is configured in this way that only the following accesses are possible:
1
Stations from the Internet can access to the servers in the DMZ, but no access from the Internet to the LAN is possible.
1
The stations of the LAN can access the Internet, as well as servers in the DMZ.
512
Reference Manual
8 Firewall
1
Servers of the DMZ have no access to the stations of the LAN. That guarantees that no “cracked” server of the DMZ
becomes a security risk for the LAN.
PC
PC
PC
server
server
Router
INTERNET
Web server
FTP server
Local networkDMZ
Some LANCOM models support this structure by a separate LAN interface only used for the DMZ. Looking at the path
of data through the LANCOM, then the function of the Firewall for shielding the LAN against the DMZ becomes visible.
VPN services
connection via LAN/Switch
WAN interfaces
VPN / PPTP
DSLoL
ADSL
ISDN
DSL
LANCOM
user
management
RADIUS
client / server
IP module: NetBIOS, DNS,
DHCP server, RADIUS, RIP,
NTP, SNMP, SYSLOG, SMTP
IP router
IP-Redirect
Configuration &
management:
WEBconfig, Telnet, TFTP
IPX router
LANCAPI
LAN interfaces
LAN / Switch
WLAN-1-1
to
WLAN-1-8
WLAN-2-1
to
WLAN-2-8
DMZ
DHCP client / PPP
IP masquerading
N:N mapping
LAN bridge with “isolated mode”
Virtual LANs (VLAN)
MAC/protocol filter
Filter
Filter
IPX over PPTP/VPN
Encryption:
802.11i/WPA/WEP
A direct data exchange between LAN and DMZ via LAN bridge is not possible if a dedicated DMZ port is used. The path
from LAN to DMZ and vice versa is therefore only possible through the router, and thus also only through the Firewall!
This shields the LAN against inquiries from the DMZ, similar to the LAN against inquiries from the Internet.
5
The shielding of the DMZ against the Internet on one side and the LAN on the other is solved in many network
structures with two separate Firewalls. When using a LANCOM with DMZ port, only one device for this setup is
needed, which e.g. results in a clearly simplified configuration.
8.3.7 Hints for setting the Firewall
The LANCOM Firewall is an extremely flexible and powerful tool. In order to help you to creating individual Firewall rules,
you'll find in the following some hints for your specific application
For LANCOM devices with VoIP functions that were already integrated or added in with a software option, the ports
required for voice connections are activated automatically.
The default settings of the Firewall
On delivery there is exactly one entry in the Firewall rule table: “WINS”. This rule prevents unwanted connection set-ups
on the default route (gen. to the Internet) by the NetBIOS protocol. Windows networks send inquiries in regular intervals
into the network to find out if known stations are still available. This leads in case of a time-based account of a network
coupling to unwanted connection set-ups.
5
The LANCOM can prevent this by the integrated NetBIOS proxy also for network couplings, by pretending an
answer for the concerned resource, until a real access takes place.
513
Reference Manual
8 Firewall
Security by NAT and Stateful Inspection
If no further Firewall rule will be entered, the local area network is protected by the interaction of Network Address
Translation and Stateful Inspection: Only connections from the local area network produce an entry in the NAT table,
whereupon the LANCOM opens a communication port. The Stateful Inspection supervises communication via this port:
Only packets, which belong exactly to this connection may communicate via this port. For accesses from the outside to
the local network results thus an implicit "Deny All" strategy.
Transmitting firewall rules with scripts
With the help of scripts firewall rules can easily be transmitted to device and software. Example scripts are saved in the
LANCOM KnowledgeBase under www.lancom.de/support.
5
If you operate a web server in your LAN, that has been permitted access to this service from the outside , stations
from the Internet can establish from the outside connections to this server. The inverse masquerading has priority
over the Firewall in this case, as long as no explicit "Deny All" rule has been set.
Set-up of an explicit "Deny All" strategy
For maximum protection and optimum control of the data traffic it is recommended to prevent first any data transfer by
the Firewall. Then only the necessary functions and communication paths are allowed selectively. This offers e.g. protection
against so-called "Trojans" and/or e-mail viruses, which set up actively an outgoing connection on certain ports.
Deny All: The most important Firewall rule!
The Deny All rule is by far the most important rule to protect local networks. By this rule the Firewall operates according
to the principle: “All actions, which are not explicitly allowed, remain forbidden!“ Only by this strategy the administrator
can be sure not to have “forgotten” an access method, because only those accesses exist, which have been opened
explicitly by himself.
We recommend to set up the Deny All rule before connecting the LAN via a LANCOM to the Internet. Then you can
analyse in the logging table (to start e. g. via LANmonitor), which connection attempts have been blocked by the Firewall.
With the help of this information the Firewall and the “Allow rules“ can be gradually extended.
Some typical applications are shown in the following.
5
All filters described here can be installed very comfortably with the Firewall wizard, and if necessary be further
refined with e.g. LANconfig.
1
Example configuration “Basic Internet”
Service
(target port)
ActionDestinationSourceRule name
HTTP, HTTPStransmitAll stationsLocal networkALLOW_HTTP
FTPtransmitAll stationsLocal networkALLOW_FTP
MAIL, NEWStransmitAll stationsLocal networkALLOW_EMAIL
DNStransmitIP address of LANOM
(or: Local network)
Local networkALLOW_DNS_FORWARDING
ANYrejectrejectAll stationsDENY_ALL
1
If you want to permit a VPN dial-in to a LANCOM acting as VPN gateway, then you need a Firewall rule allowing
incoming communication from the client to the local network:
ServiceActionDestinationSourceRule
ANYtransmitLocal networkremote site nameALLOW_VPN_DIAL_IN
514
Reference Manual
8 Firewall
1
In case a VPN is not terminated by the LANCOM itself (e.g. a VPN Client in the local area network, or LANCOM as
Firewall in front of an additional VPN gateway), you'd have to allow IPSec and/or PPTP (for the "IPSec over PPTP" of
the LANCOM VPN Client) ports additionally:
Service
(target port)
ActionDestinationSourceRule
IPSEC, PPTPtransmitVPN ServerVPN ClientALLOW_VPN
1
For ISDN or V.110 dial-in (e.g. by HSCSD mobile phone) you have to allow the particular remote site (see also ):
ServiceActionDestinationSourceRule
ANYtransmitLocal networkremote site nameALLOW_DIAL_IN
1
For a network coupling you permit additionally the communication between the involved networks:
ServiceActionDestinationSourceRule
ANYtransmitLAN2LAN1ALLOW_LAN1_TO_LAN2
ANYtransmitLAN1LAN2ALLOW_LAN2_TO_LAN1
1
If you operate e.g. an own web server, you selectively allow access to the server:
Service
(target port)
ActionDestinationSourceRule
HTTP, HTTPStransmitWebserverANYALLOW_WEBSERVER
1
For diagnostic purposes it is helpful to allow ICMP protocols (e.g. ping):
ServiceActionDestinationSourceRule
ICMPtransmitANYLocal networkALLOW_PING
These rules can now be refined as needed - e.g. by the indication of minimum and maximum bandwidths for the server
access, or by a finer restriction on certain services, stations or remote sites.
5
The LANCOM automatically sorts Firewall rules when creating the filter list. Thereby, the rules are sorted into
the filter list on the basis of their level of detail. First all specific rules are considered, afterwards the general
ones (e.g. Deny All). Examine the filter list in case of complex rule sets, as described in the following section.
515
Reference Manual
8 Firewall
8.4 Configuring the firewall with LANconfig
8.4.1 Firewall wizard
The fastest method to configure the Firewall is provided by the Firewall wizard in LANconfig:
8.4.2 Definition of firewall objects
When configuring the firewall with LANconfig, various objects can be defined that are used in the firewall rules. This
means that frequently used definitions (such as a particular action) do not need to be re-entered for every rule. Instead
they can be stored once at a central location.
5
Please note that a change to firewall objects affects all of the firewall rules that use this object. For this reason,
all firewall rules that also use these objects are displayed when you make changes to firewall objects.
516
Reference Manual
8 Firewall
5
Existing firewalls (in the % notation) are not automatically converted to the object-orientated form when the
configuration is opened in LANconfig. The LANCOM KnowledgeBase contains the pre-defined firewall settings
used by the new objects.
517
Reference Manual
8 Firewall
Action objects
Here you specify here the firewall action, which is comprised of condition, limit, packet action and other measures to be
used by the firewall rules.
QoS objects
Here you set the minimum bandwidths that the firewall rules allocate to data packets.
518
Reference Manual
8 Firewall
Station objects
This is where the stations are defined that the firewall rules are to use as packet sender or addressee. The station objects
are not restricted to any particular source or destination, but can be used as required by the firewall rules. In the context
of Advanced Routing and Forwarding (ARF) you can specify a certain IP network as station object.
Service objects
The IP protocols and the source/destination ports to be used by the firewall rules are defined here.
8.4.3 Defining firewall rules
The firewall rules are shown in a clearly laid-out table containing the following information:
1
In the left-most column, icons indicate the status of the firewall rule:
2
Green check-mark: Firewall rule is enabled.
2
Red cross: Firewall rule is disabled.
2
Lock: Firewall rule is used to create VPN rules manually.
2
Two interlinked arrows: If this firewall rule applies, please observe other rules.
1
Name of firewall rule
519
Reference Manual
8 Firewall
1
Source
1
Destination
1
Source and destination service
1
Action/QoS
1
Comment
Adding a new firewall rule
When creating a new firewall rule, the general data is entered first. Objects already defined can be selected directly from
the tabs for Actions, QoS, Stations and Services. New objects that can also be used in other rules can be created here,
as user-defined entries that are only to be used in the active firewall rule.
520
Reference Manual
8 Firewall
Editing firewall rules
When editing an existing firewall rule, the user is shown whether actions, QoS, stations or services have been added as
pre-defined objects. A message is displayed if you try to edit a referenced object that is already used by another firewall.
8.5 Configuring firewall rules with WEBconfig or Telnet
8.5.1 Rule table
1
WEBconfig: Setup / IP router / Firewall / Rules
The rules table links various pieces of information on a firewall rule. The rule contains the protocol to be filtered, the
source, the destination and the firewall action to be executed. For every firewall rule there is also an on/off switch, a
priority, the option to link with other rules, and activation of the rule for VPN connections.
521
Reference Manual
8 Firewall
Just as with LANconfig, WEBconfig can be used to configure the firewall with the help of objects. The % notation described
as follows is only necessary for defining objects or actions.
5
Existing firewalls in the % notation are not automatically converted to the object-orientated form. However, the
LANCOM KnowledgeBase contains the pre-defined firewall settings used by the new objects.
5
Devices with LCOS version 7.6 or later are automatically pre-defined with the main firewall objects. When
processing older configurations with LANconfig, the firewall's standard objects are added automatically.
LCOS has a special syntax to define firewall rules. This syntax enables the representation of complex interrelationships
for the testing and handling of data packets in the firewall with just a few characters. The rules are defined in the rules
table. Pre-defined objects can be stored in two further tables so that frequently used objects do not have to be entered
into the LCOS syntax every time:
1
The firewall actions are stored in the action table
1
The object table holds the stations and services
5
The objects from these tables can be used for rule definition, although this is not compulsory. They merely simplify
the use of frequently used objects.
The definition of firewall rules can contain entries in the object table for protocols, services, stations and the action table
for firewall actions, and also direct definitions in the appropriate LCOS syntax (e.g. %P6 for TCP).
5
For direct input of level parameters in the LCOS syntax, the same rules apply as specified in the following sections
for protocols, source/destination and firewall actions.
8.5.2 Object table
1
WEBconfig: Setup / IP router / Firewall / Objects
Elements/objects that are to be used in the firewall rules table are defined in the objects table. Objects can be:
1
Individual computers (MAC or IP address , hostname)
1
Complete networks
1
Protocols
1
Services (ports or port areas, e.g. HTTP, Mail&News, FTP, ...)
These elements can be combined and hierarchically structured in any way. For example, objects for the TCP and UDP
protocols can be defined first. Building upon this, objects can subsequently be created, for example, for FTP (= TCP +
ports 20 and 21), HTTP (= TCP + port 80) and DNS (= TCP, UDP + port 53). These can in turn be combined into one
object that contains all the definitions of the individual objects.
522
Reference Manual
8 Firewall
8.5.3 Action table
1
WEBconfig: Setup / IP Router / Firewall / Actions
A firewall action comprises of a condition, a limit, a packet action and other measures.
As with the elements of the object table, firewall actions can be given a name and be combined with each other in any
way recursively. The maximum recursion depth is limited to 16. They can also be entered into the actions field of the
rules table directly.
8.6 Firewall diagnosis
All events, conditions and connections of the Firewall can be logged and monitored in detail.
The most comfortable inspection is accomplished by displaying the logging table (see below) with LANmonitor. LANmonitor
displays under ’Firewall’ the last five events, that were triggered either by a Firewall rule, the DoS, or the IDS system
with activated ’SNMP/LANmonitor’ option.
A new window with the complete logging table opens by clicking the right mouse button in the Firewall Event Log
context menu.
All lists and tables described in this section can be found under the following menu options:
WEBconfig: LCOS menu tree / Status/ IP-Router-Statistics
8.6.1 The Firewall table
If an event occurred that had to be logged in either way, i.e. a log action was specified with the receipt of a packet, or
a report by e-mail, Syslog or SNMP was generated, then this event is held in the logging table.
523
Reference Manual
8 Firewall
If you call up the logging table via LANmonitor, it looks like the following depiction:
If you call up the logging table via WEBconfig, it looks like the following depiction:
The table contains the following values:
Element meaningElement
Current index (so that the table can be polled also via SNMP)Idx.
System time in UTC codification (will be transformed on displaying of the table into clear text)System time
Source address of the filtered packetSrc address
Destination address of the filtered packetDst address
Protocol (TCP, UDP etc.) of the filtered packetProt.
Source port of the filtered packet (only with port-related protocols)Src-p
Destination port of the filtered packet (only with port-related protocols)Dst-p
Name of the rule, which has raised the entry.Filter-Rule
Bit field, which describes the crossed limit, which has filtered the packet. The following values are
defined at present: 0x01 Absolute number 0x02 Number per second 0x04 Number per minute 0x08
Limit
Number per hour 0x10 Global limit 0x20 Byte limit (if not set, it concerns a packet-related limit)
0x40 Limit applies only in receiving direction 0x80 limit applies only in transmission direction
Exceeded limit value of the trigger limitThreshold
524
Reference Manual
8 Firewall
Element meaningElement
Bit field, which specifies all implemented actions. At present the following values are defined:
0x00000001 Accept 0x00000100 Reject 0x00000200 Connect filter 0x00000400 Internet- (Default
Action
route-) filter 0x00000800 Drop 0x00001000 Disconnect 0x00004000 Block source address
0x00020000 Block destination address and port 0x20000000 Send SYSLOG notification 0x40000000
Send SNMP trap 0x80000000 Send email
5
All Firewall actions are likewise displayed within the IP router trace. Furthermore, some LANCOM models have
a Firewall LED, which signals each filtered packet.
8.6.2 The filter list
The filter list allows to examine filters generated by rules defined in the action, object and rule table.
5
Please note that manually entered filter rules do not generate a fault indication and also no error message. If
you configure filters manually, you should in each case examine on the basis of the filter list whether the desired
filters were generated or not.
On Telnet level, the content of the filter list can be displayed with the command show filter:
Under WEBconfig the filter list has the following structure:
The individual fields in the filter list have the following meaning:
525
Reference Manual
8 Firewall
DescriptionEntry
Current indexIdx.
Protocol to be filtered, e.g. 6 for TCP or 17 for UDP.Prot
Ethernet source address of the packet to be filtered or 000000000000, if the filter should apply to all
packets.
Src MAC
Source IP address or 0.0.0.0, if the filter should apply to all packets.Src address
Source network mask, which determinates the source network together with the source IP address, or
0.0.0.0, if the filter should apply to packets from all networks.
Source mask
Start source port of the packets to be filtered.Q start
End source port of the packets to be filtered. Makes up the port range together with the start source port,
in which the filter takes effect. If start and end port are 0, then the filter is valid for all source ports.
Q end
Ethernet destination address of the packet to be filtered or 000000000000, if the filter should apply to
all packets.
Dst MAC
Destination address or 0.0.0.0, if the filter should apply to all packets.Dst address
Destination network mask, which determinates the destination network together with the destination IP
address, or 0.0.0.0, if the filter should apply to packets to all networks.
Dst mask
Start destination port of the packets to be filtered.Z start
Destination port of the packets to be filtered. Makes up the port range together with the start destination
port, in which the filter takes effect. If start and end port are 0, so the filter is valid for all destination
ports.
Z end
Into this column, the "main action" is unveiled as a text, which will be executed when the first limit has
been exceeded. The first limit can be also an implicit limit, e.g. if only one limit for the restriction of the
Action
throughput was configured. Then an implicit limit - linked with an "accept" action - is inserted. In this
case, "accept" is unveiled as main action. You can see the complete actions under the command show
filter.
Indicates whether it concerns a "first Match" rule (linked = no). Only with linked rules in the case of
applying of this rule, also further rules are evaluated.
Linked
Priority of the rule having generated the entry.Prio
8.6.3 The connection list
The connection table files source address, destination address, protocol, source port, destination port, etc. of a connection,
as well as possible actions. This table is sorted according to source address, destination address, protocol, source port
and destination port of the packet, which caused the entry in the table.
526
Reference Manual
8 Firewall
Under WEBconfig the filter list has the following structure:
The table contains the following elements:
Element meaningElement
Source address of the connectionSrc addr.
Destination address of the connectionDst addr.
Used protocol (TCP/UDP etc.). The protocol is decimally indicated.Protocol
Source port of the connection. The port is only indicated with port-related protocols (TCP/UDP) or protocols,
which own a comparable field (ICMP/GRE).
Src port
Destination port of the connection (with UDP connections, this one is occupied only with the first answer).Dst port
Each entry ages out with the time of this table, thus the table does not overflow with "died" connections.Timeout
In the flags the condition of the connection and further (internal) information are stored in a bit field. As
conditions the following values are possible: new, establish, open, closing, closed, rejected (corresponding
to the TCP flags: SYN, SYN ACK, ACK, FIN, FIN ACK and RST).
Flags
UDP connections know the conditions new, open and closing (the last one only, if the UDP connection is
linked with a condition-afflicted control path. This is e.g. the case with protocol H.323.).
Name of the remote station, over which the first packet has been received.Src route
Name of the remote station, where the first packet will be sent to.Dst route
Name of the rule, which has generated the entry (determines also the actions to be executed), when a
suitable packet is received.
Filter rule
Meaning of the flags of the connection list
Flag meaningFlag
TCP: SYN sent00000001
TCP: SYN/ACK received00000002
TCP: waiting for ACK of the server00000004
all: open connection00000008
TCP: FIN received00000010
TCP: FIN sent00000020
TCP: RST sent or received00000040
527
Reference Manual
8 Firewall
Flag meaningFlag
TCP: session will be re-established00000080
FTP: passive FTP connection will be established00000100
H.323: belonging to T.120 connection00000400
connection via loopback interface00000800
checking concatenated rules00001000
rule is catenated00002000
destination is on "local route"00010000
destination is on default route00020000
destination is on VPN route00040000
physical connection is not established00080000
source is on default route00100000
source is on VPN route00200000
no route for destination00800000
contains global actions with condition01000000
8.6.4 Port block list
Address, protocol and port of a destination station are filed in the port block list, if blocking of the destination port on
the destination station was selected as a filter’s packet action. This table is likewise a sorted semi-dynamic table. Sorting
is done according to address, protocol and port. The table contains the following elements:
Element meaningElement
Address of the station, to which the blocking should apply.Address
Used protocol (TCP/UDP etc.) The protocol is decimally indicated.Protocol
Port to close at the station. If the respective protocol is not port related, then the entire protocol for this
station becomes closed.
Port
Duration of the blocking in minutes.Timeout
Name of the rule, which has produced the entry (determines also the actions to be executed), when a
suitable packet is received.
Filter rule
8.6.5 Host block list
The address of a station is filed in the host block list, if blocking of the sender was selected in a filter’s packet action.
This table is a sender address sorted semi-dynamic table and contains the following elements:
Element meaningElement
Address of the station, to which the blocking should apply.Address
Duration of the blocking in minutes.Timeout
Name of the rule, which has generated the entry (determines also the actions to be executed), when a
suitable packet is received.
Filter rule
528
Reference Manual
8 Firewall
8.7 Firewall limitations
Apart from understanding the functioning of Firewalls, it is also very important to discern their limitations and to extend
them if necessary. The Firewall does not protect against malicious contents coming through the permitted ways into
your local network. It is true that certain effects of some viruses and worms are stopped, because communication is
blocked via the required ports, but no Firewall alone is a comprehensive protection against viruses.
Also monitoring of sensitive data in the Internet is not be prevented by a Firewall. If data once reaches the unsecured
net beyond the Firewall, then it is exposed to well-known dangers. Despite using a Firewall, any confidential information
such as contracts, passwords, development information etc. should be transmitted only over protected connections, i.e.
by using suitable data encryption and VPN connections.
8.8 Protection against break-in attempts: Intrusion Detection
A Firewall has the task to examine data traffic across borders between networks, and to reject those packets, which do
not have a permission for transmission. Beside attempts to access directly a computer in the protected network, there
are also attacks against the Firewall itself, or attempts to outwit a Firewall with falsified data packets.
Such break-in attempts are recognized, repelled and logged by the Intrusion Detection system (IDS). Thereby it can be
selected between logging within the device, email notification, SNMP traps or SYSLOG alarms. IDS checks the data traffic
for certain properties and detects in this way also new attacks proceeding with conspicuous patterns.
8.8.1 Examples for break-in attempts
Typical break-in attempts are falsified sender addresses ("IP Spoofing") and port scans, as well as the abuse of special
protocols such as e.g. FTP in order to open a port on the attacked computer and the Firewall in front of it.
IP Spoofing
With IP Spoofing the sender of a packet poses itself as another computer. This happens either in order to trick the Firewall,
which trusts packets from the own network more than packets from untrusted networks, or in order to hide the author
of an attack (e.g. Smurf).
The LANCOM Firewall protects itself against spoofing by route examination, i.e. it examines, whether a packet was
allowed to be received over a certain interface at all, from which it was received.
Portscan Detection
The Intrusion Detection system tries to recognize Portscans, to report and to react suitably on the attack. This happens
similarly to the recognition of a ’SYN Flooding’ attack: The "half-open" connections are counted also here, whereby a
TCP RESET, which is sent by the scanned computer, leaves a "half-open" connection open again.
If a certain number of half-open connections between the scanned and the scanning computer exist, then this is reported
as a port scan.
Likewise, the receipt of empty UDP packets is interpreted as an attempted port scan.
529
Reference Manual
8 Firewall
8.8.2 Configuration of the IDS
LANconfig: Firewall/QoS / IDS
WEBconfig: LCOS menu tree / Setup / IP-Router / Firewall
Apart from the maximum number of port inquiries, fragment action and the possible registration mechanisms, also these
reactions are possible:
1
The connection will be cut off.
1
The sender address will be blocked for an adjustable period of time.
1
The destination port of the scan will be blocked for an adjustable period of time.
8.9 Protection against “Denial of Service” attacks
Attacks from the Internet can be break-in attempts, as well as attacks aiming to block the accessibility and functionality
of individual services. Therefore a LANCOM is equipped with appropriate protective mechanisms, which recognize
well-known hacker attacks and which guarantee functionality.
8.9.1 Examples of Denial of Service Attacks
Denial of service attacks do profit from fundamental weaknesses of TCP/IP protocols, as well as from incorrect
implementations of TCP/IP protocol stacks. Attacks, which profit from fundamental weaknesses are e.g. SYN Flood and
Smurf. Attacks aiming at incorrect implementations are all attacks, which operate with incorrectly fragmented packets
(e.g. Teardrop), or which work with falsified sender addresses (e. g. Land). In the following some of these attacks are
described, their effects and possible countermeasures.
SYN Flooding
SYN Flooding means that the aggressor sends in short distances TCP packets with set SYN flag and with constantly
changing source ports on open ports of its victim. The attacked computer establishes as a result a TCP connection, replies
to the aggressor a packet with set SYN and ACK flags and waits now in vain for the confirmation of the connection
establishment. Hundreds of "half-open" TCP connections are staying thereby, and just consume resources (e.g. memory)
530
Reference Manual
8 Firewall
of the attacked computer. This procedure can go that far that the victim can accept no more TCP connection or crashes
due to the lack of memory.
An appropriate countermeasure of a Firewall is to supervise the number of "half-open" TCP connections, which exists
between two stations and to limit it. That means, if further TCP connections between these workstations were established,
these connections would be blocked by the Firewall.
Smurf
The Smurf attack works in two stages and paralyzes two networks at once. In the first step a Ping (ICMP echo Request)
packet with a falsified sender address is sent to the broadcast address of the first network, whereupon all workstations
in this network answer with an ICMP echo Reply to the falsified sender address, which is located in the second network.
If the rate of incoming echo requests is high enough, as well as the number of answering workstations, then the entire
incoming traffic of the second network is blocked during the attack and, moreover, the owner of the falsified address
cannot receive normal data any more during the attack. If the falsified sender address is the broadcast address of the
second network, also all workstations are blocked in this network, too.
In this case the DoS recognition of the LANCOM blocks passing packets, which are addressed to the local broadcast
address.
LAND
The land attack is a TCP packet that is sent with set SYN flag and falsified sender address to the victim workstation. The
bottom line is that the falsified sender address is equal to the address of the victim. With an unfortunate implementation
of TCP, the victim interprets the sent SYN-ACK again as SYN, and a new SYN-ACK is sent. This leads to a continuous loop,
which lets the workstation freeze.
In a more up to date variant, the loopback address “127.0.0.1” is taken as sender address, but not the address of the
attacked workstation. Sense of this deception is to outwit personal firewalls, which react in fact to the classical variant
(sender address = destination address), but which pass through the new form without hindrance. This variant is also
recognized and blocked by a LANCOM.
Ping of Death
The Ping of Death belongs to those attacks, which use errors when fragmented packets are reassembled. This functions
as follows:
In the IP header there is a field "fragment offset" that indicates in which place the received fragment is to be assembled
into the resulting IP packet. This field is 13 bits long and gives the offset in 8 byte steps, and can form an offset from 0
to 65528. With a MTU on the Ethernet of 1500 bytes, an IP packet can be made up to 65528 + 1500 - 20 = 67008
bytes. This can lead to an overrun of internal counters or to buffer overruns, and thus it can provoke the possibility to
the aggressor of implementing own code on the victim workstation.
In this case, the Firewall offers two possibilities:
Either, the Firewall reassembles the entire incoming packet and examines its integrity, or solely the fragment which goes
beyond the maximum packet size is rejected. In the first case, the Firewall itself can become the victim when its
implementation was incorrect. In the second case "half" reassembled packets accumulate at the victim, which are only
rejected after a certain time, whereby a new Denial of Service attack can result thereby if the memory of the victim is
exhausted.
Teardrop
The Teardrop attack works with overlapping fragments. After the first fragment another one is sent, which overlaps
completely within the first one, i.e. the end of the second fragment is located before the end of the first. If - due to the
indolence of the IP stack programmer - it is simply counted "new end" - "old end" when determining the number of
bytes to copy for the reassembly, then a negative value results, resp. a very large positive value, by which during the
copy operation parts of the memory of the victim are overwritten and thereupon the workstation crashes.
The Firewall has again two possibilities:
531
Reference Manual
8 Firewall
Either the Firewall reassembles and rejects if necessary the entire packet, or it holds only minimum offset and maximum
end of the packet and rejects all fragments, whose offset or end fall into this range. In the first case the implementation
within the Firewall must be correct, so that the Firewall does not become the victim itself. In the other case "half"
reassembled packets accumulate again at the victim.
Bonk/Fragrouter
Bonk is a variant of the Teardrop attack, which targets not at crashing the attacked computer, but to trick simple port
filter Firewalls, which accept also fragmented packets and thus to penetrate into the network being protected. During
this attack, the UDP or TCP Header of the first fragment is overwritten by skillful choice of the fragment offset. Thereby,
simple port filter Firewalls accept the first packet and the appropriate fragments while overwriting the first packet's
header by the second fragment. Thus suddenly a permissible packet is created, which rather actually should be blocked
by the Firewall.
Concerning this occurrence, the Firewall can itself either reassemble or filter only the wrong fragment (and all following),
leading to the problems already indicated by either one of the other solutions above.
5
By default installation all items are configured as "secure", i.e. maximal 100 permissible half-open connections
by different workstations (see SYN Flooding), at most 50 half-open connections of a single computer (see Portscan)
of fragmented packets to be reassembled.
8.9.2 Configuration of DoS blocking
LANconfig: Firewall/QoS / DoS
WEBconfig: LCOS menu tree / Setup / IP-Router / Firewall
5
In order to drastically reduce the susceptibility of the network for DoS attacks in advance, packets from distant
networks may be only accepted, if either a connection has been initiated from the internal network, or the
incoming packets have been accepted by an explicit filter entry (source: distant network, destination: local area
network). This measure already blocks a multitude of attacks.
For all permitted accesses explicitly connection state, source addresses and correctness of fragments are tracked in a
LANCOM. This happens for incoming and for outgoing packets, since an attack could be started also from within the
local area network.
532
Reference Manual
8 Firewall
This part is configured centrally in order not to open a gate for DoS attacks by incorrect configuration of the Firewall.
Apart from specifying the maximum number of half-open connections, fragment action and possible notification
mechanisms, also these more extensive possibilities of reaction exist:
1
The connection will be cut off.
1
The sender address will be blocked for an adjustable period of time.
1
The destination port of the scan will be blocked for an adjustable period of time.
However, always active are the following protection mechanisms:
1
Address examination (against IP Spoofing)
1
Blocking of broadcasts into local area network (against Smurf and Co).
8.9.3 Configuration of ping blocking and Stealth mode
LANconfig: Firewall/QoS / General
WEBconfig: LCOS menu tree / Setup / IP-Router / Firewall
8.10 Addition(s) to LCOS 7.80
8.10.1 Increased DoS threshold value for central devices
Denial-of-Service attacks take advantage of inherent weaknesses in the TCP/IP protocol in combination with poor
implementations.
1
Attacks which target these inherent weaknesses include SYN Flood and Smurf.
1
Attacks which target erroneous implementations include those operating with erroneously fragmented packets (e. g.
Teardrop) or with fake sender addresses (e. g. Land).
Your device detects most of these attacks and reacts with appropriate countermeasures. Detecting these attacks relies
on counting the number of connections which are concurrently under negotiation (half-open connections). If the number
of half-open connections exceeds a certain threshold value, then the device assumes that a DoS attack is underway. The
actions and measures which are taken in this case can be defined, similar to firewall rules.
533
Reference Manual
8 Firewall
5
Central devices are connected to a large number of users, so it is possible for a large number of half-open
connections to exist without being caused by a DoS attack. For this reason, a higher default threshold value is
required for the accurate detection of DoS attacks.
LANconfig: Firewall/QoS / DoS
WEBconfig: LCOS menu tree / Setup / IP-Router / Firewall
1
Maximum half-open connections
Specifies the number of half-open connections which triggers DoS-attack countermeasures.
Possible values:
2
0 to 9999
Default:
2
100
2
1000 for central-site devices such as the 7100, 7111, 8011, 9100, 4025(+), 4100.
534
Reference Manual
8 Firewall
8.11 Addition(s) to LCOS 8.82
8.11.1 Source tags for firewall rules
Additions to the Setup menu
Source tag
The source tag (the expected interface- or routing tag) is used to identify the ARF context from which a packet was
received. This can be used to restrict firewall rules to certain ARF contexts.
Telnet path:
Setup > IP-Router > Firewall > Rules
Possible values:
0 - 65535
Comment
1
65535: The firewall rule is applied if the expected interface- or routing tag is 0.
1
1 - 65534: The firewall rule is applied if the expected interface- or routing tag is 1...65534.
1
0: Wildcard. The firewall rule is applied to all ARF contexts (the expected interface- or routing tag is
0...65535).
Default:
0
535
Reference Manual
8 Firewall
9 IPv6
9.1 IPv6 basics
IPv4 (Internet Protocol version 4) is a protocol for unique addressing of nodes in a network and, at the time of writing,
it has defined all of the IP addresses assigned globally. The limited availability of address space required the development
of IPv6 (Internet Protocol version 6), which is to replace the former standard. With a different IP-address structure, IPv6
provides for a greater range of IP addresses and thus increases the possible number of participants in networks worldwide.
9.1.1 Why use IPv6-standard IP addresses?
The new IPv6 standard was developed for the following reasons:
1
IPv4 address space allows for approximately four billion IP addresses for unique identities in networks. When the
IPv4 standard was implemented in the '80s this address space was considered to be sufficient. Due to the enormous
growth of the World Wide Web and the unexpectedly large number of computers and network devices, an address
shortage has arisen that the IPv6 standard is intended to bridge.
1
The increase in address space with IPv6 hampers the scanning of IP addresses by viruses and Trojans. The broader
spectrum provides greater protection against attacks.
1
IPv6 has been implemented with a view to the security requirements. For this reason it uses the security protocol
IPSec (IP Security). This provides secure network communications on layer 3 whereas many of IPv4 security mechanisms
only operate on higher layers.
1
Simplified, fixed descriptors for data packets save on router processing power and thus accelerate the available
throughput.
1
IPv6 allows for easier and faster transmission of data in real time, making it suitable for multimedia applications
such as Internet telephony and Internet TV.
1
So-called mobile IPs allow you to use a fixed IP address to login to different networks. This allows you to log on with
your laptop using the same IP address, whether you are in your home network, in a café or at work.
9.1.2 IP address structure according to the IPv6 standard
The new IPv6 addresses are 128 bits long and the range of possible addresses can cater for about 340 sextillion network
participants. IPv6 addresses consist of eight blocks of 16 bits and are written as hexadecimal numbers. The following is
an example of a possible IPv6 address:
2001:0db8:0000:0000:0000:54f3:dd6b:0001/64
To improve the legibility of these IP addresses, zeros at the beginning of a block of numbers are omitted. It is also possible
to omit one group of blocks that consist entirely of zeros. For the above example, one possible representation would be
as follows:
2001:db8::54f3:dd6b:1/64
An IPv6 address consists of two parts; a prefix and an interface identifier. The prefix denotes the membership of the IP
address to a network, while the interface identifier (e.g. in the case of auto-configuration) is generated from a link-layer
address, and thus belongs to a particular network card. The device can also generate interface identifiers from random
numbers. This improves security. In this way, multiple IPv6 addresses can be assigned to a single component.
The prefix describes the first part of the IP address. The length of the prefix is shown as a decimal number after a slash.
For the example given here the prefix is:
2001:db8::/64
536
Reference Manual
9 IPv6
The remainder of the IP address is the interface identifier. In our example, this is:
::54f3:ddb6:1
Compared with the IP addresses for the IPv4 standard, a number of changes have resulted in the structure of the new
IPv6 addresses:
1
While IPv4 addresses cater for an address space of 32 bits, the new length of 128 bits results in a significantly larger
address space with IPv6. IPv6 addresses are four times longer than IPv4 addresses.
1
An interface can have multiple IPv6 addresses due to the potential assignment of multiple prefixes to a single interface
identifier. With the IPv4 standard, an interface has only one IP address.
1
IPv4 addresses must be assigned by a central server. This is usually a DHCP server. However, IPv6 can operate an
auto-configuration, which makes the use of a DHCP server unnecessary. However, you the option of using a DHCP
server is still open to you.
9.1.3 Stages of migration
IPv6 is available to networks in a variety of ways. We make a distinction between environments with native IPv6 and
those which provide IPv6 through a tunnel.
1
Native IPv6: Native IPv6 describes a network that communicates to the outside only via IPv6. Users with IPv4
addresses can only access this network by communicating through a gateway that mediates between IPv6 and IPv4
networks.
1
IPv6 via dual stack: Dual stack refers to the parallel operation of IPv4 and IPv6 in a network. A router mediates
between devices that "speak" only IPv4 or IPv6. The clients select the protocol they need.
1
IPv6 tunneling: If a router does not have IPv6 Internet access, it can still access IPv6 networks by means of a tunnel.
9.2 IPv6 tunneling technologies
9.2.1 6in4 tunneling
6in4 tunnels are used to connect two hosts, routers, or to interconnect a host and router. This means that 6in4 tunnels
can connect two IPv6 networks via an IPv4 network. The diagram shows a static 6in4 tunnel between the local router
and a 6in4 gateway belonging to a tunnel broker.
80.25.211.2
2001:1234:ae12:32bd::/64
Dual Stack
IPv4 / IPv6
IPv4
IPv4
IPv4
IPv6
IPv4 IPv6
Internet
IPv6
IPv6
Provider Backbone
Tunnelbroker
216.66.84.46
Unlike 6to4, these are dedicated services operated by a known provider. The end-points are fixed and the tunnel broker
assigns a static prefix. The advantages of a 6in4 solution are that the gateways are fixed and the operator is known. The
fixed prefix from the tunnel broker also determines the number of possible subnets that can be used. A 64-bit prefix
(e. g. 2001:db8::/64) allows one subnet to be used. If a 48-bit prefix is used, 16 bits of the 64-bit prefix are available
for use. This allows the implementation of up to 65,536 subnets.
The disadvantage of the 6in4 technology is the higher administrative effort. You must be registered with and login to
the tunnel broker. In addition, the tunnel endpoints must be statically configured. Where a dynamic IPv4 address is used,
the relevant data must be updated regularly. This can be automated by running a script on a router.
537
Reference Manual
9 IPv6
6in4 is a relatively secure and stable technology for providing IPv6 Internet access. This technology is thus suitable for
operating web servers that are to be accessed over IPv6. The only drawback is the increased effort in administration.
This technology is also suitable for professional use.
9.2.2 6rd tunneling
6rd (rapid deployment) is a development of 6to4. The underlying function is identical. The difference is that just one
particular relay is used, as operated by a provider. This solves the two basic problems of the 6to4 technology—the lack
of security and stability. The prefix with 6rd is either configured manually or sent via DHCP (IPv4), which further reduces
the effort involved with configuration. The diagram is a schematic representation of a 6rd scenario.
80.25.211.2
2001:db8:5019:d302::/64
Dual Stack
IPv4 / IPv6
IPv4
IPv4
IPv6
IPv4 IPv6
Internet
IPv6
IPv6
Provider Backbone
6rd-Border-Relay
80.25.211.1
IPv4
The provider assigns the router with a prefix (2001:db8::/32), which the router then supplements with its own IPv4
address. The IPv6 address generated in this way has the form: 2001:db8:5019:d302::/64. This makes 6rd interesting
from two perspectives. The provider has a simple way to give its customers access to the IPv6 Internet. In addition,
customers benefit from greatly simplified usage. They do not have to accept the security risks of 6to4, nor do they have
to handle the complicated configuration of 6in4.
9.2.3 6to4 tunneling
6to4 tunneling offers you an easy way to set up a connection between two IPv6 networks via an IPv4 network. To this
end, what is known as a 6to4 tunnel is set up:
1
A router between the local IPv6 network and an IPv4 network serves to mediate between the networks.
1
The router has both a public IPv4 address and an IPv6 address. The IPv6 address consists of an IPv6 prefix and the
IPv4 address in hexadecimal notation. If a router such has the IPv4 address 80.25.211.2, this will first be converted
into hexadecimal notation: 5019:d302. Supplementing this is an IPv6 prefix (e.g. 2002::/16), so that the IPv6 address
for the router appears as follows: 2002:5019:d302::/48.
1
If a device in the IPv6 network sends data packets via the router to a destination address in the IPv4 network, then
the router first of all repacks the IPv6 packets and encapsulates them into a package with an IPv4 header. The router
then forwards the encapsulated package to a 6to4 relay. The 6to4 relay unpacks the packet and forwards it to the
desired destination. The following illustration shows the operating principle of 6to4 tunneling:
6to4 tunnels establish a dynamic connection between IPv6 and IPv4 networks: the response packets may be routed back
via a different 6to4 relay. 6to4 tunnels are not a point-to-point connection. For every new connection, the router always
looks for the "nearest" public 6to4 relay. This is done using the anycast address 192.88.99.1. This aspect is an advantage
of 6to4 tunneling on the one hand, but it also presents a disadvantage on the other. Public 6to4 relays do not require
registration and are freely accessible. What's more, the dynamic connection is easily configured. In this way it is possible
for any user to create a 6to4 tunnel over a public relay, quickly and easily.
538
Reference Manual
9 IPv6
On the other hand, the dynamic connection means that the user has no influence on the choice of the 6to4 relay. The
provider of the relay is able to intercept or manipulate data.
9.3 DHCPv6
Compared to IPv4, clients in an IPv6 network do not require automatic address assignment from a DHCP server because
they use auto-configuration. However, because certain information such as DNS server addresses are not transmitted
during auto-configuration, certain application scenarios can benefit from a DHCP service on the IPv6 network.
9.3.1 DHCPv6 server
The use of a DHCPv6 server is optional for IPv6. In principle, a DHCPv6 server supports two modes:
1
Stateless: The DHCPv6 server does not distribute addresses but only information, such as DNS server addresses.
Using this method, clients generate their own IPv6 addresses by 'stateless address auto-configuration (SLAAC)'. This
method is particularly attractive for example for small networks in order to keep administration efforts to a minimum.
1
Stateful: The DHCPv6 server distributes IPv6 addresses, similar to IPv4. This method is more complicated, since a
DHCPv6 server has to assign and manage the addresses.
A DHCPv6 server distributes only the options that are explicitly requested by an IPv6 client, i. e. the server only assigns
an address to a client if it explicitly requests one.
Additionally, the DHCPv6 server can pass on prefixes to routers for further distribution. This method is referred to as
'prefix delegation'. A DHCPv6 client must have explicitly requested this prefix, however.
9.3.2 DHCPv6 client
The auto-configuration available with IPv6 networks makes it very easy and convenient to configure the clients.
However, in order for a client to receive additional information, such as a DNS server address, you must configure the
device so that it can activate the DHCPv6 client when necessary.
The settings for the DHCPv6 client ensure that a device receiving certain flags in the router advertisement will start the
DHCPv6 client, which can then send requests to the DHCPv6 server:
1
M flag: If an appropriately configured device receives a router advertisement with the 'M flag' set, the DHCPv6 client
will request an IPv6 address from the DHCPv6 server along with other information such as DNS server, SIP server
and NTP server.
1
O flag: With an 'O flag', the DHCPv6 client requests the DHCPv6 server for information such as a DNS server, SIP
server and NTP server only, but not an IPv6 address.
5
If the 'M-flag' is set, the 'O-flag' does not necessarily have to be set as well.
5
With IPv6, the default route is distributed via router advertisements and not via DHCPv6.
9.4 IPv4 VPN tunnel via IPv6
Until now it was not possible to set up a VPN between two remote stations using private IPv4 addresses to access the
Internet (e. g. 3G/4G networking).
539
Reference Manual
9 IPv6
This restriction no longer exists with IPv6, because every IPv6 device receives a public IPv6 address. Thus IPv6 can be
used to set up an IPv4 VPN tunnel to interconnect two remote IPv4 networks, regardless of the IPv4 WAN addresses
used at each site.
In the example shown, two local IPv4 networks are connected via an IPv4 VPN tunnel, which is established over an IPv6
Internet connection. The IPv4 VPN packets are given IPv6 headers and sent to the remote site via the IPv6 Internet
connection (either native or via tunnel broker).
9.4.1 Setup Wizard – Setting up an IPv4 VPN connection via IPv6
The Setup Wizard option "Connect two local area networks" helps you to set up a VPN connection.
1. Start LANconfig, for example from the Windows start menu with Start > Programs > LANCOM > LANconfig.
LANconfig now automatically searches the local network for devices. As soon as LANconfig has completed its search,
it presents a list of all the devices it found, if possible with a brief description, the IP address and the status.
2. Choose your device from the selection window in LANconfig and select the Setup Wizard button or use the menu
under Tools > Setup Wizard.
LANconfig first reads out the device configuration and then displays the selection window with the optional
applications.
3. Launch the action Connect two local area networks.
4. Follow the Wizard’s instructions and enter the necessary data.
5. As the gateway address, enter the IPv6 address of the gateway.
6. You can then close the Wizard with Finish.
The Setup Wizard writes the configuration to the device.
540
Reference Manual
9 IPv6
9.5 IPv6 firewall
9.5.1 Function
While the IPv4 firewall only controls the forwarding of IP data, the IPv6 firewall also regulates the functions of the access
lists for all IPv6 server services. Therefore, the IPv6 firewall is similar to a classic firewall design, which separately supports
the inbound and outbound communications, as well as forwarding. Since the LANCOM configuration specifically controls
communication, LCOS does not require an outbound firewall.
9.5.2 Configuration
The configuration of the IPv6 firewall is practically the same as the IPv4 firewall; however, it is performed separately.
The inbound and forwarding firewalls each have their own rule tables, which are similar in scope and structure to the
IPv4 firewall.
The rules are sorted with decreasing priority, i. e. the rule with the highest priority is at the top of the list. Rules of the
same priority are sorted by their precision, analogous to the IPv4 procedure. If a rule requires further actions, these are
also performed by firewall in sequence. Otherwise, firewall filtering is terminated after the current rule has been applied.
9.5.3 Default entries for the IPv6 firewall rules
By default, IPv6 firewall has a number of filter rules that are applied on incoming data streams.
Default entries for the inbound rules
This table contains the rules that the firewall will apply to inbound connections. The factory settings provide the following
rules for the most important applications:
1
ALLOW-ICMP, ACCEPT: Allow all connections using ICMPV6.
1
ALLOW-DHCP-CLIENT, ACCEPT: Allow communication with the DHCPv6 client.
1
ALLOW-VPN-CONFIG, ACCEPT-VPN: Allow VPN communication via HTTP, HTTPS, SNMP, SSH, TELNET, and TFTP.
1
ALLOW-DNS-SERVER-VPN, ACCEPT-VPN: Allow VPN communication with the internal DNS server.
1
DENY-ALL, REJECT-SNMP: Block all communication via SNMP.
1
ALLOW-CONFIG-LOCALNET, ACCEPT: Allow configuration in the local network via HTTP, HTTPS, SNMP, SSH,
TELNET, TFTP.
1
ALLOW-CONFIG-WAN, ACCEPT: Allow communication via the WAN interface via HTTPS, SSH.
1
ALLOW-DHCP-SERVER, ACCEPT: Allow communication with the DHCPv6 server.
1
ALLOW-DNS-SERVER, ACCEPT: Allow unsecured communication with the internal DNS server.
1
ALLOW-IPSEC, ACCEPT: Allow all VPN communication over IPSec.
1
ALLOW-IPSEC-HTTPS-ENCAPSULTION, ACCEPT: Allow all VPN communication with HTTPS over IPSec.
Default entries for the forwarding rules
This table contains the rules that the firewall will apply for forwarding data. The factory settings provide the following
rules for the most important applications:
1
ALLOW-VPN, ACCEPT-VPN: Allow all connections using IPSec.
1
DENY-ALL, REJECT-SNMP: Block all communication via SNMP.
1
ALLOW-OUTBOUND, ACCEPT-VPN: Allow all outbound communication.
9.5.4 IPv6 firewall log table
Similar to the IPv4 firewall, the IPv6 firewall provides a log table of events in the IPv6 environment.
541
Reference Manual
9 IPv6
The syntax of the log table is the same as the IPv4 log table with the exception of the IP address format (IPv6 addresses
are in hexadecimal format, IPv4 in decimal format).
Analyzing the IPv6 firewall log table with WEBconfig
You can open IPv6 log tables in WEBconfig with LCOS menu tree > Status > IPv6 > Firewall > Log table.
The items have the following meanings:
1
Idx.: Consecutive index. Furthermore, the table can also be checked via SNMP.
1
System time: System time in UTC encoding (converted to plain text for display).
1
Source addresses: Source address of the filtered packets.
1
Destination addresses: Destination address of the filtered packets.
1
Prot.: Protocol (TCP, UDP, etc.) of the filtered packets.
1
Source port: Source port of the filtered packet (only for port related protocols).
1
Destination port: Destination port of the filtered packet (only for port related protocols).
1
Filter rule: Name of the rule that created the entry.
1
Limit: Bit field that contains the description of the limit that caused the firewall to apply the filter. There following
values are currently defined:
2
0x01: Absolute number
2
0x02: Number per second
2
0x04: Number per minute
2
0x08: Number per hour:
2
0X10: Global limit
2
0x20: Byte limit (if not set, it is a packet limit)
2
0x40: Limit only applies in the inbound direction
2
0x80: Limit only applies in the outbound direction
1
Threshold: Threshold limit value of the triggering limit.
1
Action: Bit field which lists all the actions performed. There following values are currently defined:
2
0x00000001: Accept
2
0x00000100: Reject
2
0x00000200: Establish filter
2
0x00000400: Internet (default router) filter
2
0x00000800: Drop
2
0x00001000: Disconnect
2
0x00004000: Lock source address
542
Reference Manual
9 IPv6
2
0x00020000: Lock destination address and port
2
0X20000000: Send SYSLOG notification message
2
0x40000000: Send SNMP trap
2
0x80000000: Send e-mail
5
All firewall actions also appear in the IP router trace .
Analyzing the IPv6 firewall log table with LANmonitor
You can view the IPv6 log for a specific device in the LANmonitor.
To do this, start the LANmontor with Start > Programs > LANCOM > LANmonitor. You can also launch the LANmonitor
for a specific device with the context menu in LANconfig or with the keyboard shortcut Ctrl + M.
Via Device > View firewall event log you can view the firewall events for a selected device. The firewall events show
the last 100 actions of the firewall with the following details:
1
Idx
1
Time
1
Source address
1
Destination address
1
Protocol
1
Source port
1
Destination port
1
Firewall rule
1
Limit
1
Action
9.6 Additions to the Setup menu
9.6.1 Tunnel
Use this setting to manage the tunneling protocols to provide access to the IPv6 Internet via an IPv4 Internet connection.
Telnet path:
Setup > IPv6 > Tunnel
6in4
The table contains the settings for the 6in4 tunnel.
543
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Tunnel > 6in4
Peer name
Contains the name of the 6in4 tunnel.
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Peer-Name
Possible values:
Max. 16 characters
Default:
Blank
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65534
Default:
0
Gateway address
Contains the IPv4 address of the remote 6in4 gateway.
5
The 6in4 tunnel is only set up if the gateway can be reached by ping at this address.
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Gateway-Address
Possible values:
IP address in IPv4 notation, max. 64 characters
Default:
Blank
IPv4 routing tag
Here you define the routing tag that the device uses to determine the route to the associated remote gateway. The IPv4
routing tag specifies which tagged IPv4 route is to be used for the data packets to reach their destination address. The
following destination addresses can be entered:
544
Reference Manual
9 IPv6
1
6to4 anycast address
1
6in4 gateway address
1
6rd border relay address
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > IPv4-Rtg-tag
Possible values:
Max. 5 characters in the range 0 – 65534
Default:
0
Gateway IPv6 address
Contains the IPv6 address of the remote tunnel endpoint on the intermediate network, for example, "2001:db8::1".
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Gateway-IPv6-Address
Possible values:
IPv6 address with max. 43 characters
Default:
Blank
Local-IPv6-Address
Contains the local IPv6 address of the device on the intermediate network, for example "2001:db8::2/64".
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Local-IPv6-Address
Possible values:
Max. 43 characters
Default:
Blank
Routed IPv6 prefix
Contains the prefix that is routed from the remote gateway to the local device and that is to be used in LAN, e. g.
"2001:db8:1:1::/64" or "2001:db8:1::/48".
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Routed-IPv6-Prefix
Possible values:
Max. 43 characters
Default:
Blank
545
Reference Manual
9 IPv6
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for an individual tunnel interface here.
To enable the firewall globally for all interfaces, select IPv6 firewall/QoS enabled in the menu Firewall/QoS > General
.
5
Disabling the firewall globally means that the firewall is disabled for all interfaces, even if you enable this option.
Telnet path:
Setup > IPv6 > Tunnel > 6in4 > Firewall
Possible values:
Yes
No
Default:
Yes
6rd border relay
A LANCOM router can operate as a 6rd client or as a 6rd border relay. A 6rd client or 6rd CE router (customer edge
router) connects to an Internet service provider via a WAN connection and propagates the 6rd prefix to clients on the
LAN. A 6rd border relay operates in the provider's network and connects 6rd clients to the IPv6 network. Thus a 6rd
border relay used when an IPv6 connection is to be provided to 6rd routers.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay
Peer name
Contains the name of the 6rd border relay tunnel.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > Peer-Name
Possible values:
Max. 16 characters
Default:
Blank
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65534
546
Reference Manual
9 IPv6
Default:
0
IPv4 loopback address
Set the IPv4 loopback address, i.e. the address where the device operates as a 6rd border relay.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > IPv4-Loopback-Address
Possible values:
Max. 16 characters
Default:
Blank
6rd prefix
Defines the prefix used by this border relay for the 6rd domain, e. g. 2001:db8:/32. This prefix must also be configured
on all associated 6rd clients.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > 6rd-Prefix
Possible values:
Max. 24 characters as a prefix of an IPv6 address with up to four blocks of four hexadecimal digits each
Default:
Blank
IPv4 mask length
Defines the number of significant bits of IPv4 addresses that are identical within a 6rd domain. With mask length "0"
there are no identical bits. In this case, the entire IPv4 address is used to generate the delegated 6rd prefix.
The provider sets the mask length.
Example: The IPv4 address of the device is "192.168.1.99" (in hexadecimal: "c0a8:163"). In this case, the following are
examples of possible combinations:
6rd prefixMask length6rd domain
2001:db8:c0a8:163::/6402001:db8::/32
2001:db8:2:163::/64162001:db8:2::/48
2001:db8:2:3363::/64242001:db8:2:3300::/56
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > IPv4-Mask-Length
Possible values:
Max. 2 numbers in the range 0 – 32
547
Reference Manual
9 IPv6
Default:
0: The device uses the full IPv4 address.
DHCPv4 propagate
If you enable this function, the 6rd border relay distributes the prefix via DHCPv4 if the DHCPv4 client requests it.
5
If you do not enable this feature, you must manually configure the required 6rd settings for the 6rd clients.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > DHCPv4-Propagate
Possible values:
Yes
No
Default:
No
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for an individual tunnel interface here.
To enable the firewall globally for all interfaces, select IPv6 firewall/QoS enabled in the menu Firewall/QoS > General
.
5
Disabling the firewall globally means that the firewall is disabled for all interfaces, even if you enable this option.
Telnet path:
Setup > IPv6 > Tunnel > 6rd-Border-Relay > Firewall
Possible values:
Yes
No
Default:
Yes
6rd
The table contains the settings for the 6rd tunnel.
Telnet path:
Setup > IPv6 > Tunnel > 6rd
Peer name
Contains the name of the 6rd tunnel.
548
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Tunnel > 6rd > Peer-Name
Possible values:
Max. 16 characters
Default:
Blank
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > Tunnel > 6rd > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65534
Default:
0
Border relay address
Contains the IPv4 address of the 6rd border relay.
Telnet path:
Setup > IPv6 > Tunnel > 6rd4 > Border-Relay-Address
Possible values:
IPv4 address with max. 64 characters
Default:
Blank
IPv4 routing tag
Here you define the routing tag that the device uses to determine the route to the associated remote gateway. The IPv4
routing tag specifies which tagged IPv4 route is to be used for the data packets to reach their destination address. The
following destination addresses can be entered:
1
6to4 anycast address
1
6in4 gateway address
1
6rd border relay address
Telnet path:
Setup > IPv6 > Tunnel > 6rd > IPv4-Rtg-tag
Possible values:
Max. 5 characters in the range 0 – 65534
549
Reference Manual
9 IPv6
Default:
0
6rd prefix
Contains the prefix used by the provider for 6rd services, e. g. 2001:db8::/32.
5
If the 6rd prefix is assigned through DHCPv4, you have to enter "::/32" here.
Telnet path:
Setup > IPv6 > Tunnel > 6rd > 6rd-Prefix
Possible values:
Max. 24 characters
Default:
Blank
IPv4 mask length
Defines the number of significant bits of IPv4 addresses that are identical within a 6rd domain. With mask length "0"
there are no identical bits. In this case, the entire IPv4 address is used to generate the delegated 6rd prefix.
The provider sets the mask length.
Example: The IPv4 address of the device is "192.168.1.99" (in hexadecimal: "c0a8:163"). In this case, the following are
examples of possible combinations:
6rd prefixMask length6rd domain
2001:db8:c0a8:163::/6402001:db8::/32
2001:db8:2:163::/64162001:db8:2::/48
2001:db8:2:3363::/64242001:db8:2:3300::/56
Telnet path:
Setup > IPv6 > Tunnel > 6rd > IPv4-Mask-Length
Possible values:
Max. 2 numbers in the range 0 – 32
Default:
0
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for an individual tunnel interface here.
To enable the firewall globally for all interfaces, select IPv6 firewall/QoS enabled in the menu Firewall/QoS > General
.
5
Disabling the firewall globally means that the firewall is disabled for all interfaces, even if you enable this option.
550
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Tunnel > 6rd4 > Firewall
Possible values:
Yes
No
Default:
Yes
6to4
The table contains the settings for the 6to4 tunnel.
5
Connections through a 6to4 tunnel work with relays that are selected by the IPv4 Internet provider's backbone.
The device administrator has no influence on relay selection. Furthermore, the selected relay can change without
the administrator knowing about it. For this reason, connections via a 6to4 tunnels are suitable for test purposes
only. In particular, avoid using 6to4-tunnel data connections for productive systems or for the transmission of
confidential data.
Telnet path:
Setup > IPv6 > Tunnel > 6to4
Peer name
Contains the name of the 6to4 tunnel.
Telnet path:
Setup > IPv6 > Tunnel > 6to4 > Peer-Name
Possible values:
Max. 16 characters
Default:
Blank
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > Tunnel > 6to4 > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65535
Default:
0
551
Reference Manual
9 IPv6
Gateway address
Contains the IPv4 address of the 6to4 relay or 6to4 gateway. Default value is the anycast address "192.88.99.1". In
general, you can leave this address unchanged as it will always give you access to the closest 6to4 relay on the Internet.
5
The 6to4 tunnel is only set up if the gateway can be reached by ping at this address.
Telnet path:
Setup > IPv6 > Tunnel > 6to4 > Gateway-Address
Possible values:
IPv4 address with max. 64 characters
Default:
192.88.99.1
IPv4 routing tag
Here you define the routing tag that the device uses to determine the route to the associated remote gateway. The IPv4
routing tag specifies which tagged IPv4 route is to be used for the data packets to reach their destination address. The
following destination addresses can be entered:
1
6to4 anycast address
1
6in4 gateway address
1
6rd border relay address
Telnet path:
Setup > IPv6 > Tunnel > 6to4 > IPv4-Rtg-tag
Possible values:
Max. 5 characters in the range 0 – 65534
Default:
0
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for an individual tunnel interface here.
To enable the firewall globally for all interfaces, select IPv6 firewall/QoS enabled in the menu Firewall/QoS > General
.
5
Disabling the firewall globally means that the firewall is disabled for all interfaces, even if you enable this option.
Telnet path:
Setup > IPv6 > Tunnel > 6to4 > Firewall
Possible values:
Yes
No
Default:
Yes
552
Reference Manual
9 IPv6
9.6.2 Router advertisement
These settings are used to manage the router advertisements, which are used to announce the device's availability as a
router to the network.
Telnet path:
Setup > IPv6 > Router-Advertisement
Prefix options
The table contains the settings for IPv6 prefixes for each interface.
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Options
Interface name
Defines the name of the logical interface.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
Prefix
Enter the prefix that is transmitted with the router advertisements, e. g. "2001:db8::/64".
The length of the prefix must always be exactly 64 bits ("/64"), or else the clients will not be able to generate their own
addresses by adding their "interface identifier" (64 bits long).
5
If you wish to automatically use the prefix issued by the provider, then configure "::/64" here and enter the name
of the corresponding WAN interface in the field PD-Source.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Prefix
Possible values:
Max. 43 characters
Default:
Blank
Subnet ID
Here you set the subnet ID that is to be combined with the prefix issued by the provider.
If the provider assigns the prefix "2001:db8:a::/48", for example, and you assign the subnet ID "0001" (or "1" for short),
then the router advertisement on this interface is given the prefix "2001:db8:a:0001::/64".
553
Reference Manual
9 IPv6
The maximum subnet length with a 48-bit long, delegated prefix is 16 bits (65,536 subnets of "0000" to "FFFF"). With
a delegated prefix of "/56", the maximum subnet length is 8 bits (256 subnets of "00" to "FF").
5
In general, the subnet ID "0" is used when the WAN IPv6 address is compiled automatically. For this reason you
should start with "1" when assigning subnet IDs for LANs.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Subnet-ID
Possible values:
Max. 19 characters
Default:
1
Adv.-OnLink
Indicates whether the prefix is "on link".
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Adv.-OnLink
Possible values:
Yes
No
Default:
Yes
Adv.-Autonomous
Indicates whether a host can use the prefix for a "Stateless Address Autoconfiguration". If this is the case, it can connect
directly to the Internet.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Adv.-Autonomous
Possible values:
Yes
No
Default:
Yes
PD source
Use the name of the interface that receives a prefix issued by the provider. This prefix is combined with the string entered
in the field Prefix to form a subnet that announces router advertisements (DHCPv6 prefix delegation).
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > PD-Source
554
Reference Manual
9 IPv6
Possible values:
Max. 16 characters
Default:
Blank
Advertise preferred lifetime
Defines the time in milliseconds for which an IPv6 address is to be "Preferred". The client also uses this lifetime for its
generated IPv6 address. If the lifetime of the prefix has expired, the client no longer uses the corresponding IPv6 address.
Is the "preferred lifetime" of an address expires, it will be marked as "deprecated". This address is then used only by
already active connections until those connections end. Expired addresses are no longer available for new connections.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Adv.-Pref.-Lifetime
Possible values:
Max. 10 numbers in the range 0 – 2147483647
Default:
604800
Adv.-Valid-Lifetime
Defines the time in seconds, after which the validity of an IPv6 address expires. Expired addresses are no longer available
for new connections.
Telnet path:
Setup > IPv6 > Router-Advertisements > Prefix-Options > Adv.-Valid-Lifetime
Possible values:
Max. 10 numbers in the range 0 – 2147483647
Default:
2592000
Decrement lifetimes
If this option is enabled, the preferred and valid lifetime of the prefix in the router advertisements are automatically
counted down over time or extended. The preferred and valid lifetimes of the prefix in the router advertisements are
synchronized with the times from the delegated prefix as retrieved from the WAN. If the prefix from the provider is not
updated, then the preferred and valid lifetimes are counted down to 0, and thus expire. As soon as the device updates
the lifetimes of the delegated prefix from the WAN, then the prefix in the router advertisements is extended again. If
this option is disabled, are preferred and valid lifetime from the delegated prefix are applied statically, but they not
reduced or extended. This parameter has no effect on tunneled WAN connections (6to4, 6in4 and 6rd), because in this
case the prefixes are not retrieved by DHCPv6 prefix delegation, and thus they have no lifetimes. Here, the
statically-configured preferred and valid lifetimes from the prefix are applied. This parameter also has no effect if the
value for PD source is left empty, because in this case there is no synchronization with the delegated WAN prefix.
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Options
555
Reference Manual
9 IPv6
Possible values:
Yes
No
Default:
Yes
Interface options
The table contains the settings for the IPv6 interfaces.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options
Interface name
Defines the name of the logical interface to be used for sending router advertisements.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
Send adverts
Enables the periodic transmission of router advertisements and the response to router solicitations.
Telnet path:
Setup > IPv6 > Router-Advertisement > Interface-Options > Send-Adverts
Possible values:
Yes
No
Default:
Yes
Min. RTR interval
Defines in seconds the minimum time allowed between the transmission of consecutive unsolicited multicast router
advertisements. Min-RTR-Interval and Max-RTR-Interval form a time space within which the device sends a router
advertisement at random.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Min-RTR-Interval
556
Reference Manual
9 IPv6
Possible values:
Min. 3 seconds
Max. 0.75 * Max-RTR-Interval
Max. 10 numbers
Default:
0.33 * Max-RTR-Interval (if Max-RTR-Interval >= 9 seconds)
Max-RTR-Interval (if Max-RTR-Interval < 9 seconds)
Max. RTR interval
Defines in seconds the maximum time allowed between the transmission of consecutive unsolicited multicast router
advertisements. Min-RTR-Interval and Max-RTR-Interval form a time space within which the device sends a router
advertisement at random.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Max-RTR-Interval
Possible values:
Min. 4 seconds
Max. 1800 seconds
Max. 10 numbers
Default:
600 seconds
Managed flag
Sets the "Managed address configuration" flag in the router advertisement.
Setting this flag causes the clients to configure all addresses via "Stateful Autoconfiguration" (DHCPv6). In this case the
clients also automatically retrieve other information, such as DNS server addresses.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Managed-Flag
Possible values:
Yes
No
Default:
No
Other config flag
Sets the "Other configuration" flag in the router advertisement.
If this flag is set, the device instructs the clients to retrieve additional information (but not the addresses for the client)
such as DNS server addresses via DHCPv6.
557
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Other-Config-Flag
Possible values:
Yes
No
Default:
Yes
Link MTU
Here you set the valid MTU for the corresponding link.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Link-MTU
Possible values:
Max. 5 numbers in the range 0 – 99999
Default:
1500
Reachable time
Specifies the time in seconds for which the router is considered to be reachable.
The default value of "0" means that the router advertisements have no specifications for reachable time.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Reachable-Time
Possible values:
Max. 10 numbers in the range 0 – 2147483647
Default:
0
Hop limit
Defines the maximum number of routers to be used to forward a data packet. One router corresponds to one "hop".
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Hop-Limit
Possible values:
Max. 5 numbers in the range 0 – 255
Default:
0: No hop limit defined
558
Reference Manual
9 IPv6
Default lifetime
Specifies the time in seconds for which the router is considered to be reachable in the network.
5
If this value is set to 0, the operating system will not use this router as the default router.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Def.-Lifetime
Possible values:
Max. 10 numbers in the range 0 – 2147483647
Default:
1800
Default router mode
Defines how the device advertises itself as the default gateway or router.
The settings have the following functions:
1
Auto: As long as a WAN connection exists, the router sends a positive router lifetime in the router advertisement
messages. The result is that a client uses this router as the default gateway. If there is no WAN connection, the router
sets the router lifetime to "0". A client then stops using this router as the default gateway. This behavior is compliant
with RFC 6204.
1
Always: The router lifetime is always positive—i. e. greater than "0"—irrespective of the WAN connection status.
1
Never: The router lifetime is always "0".
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Default-Router-Mode
Possible values:
Auto
Always
Never
Default:
Auto
Router preference
Defines the preference of this router. Clients enter this preference into their local routing tables.
Telnet path:
Setup > IPv6 > Router-Advertisements > Interface-Options > Router-Preference
Possible values:
Low
Medium
High
559
Reference Manual
9 IPv6
Default:
Medium
Route options
The table contains the settings for the route options.
Telnet path:
Setup > IPv6 > Router-Advertisement > Route-Options
Interface name
Defines the name of the interface that this route option applies to.
Telnet path:
Setup > IPv6 > Router-Advertisement > Route-Options > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
Prefix
Set the prefix for this route. This should not exceed 64 bits in length if it is to be used for auto-configuration.
Telnet path:
Setup > IPv6 > Router-Advertisement > Route-Options > Prefix
Possible values:
IPv6 prefix with max. 43 characters, e.g. 2001:db8::/64
Default:
Blank
Route lifetime
Set how long in seconds the route should remain valid.
Telnet path:
Setup > IPv6 > Router-Advertisement > Route-Options > Route-Lifetime
Possible values:
Max. 5 numbers in the range 0 – 65335
Default:
0: No route lifetime specified
560
Reference Manual
9 IPv6
Route preference
This parameter specifies the priority of an advertised route. A router receiving a router advertisement with two routes
of different preference will choose the route with the higher priority.
Telnet path:
Setup > IPv6 > Router-Advertisement > Route-Options > Route-Preference
Possible values:
Low
Medium
High
Default:
Medium
RDNSS options
This table contains the settings of RDNSS extension (recursive DNS server).
5
This function is not currently supported by Windows. Propagation of a DNS server, where required, is performed
via DHCPv6.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Interface name
Name of the interface used by the device to announce information about the IPv6 DNS server in router advertisements.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Possible values:
Max. 16 characters
Default:
Blank
Primary DNS
IPv6 address of the first IPv6 DNS server (recursive DNS server, RDNSS, according to RFC6106) for this interface.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Possible values:
Valid IPv6 address
Default:
Blank
561
Reference Manual
9 IPv6
Secondary DNS
IPv6 address of the secondary IPv6 DNS server for this interface.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Possible values:
Valid IPv6 address
Default:
Blank
DNS search list
This parameter defines which DNS search list the device propagates on this logical network.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Possible values:
Internal: If you select this option, the device propagates either the DNS search list from the internal DNS
server or the domain of this logical network. The domain is configured under Setup > DNS > Domain.
WAN: If you select this option, the device propagates the DNS search list from the provider (e.g.
provider-xy.com) for this logical network. This feature is available only if the prefix list is connected to the
corresponding WAN interface under Receive prefix from.
Default:
Internal enabled, WAN disabled.
Lifetime
Defines the time in seconds for which a client may use this DNS server for name resolution.
Telnet path:
Setup > IPv6 > Router-Advertisements > RDNSS-Options
Possible values:
1
Max. 5 numbers in the range 0 – 65535
1
0: Discontinuation
Default:
900
9.6.3 DHCPv6
This menu contains the DHCPv6 settings.
Telnet path:
Setup > IPv6 > DHCPv6
562
Reference Manual
9 IPv6
Server
This menu contains the DHCP server settings for IPv6.
Telnet path:
Setup > IPv6 > DHCPv6 > Server
Address pools
If distribution of the DHCPv6 server is to be stateful, this table defines an address pool.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pool
Address pool name
Specify the name of the address pool here.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools > Address-Pool-Name
Possible values:
Maximum 31 characters
Default:
Blank
Start address pool
Here you specify the first address in the pool, e. g. "2001:db8::1"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools > Start-Address-Pool
Possible values:
Maximum 39 characters
Default:
Blank
End address pool
Here you specify the last address in the pool, e. g. "2001:db8::9"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools > End-Address-Pool
Possible values:
Maximum 39 characters
Default:
Blank
563
Reference Manual
9 IPv6
Preferred lifetime
Here you specify the time in seconds that the client should treat this address as "preferred". After this time elapses, a
client classifies this address as "deprecated".
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools > Pref.-Lifetime
Possible values:
Maximum 10 characters.
Default:
3600
Valid lifetime
Here you specify the time in seconds that the client should treat this address as "valid".
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools > Valid-Lifetime
Possible values:
Maximum 10 characters.
Default:
86400
PD source
Name of the WAN interface from which the client should use the prefix to form the address or prefix.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Address-Pools
Possible values:
Maximum 16 characters
Default:
Blank
PD pools
In this table, you specify the prefixes that the DHCPv6 server delegates to other routers.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools
PD pool name
Specify the name of the PD pool here.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > PD-Pool-Name
564
Reference Manual
9 IPv6
Possible values:
Maximum 31 characters
Default:
Blank
Start PD pool
Here you specify the first prefix for delegation in the PD pool, e. g. "2001:db8:1100::"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > Start-PD-Pool
Possible values:
Maximum 39 characters
Default:
Blank
End PD pool
Here you specify the last prefix for delegation in the PD pool, e. g. "2001:db8:FF00::"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > End-PD-Pool
Possible values:
Maximum 39 characters
Default:
Blank
Prefix length
Here you set the length of the prefixes in the PD pool, e. g. "56" or "60"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > Prefix-Length
Possible values:
Maximum 3 characters.
Default:
56
Preferred lifetime
Here you specify the time in seconds that the client should treat this prefix as "preferred". After this time elapses, a client
classifies this address as "deprecated".
565
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > Pref.-Lifetime
Possible values:
Maximum 10 characters.
Default:
3600
Valid lifetime
Here you specify the time in seconds that the client should treat this prefix as "valid".
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools > Valid-Lifetime
Possible values:
Maximum 10 characters.
Default:
86400
PD source
Name of the WAN interface from which the client should use the prefix to form the address or prefix.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > PD-Pools
Possible values:
Maximum 16 characters
Default:
Blank
Interface list
This table is used to configure the basic settings of the DHCPv6 server, and to specify which interfaces they apply to.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Interface name or relay
Name of the interface on which the DHCPv6 server is working, for example "INTRANET"
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List > Interface-Name
Possible values:
Selection from the list of LAN interfaces defined in the device; max. 39 characters
566
Reference Manual
9 IPv6
Default:
Blank
Active
Activates or deactivates the DHCPv6 server.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List > Operating
Possible values:
No
Yes
Default:
Yes
Primary DNS
IPv6 address of the primary DNS server.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List > Primary-DNS
Possible values:
IPv6 address with max. 39 characters
Default:
::
Secondary DNS
IPv6 address of the secondary DNS server.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List > Secondary-DNS
Possible values:
IPv6 address with max. 39 characters
Default:
Blank
Address pool name
Here you specify the address pool that the devices uses for this interface.
5
If the DHCPv6 server operates 'stateful' addresses distribution, you must enter the corresponding addresses into
the table Setup > IPv6 > DHCPv6 > Server > Address-Pools.
567
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-Liste > Address-Pool-Name
Possible values:
Maximum 31 characters
Default:
Blank
PD pool name
Determine the prefix-delegation pool that the devices is to use for this interface.
5
If the DHCPv6 server is to delegate prefixes to other routers, you must enter the corresponding prefixes in the
table Setup > IPv6 > DHCPv6 > Server > PD-Pools.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-Liste > PD-Pool-Name
Possible values:
Maximum 31 characters
Default:
Blank
Rapid commit
With rapid commit activated, the DHCPv6 server responds directly to a solicit message with a reply message.
5
The client must explicitly include the rapid commit option in its solicit message.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-Liste > Rapid-Commit
Possible values:
No
Yes
Default:
No
Preference
Where multiple DHCPv6 servers are operated on the network, the preference parameter gives you the control over which
server the clients will use. The primary server requires a higher preference value than the backup server.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-Liste > Preference
Possible values:
0 to 255
568
Reference Manual
9 IPv6
Default:
0
Renew time
This specifies the time in seconds when the client should contact the server again (using a renew message) to extend
the address/prefix received from the server. The parameter is also called T1.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Possible values:
0 to 255
Default:
0 (automatic)
Rebind time
This specifies the time when the client should contact any server (using a rebind message) to extend its delegated
address/prefix. The rebind event occurs only if the client receives no answer its renew request. The parameter is also
called T2.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Possible values:
0 to 255
Default:
0 (automatic)
Unicast address
Unicast address of the DHCP server. The DHCP server uses this address in the server unicast option to allow the client
to communicate with to the server via unicast messages. By default, multicast is used.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Possible values:
Valid unicast address
Default:
Blank
DNS search list
This parameter defines which DNS search list is sent to the clients by the DNS server.
569
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Possible values:
None: The DNS server distributes no search lists to the clients.
Internal: Indicates whether the DNS search list or the own domain for this logical network should be inserted
from the internal DNS server, e.g., "internal". The own domain can be configured under IPv4 > DNS > General
settings.
WAN: Specifies whether the DNS search list sent by the provider (e.g., provider-xy.de) is announced in this
logical network. This feature is available only if the prefix list is connected to the corresponding WAN interface
under Receive prefix from.
Default:
Internal
Reservations
If you want to assign fixed IPv6 addresses to clients or fixed prefixes to routers, you can define a reservation for each
client in this table.
Telnet path:
Setup > IPv6 > DHCPv6 > Server
Interface name or relay
Name of the interface on which the DHCPv6 server is working, for example "INTRANET". Alternatively, you can also enter
the IPv6 address of the remote relay agent.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Selection from the list of LAN interfaces defined in the device; max. 39 characters
Default:
Blank
Address or PD prefix
IPv6 address or PD prefix that you want to assign statically.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Maximum 43 characters
Default:
Blank
570
Reference Manual
9 IPv6
Client ID
DHCPv6 unique identifier (DUID) of the client.
DHCPv6 clients are no longer identified with their MAC addresses like DHCPv4 clients, they are identified with their DUID
instead. The DUID can be read from the respective client, for example, on Windows with the shell command ipconfig
/all or in WEBconfig under Status > IPv6 > DHCPv6 > Client > Client ID.
For devices working as a DHCPv6 server, the client IDs for clients that are currently using retrieved IPv6 addresses are
to be found under Status > IPv6 > DHCPv6 > Server > Address bindings, and retrieved IPv6 prefixes are under
Status > IPv6 > DHCPv6 > Server > PD bindings.
LANmonitor displays that client IDs under DHCPv6 server.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Maximum 96 characters
Default:
Blank
Preferred lifetime
Here you specify the time in seconds that the client should treat this prefix as "preferred". After this time elapses, a client
classifies this address as "deprecated".
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Maximum 10 characters.
Default:
3600
Valid lifetime
Here you specify the time in seconds that the client should treat this prefix as "valid".
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values for preferred
lifetime and valid lifetime. In this case, the device automatically determines the values that apply to the prefix
delegated by the provider.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Maximum 10 characters.
Default:
86400
571
Reference Manual
9 IPv6
PD source
Name of the WAN interface from which the client should use the prefix to form the address or prefix.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Reservations
Possible values:
Maximum 16 characters
Default:
Blank
Client
This menu contains the DHCP client settings for IPv6.
Telnet path:
Setup > IPv6 > DHCPv6 > Client
Interface list
This table determines the behavior of the DHCPv6 client.
5
Normally client behavior is controlled by the auto-configuration.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List
Interface name
Specify the name of the interface that the DHCPv6 client operates on. These may be LAN interfaces or WAN interfaces
(remote stations), such as "INTRANET" or "INTERNET".
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Interface-Name
Possible values:
Selection from the list of LAN interfaces defined in the device; max. 16 characters
Default:
Blank
Operating
Here you specify if and how the device enables the client. Possible values are:
1
Autoconf: The device waits for router advertisements, and then starts the DHCPv6 client. This option is the default
setting.
1
Yes: The device starts the DHCPv6 client as soon as the interface is active, without waiting for router advertisements.
1
No: The DHCPv6 client is disabled on this interface. Even if the device receives router advertisements, it will not start
the client.
572
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Operating
Possible values:
Autoconf
No
Yes
Default:
Autoconf
Request DNS
Here you specify whether the client should query the DHCPv6 server for DNS servers.
5
You must enable this option in order for the device to obtain information about a DNS server.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Request-DNS
Possible values:
No
Yes
Default:
Yes
Request address
Here you specify whether the client should query the DHCPv6 server for an IPv6 address.
5
Only activate this option if addresses configured by the DHCPv6 server via this interface are stateful, i. e. not
distributed by 'SLAAC'.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Request-Address
Possible values:
No
Yes
Default:
Yes
Request PD
Here you specify whether the client should request the DHCPv6 server for an IPv6 prefix. Activating this option is only
necessary if the device itself functions as a router and redistributes these prefixes. This option is enabled by default on
WAN interfaces in order for the DHCPv6 client to request a prefix from the provider for use in its local network. This
option is disabled by default on LAN interfaces because devices in a local network are more likely to function as clients
rather than as routers.
573
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Request-PD
Possible values:
No
Yes
Default:
No
Rapid commit
When rapid commit is activated, the client attempts to obtain an IPv6 address from the DHCPv6 server with just two
messages. If the DHCPv6 server is configured correspondingly, it immediately responds to this solicit message with a
reply message.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Interface-List > Rapid-Commit
Possible values:
No
Yes
Default:
Yes
User class identifier
This assigns the device a unique user class ID.
A user class identifier is used to identify the type or category of client to the server. For example, the user class identifier
can be used to identify all clients of people in the accounting department, or all printers at a specific location.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > User-Class-Identifier
Possible values:
Maximum 253 characters
Default:
Blank
Vendor class identifier
This assigns the device a unique vendor class ID.
The vendor-class-identifier is used to identify the manufacturer of the hardware running the DHCP client.
Telnet path:
Setup > IPv6 > DHCPv6 > Client > Vendor-Class-Identifier
574
Reference Manual
9 IPv6
Possible values:
Maximum 253 characters
Default:
Manufacturer name
Vendor class number
Determines the enterprise number that the device manufacturer used to register with the Internet Assigned Numbers
Authority (IANA).
Telnet path:
Setup > IPv6 > DHCPv6 > Client
Possible values:
Maximum 10 characters
Default:
2356
9.6.4 Relay agent
This menu contains the DHCP relay agent settings for IPv6.
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent
Interface list
This table determines the behavior of the DHCPv6 relay agent.
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List
Interface name
Define the name of the interface on which the relay agent receives requests from DHCPv6 clients, e. g. "INTRANET".
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List > Interface-Name
Possible values:
Selection from the list of LAN interfaces defined in the device; max. 16 characters
Default:
Blank
Relay agent operating
With this option you define if and how the device enables the relay agent.
575
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List > Relay-Agent-Operating
Possible values:
Yes: Relay agent is enabled. This option is the default setting.
No: Relay agent is not enabled.
Default:
Yes
Interface address
Specify the relay agent's own IPv6 address at the interface that is configured under Interface Name. This IPv6 address
is used as a sender address in DHCP messages that are forwarded. This sender address enables DHCPv6 clients to uniquely
identify a relay agent. An explicit specification of the interface address is necessary because an IPv6 host can have
multiple IPv6 addresses for each interface.
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List > Interface-Address
Possible values:
Maximum 39 characters
Default:
Blank
Destination address
Define the IPv6 address of the (destination) DHCPv6 server which the relay agent is to forward DHCP requests to. The
address can be either a unicast or link-local multicast address. When using a link-local multicast address, you must
specify the destination interface where the DHCPv6 server is to be reached. All DHCPv6 servers and relay agents are
available at the link-local multicast address ff02::1:2.
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List > Dest-Address
Possible values:
Maximum 39 characters
Default:
ff02::1:2
Destination interface
Here you specify the destination interface where the parent DHCPv6 server or the next relay agent is to be reached. This
information is essential if a link-local multicast address is configured under the destination address, as link local-multicast
addresses are only valid at that respective link.
Telnet path:
Setup > IPv6 > DHCPv6 > Relay-Agent > Interface-List > Dest-Interface
576
Reference Manual
9 IPv6
Possible values:
Maximum 39 characters
Default:
Blank
9.6.5 Network
Here you can adjust further IPv6 network settings for each logical interface supported by your device.
Telnet path:
Setup > IPv6 > Network
Addresses
This table is used to manage the IPv6 addresses.
Telnet path:
Setup > IPv6 > Network > Addresses
Interface name
Give a name to the interface that you want to assign the IPv6 network.
Telnet path:
Setup > IPv6 > Network > Addresses > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
IPv6 address prefix length
Specify an IPv6 address including the prefix length for this interface.
5
The default prefix length is 64 bits ("/64"). If possible do not use IPv6 addresses with longer prefixes, as many
IPv6 mechanisms in the device are designed for a maximum length of 64 bits.
A possible address is, for example, "2001:db8::1/64". An interface can have multiple IPv6 addresses:
1
A "global unicast address", e. g. "2001:db8::1/64",
1
A "unique local address", e. g. "fd00::1/64".
"Link local addresses" are fixed and not configurable.
Telnet path:
Setup > IPv6 > Network > Addresses > IPv6-Address-Prefixlength
Possible values:
Max. 43 characters
577
Reference Manual
9 IPv6
Default:
Blank
Address type
Determine the type of IPv6 address.
Using the address type EUI-64 causes IPv6 addresses to be formed according to the IEEE standard "EUI-64". The MAC
address of the interface thus forms a uniquely identifiable part of the IPv6 address. The correct input format for an IPv6
address including the prefix length as per EUI-64 would be: "2001:db8:1::/64".
5
"EUI-64" ignores any value set as "interface identifier" in the corresponding IPv6 address and replaces it with
an "interface identifier" as per "EUI-64".
5
The prefix length for "EUI-64" must be "/64".
Telnet path:
Setup > IPv6 > Network > Addresses > Address-Type
Possible values:
Unicast
Anycast
EUI-64
Default:
Unicast
Name
Enter a descriptive name for this combination of IPv6 address and prefix.
5
Entering a name is optional.
Telnet path:
Setup > IPv6 > Network > Addresses > Name
Possible values:
Max. 16 characters
Default:
Blank
Comment
Enter a descriptive comment for this entry.
5
Entering a comment is optional.
Telnet path:
Setup > IPv6 > Network > Addresses > Comment
578
Reference Manual
9 IPv6
Possible values:
Max. 64 characters
Default:
Blank
Parameter
This table is used to manage the IPv6 parameters.
Telnet path:
Setup > IPv6 > Network > Parameter
Interface name
Give a name to the interface for which the IPv6 parameters are to be configured.
Telnet path:
Setup > IPv6 > Network > Parameter > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
IPv6 gateway
Specify the IPv6 gateway to be used by this interface.
5
This parameter overrides gateway information that the device may receive via router advertisements, for example.
Telnet path:
Setup > IPv6 > Network > Parameter > IPv6-Gateway
Possible values:
1
Global unicast address, e.g. 2001:db8::1
1
Link-local address to which you add to the corresponding interface (%<INTERFACE>), e.g.
fe80::1%INTERNET
Default:
::
Primary DNS
Specify the primary IPv6 DNS server to be used by this interface.
Telnet path:
Setup > IPv6 > Network > Parameter > Primary-DNS
579
Reference Manual
9 IPv6
Possible values:
IPv6 address with max. 39 characters
Default:
::
Secondary DNS
Specify the secondary IPv6 DNS server to be used by this interface.
Telnet path:
Setup > IPv6 > Network > Parameter > Secondary-DNS
Possible values:
IPv6 address with max. 39 characters
Default:
::
9.6.6 Firewall
This menu contains the settings for the firewall.
Telnet path:
Setup > IPv6 > Firewall
Operating
Enables or disables the firewall.
5
This item enables the firewall globally. The firewall is only active if you enable it here. If you disable the firewall
here and at the same time enable it for individual interfaces, it remains disabled for all interfaces.
Telnet path:
Setup > IPv6 > Firewall > Operating
Possible values:
Yes
No
Default:
Yes
Forwarding rules
This table contains the rules that the firewall will apply for forwarding data.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
580
Reference Manual
9 IPv6
Name
Defines the name for the forwarding rule.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Maximum 36 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Flags
These options determine how the firewall handles the rule. The options have the following meanings:
1
Deactivated: The rule is disabled. The firewall skips this rule.
1
Linked: After processing the rule, the firewall looks for additional rules which come in question.
1
Stateless: This rule does not take the statuses of the TCP sessions into account.
You can select several options at the same time.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Deactivated
Linked
Stateless
Default:
No selection
Priority
This information determines the priority with which the firewall applies the rule. A higher value determines a higher
priority.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Max. 4 characters from 1234567890
Default:
0
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag makes it possible to separate the rules valid
for this network.
581
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Max. 5 characters from 1234567890
Default:
0
Action
Specifies the action that the firewall performs if the rule condition is true. There are certain standard actions already
specified in the table Setup IPv > IPv6 > Firewall > Actions. In addition, you can also define your own actions.
You can enter multiple actions, separated by commas.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
REJECT
Services
This information determines for which services the firewall applies this rule. There are certain services already specified
in the table Setup > IPv6 > Firewall > Actions. In addition, you can also define your own services.
You can enter multiple services separated by commas.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
ANY
Source stations
This information determines for which source stations the firewall applies this rule. There are certain stations already
specified in the table Setup > IPv6 > Firewall > Stations. In addition, you can also define your own stations.
You can enter multiple stations separated by commas.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
582
Reference Manual
9 IPv6
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
ANYHOST
Destination stations
This information determines, for which destination stations the firewall applies this rule. There are certain stations already
specified in the table Setup > IPv6 > Firewall > Stations. In addition, you can also define your own stations.
You can enter multiple stations separated by commas.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
ANYHOST
Comment
Enter a descriptive comment for this entry.
Telnet path:
Setup > IPv6 > Firewall > Forwarding-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
Blank
Actions list
In this table, you can group actions. Define the actions you previously under Setup > IPv6 > Firewall > Actions.
5
You can not delete an action in this list if the firewall is used in a forwarding or inbound rule.
Telnet path:
Setup > IPv6 > Firewall > Action-List
Name
Specifies the name of a group of actions.
583
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Action-List
Possible values:
Maximum 36 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Description
Contains the list of actions that are grouped together under this group name.
Separate the individual entries with a comma.
Telnet path:
Setup > IPv6 > Firewall > Action-List
Possible values:
Maximum 252 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
Blank
Station list
You can group stations in this table. Define the actions previously under Setup > IPv6 > Firewall > Stations.
5
You can not delete a station in this list if the firewall is used in a forwarding or inbound rule.
Telnet path:
Setup > IPv6 > Firewall > Stations-List
Name
Specifies the name of a group of stations.
Telnet path:
Setup > IPv6 > Firewall > Stations-List
Possible values:
Maximum 36 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Description
Contains the list of stations that are grouped together under this group name.
Separate the individual entries with a comma.
584
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Stations-List
Possible values:
Maximum 252 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
Blank
Service list
You can group services in this table. Define the services previously under Setup > IPv6 > Firewall > Services.
5
You can not delete a service in this list if the firewall is used in a forwarding or inbound rule.
Telnet path:
Setup > IPv6 > Firewall > Service-List
Name
Specifies the name of a group of services.
Telnet path:
Setup > IPv6 > Firewall > Service-List
Possible values:
Maximum 36 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Description
Contains the list of services that are grouped together under this group name.
Separate the individual entries with a comma.
Telnet path:
Setup > IPv6 > Firewall > Service-List
Possible values:
Maximum 252 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
Blank
Actions
The firewall can perform the forwarding and inbound rule actions for the actions contained in this table.
You can combine multiple actions under Setup > IPv6 > Firewall > Actions-list.
585
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Actions
Name
Specifies the name of the action.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Limit
When this limit is exceeded, the firewall applies the filter rule.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Max. 10 characters from 0123456789
Special values:
0: The rule will come into force immediately.
Default:
0
Unit
Determines the unit for the limits.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
kBit
kByte
Packets
Sessions
Bandwidth (%)
Default:
Packets
586
Reference Manual
9 IPv6
Time
Determines the measurement period that the firewall applies to the limit.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Second
Minute
Hour
Absolute
Default:
Absolute
Context
Determines the context that the firewall applies to the limit. Possible values are:
1
Session: The limit only applies to the data traffic for the current session.
1
Station: The limit only applies to the data traffic for the current station.
1
Global: All sessions to which this rule applies use the same limit counter.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Session
Station
Global
Default:
Session
Flags
Determines the properties of the limits of the action. Possible values are:
1
Reset: If the limit is exceeded, the action resets the counter.
1
Shared: All rules to which this limit applies use the same limit counter.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Reset
Shared
Default:
Blank
587
Reference Manual
9 IPv6
Action
Determines the action the firewall performs when the limit is reached.
The following options are possible:
1
Reject: The firewall rejects the data packet and sends an appropriate notification to the sender.
1
Drop: The firewall discards the data packet without notification.
1
Accept: The firewall accepts the data packet.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Reject
Drop
Accept
Default:
.
DiffServ
Determines the priority of the data packets (differentiated services, DiffServ), with which the firewall should transfer the
data packets.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section "QoS".
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
BE
EF
CS0 to CS7
AF11 to AF43
No
Value
Special values:
Value: You can enter the DSCP decimal value directly in the DSCP value field.
Default:
No
DSCP value
Determines the value for the Differentiated Services Code Point (DSCP).
If you selected the "Value" option in the DiffServ field, enter a value here.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section "QoS".
588
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Max. 2 characters from 1234567890
Default:
0
Conditions
Determines which conditions must be met in order for the action to be performed. Define the conditions under Setup >
IPv6 > Firewall > Conditions.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Trigger actions
Determines which trigger actions the firewall should start in addition to filtering the data packets. Define the trigger
actions under Setup > IPv6 > Firewall > Trigger-actions.
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Stations
The firewall can perform the forwarding and inbound rule actions for inbound connections from the source stations listed
in this table.
You can combine multiple stations under Setup > IPv6 > Firewall > Station-list.
Telnet path:
Setup > IPv6 > Firewall > Stations
Name
Specifies the name of the station.
589
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Type
Determines the station type.
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
Local network
Remote peer
Prefix
Identifier
IP address
Named host
Default:
Local network
Local network
If you selected the appropriate option in the Type field, you enter the name of the local network here.
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
Max. 16 characters from: #ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Remote peer/local host
If you selected the appropriate option in the Type field, you enter the name of the remote peer or local host here.
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
Maximum 64 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
590
Reference Manual
9 IPv6
Default:
Blank
Address/Prefix
If you selected the appropriate option in the Type field, enter the IP address or prefix of the station here.
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
Max. 43 characters from ABCDEFabcdef0123456789:
Default:
Blank
Services
The firewall can perform the forwarding and inbound rule actions for the connection protocols of the services listed in
this table.
You can combine multiple services under Setup > IPv6 > Firewall > Service-list.
Telnet path:
Setup > IPv6 > Firewall > Services
Name
Specifies the name of the service.
Telnet path:
Setup > IPv6 > Firewall > Services
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Protocol
Specifies the protocol of the service.
Telnet path:
Setup > IPv6 > Firewall > Services
Possible values:
TCP+UDP
TCP
UDP
591
Reference Manual
9 IPv6
Default:
TCP+UDP
Ports
Specifies the port for the service. Separate multiple ports with a comma.
5
Lists with the official protocol and port numbers are available in the Internet at
www.iana.org
.
Telnet path:
Setup > IPv6 > Firewall > Services
Possible values:
Max. 64 characters from 0123456789,
Default:
Blank
Source ports
Determines whether the specified ports are source ports.
5
In certain scenarios, it may be useful to specify a source port. This is unusual. Selecting "No" is recommended.
Telnet path:
Setup > IPv6 > Firewall > Stations
Possible values:
No
Yes
Default:
No
Protocol
The firewall can perform the forwarding and inbound rule actions for the protocols listed in this table.
Telnet path:
Setup > IPv6 > Firewall > Protocols
Name
Specifies the name of the protocol.
Telnet path:
Setup > IPv6 > Firewall > Protocols
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
592
Reference Manual
9 IPv6
Default:
Blank
Protocol
Specifies the protocol number.
5
Lists with the official protocol and port numbers are available in the Internet at
www.iana.org
.
Telnet path:
Setup > IPv6 > Firewall > Protocols
Possible values:
Max. 3 characters from 0123456789
Default:
Blank
Conditions
The firewall can perform the forwarding and inbound rule actions for the conditions listed in this table.
Telnet path:
Setup > IPv6 > Firewall > Conditions
Name
Specifies the name of the condition.
Telnet path:
Setup > IPv6 > Firewall > Conditions
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Conditions
Specifies the conditions which must be met.
Telnet path:
Setup > IPv6 > Firewall > Conditions
Possible values:
Not connected
Default route
Backup connection
593
Reference Manual
9 IPv6
VPN route
Transmitted
Received
Default:
Blank
Transport direction
Determines whether the transport direction refers to the logical connection or the physical data transmission over the
respective interface.
Telnet path:
Setup > IPv6 > Firewall > Conditions
Possible values:
Physical
Logical
Default:
Physical
DiffServ
Determines the priority that the data packets (differentiated services, DiffServ) have to have, so that the condition is met.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section "QoS".
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
BE
EF
CS0 to CS7, CSx
AF11 to AF43, AF1x, AF2x, AF3x, AF4x, AFx1, AFx2, AFx3, AFxx
No
Value
Special values:
CSx: Extends the range to all class selectors.
AF1x, AF2x, AF3x, AF4x, AFx1, AFx2, AFx3, AFxx: Extends the range to the corresponding
assured-forwarding classes (e.g., AF1x takes the classes AF11, AF12, AF13 into account)
Value: You can enter the DSCP decimal value directly in the DSCP value field.
Default:
Ignore
594
Reference Manual
9 IPv6
DSCP value
Determines the value for the Differentiated Services Code Point (DSCP).
If you selected the "Value" option in the DiffServ field, enter a value here.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section "QoS".
Telnet path:
Setup > IPv6 > Firewall > Actions
Possible values:
Max. 2 characters from 1234567890
Default:
0
Trigger actions
This table contains a list of the trigger actions, which the firewall actions can start.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Name
Specifies the name of the trigger action.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Notifications
Determines whether and how a notification should be sent.
5
If you want to receive e-mail notifications, you must enter an e-mail address in Setup > IP-Router > Firewall >
Admin-Email.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
SNMP
SYSLOG
E-mail
595
Reference Manual
9 IPv6
Default:
Blank
Disconnect
Determines whether the firewall disconnects the connection to the remote station if the filter condition is true.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
No
Yes
Default:
No
Block source
Determines whether the firewall disconnects the source if the filter condition is true. The firewall registers the blocked
IP address, the lockout period, as well as the underlying rule in the Host-lock-list under Status > IPv6 > Firewall.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
No
Yes
Default:
No
Lockout period
Specifies how many minutes the firewall blocks the source.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
Max. 8 characters from 0123456789
Special values:
0: Disables the lock because, in practice, the lockout period expires after 0 minutes.
Default:
0
596
Reference Manual
9 IPv6
Close destination
Specifies whether the firewall disconnects the source if the filter condition is true. The firewall registers the blocked
destination IP address, the protocol, the destination port, the lockout period, as well as the underlying rule in the
Port-block-list under Status > IPv6 > Firewall.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
No
Yes
Default:
No
Closing time
Determines, for how many seconds the firewall closes the destination.
Telnet path:
Setup > IPv6 > Firewall > Trigger-Actions
Possible values:
Max. 8 characters from 0123456789
Special values:
0: Disables the lock because, in practice, the lockout period expires after 0 minutes.
Default:
0
ICMP service
This table contains a list of ICMP-service.
5
Since ICMPv6 has central importance for numerous IPv6 features, basic ICMPv6 rules are already configured by
default. You can not delete these rules.
Telnet path:
Setup > IPv6 > Firewall > ICMP-Services
Name
Specifies the name of the ICMP service.
Telnet path:
Setup > IPv6 > Firewall > ICMP-Services
Possible values:
Maximum 32 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
597
Reference Manual
9 IPv6
Default:
Blank
Type
Specifies the type of the ICMP service.
5
Lists with the official ICMP types and port codes are available in the Internet under
www.iana.org
.
Telnet path:
Setup > IPv6 > Firewall > ICMP-Services
Possible values:
Max. 3 characters from 0123456789
Default:
0
Code
Specifies the codes of the ICMP service.
5
Lists with the official ICMP types and port codes are available in the Internet under
www.iana.org
.
Telnet path:
Setup > IPv6 > Firewall > ICMP-Services
Possible values:
Max. 3 characters from 0123456789
Default:
0
Inbound rules
This table contains the rules that the firewall will apply to inbound connections.
By default, there are already some rules for the most important cases.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Name
Specifies the name of the inbound rule.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Maximum 36 characters from: ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
598
Reference Manual
9 IPv6
Default:
Blank
Active
This option enables the inbound rule.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Yes
No
Default:
Yes
Priority
This information determines the priority with which the firewall applies the rule. A higher value determines a higher
priority.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Max. 4 characters from 1234567890
Default:
0
Action
Specifies the action that the firewall performs if the rule condition is true. There are certain standard actions already
specified in the table Setup IPv > IPv6 > Firewall > Actions. In addition, you can also define your own actions.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
REJECT
Services
This information determines for which services the firewall applies this rule. There are certain services already specified
in the table Setup > IPv6 > Firewall > Actions. In addition, you can also define your own services.
599
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
ANY
Source stations
This information determines for which source stations the firewall applies this rule. There are certain stations already
specified in the table Setup > IPv6 > Firewall > Stations. In addition, you can also define your own stations.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
ANYHOST
Comment
Enter a descriptive comment for this entry.
Telnet path:
Setup > IPv6 > Firewall > Inbound-Rules
Possible values:
Maximum 64 characters from:
#ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789abcdefghijklmnopqrstuvwxyz`
Default:
Blank
9.6.7 LAN interfaces
This table contains the settings for the LAN interfaces.
Telnet path:
Setup > IPv6 > LAN-Interfaces
Interface name
Enter a name for the logical IPv6 interface that is defined by the physical interface (interface assignment) and the VLAN
ID.
600
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > LAN-Interfaces > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
Interface ID
Select the physical interface to be combined with the VLAN ID to form the logical IPv6 interface.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Interface-ID
Possible values:
All physically available interfaces on the device
Default:
LAN-1
VLAN ID
Select the VLAN ID to be combined with the physical interface to form the logical IPv6 interface.
5
If you enter an invalid VLAN ID here, no communication will take place.
Telnet path:
Setup > IPv6 > LAN-Interfaces > VLAN-ID
Possible values:
0 to 4096
Max. 4 numbers
Default:
0
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65535
Default:
0
601
Reference Manual
9 IPv6
Autoconf
Enable or disable "stateless address autoconfiguration" for this interface.
5
If the device sends router advertisements from this interface, it does not generate any IPv6 addresses even with
auto-configuration enabled.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Autoconf
Possible values:
Yes
No
Default:
Yes
Accept RA
Enables or disables the processing of received router advertisement messages.
5
With processing disabled, the device ignores any prefix, DNS and router information received via router
advertisements.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Accept-RA
Possible values:
Yes
No
Default:
Yes
Interface status
Enables or disables this interface.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Interface-Status
Possible values:
Up
Down
Default:
Up
Forwarding
Enables or disables the forwarding of data packets to other interfaces.
602
Reference Manual
9 IPv6
5
With forwarding disabled, no router advertisements are transmitted from this interface.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Forwarding
Possible values:
Yes
No
Default:
Yes
MTU
Specify the applicable MTU for this interface.
Telnet path:
Setup > IPv6 > LAN-Interfaces > MTU
Possible values:
Max. 4 numbers in the range 0 – 9999
Default:
1500
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for an individual interface here. To enable
the firewall globally for all interfaces, select IPv6 firewall/QoS enabled in the menu Firewall/QoS > General .
5
If you disable the global firewall, the firewall of an individual interface is also disabled. This applies even if you
have enabled this option.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Firewall
Possible values:
Yes
No
Default:
No
Comment
Enter a descriptive comment for this entry.
5
Entering a comment is optional.
Telnet path:
Setup > IPv6 > LAN-Interfaces > Comment
603
Reference Manual
9 IPv6
Possible values:
Max. 64 characters
Default:
Blank
9.6.8 WAN interfaces
This table contains the settings for the LAN interfaces.
Telnet path:
Setup > IPv6 > WAN-Interfaces
Interface name
Specify the name of the WAN remote peer here. Use the name as specified at the remote site.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Interface-Name
Possible values:
Max. 16 characters
Default:
Blank
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will be internally marked with this tag. The interface tag enables the routes which are valid for this
network to be separated even without explicit firewall rules.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Rtg-Tag
Possible values:
Max. 5 characters in the range 0 – 65534
Default:
0
Autoconf
Enable or disable "stateless address autoconfiguration" for this interface.
5
If the device sends router advertisements from this interface, it does not generate any addresses even with
auto-configuration enabled.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Autoconf
604
Reference Manual
9 IPv6
Possible values:
Yes
No
Default:
Yes
Accept RA
Enables or disables the processing of received router advertisement messages.
5
With processing disabled, the device ignores any prefix, DNS and router information received via router
advertisements.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Accept-RA
Possible values:
Yes
No
Default:
Yes
Interface status
Enables or disables this interface.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Interface-Status
Possible values:
Up
Down
Default:
Up
Forwarding
Enables or disables the forwarding of data packets to other interfaces.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Forwarding
Possible values:
Yes
No
Default:
Yes
605
Reference Manual
9 IPv6
Firewall
Enables the firewall for this interface.
5
If you disable the global firewall, the firewall of an individual interface is also disabled. This applies even if you
have enabled this option.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Firewall
Possible values:
Yes
No
Default:
Yes
Comment
Enter a descriptive comment for this entry.
5
Entering a comment is optional.
Telnet path:
Setup > IPv6 > WAN-Interfaces > Comment
Possible values:
Max. 64 characters
Default:
Blank
DaD attempts
Before the device can use an IPv6 address on an interface, it uses 'Duplicate Address Detection (DAD)' to check to see
whether the IPv6 address already exists on the local network. In this way the device avoids address conflicts on the
network.
This option specifies the number of times that the device attempts to find duplicate IPv6 addresses on the network.
Telnet path:
Setup > IPv6 > WAN-Interfaces > DaD-Attempts
Possible values:
Max. 1 number
Default:
1
9.6.9 Operating
Switches the IPv6 stack on or off, globally. With the IPv6 stack deactivated, the device does not perform any IPv6-related
functions.
606
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6 > Operating
Possible values:
Yes
No
Default:
No
9.6.10 Forwarding
If forwarding is turned off, the device transmits no data packets between IPv6 interfaces.
5
Forwarding is essential if you wish to operate the device as a router.
Telnet path:
Setup > IPv6 > Forwarding
Possible values:
Yes
No
Default:
Yes
9.6.11 Router
These are the router settings.
Telnet path:
Setup > IPv6 > Router
Routing table
The table contains the entries to be used for routing packets with IPv6 addresses.
Telnet path:
Setup > IPv6 > Router > Routing-Table
Prefix
This prefix denotes the network range from which the current remote site, e.g. 2001:db8::/32, is to receive data
Telnet path:
Setup > IPv6 > Router > Routing-Table > Prefix
Possible values:
Max. 43 characters
607
Reference Manual
9 IPv6
Default:
Blank
Routing tag
Specify the routing tag for this route. This route is active only for packets with the same tag. The data packets receive
the routing tag either from the firewall or depending on the LAN or WAN interface used.
5
Routing tags are only necessary if used in combination with routing tags as set by firewall rules or as set at an
interface.
Telnet path:
Setup > IPv6 > Router > Routing-Table > Routing-Tag
Possible values:
Max. 5 characters
Default:
Blank
Peer or IPv6
This is where you specify the remote site for this route. Enter one of the following options:
1
An interface name
1
An IPv6 address (e.g. 2001:db8::1)
1
An interface supplemented with a link-local address (e.g. fe80::1%INTERNET)
5
The device stores the remote sites for IPv6 routing as (
WAN interfaces
).
Telnet path:
Setup > IPv6 > Router > Routing-Table > Peer-or-IPv6
Possible values:
Max. 56 characters
Default:
Blank
Comment
Enter a descriptive comment for this entry.
5
Entering a comment is optional.
Telnet path:
Setup > IPv6 > Router > Routing-Table > Comment
Possible values:
Max. 64 characters
608
Reference Manual
9 IPv6
Default:
Blank
Destination cache timeout
The 'destination cache timeout' specifies how long the device remembers the path to a destination address when no
packets are sent to it.
This value also influences the length of time the device takes to change the settings of the firewall: It accepts state
changes after at least half of the 'destination cache timeout' time, on average after one quarter of the timeout. Thus
with the default setting of 30 seconds, changes to the firewall come into effect on average after 7.5 seconds, but no
later than after 15 seconds.
Telnet path:
Setup > IPv6 > Router > Dest.-Cache-Timeout
Possible values:
Max. 3 characters
Default:
30 seconds
9.6.12 IPv6 address
Enter the IPv6 address of the station.
If a client needs to resolve the name of a station, it sends a request with that name to the DNS server. The server responds
by communicating the IPv6 address entered here.
SNMP ID: 2.17.5.3
Telnet path: /Setup/DNS/DNS-List
Possible values:
1
Valid IPv6 address.
Default: Blank
9.7 Additions to the Status menu
9.7.1 Log table
This table contains a list of all IPv6 firewall events.
Telnet path:
Status > IPv6 > Firewall
Idx.
Sequential index. Furthermore, the table can also be checked via SNMP.
System time
System time in UTC encoding (converted to plain text for display).
609
Reference Manual
9 IPv6
Source address
Source address of the filtered packet.
Destination address
Destination address of the filtered packet.
Prot.
Protocol (TCP, UDP, etc.) of the filtered packets.
Source port
Source port of the filtered packet (only for port related protocols).
Destination port
Destination port of the filtered packet (only for port related protocols).
Filter rule
Name of the rule that created the entry.
Limit
Bit field that contains the description of the limit that caused the firewall to apply the filter. There following
values are currently defined:
1
0x01: Absolute number
1
0x02: Number per second
1
0x04: Number per minute
1
0x08: Number per hour:
1
0X10: Global limit
1
0x20: Byte limit (if not set, it is a packet limit)
1
0x40: Limit only applies in the inbound direction
1
0x80: Limit only applies in the outbound direction
Threshold
Threshold limit value of the triggering limit.
Action
Bit field which lists all the actions performed. There following values are currently defined:
1
0x00000001: Accept
1
0x00000100: Reject
1
0x00000200: Establish filter
1
0x00000400: Internet (default router) filter
1
0x00000800: Drop
1
0x00001000: Disconnect
1
0x00004000: Lock source address
1
0x00020000: Lock destination address and port
1
0X20000000: Send SYSLOG notification message
1
0x40000000: Send SNMP trap
1
0x80000000: Send e-mail
610
Reference Manual
9 IPv6
9.8 Additional command-line commands
Various IPv6 functions can be queried at the command line. The following command-line functions are available:
1
IPv6 addresses
: show ipv6-addresses
1
IPv6 prefixes
: show ipv6-prefixes
1
IPv6 interfaces
: show ipv6-interfaces
1
IPv6 neighbor cache
: show ipv6-neighbor-cache
1
IPv6 DHCP
: show dhcp6-server
1
IPv6 DHCP
: show dhcpv6-client
1
IPv6 route
: show ipv6-route
Additionally, IPv6 communications can be followed with the trace command.
9.8.1 IPv6 addresses
The command show ipv6-addresses shows a list of IPv6 addresses that are currently being used. This is sorted
by interface. Note that an interface can have multiple IPv6 addresses. One of these addresses is always the link-local
address, which starts with fe80:.
The output is formatted as follows:
<Interface> :
<IPv6 address>, <status>, <attribute>, (<type>)
Table 5: Components of the command-line output show ipv6-addresses:
CommentOutput
The name of the interfaceInterface
The IPv6 addressIPv6 address
The status field can contain the following values:Status
1
TENTATIVE
Duplicate Address Detection (DAD) is currently checking the address. It is not yet available
for unicast.
1
PREFERRED
The address is valid
1
DEPRECATED
The address is still valid, but it is being discontinued. The optimal status for communication
is PREFERRED.
1
INVALID
The address is invalid and cannot be used for communication. An address given this status
after its lifetime has expired.
Shows an attribute of the IPv6 address. Possible attributes are:Attribute
1
None
No special attributes
1
(ANYCAST)
This is an anycast address
1
(AUTO CONFIG)
611
Reference Manual
9 IPv6
CommentOutput
The address was retrieved by auto-configuration
1
(NO DAD PERFORMED)
No DAD is performed
The type of IP addressType
9.8.2 IPv6 prefixes
The command show ipv6-prefixes displays all known prefixes. These are sorted according to the following
criteria:
1
Delegated prefixes: All prefixes that the router has obtained by delegation.
1
Advertised prefixes: All prefixes that the router announces in its router advertisements.
1
Deprecated prefixes: All prefixes that are being discontinued. These may still be functional, but they will be deleted
after a certain time.
9.8.3 IPv6 interfaces
The command show ipv6-interfaces displays a list of IPv6 interfaces and their status.
The output is formatted as follows:
<Interface> : <Status>, <Forwarding>, <Firewall>
Table 6: Components of the command-line output show ipv6-interfaces:
CommentOutput
The name of the interfaceInterface
The status of the interface Possible entries are:Status
1
oper status is up
1
oper status is down
The forwarding status of the interface. Possible entries are:Forwarding
1
forwarding is enabled
1
forwarding is disabled
The status of the firewall. Possible entries are:Firewall
1
forwarding is enabled
1
firewall is disabled
9.8.4 IPv6 neighbor cache
The command show ipv6-neighbor-cache displays the current neighbor cache.
The output is formatted as follows:
<IPv6 address> iface <interface> lladdr <MAC address> (<switch port>) <device type> <status> src <source>
Table 7: Components of the command-line output show ipv6-neighbor-cache:
CommentOutput
The IPv6 address of the neighboring deviceIPv6 address
The interface where the neighbor is accessedInterface
612
Reference Manual
9 IPv6
CommentOutput
The MAC address of the neighborMAC address
The switch port on which the neighbor was foundSwitch port
Neighbor's device type (host or router)Device type
The status of the connection to neighboring devices. Possible entries are:Status
1
INCOMPLETE
Resolution of the address was still in progress and the link-layer address of the neighbor was
not yet determined.
1
REACHABLE
The neighbor was reached in the last ten seconds.
1
STALE
The neighbor is no longer qualified as REACHABLE, but an update will only be performed
when an attempt is made to reach it.
1
DELAY
The neighbor is no longer qualified as REACHABLE, but data was recently sent to it; waiting
for verification by other protocols.
1
PROBE
The neighbor is no longer qualified as REACHABLE. Neighbor solicitation probes are sent to
it to confirm availability.
The IPv6 address at which the neighbor was detected.Source
9.8.5 IPv6 DHCP server
The command show dhcpv6-server displays the current status of the DHCP server. The display includes
information about the interface on which the server is active, which DNS server and prefixes it has, and what client
preferences it has.
9.8.6 IPv6 DHCP client
The command show dhcpv6-client displays the current status of the DHCP client. The display includes information
about the interface being used by the client and the prefixes and DNS server that it is using.
9.8.7 IPv6 route
The command show ipv6-route displays the complete IPv6 routing table. Routers with fixed entered routes are
displayed with the suffix [static] and the dynamically obtained routes have the suffix [connected]. The loopback address
is marked [loopback]. Other automatically generated addresses have the suffix [local].
9.8.8 Release IPv6 address
DescriptionCommand
The DHCPv6 client returns its IPv6 address and/or its prefix to the DHCPv6 server. It then submits a
new request for an address or prefix to the DHCPv6 server. Depending on the provider, the server
Release [ -x] <Interface 1> ...
<Interface n>
assigns a new address to the client, or reassigns the previous one. Whether the client receives a
different address or prefix is determined solely by the server.
The option switch -x suppresses the confirmation message.
The * wildcard applies the command on all of the interfaces and prefix delegations.
613
Reference Manual
9 IPv6
9.8.9 Ping command for IPv6
As of LCOS version 8.80, you can use the command ping -6(or the alias ping6) to send an ICMP ECHO_REQUEST
to a host on an IPv6 network.
For IPv6, the scope of parameters is of central importance: IPv6 requires a link-local address (fe80::/10) to be assigned
to every network interface (logical or physical) on which the IPv6 protocol is enabled, so you must specify the scope
when pinging a link-local address. This is the only way that the ping command knows which interface it should send the
package to. A percent sign (%) separates the name of the interface from the IPv6 address.
Examples:
ping -6 fe80::1%INTRANET
Pings the link-local address "fe80::1", which can be reached via the interface or network "INTRANET".
ping -6 2001:db8::1
Pings the global IPv6 address '2001:db8::1".
The meaning of the optional parameters is explained in the following table:
MeaningParameters
Performs a ping command to the link-local address via the interface specified by <scope>.-6 <IPv6
address>%<scope>
9.8.10 Overview of parameters
5
The traces available for a particular model can be displayed by entering trace without any arguments.
...causes the following message in the trace:This parameter ...
Connection status messagesStatus
Connection error messagesError
IPX routingIPX-Router
PPP protocol negotiationPPP
IPX service advertising protocolSAP
IPX watchdog spoofingIPX-Watchdog
SPX watchdog spoofingSPX-Watchdog
Least-cost routerLCR
Script negotiationScript
IPX routing information protocolIPX-RIP
Displays firewall eventsFirewall
IP routing information protocolRIP
Address resolution protocolARP
Internet control message protocolICMP
Events in the masquerading moduleIP-Masquerading
Dynamic host configuration protocolDHCP
NetBIOS administrationNetBIOS
Domain name service protocolDNS
Displays the first 64 bytes of a packet in hexadecimalPacet-Dump
614
Reference Manual
9 IPv6
...causes the following message in the trace:This parameter ...
Traces the D channel of the ISDN bus connectedD-Channel-Dump
ATM packet levelATM-Cell
ATM errorATM-Error
ADSL link statusADSL
Email processing with the integrated mail clientSMTP-Client
Email processing with the integrated mail clientMail-Client
Simple network time protocolSNTP
Timeserver traceNTP
Messages from the activity protocolConnact
Activities of the scheduler (cron table)Cron
RADIUS traceRADIUS
Information on the state of the serial interfaceSerial
Information on the state of the USB interfaceUSB
Information on load balancingLoad-Balancer
Information on the virtual router redundancy protocolVRRP
Information on the Ethernet interfacesEthernet
Information on virtual networksVLAN
Information on the internet group management protocolIGMP
Information on activity in the wireless networksWLAN
Trace on inter access point protocol giving information on wireless LAN roaming.IAPP
Trace on dynamic frequency selection, automatic channel selection in the 5 GHz wireless LAN
band
DFS
Information on the wireless LAN bridgeBridge
Trace on EAP, the key negotiation protocol used with WPA/802.11i and 802.1xEAP
Information on spanning tree protocolSpgtree
LAN authentication (e. g. Public Spot)LANAUTH
SIP information that is exchanged between a LANCOM VoIP router and a SIP provider or a
upstream SIP telephone system
SIP-Packet
IPSec and IKE negotiationsVPN-Status
IPSec and IKE packetsVPN-Packet
Messages from the Public Spot XML interfaceXML-Interface-PbSpot
Information on the IPv6 configurationIPv6-Config
Events of the IPv6 firewallIPv6-Firewall
Information about the IPv6 interfacesIPv6-Interfaces
Data packets over the IPv6 LAN connectionIPv6-LAN-Packet
Information about the IPv6 routingIPv6-Router
Data packets over the IPv6 WAN connectionIPv6-WAN-Packet
615
Reference Manual
9 IPv6
9.9 Enhancements to LANconfig
9.9.1 IPv6 configuration menu
Where previous versions provided configuration menus for TCP/IP for IPv4, you now find the options IPv4 and IPv6.
Click on IPv6 to adjust the settings for this protocol. The configuration dialog IPv6 is divided into the options General,
Router advertisement and Tunnel. By default a click on IPv6 takes you straight to the
General
options.
General
This is where you make the basic settings.
1
IPv6 enabled: This is where you can enable or disable IPv6 for the device.
616
Reference Manual
9 IPv6
1
Forwarding enabled: Forwarding is used for packet forwarding between IPv6 interfaces. This option is activated
by default.
1
The buttons LAN interfaces and WAN interfaces access the tables where you can add new interfaces, configure
existing interfaces, or delete them.
This shows the table with a LAN interface:
1
The buttons IPv6 addresses and IPv6 parameters are used to assign IPv6 addresses to interfaces and to configure
the interface parameters (gateway address, primary and secondary DNS).
617
Reference Manual
9 IPv6
Router advertisement
The Router advertisement configuration provides you with four buttons for setting up the Neighbor Discovery Protocol
(NDP) if the device is to operate as an IPv6 router:
Each button opens a table with the settings for the corresponding function:
1
Interface options: Enable or disable the following interface features:
2
Send router advertisements: Regulates the periodic transmission of router advertisements and the response
to router solicitations.
2
Managed address configuration flag: With this function enabled, clients receiving this router advertisement
will configure their addresses with Stateful Autoconfiguration (DHCPv6). Clients then automatically retrieve other
information, such as the DNS server.
2
Other flag: If this function is active, a client will attempt to obtain additional information via DHCPv6, such as
DNS server addresses.
For each prefix, you can specify whether or not a client should form addresses by auto-configuration: Navigate
to the Prefix list under Allow auto-configuration (SLAAC).
2
Default router: Defines how the device advertises itself as the default gateway or router.
The parameters have the following functions:
3
"Automatic": As long as a WAN connection exists, the device sends a positive router lifetime in the router
advertisement messages. The result is that a client uses this router as the default gateway.
If there is no WAN connection, the router sets the router lifetime to "0". A client then stops using this router
as the default gateway.
3
"Always": The router lifetime is always positive—i. e. greater than "0"—irrespective of the WAN connection
status.
3
"Never": The router lifetime is always "0".
2
Router priority: Defines the preference of this router. Clients enter this preference into their local routing tables.
618
Reference Manual
9 IPv6
1
Prefix list: Set the prefix options for the interfaces that are being used. The following settings are possible:
2
Prefix: Enter a prefix that is announced in the router advertisements, e. g. "2001:db8::/64". The prefix length
must always be exactly "/64", otherwise it will be impossible for clients to generate their addresses by adding
their interface identifiers (with a length of 64 bits). If a prefix delegated by the provider is to be propagated
automatically, set "::/64" here and enter the name of the corresponding WAN interface as the parameter Receive
prefix from.
2
Subnet ID: Here you enter the subnet ID that is to be combined with the prefix delegated by the provider. If the
provider assigns the prefix "2001:db8:a::/48", for example, and the subnet ID is "0001" (or "1" for short), then
the router advertisement on this interface is given the prefix "2001:db8:a:0001::/64". The maximum subnet length
with a 48-bit long delegated prefix is 16 bits (i.e. 65,536 subnets), with available subnet IDs ranging from "0000"
to "FFFF". With a delegated prefix of "/56", the maximum subnet length is 8 bits (i.e. 256 subnets) with subnet
IDs ranging from "00" to "FF". In general, the subnet ID "0" is used when the WAN IPv6 address is formed
automatically. This is why subnet IDs for LANs start at "1". The default setting is '1'.
2
Allow auto configuration (SLAAC): Specifies whether the prefix is to be used for a stateless address
autoconfiguration (SLAAC). The default setting is "enabled".
2
Receive prefix from: Defines the name of the interface used to receive a prefix via DHCPv6 prefix delegation
or via a tunnel. This prefix can be used to derive and propagate a subnet for each interface.
1
DNS options: Defines the DNS information in router advertisements according to RFC 6106. The following settings
are possible:
2
Interface name: Name of the interface on which the IPv6 DNS server announces information in router
advertisements.
2
Primary DNS: IPv6 address of the first IPv6 DNS server (recursive DNS server, RDNSS, according to RFC 6106)
for this interface.
2
Secondary DNS: IPv6 address of the secondary IPv6 DNS server for this interface.
2
Import DNS search list from the internal DNS server: Indicates whether the DNS search list or the own
domain for this logical network should be inserted from the internal DNS server, e.g., "internal". The own domain
can be configured under IPv4 > DNS > General settings. The default setting is "enabled".
2
Import DNS search list from WAN: Specifies whether the DNS search list sent by the provider
(e.g., provider-xy.de) is announced in this logical network. This feature is available only if the prefix list is connected
to the corresponding WAN interface under Receive prefix from.
1
Route options: Defines the route option in router advertisements according to RFC 4191 (Route Information Option).
The following settings are possible:
2
Interface name: Defines the name of the logical interface to be used for sending router advertisements with
this route option.
2
Prefix: Prefix of the route option, e.g. "2001:db8::/32".
2
Route preference: Preferred route. Possible values are "high", "medium" (default) and "low".
619
Reference Manual
9 IPv6
DHCPv6
This is where you configure the DHCPv6 server, the DHCPv6 client and the DHCPv6 relay agent.
DHCPv6 server
Use the following buttons to access the tables and adjust the respective functions:
1
DHCPv6 networks: This table is used to configure the basic settings of the DHCPv6 server, and to specify which
interfaces they apply to.
620
Reference Manual
9 IPv6
Interface name or relay: Name of the interface on which the DHCPv6 server is working, e.g. "INTRANET".
Alternatively, you can also enter the IPv6 address of the remote DHCPv6 relay agent.
2
2
DHCPv6 server activated: Activates or deactivates the entry.
2
Rapid commit: With rapid commit activated, the DHCPv6 server responds directly to a solicit message with a
reply message.
5
The client must explicitly include the rapid commit option in its solicit message.
2
Primary DNS: IPv6 address of the primary DNS server.
2
Secondary DNS: IPv6 address of the secondary DNS server.
2
Import DNS search list from the internal DNS server: Indicates whether the DNS search list or the own
domain for this logical network should be inserted from the internal DNS server, e.g., "internal". The own domain
can be configured under IPv4 > DNS > General settings. The default setting is "enabled".
2
Import DNS search list from WAN: Specifies whether the DNS search list from the provider (e.g., provider-xy.com)
is announced on this logical network. The default setting is "disabled".
2
Address pool: Name of the address pool used for this interface.
5
If the DHCPv6 server operates 'stateful' addresses distribution, you must enter the corresponding addresses
into the Address pools table.
2
Prefix delegation pool: Name of prefix pools to be used by the DHCPv6 server.
5
If the DHCPv6 server is to delegate prefixes to other routers, you must enter the corresponding prefixes
in the table Prefix delegation pools.
2
Unicast address: By default the DHCPv6 server exclusively responds to multicast requests. If the DHCPv6 server
should respond to a unicast request, this IPv6 address can be configured here. Generally speaking, multicast is
sufficient for communication.
1
Address pools: If distribution of the DHCPv6 server is to be stateful, this table defines an address pool:
2
Address pool name: Name of the address pool
2
First address: First address in the pool, e.g., "2001:db8::1"
2
Last address: Last address in the pool, e.g., "2001:db8::9"
2
Preferred lifetime: Here you specify the time in seconds that the client should treat this address as "preferred".
After this time elapses, a client classifies this address as "deprecated".
2
Valid lifetime: Here you specify the time in seconds that the client should treat this address as "valid".
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values for
preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
2
Receive prefix from: With this parameter you can assign addresses to the network clients from the prefix that
the router retrieved from the WAN interface via DHCPv6 prefix delegation. Select the desired WAN interface here.
For example, if the provider assigned the prefix "2001:db8::/64", you can then enter the value "::1" in the
parameter First address and "::9" in Last address. In combination with the prefix "2001:db8::/64" as delegated
by the provider, the clients receive addresses from the pool "2001:db8::1" to "2001:db8::9".
If the provider prefix is greater than "/64", e.g., "/48" or "56", you must take subnetting for the logical network
in to account in the address.
621
Reference Manual
9 IPv6
Example:
3
Assigned provider prefix: "2001:db8:abcd:aa::/56"
3
"/64" as the prefix of the logical network (subnet ID 1): "2001:db8:abcd:aa01::/64"
3
First address: "0:0:0:0001::1"
3
Last address: "0:0:0:0001::9"
5
You should only use this mechanism if the provider assigns a fixed prefix. Otherwise, it is possible that
the provider delegates a new prefix to the router, but the client still has an address from the pool with
the old prefix. In this case, the client must update its address at the server.
1
Prefix delegation pools: In this table, you specify the prefixes that the DHCPv6 server delegates to other routers:
2
PD pool name: Name of the PD pool
2
First prefix: First prefix to be delegated in the PD pool, e.g., "2001:db8:1100::"
2
Last prefix: Last prefix to be delegated in the PD pool, e.g., "2001:db8:FF00::"
2
Prefix length: Length of the prefixes in the PD pool, e.g., "56" or "60"
2
Preferred lifetime: Here you specify the time in seconds that the client should treat this prefix as "preferred".
After this time elapses, a client classifies this address as "deprecated".
2
Valid lifetime: Here you specify the time in seconds that the client should treat this prefix as "valid".
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values for
preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
2
Receive prefix from: Name of the WAN interface from which the client should use the prefix to form the address
or prefix.
1
Reservations: If you want to assign fixed IPv6 addresses to clients, you can make a reservation for each client in
this table:
2
Interface name or relay: Name of the interfaces on which the DHCPv6 server is working, e.g., "INTRANET".
Alternatively, you can also enter the IPv6 address of the remote relay agent.
2
Address/PD-Prefix: IPv6 address, or PD prefix that you want to assign statically.
2
Client ID: DHCPv6 unique identifier (DUID) of the client.
622
Reference Manual
9 IPv6
DHCPv6 clients are no longer identified with their MAC addresses like DHCPv4 clients, they are identified with
their DUID instead. The DUID can be read from the respective client, for example, on Windows with the shell
command ipconfig /all or in WEBconfig under Status > IPv6 > DHCPv6 > Client > Client ID.
For devices working as a DHCPv6 server, the client IDs for clients that are currently using retrieved IPv6 addresses
are to be found under Status > IPv6 > DHCPv6 > Server > Address bindings, and retrieved IPv6 prefixes are
under Status > IPv6 > DHCPv6 > Server > PD bindings.
LANmonitor displays that client IDs under DHCPv6 server.
2
Preferred lifetime: Here you specify the time in seconds that the client should treat this address as "preferred".
After this time elapses, a client classifies this address as "deprecated".
2
Valid lifetime: Here you specify the time in seconds that the client should treat this address as "valid".
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values for
preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
2
Receive prefix from: Name of the WAN interface from which the client should use the prefix to form the address
or prefix.
DHCPv6 client
Use the following buttons to access the tables and adjust the respective functions:
1
Interfaces: This table determines the behavior of the DHCPv6 client.
5
Normally client behavior is controlled by the auto-configuration. Only make entries in this table if you want
to use the client in "stand-alone" mode or if there are other specific options that deviate from the default
settings.
2
Interface name: Name of the interface on which the DHCPv6 client is working. These can be LAN interfaces or
WAN interfaces (remote stations), e.g. "INTRANET" or "INTERNET".
2
Operating: Determines if and how the device enables the client. Possible values are:
3
"Autoconfiguration": The device waits for router advertisements, and then starts the DHCPv6 client. This
option is the default setting.
3
"Yes": The device starts the DHCPv6 client as soon as the interface is active, without waiting for router
advertisements. The device ignores the specifications from router advertisements.
3
"No": The DHCPv6 client is disabled on this interface. Even if the device receives router advertisements, it will
not start the client.
2
Rapid commit: When rapid commit is activated, the client attempts to obtain an IPv6 address from the DHCPv6
server with just two messages. If the DHCPv6 server is configured correspondingly, it immediately responds to
this solicit message with a reply message.
2
Reconfigure accept: If the client successfully negotiates a re-configuration (reconfigure) with the server during
first contact, the server can request the client to update its address or other information at any time. The mechanism
623
Reference Manual
9 IPv6
is protected by the so-called 'Reconfigure Key', so that only the original server with the correct key can make
requests to the client. If the client receives a reconfigure message without a valid reconfigure key, the client
rejects this invocation.
The client supports the "Reconfigure Key Authentication Protocol" according to RFC 3315 for the options "Renew"
and "Information Request", and also "Rebind" as per RFC 6644.
This option is enabled by default for WAN interfaces.
2
Send own name (FQDN): The client sends its own host name (Fully Qualified Domain Name). By default, this
option is active on LAN interfaces.
2
Request DNS server: Specifies whether the client queries the DHCPv6 server for DNS servers.
5
You must enable this option in order for the device to obtain information about a DNS server.
2
DNS search list: The client queries the DNS search list.
2
Request address: Determines whether the client should request an IPv6 address from the DHCPv6 server.
5
Only activate this option if addresses configured by the DHCPv6 server via this interface are stateful, i. e.
not distributed by 'SLAAC'.
2
Request prefix: Determines whether the client should request an IPv6 prefix from the DHCPv6 server. Activating
this option is only necessary if the device itself functions as a router and redistributes these prefixes. This option
is enabled by default on WAN interfaces in order for the DHCPv6 client to request a prefix from the provider for
use in its local network. This option is disabled by default on LAN interfaces because devices in a local network
are more likely to function as clients rather than as routers.
DHCPv6 relay agent
Use the following buttons to access the tables and adjust the respective functions:
1
Interfaces: A DHCPv6 relay agent forwards DHCP messages between DHCPv6 clients and DHCPv6 servers, which
are located in different networks. This table determines the behavior of the DHCPv6 relay agent.
2
Interface name: Name of the interface on which the relay agent receives requests from DHCPv6 clients,
e.g. "INTRANET".
2
DHCPv6-Relay-Agent-enabled: Determines if and how the device enables the relay agent. Possible values are:
3
"Yes": Relay agent is enabled. This option is the default setting.
3
"No": Relay agent is not enabled.
2
Interface address: The relay agent's own IPv6 address on the interface that is configured under Interface name.
This IPv6 address is used as a sender address in DHCP messages that are forwarded. This sender address enables
DHCPv6 clients to uniquely identify a relay agent. An explicit specification of the interface address is necessary
because an IPv6 host can have multiple IPv6 addresses for each interface.
2
Destination address: The IPv6 address of the (destination) DHCPv6 server which the relay agent should forward
DHCP requests to. The address can be either a unicast or link-local multicast address. When using a link-local
624
Reference Manual
9 IPv6
multicast address, you must specify the destination interface where the DHCPv6 server is to be reached. All
DHCPv6 servers and relay agents are available at the link-local multicast address ff02::1:2.
2
Destination interface: The destination interface where the parent DHCPv6 server or the next relay agent can
be reached. This information is essential if a link-local multicast address is configured under the destination
address, as link local-multicast addresses are only valid at that respective link.
Tunnel
The Tunnel configuration offers you 3 buttons to create IPv6 tunnels that can be used over IPv4 networks. Use these
options to gain access to the IPv6 Internet using an IPv4 connection.
1
6to4 tunnel: This button opens the 6to4 tunnel settings.
5
Connections through a 6to4 tunnel work with relays that are selected by the IPv4 Internet provider's backbone.
The device administrator has no influence on relay selection. Furthermore, the selected relay can change
without the administrator knowing about it. For this reason, connections via a 6to4 tunnels are suitable for
test purposes only. In particular, avoid using 6to4-tunnel data connections for productive systems or for
the transmission of confidential data.
1
6in4 tunnel: This button opens the 6in4 tunnel settings.
5
6in4 tunnels require more administrative effort, but they represent a secure and stable technology for IPv6
Internet access. This option is also suitable for professional use.
1
6rd tunnel: This button opens the 6rd tunnel settings.
5
6rd tunneling is suitable for end users and for professional applications because configuration is less complex
than with 6in4 tunneling and the technology avoids the security risks of 6to4 tunneling.
9.9.2 Settings in the PPP list
In the PPP list, you are able to specify you own definition of PPP negotiation for every remote site contacting your network.
625
Reference Manual
9 IPv6
You can also specify whether communications should use an IPv4 or an IPv6 connection.
The authentication of point-to-point connections in the WAN commonly relies on one of the protocols PAP, CHAP,
MSCHAP or MSCHAPv2. The protocols here have a "hierarchy" amongst themselves, i.e. MSCHAPv2 is a "higher-level"
protocol than MSCHAP, CHAP and PAP (higher protocols provide higher security). Many dial-in routers at Internet
providers allow up-front authentication using a higher-level protocol such as CHAP, but only support the use of PAP
further down the line. If the setting for the protocol for authentication is fixed in the LANCOM, the connection may fail
because no common authentication protocol can be negotiated.
5
In principle authentication can be repeated while the connection is being negotiated. Another protocol can be
selected if, for example, it can only be recognized from the username at the earliest. However, this repeat
negotiation is not supported in all scenarios. In particular when dialing in over UMTS, the device must explicitly
refuse the provider's request for CHAP to be able to provide PAP user data for requests to be forwarded by the
provider.
A flexible setting for the authentication protocols in the device ensures that the PPP connection is established as required.
In addition, one or more protocols can be defined that are accepted for authentication of remote sites in the device
(inbound connections) and on login of the device into other remote sites (outbound connections).
1
When establishing inbound connections, the device requires the lowest of the permitted protocols, but where possible
it also permits the remote site to use one of the higher-level protocols (enabled in the device).
1
When establishing outbound connections, the device offers all enabled protocols, but only permits a selection from
precisely these protocols. It is not possible to negotiate one of the disabled, possibly higher-level, protocols.
The PPP authentication protocols are set in the PPP list.
LANconfig: Communication > Protocols > PPP list
9.9.3 IP routing tables
Unlike previous versions where the configuration menu contained just a single IP routing table, this item now offers the
configuration of separate routing tables for IPv4 and IPv6 connections.
You will find the new table under IP router > Routing > IPv6 routing table
626
Reference Manual
9 IPv6
The IPv4 settings that were previously in the table IP routing table are now located in the IPv4 routing table .
The table contains the entries to be used for routing packets with IPv6 addresses.
Prefix
Specify the prefix of the network area for which the data is to be routed to the given remote station.
Routing tag
Specify the routing tag for this route. This route is active only for packets with the same tag. The data packets
receive the routing tag either from the firewall or depending on the LAN or WAN interface used.
Router
This is where you specify the remote site for this route.
Comment
Enter a descriptive comment for this entry.
5
Entering a comment is optional.
627
Reference Manual
9 IPv6
9.9.4 Separate views for the IPv4 and IPv6 firewalls
As of LCOS version 8.80, you can configure the rules for the IPv4 and IPv6 firewalls in separate views.
The corresponding configurations are located under Firewall/QoS > IPv4 rules and Firewall/QoS > IPv6 rules
respectively.
9.9.5 IPv6 DNS hosts in the DNS list
When the DNS server in your device receives a query about a station name, it responds with the IP address contained
in the Host names list. For each station/host name you define either the IPv4 or the IPv6 address, or alternatively you
can enter both IP addresses.
In LANconfig, the table with the station names and the associated IP addresses is under IPv4 > DNS > Host names.
9.9.6 Configuring the IPv6 firewall rules
With LANconfig you can set the firewall rules under Firewall/QoS > IPv6 Rules.
The factory settings provide various objects and lists for the most important applications.
628
Reference Manual
9 IPv6
5
You cannot delete objects or lists if the firewall uses them in a forwarding or inbound rule.
IPv6 inbound rules
Using the IPv6 inbound rules you set the rules that the IPv6 firewall should use to handle incoming traffic.
The factory settings provide various rules for the most important applications.
Click on Add... to create a new rule.
You can set the following properties for the rule:
Name
Specifies the name of the rule.
This rule is active for the firewall
Enables the rule.
Priority
Specifies the priority of the rule: The higher the value, the higher the priority.
Actions
Specifies the action that the firewall performs if the rule condition is true. Using Select you can choose one
action or a list of actions.
If you make a new entry here, it initially appears under Unknown source. Next, highlight the entry for a
source that you want to assign to the new entry, and click on Manage source. Set the values for this entry,
and save the new object. The new entry now appears as a new object in the list of the corresponding source.
629
Reference Manual
9 IPv6
Server services
Determines the services which the firewall applies this rule to. Using Select you can choose one service or a
list of services.
Source stations
Determines the source stations which the firewall applies this rule to. Using Select you can choose one station
or a list of stations.
Comment
Here you assign a meaningful description for the filter rule.
IPv6 forwarding rules
The IPv6 forwarding rules button accesses dialog where you set the rules that the IPv6 firewall should use to handle
forwarded traffic.
The factory settings provide various rules for the most important applications.
In order to change the order of the rules, highlight the specific rule in the table and move it up or down in the table by
clicking on the arrow buttons. The firewall applies the rules one after the other from top to bottom.
Click on Add... to create a new rule.
You can set the following properties for the rule:
Name
Specifies the name of the rule.
This rule is active for the firewall
Enables the rule.
Observe further rules after this one matches
If you enable this option, the firewall also applies the subsequent rules in the list. This is useful if the firewall
should, for example, initially apply a group rule and then apply each rule to the individual objects in the
group.
This rule tracks connection states (recommended)
Select this option if the rule should track the TCP connection states.
630
Reference Manual
9 IPv6
Priority
Specifies the priority of the rule: The higher the value, the higher the priority.
Routing tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by
this device on this network will be internally marked with this tag. The interface tag makes it possible to
separate the rules valid for this network.
Actions
Specifies the action that the firewall performs if the rule condition is true. Using Select you can choose one
action or a list of actions.
If you make a new entry here, it initially appears under Unknown source. Next, highlight the entry for a
source that you want to assign to the new entry, and click on Manage source. Set the values for this entry,
and save the new object. The new entry now appears as a new object in the list of the corresponding source.
Server services
Determines the services which the firewall applies this rule to. Using Select you can choose one service or a
list of services.
Source stations
Determines the source stations which the firewall applies this rule to. Using Select you can choose one station
or a list of stations.
Target stations
Determines the target stations which the firewall applies this rule to. Using Select you can choose one station
or a list of stations.
Comment
Here you assign a meaningful description for the filter rule.
Action list
Using the Action list button, you can collect actions into groups. The actions available here must first be defined using
Action objects.
631
Reference Manual
9 IPv6
Click on Add... to create a new rule.
You can set the following properties for a list:
Name
Determines the name of the list.
Action objects
Determines the objects that you want to combine in this list. Using Select you can choose one or more objects
from a list.
If you make a new entry here, it initially appears under Unknown source. Next, highlight the entry for a
source that you want to assign to the new entry, and click on Manage source. Set the values for this entry,
and save the new object. The new entry now appears as a new object in the list of the corresponding source.
Action objects
Using the Action objects button, you define actions that the IPv6 firewall runs when a filter is true.
632
Reference Manual
9 IPv6
Click on Add... to create a new action.
You can set the following properties for the object:
Name
Specifies the name of the object.
Count
When this limit is exceeded, the firewall performs the action.
Unit
Determines the unit for the limits. Select the corresponding value in the drop-down menu.
Time
Determines the measurement period that the firewall applies to the limit. Select the corresponding value in
the drop-down menu.
Context
Determines the context that the firewall applies to the limit. Select the corresponding value in the drop-down
menu.
Reset counter
If you enable this option, the firewall resets the counter after running the action.
5
You can only activate this option if you selected "absolute" in the time value.
Common counter
If you enable this option, the firewall adds all action triggers together in one counter.
5
You can only activate this option if you selected "per station" or "global" in the Context value.
Action
Determines the action the firewall performs when the limit is reached.
633
Reference Manual
9 IPv6
The following options are possible:
1
Reject: The firewall rejects the data packet and sends an appropriate notification to the sender.
1
Drop: The firewall discards the data packet without notification.
1
Transmit: The Firewall accepts the data packet.
Mark with DiffServ-CP
Determines the priority of the data packets (differentiated services, DiffServ), with which the firewall should
transfer the data packets.
5
You can only activate this option if you selected "transmit" in the Action value.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section
"QoS".
DiffServ-CP value
Determines the value for the Differentiated Services Code Point (DSCP).
5
You can only activate this option if you selected "Value" in Mark with DiffServ-CP.
Conditions
Determines which conditions must be met in order for the action to be performed. The item Conditions is
used to specify any conditions.
Further measures
Determines which trigger actions the firewall should start in addition to filtering the data packets. You can
specify trigger actions under the Further measures.
Conditions
Use the Conditions button to specify the conditions that have to be met for the forwarding and inbound rules to apply.
Click on Add... to create a new condition.
You can set the following properties for the condition:
Name
Specifies the name of the object.
Action only – if not connected
Select this option if the firewall should only perform the action if there is no connection.
634
Reference Manual
9 IPv6
Action only – for default route (e.g. Internet)
Select this option if the firewall should only perform the action if there is a connection over the default route.
Action only – for backup connections
Select this option if the firewall should only perform the action if the connection is a backup connection.
Action only – for VPN route
Select this option if the firewall should only perform the action if the connection is a VPN connection.
Action only – for packets sent
Select this option if the firewall should only perform the action for packets sent.
Action only – for packets received
Select this option if the firewall should only perform the action for packets received.
Transmission direction
Determines whether the transport direction refers to the logical connection or the physical data transmission
over the respective interface.
Action only – for DiffServ-CP
Determines the priority that the data packets (differentiated services, DiffServ) have to have, so that the
condition is met.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section
"QoS".
DiffServ-CP value
Determines the value for the Differentiated Services Code Point (DSCP).
Enter a value here if you selected the "Value" option in the – for DiffServ-CP field.
5
Further information about DiffServ CodePoints is available in the Reference Manual under the section
"QoS".
Further measures
Use the Further measures button to define further measures that the firewall performs after you apply the forwarding
and inbound rules.
Click on Add... to create a new measure.
635
Reference Manual
9 IPv6
You can set the following properties for the trigger actions:
Name
Specifies the name of the object.
SNMP (e.g. LANmonitor)
Select this option if the firewall should send a notification via SNMP. You can receive this notification, e.g., with
LANmonitor.
Send SYSLOG message
Select this option if the firewall should send a SYSLOG notification via SNMP.
5
For more information about SYSLOG, refer to the chapter "Diagnostics" in the section "SYSLOG" in
the Reference Guide.
Send e-mail message
Select this option, if the firewall should send a notification by e-mail.
5
If you want to receive e-mail notifications, you must enter an e-mail address in Firewall/QoS >
General > Administrator e-mail.
Disconnect
Select this option if the firewall should disconnect.
Lock source address
Select this option if the firewall should block the source address. The firewall registers the blocked IP address,
the lockout period, as well as the underlying rule in the Host-lock-list under Status > IPv6 > Firewall.
Duration
If the firewall should block the sender, you can set the duration of the lock in minutes. The value "0" disables
the lock because, in practice, the lockout period expires after 0 minutes.
Close destination port
Select this option, if the firewall should block the target port. The firewall registers the blocked destination
IP address, the protocol, the destination port, the lockout period, as well as the underlying rule in the
Port-block-list under Status > IPv6 > Firewall.
Duration
If the firewall should block the target port, you can set the duration of the lock in minutes. The value "0"
disables the lock because, in practice, the lockout period expires after 0 minutes.
Service list
Using the Service list button, you can collect services into groups. You first define the services under TCP/UDP service
objects, ICMP service objects and IP protocol objects.
Click on Add... to specify a new service.
You can set the following properties for a list:
636
Reference Manual
9 IPv6
Name
Determines the name of the list.
Service objects
Determines the objects that you want to combine in this list. Using Select you can choose one or more objects
from a list.
If you make a new entry here, it initially appears under Unknown source. Next, highlight the entry for a
source that you want to assign to the new entry, and click on Manage source. Set the values for this entry,
and save the new object. The new entry now appears as a new object in the list of the corresponding source.
TCP/UDP service objects
Using the TCP/UDP service objects button, you define TCP/UDP services that the IPv6 firewall can use in filter rules.
Click on Add... to create a new service.
You can set the following properties for the rule:
Name
Specifies the name of the object.
IP protocol
Specifies the protocol of the service
Ports
Specifies the ports for the service. Separate multiple ports with a comma.
5
Lists with the official protocol and port numbers are available in the Internet at
www.iana.org
.
This is/are source ports
Determines whether the specified ports are source ports.
5
In certain scenarios, it may be useful to specify a source port. This is unusual. Selecting "No" is
recommended.
ICMP service objects
Using the ICMP service objects button, you define ICMP services that the IPv6 firewall can use in filter rules.
5
Lists with the official ICMP types and port codes are available in the Internet under
www.iana.org
.
637
Reference Manual
9 IPv6
Click on Add... to create a new service.
You can set the following properties for the rule:
Name
Specifies the name of the object.
ICMP type
Specifies the type of the ICMP service.
ICMP code
Specifies the code of the ICMP service.
IP protocol objects
Using the IP protocol objects button, you define IP protocol objects that the IPv6 firewall can use in filter rules.
5
Lists with the official protocol and port numbers are available in the Internet at
www.iana.org
.
Click on Add... to create a new object.
You can set the following properties for the rule:
Name
Specifies the name of the object.
Protocol
Defines the protocol number.
Station list
Using the Station list button, you can collect stations into groups. Stations must previously be defined using Station
objects.
Click on Add... to create a new list.
You can set the following properties for a list:
638
Reference Manual
9 IPv6
Name
Determines the name of the list.
Station objects
Determines the objects that you want to combine in this list. Using Select you can choose one or more objects
from a list.
If you make a new entry here, it initially appears under Unknown source. Next, highlight the entry for a
source that you want to assign to the new entry, and click on Manage source. Set the values for this entry,
and save the new object. The new entry now appears as a new object in the list of the corresponding source.
Station objects
Using the Station objects button, you define stations that the IPv6 firewall can use in filter rules.
Click on Add... to create a new object.
You can set the following properties for the object:
Name
Specifies the name of the object.
Type
Determines the station type.
Network name
Here you enter the name of the network if you selected the appropriate option in the Type field.
5
Entering the network name is optional.
Local station/Remote site
Here you enter the name of the remote site if you selected the appropriate option in the Type field.
Address
Here you enter the address of the remote site if you selected the appropriate option in the Type field.
9.10 Tutorials
9.10.1 Setting up IPv6 Internet access
You can set up access to an IPv6 network if
1
You have an IPv6-capable device,
639
Reference Manual
9 IPv6
1
You use a tunneling technology and
1
Your provider supports a native IPv6 network or you have access to a so-called tunnel broker who can mediate your
IPv6 packets.
IPv6 access using the Setup Wizard in LANconfig
The Setup Wizard assists you with the configuration of IPv6 access with your equipment.
The Wizard presents following options:
1
Set up IPv6 access for a new, unconfigured device.
1
Set up IPv6 access in addition to a functioning IPv4 access for an existing device.
Setup Wizard – setting up IPv6 in a new device
If you have connected up a new device but not have yet configured it, you have the option of using a Setup Wizard to
set up IPv4 and IPv6 connections.
To save your entries and proceed to the next screen, click Next.
1. Then start the Setup Wizard in LANconfig. Highlight the device to be configured. The Setup Wizard is started either
by right-clicking and using the context menu, or with the Magic Wand icon in the toolbar
640
Reference Manual
9 IPv6
2. In the Setup Wizard, select the option Set up Internet access.
3. You can choose from the following options:
1
Set up a dual-stack connection. This is IPv4-and IPv6-capable and currently the recommended option for a new
device.
1
Set up an IPv4-only connection.
1
Set up an IPv6-only connection.
In the following we take you through the setup of a dual-stack connection. Activate the appropriate selection.
641
Reference Manual
9 IPv6
4. Set the interface to be used for the connection.
You can select from the following entries:
1
ADSL interface
1
Ethernet interface (external modem/router)
1
ISDN interface
1
Mobile over USB interface
5. Select your country from the list.
6. Select your Internet provider.
You can select from the following entries:
1
A selection of the major Internet providers
1
Alternative Internet providers over T-DSL
1
Internet access via PPP over ATM (PPPoA)
1
Internet access via PPP over Ethernet (PPPoE, PPPoEoA)
1
Internet access via plain IP (IPoA)
1
Internet access over Plain Ethernet (IPoE, IPoEoA)
642
Reference Manual
9 IPv6
7. Enter a name for this connection.
If you access the Internet with an alternative connection, e. g. over a PPPoE connection, you should additionally
enter the appropriate ATM parameters.
8. Enter the login details given to you by your provider for setting up your Internet access.
643
Reference Manual
9 IPv6
5
Depending on the provider, the type and number of fields may vary.
9. Specify how you want the device to behave in case of disconnection. You can also specify if and when the device is
to carry out a forced re-connection.
10. Define the type of backup connection to be used in case of connection failure.
You can select from the following options:
1
No backup connection: Skips the configuration of a backup.
1
Use the connection already configured in case of backup: In the following dialog, select an already configured
connection from a list.
1
Setup a backup connection over UMTS: In the next dialog, set up a new UMTS connection. You will need the
access data for your UMTS provider.
1
Setup a backup connection over ISDN: In the next dialog, set up a new ISDN connection. You will need the access
data for your ISDN provider.
644
Reference Manual
9 IPv6
11. If your device does not yet have an IP address, enter a new IP address and corresponding netmask.
12. Select the type of IPv6 Internet access.
You can select from the following options:
1
Additional native IPv6: Configure a direct connection without a tunnel.
1
6to4 tunnel: Start the wizard to configure a 6to4 tunnel.
1
6in4 tunnel: Use the input mask to set the parameters for the 6in4 tunnel.
1
6rd tunnel: Use the input mask to set the parameters for the 6rd tunnel.
Select the option for setting up a native IPv6 Internet connection.
645
Reference Manual
9 IPv6
13. Accept the default setting of Automatically take IPv6 parameters from router advertisements.
14. You have completed the setup of the native IPv6 Internet access. Click on Finish when you are done and the wizard
will save your entries to the device.
Setup Wizard – Setting up IPv6 on an existing device
If you have a device configured for IPv4 and you wish to set up an additional IPv6 connection, you have the option of
setting up the IPv6 connections with the Setup Wizard.
To save your entries and proceed to the next screen, click Next.
1. Then start the Setup Wizard in LANconfig. Highlight the device to be configured. The Setup Wizard is started either
by right-clicking and using the context menu, or with the Magic Wand icon in the toolbar
646
Reference Manual
9 IPv6
2. In the Setup Wizard, select the option Set up Internet access. To continue, click on Next.
3. Because your device is already IPv4-capable, the Setup Wizard gives you the opportunity to extend your existing
settings with IPv6. Select this option and click on Next.
4. Select the type of IPv6 Internet access.
647
Reference Manual
9 IPv6
You can select from the following options:
1
Additional native IPv6: Configure a direct connection without a tunnel.
1
6to4 tunnel: Start the wizard to configure a 6to4 tunnel.
1
6in4 tunnel: Use the input mask to set the parameters for the 6in4 tunnel.
1
6rd tunnel: Use the input mask to set the parameters for the 6rd tunnel.
Select the option for setting up a native IPv6 Internet connection.
5. Accept the default setting of Automatically take IPv6 parameters from router advertisements.
6. You have completed the setup of the native IPv6 Internet access. Click on Finish when you are done and the wizard
will save your entries to the device.
9.10.2 Setting up a 6to4 tunnel
The use of a 6to4 tunnel is feasible when
1
Your device is IPv6 capable and you want to access IPv6 services,
1
Your provider does not support a native IPv6 network and
1
You do not have access to a so-called tunnel broker who can mediate your IPv6 packets.
When using a 6to4 tunnel, the lack of support of IPv6 by the provider means the device does not receive an IPv6 address
or an IPv6 prefix.
The device calculates its own unique prefix from "2002::/16" and the hexadecimal representation of its own public IPv4
address from the provider. This application only works if the device has a public IPv4 address. The device does not receive
a public IPv4 address but an IPv4 address from a private address range only, for example when it accesses the Internet
via UMTS and the provider supplies an IP address from its private address range, or if the device does not access the
Internet directly, but is "behind" another router.
5
Connections through a 6to4 tunnel work with relays that are selected by the IPv4 Internet provider's backbone.
The device administrator has no influence on relay selection. Furthermore, the relay used can change without
the administrator knowing about it. For this reason, connections via a 6to4 tunnels are suitable for test purposes
only. In particular, avoid using 6to4-tunnel data connections for productive systems or for the transmission of
confidential data.
Working with LANconfig
To set up a 6to4 tunnel with LANconfig, proceed as follows:
1. LANconfig can be started from the Windows Start bar: Click on Start > Programs > LANCOM > LANconfig.
LANconfig now automatically searches the local network for devices.
648
Reference Manual
9 IPv6
2. Select the device on which you want to set up a 6to4 tunnel. Select it with a left-click and start the configuration
from the menu bar with Device > Configure.
3. Navigate to IPv6 > Tunnel and click on 6to4 tunnel.
4. Click on Add to create a new 6to4 tunnel.
5. Set the name of the 6to4 tunnel.
6. Set the Interface tag to a value that uniquely identifies the network. All packets received by this device on this
network will be internally marked with this tag. The interface tag enables the routes which are valid for this network
to be separated even without explicit firewall rules.
7. The Gateway address is set by default to the anycast address "192.88.99.1". This address can only be changed
with WEBconfig or Telnet.
8. Here you define the routing tag that the device uses to determine the route to the associated remote gateway. The
IPv4 routing tag specifies which tagged IPv4 route is to be used for the data packets to reach their destination
address.
9. The default value is this tunnel's firewall.
If you disable the global firewall, you should also disable the firewall for the tunnel.
10. Accept your entries with OK.
649
Reference Manual
9 IPv6
11. Change to the directory IPv6 > Router advertisements.
12. Open the Prefix list and click on Add.
13. Enter a name for the interface that is used by the 6to4 tunnel, e. g. "INTRANET".
14. Set the value for the Prefix to "::/64" in order to accept the prefix issued by the provider automatically and in its
entirety.
15. Accept the default value of "1" for the Subnet ID.
16. Accept the activated option Stateless address configuration.
17. In the field Prefix delegation from, enter the name of the tunnel that you have defined earlier, e.g. in the example
above "TUNNEL-6TO4".
18. Accept your entries with OK.
19. In the directory IPv6 > Router advertisements, open the Interface options, select the entry INTRANET and click
on Edit.
650
Reference Manual
9 IPv6
20. In the drop-down menu Send router advertisements select the option 'Yes'.
21. Accept all other default values without change.
22. Save your entries with OK.
23. Change to the directory IP router > Routing.
24. Open the IPv6 routing table and click on Add.
25. Set the Prefix to the value "::/0".
26. In the field Routing tag accept the default value "0".
27. In the field Router, select from the list the name of the tunnel that you defined earlier, e.g. in the example above
"TUNNEL-6TO4".
28. Enter a descriptive Comment for this entry.
29. Save your entries with OK.
651
Reference Manual
9 IPv6
30. Change to the directory IPv6 > General and enable the IPv6 stack.
Working with WEBconfig
To set up a 6to4 tunnel with WEBconfig, proceed as follows:
1. Type into your browser's address bar the address of the device to be set up with a 6to4 tunnel.
2. Change to the directory LCOS Menu Tree > Setup > IPv6 > Tunnel > 6to4 and click on Add.
3. Enter a name for the remote peer, e. g. "TUNNEL-6TO4".
4. Leave the Routing tag unchanged as the default value "0".
5. As the Gateway address you can accept the default value "192.88.99.1". This is the default anycast address for
6to4 relays that your device connects to.
This address is the reason why 6to4 tunnels are unstable and insecure. There is no assurance that a 6to4 relay will
be available, and publicly available 6to4 relays may not be trustworthy. There is no guarantee that the relay does
not record your traffic.
6. In the field IPv4-Rtg-tag accept the default value "0"
652
Reference Manual
9 IPv6
7. Enable the firewall for this tunnel.
If you disable the global firewall, you should also disable the firewall for the tunnel.
8. Save your entries with Send.
9. Change to the directory LCOS Menu Tree > Setup > IPv6 > Router-Advertisement, open the Prefix options
table and click on Add.
10. Enter a name for the interface that uses the 6to4 tunnel, e. g. "INTRANET".
11. Set the value for the Prefix to "::/64" in order to accept the prefix issued by the provider automatically and in its
entirety.
12. Accept the default value of "1" for the Subnet ID.
13. Set PD source to the name of the remote peer that you previously defined in the example above, e.g. "TUNNEL-6TO4".
14. Save your entries with Send.
15. Change to the directory LCOS Menu Tree > Setup > IPv6 > Router-Advertisement, open the Interface options
table and click on Add.
16. Accept all other default values without change.
17. Save your entries with Send.
653
Reference Manual
9 IPv6
18. Change to the directory LCOS Menu Tree > Setup > IPv6, open the Routing table and click on Add.
19. Set the Prefix to the value "::/0".
20. In the field Rtg-tag accept the default value "0".
21. In the field Peer or IPv6, enter the name of the interface that will use the 6to4 tunnel, e.g. "TUNNEL-6TO4" in the
example above.
22. Enter a descriptive Comment for this entry.
23. Save your entries with Send.
24. Enable the IPv6 stack under LCOS Menu Tree > Setup > IPv6 by setting the option Operating to "yes" and save
with Send.
9.11 Addition(s) to LCOS 8.82
9.11.1 Reconfigure function of the DHCPv6 server
Each IPv6 address or IPv6 prefix has a default life time assigned by the server. At certain intervals, a client asks the server
to renew its address (called renew/rebind times).
However, if the WAN prefix changes, for example, due to disconnection and reconnection of an Internet connection or
a request for a new prefix (Deutsche Telekom Privacy feature), the server has no way to inform the network devices that
the prefix or address has changed. This means that a client is still using an old address or an old prefix, and can no
longer communicate with the Internet.
As of the LCOS 8.82 version, the DHCPv6 server on IPv6-capable LANCOM devices can require clients in the network to
renew their leases/bindings.
654
Reference Manual
9 IPv6
Enhancements to LANconfig
IPv6 configuration menu
Where previous versions provided configuration menus for TCP/IP for IPv4, you now find the options IPv4 and IPv6.
Click on IPv6 to adjust the settings for this protocol. The IPv6 configuration is divided into the options
1
General,
1
Router advertisement,
1
DHCPv6 and
1
Tunnel.
By default a click on IPv6 takes you straight to the General options.
655
Reference Manual
9 IPv6
DHCPv6
This is where you configure the DHCPv6 server, the DHCPv6 client and the DHCPv6 relay agent.
DHCPv6 server
Use the following buttons to access the tables and adjust the respective functions:
DHCPv6 networks
This table is used to configure the basic settings of the DHCPv6 server, and to specify which interfaces they apply to.
Interface name/Relay IP
Name of the interface on which the DHCPv6 server is working, for example "INTRANET". Alternatively, you
can also enter the IPv6 address of the remote DHCPv6 relay agent.
656
Reference Manual
9 IPv6
DHCP server activated
Activates or deactivates the entry.
Rapid commit
With rapid commit activated, the DHCPv6 server responds directly to a solicit message with a reply message.
5
The client must explicitly include the rapid commit option in its solicit message.
DNS default
IPv6 address of the primary DNS server.
DNS backup
IPv6 address of the secondary DNS server.
Import DNS search list from internal DNS server
Indicates whether the DNS search list or the own domain for this logical network should be inserted from the
internal DNS server, e.g., "internal". The own domain can be configured under IPv4 > DNS > General
settings. The default setting is "enabled".
Import DNS search list from WAN
Specifies whether the DNS search list sent by the provider (e.g., provider-xy.de) is announced in this logical
network. The default setting is "disabled".
Address pool
Name of the address pool used for this interface.
5
If the DHCPv6 server operates 'stateful' addresses distribution, you must enter the corresponding
addresses into the Address pools table.
Prefix delegation pool
Name of prefix pools to be used by the DHCPv6 server.
5
If the DHCPv6 server is to delegate prefixes to other routers, you must enter the corresponding prefixes
in the table Prefix delegation pools.
Unicast address
By default the DHCPv6 server exclusively responds to multicast requests. If the DHCPv6 server should respond
to a unicast request, this IPv6 address can be configured here. Generally speaking, multicast is sufficient for
communication.
Reconfigure
Each IPv6 address or IPv6 prefix has a default life time assigned by the server. At certain intervals, a client
asks the server to renew its address (called renew/rebind times).
However, if the WAN prefix changes, for example, due to disconnection and reconnection of an Internet
connection or a request for a new prefix (Deutsche Telekom Privacy feature), the server has no way to inform
the network devices that the prefix or address has changed. This means that a client is still using an old
address or an old prefix, and can no longer communicate with the Internet.
The reconfigure feature allows the DHCPv6 server to require the clients in the network to request a renewal
of leases / bindings. If the client successfully negotiates a re-configuration (reconfigure) with the server during
first contact, the server can request the client to update its address or other information at any time. The
mechanism is protected by the so-called
Reconfigure Key
, so that only the original server with the correct key
can make requests to the client. If the client receives a reconfigure message without a valid reconfigure key,
the client rejects this invocation.
The
Reconfigure Key Authentication Protocol
according to RFC 3315 is supported for
Renew
and
Information-Request
, as well as
Rebind
according to RFC 6644. Reconfiguration is started on the console of
the device using a "do" command in the status tree (see the description of the status tree).
657
Reference Manual
9 IPv6
5
You can find more about the status of a client regarding the Reconfigure function under Status >
IPv6 > DHCPv6 > Server > Clients.
The following settings are available:
1
Off: Disables the reconfigure function
1
Reject: Clients that have used the Reconfigure Option in queries are rejected by the server and are not
assigned an address, prefix or other options.
1
Allow: If the client sets the Reconfigure Option in queries, the server negotiates the necessary parameters
with the client in order to start a reconfiguration at a later time.
1
Require: Clients have to set the Reconfigure Option in queries, otherwise the client rejects these clients.
This mode is makes sense when you want to ensure that the server only serves clients which support
Reconfigure. This ensure that all clients can use Reconfigure to update their addresses, prefixes, or other
information at a later point in time.
Address pools
If distribution of the DHCPv6 server is to be stateful, this table defines an address pool:
Address pool name
Name of the address pool
Start address
First address in the pool, e.g. "2001:db8::1"
End address
Last address in the pool, e.g. "2001:db8::9"
Preferred lifetime:
Here you specify the time in seconds that the client should treat this address as 'preferred'. After this time
elapses, a client classifies this address as "deprecated".
Validity period
Here you specify the time in seconds that the client should treat this address as 'valid'.
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values
for preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
Receive prefix from
With this parameter you can assign addresses to the network clients from the prefix that the router retrieved
from the WAN interface via DHCPv6 prefix delegation. Select the desired WAN interface here. For example,
if the provider assigned the prefix "2001:db8::/64", you can then enter the value "::1" in the parameter First
address and "::9" in Last address. In combination with the prefix "2001:db8::/64" as delegated by the
provider, the clients receive addresses from the pool "2001:db8::1" to "2001:db8::9". If the provider prefix
658
Reference Manual
9 IPv6
is greater than "/64", e.g.,"/48" or "56", you must take subnetting for the logical network in to account in
the address. Example:
1
Assigned provider prefix: "2001:db8:abcd:aa::/56"
1
"/64" as the prefix of the logical network (subnet ID 1): "2001:db8:abcd:aa01::/64"
1
First address: "0:0:0:0001::1"
1
Last address: "0:0:0:0001::9"
5
You should only use this mechanism if the provider assigns a fixed prefix. Otherwise, it is possible
that the provider delegates a new prefix to the router, but the client still has an address from the pool
with the old prefix. In this case, the client must update its address at the server.
Prefix delegation pool
In this table, you specify the prefixes that the DHCPv6 server delegates to other routers:
PD pool name
Name of the PD pool
First prefix
First prefix for delegation in the PD pool, e.g. "2001:db8:1100::"
Last prefix
Last prefix for delegation in the PD pool, e.g. "2001:db8:FF00::"
Prefix length
Length of the prefixes in the PD pool, e.g. "56" or "60"
Preferred lifetime:
Here you specify the time in seconds that the client should treat this prefix as 'preferred'. After this time
elapses, a client classifies this address as "deprecated".
Validity period
Here you specify the time in seconds that the client should treat this prefix as 'valid'.
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values
for preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
Receive prefix from
Name of the WAN interface from which the client should use the prefix to form the address or prefix.
659
Reference Manual
9 IPv6
Reservations
If you want to assign fixed IPv6 addresses to clients or fixed prefixes to routers, you can use this table to make a reservation
for each client.
Interface name or relay
Name of the interface on which the DHCPv6 server is working, for example "INTRANET". Alternatively, you
can also enter the IPv6 address of the remote relay agent.
Address/PD prefix
IPv6 address or PD prefix that you want to assign statically.
Client ID
DHCPv6 unique identifier (DUID) of the client.
DHCPv6 clients are no longer identified with their MAC addresses like DHCPv4 clients, they are identified with
their DUID instead. The DUID can be read from the respective client, for example, on Windows with the shell
command ipconfig /all or in WEBconfig under Status > IPv6 > DHCPv6 > Client > Client ID.
For devices working as a DHCPv6 server, the client IDs for clients that are currently using retrieved IPv6
addresses are to be found under Status > IPv6 > DHCPv6 > Server > Address bindings, and retrieved
IPv6 prefixes are under Status > IPv6 > DHCPv6 > Server > PD bindings.
LANmonitor displays that client IDs under DHCPv6 server.
Preferred lifetime:
Here you specify the time in seconds that the client should treat this address as 'preferred'. After this time
elapses, a client classifies this address as "deprecated".
Validity period
Here you specify the time in seconds that the client should treat this address as 'valid'.
5
If you use a prefix from a WAN interface for dynamic address formation, you cannot configure values
for preferred lifetime and valid lifetime. In this case, the device automatically
determines the values that apply to the prefix delegated by the provider.
Receive prefix from
Name of the WAN interface from which the client should use the prefix to form the address or prefix.
Additions to the Setup menu
Reconfigure
Each IPv6 address or IPv6 prefix has a default life time assigned by the server. At certain intervals, a client asks the server
to renew its address (called renew/rebind times).
However, if the WAN prefix changes, for example, due to disconnection and reconnection of an Internet connection or
a request for a new prefix (Deutsche Telekom Privacy feature), the server has no way to inform the network devices that
the prefix or address has changed. This means that a client is still using an old address or an old prefix, and can no
longer communicate with the Internet.
660
Reference Manual
9 IPv6
The reconfigure feature allows the DHCPv6 server to require the clients in the network to request a renewal of leases /
bindings.
Telnet path:
Setup > IPv6 > DHCPv6 > Server > Interface-List
Possible values:
Off: Disables the reconfigure function
Prohibit: Clients that have used the Reconfigure Option in queries are rejected by the server and are not
assigned an address, prefix or other options.
Allow: If the client sets the Reconfigure Option in queries, the server negotiates the necessary parameters
with the client in order to start a reconfiguration at a later time.
Force: Clients have to set the Reconfigure Option in queries, otherwise the client rejects these clients. This
mode is makes sense when you want to ensure that the server only serves clients which support Reconfigure.
This ensure that all clients can use Reconfigure to update their addresses, prefixes, or other information at a
later point in time.
Default:
Off
Additions to the Status menu
Reconfigure
This action causes the clients in the network to renew their leases/bindings. It can be triggered by a Reconfigure for
Renew, Rebind, or Information Request.
The reconfigure function will then expect the following parameters:
1
renew: (optional, default) Asks the client to perform a renewal for his address and/or prefix.
1
rebind: (optional) Asks the client to perform a rebind for his address and/or prefix.
1
info: (optional) Asks the client to send an Information-Request, in order to, for example, update its DNS server.
1
-c <Client-ID>: The reconfigure function applies to the client with the specified client ID.
1
-b <Address/Prefix>: The reconfigure function applies to the client with the specified address and the
specified prefix.
1
-i <Interface/Relay>: The reconfigure function applies to all clients that are connected to the specified
interface or relay.
1
-a: The reconfigure function applies to all clients.
Telnet path:
Status > IPv6 > DHCPv6 > Server
9.12 Addition(s) to LCOS 8.84
9.12.1 IPv6 prefix delegation from the WWAN to the LAN
As of LCOS 8.84, the WWAN router can communicate an IPv6/64 prefix to the LAN by means of DHCPv6 or router
advertising.
661
Reference Manual
9 IPv6
Enhancements to LANconfig
IPv6 prefix delegation from the WWAN to the LAN
For cellular networks with IPv6 support, the support of DHCPv6 prefix delegation is only expected to be provided with
3GPP Release 10. So for cellular networks earlier than Release 10, the only way to assign just one /64 prefix to a terminal
device is, for example, by using router advertisements. In the case of smartphones or laptops, this method allows IPv6
support to be implemented relatively simply. However, each IPv6 router needs at least one additional prefix that it can
propagate to clients on the LAN.
IPv6 prefix delegation from the WWAN into the LAN makes it possible for clients to use the /64 prefix, as assigned on
the WAN cellular network side, to be used on the LAN. This makes it possible to operate a router in an IPv6 cellular
network without DHCPv6 prefix delegation and neighbor discovery proxy (ND proxy). The router announces the assigned
/64 prefix by router advertisement on the LAN, rather than adding it at the WAN interface. Clients can then generate an
address from this prefix and use it for IPv6 communication.
To do this, you configure the IPv6 Internet access in the normal way. Additionally you should go to IPv6 > General >
IPv6 interfaces > WAN interface and, for the corresponding WAN interface, switch the parameter PD source type
from "DHCPv6" to "Router advertisement".
The following restrictions apply:
1
You can only use the feature on point-to-point connections (such as PPP), whereby the remote station automatically
sends all traffic to the router because there is no ND proxy.
1
You can create only one IPv6 network in the LAN, because only one /64 prefix is available.
1
This feature is not suitable for scenarios where an interim router cannot or does not perform prefix delegation, with
the exception of point-to-point connections.
1
The automatically generated IPv6 address on the WAN interface cannot be reached from clients on the LAN, because
there is no ND proxy.
Additions to the Setup menu
PD mode
For cellular networks with IPv6 support, the support of DHCPv6 prefix delegation is only expected to be provided with
3GPP Release 10. So for cellular networks earlier than Release 10, the only way to assign just one /64 prefix to a terminal
device is, for example, by using router advertisements. In the case of smartphones or laptops, this method allows IPv6
support to be implemented relatively simply. However, each IPv6 router needs at least one additional prefix that it can
propagate to clients on the LAN.
IPv6 prefix delegation from the WWAN into the LAN makes it possible for clients to use the /64 prefix, as assigned on
the WAN cellular network side, to be used on the LAN. This makes it possible to operate a router in an IPv6 cellular
network without DHCPv6 prefix delegation and neighbor discovery proxy (ND proxy). The router announces the assigned
/64 prefix by router advertisement on the LAN, rather than adding it at the WAN interface. Clients can then generate an
address from this prefix and use it for IPv6 communication.
662
Reference Manual
9 IPv6
This option allows you to set the way in which the router performs the prefix delegation:
1
DHCPv6: Prefix delegation via DHCPv6
1
Router advertisement: Prefix delegation via router advertisement, in which case the DHCPv6 client is not activated.
Telnet path:
Setup > IPv6 > WAN-Interfaces
Possible values:
DHCPv6
Router advertisement
Default:
DHCPv6
9.13 Addition(s) to LCOS 9.00
9.13.1 Dual-Stack Lite (DS-Lite)
Dual-Stack Lite, abbreviated DS-Lite, is used so that Internet providers can supply their customers with access to IPv4
servers over an IPv6 connection. That is necessary, for example, if an Internet provider is forced to supply its customer
with an IPv6 address due to the limited availability of IPv4 addresses. In contrast to the other three IPv6 tunnel methods
"6in4", "6rd" and "6to4", DS-Lite is also used to transmit IPv4 packets on an IPv6 connection (IPv4 viaIPv6 tunnel).
For this, the router packages the IPv4 packets in an IPv4-in-IPv6 tunnel and transmits them unmasked to the provider,
who then performs a NAT with one of their own remaining IPv4 addresses.
To define a DS-Lite tunnel, all the router needs is the IPv6 address of the tunnel endpoint and the routing tag with which
it can reach this address.
By default, the router uses the IPv4 address of the corresponding internal network, e.g., from "INTRANET". If you would
like to define a different IP address instead (e.g., 192.0.0.2), it must be entered in the IP parameter list along with the
remote site name of the DS-Lite tunnel.
Entering an IPv4 DNS server is not recommended for a DS-Lite tunnel, since its entries would unnecessarily fill the NAT
table of the Internet provider.
You set up a DS-Lite tunnel in LANconfig via IPv4 > Tunnel by clicking on DS-Lite tunnel.
Then click on the Add button and enter the designation of the tunnel, the IPv6 address of the gateway, and the routing
tag.
663
Reference Manual
9 IPv6
Name of the tunnel
This entry determines the name of the IPv4-over-IPv6 tunnel.
Gateway address
This entry defines the address of the DS-Lite gateway, the so-called Address Family Transition Router (AFTR).
The following values are possible:
1
One IPv6 address (e.g. 2001:db8::1)
1
An FQDN (Fully Qualified Domain Name) that can be resolved by DNS, e.g., aftr.example.com
1
The IPv6 unspecified address "::" determines that the device should retrieve the address of the AFTRs via
DHCPv6 (factory setting).
1
An empty field behaves the same as the entry "::".
IPv6 routing tag
The routing tag uniquely specifies the route to the DS-Lite gateway.
4
With DS-Lite, since the NAT is performed by the provider, the function of many applications depends on the
settings of the NAT provider (e.g., SIP, H.323, IRC or IPSec). PPTP does not work via DS-Lite at all. If the provider
does not operate port forwarding, the IPv4 server services do not function.
The status table and the number of current DS-Lite connections can be shown using LANmonitor:
Additions to the Status menu
DS-Lite
The statistics of the DS-Lite tunnel are located in this directory.
SNMP ID:
1.81
664
Reference Manual
9 IPv6
Telnet path:
State
Rx-Packets
This entry shows the number of data packets received by all DS-Lite interfaces.
SNMP ID:
1.81.1
Telnet path:
Status > DS-Lite
Tx-Packets
This entry shows the number of data packets sent by all DS-Lite interfaces.
SNMP ID:
1.81.2
Telnet path:
Status > DS-Lite
Queue error
This entry shows the number data packets sent by all DS-Lite interfaces.
SNMP ID:
1.81.3
Telnet path:
Status > DS-Lite
Connections
This table shows an overview of the active DS-Lite connections.
Once the device has established a DS-Lite connection, it appears in this table. After a connection terminates without
errors, the entry in the table is deleted automatically. If there is an error, the entry remains until the connection is
reestablished or you manually delete it.
Every status change of a DS-Lite connection sends an SNMP trap (ID 83) with the content of the corresponding line in
the status table
665
Reference Manual
9 IPv6
SNMP ID:
1.81.4
Telnet path:
Status > DS-Lite
Remote site
This entry shows the name of the DS-Lite tunnel.
SNMP ID:
1.81.4.1
Telnet path:
Status > DS-Lite > Connections
State
This entry shows the state of the DS-Lite tunnel.
SNMP ID:
1.81.4.2
Telnet path:
Status > DS-Lite > Connections
Last error
This entry shows the last error on the connection.
SNMP ID:
1.81.4.3
Telnet path:
Status > DS-Lite > Connections
IPv4 address
This entry shows the IPv4 address of the device when it sends data packets.
SNMP ID:
1.81.4.4
666
Reference Manual
9 IPv6
Telnet path:
Status > DS-Lite > Connections
phys. conn.
This entry shows the name of the IPv6 interface running the DS-Lite connection.
SNMP ID:
1.81.4.5
Telnet path:
Status > DS-Lite > Connections
AFTR-Name
This entry shows the DNS name of the tunnel endpoint (Address Family Transition Router, AFTR).
SNMP ID:
1.81.4.6
Telnet path:
Status > DS-Lite > Connections
AFTR-IPv6-Address
This entry shows the IPv6 address of the DS-Lite tunnel endpoint.
SNMP ID:
1.81.4.7
Telnet path:
Status > DS-Lite > Connections
Conn. time:
This entry shows how long the connection already exists. The query via SNMP returns the connection duration in seconds,
TELNET returns the system time of the connection establishment.
SNMP ID:
1.81.4.8
Telnet path:
Status > DS-Lite > Connections
667
Reference Manual
9 IPv6
Tunnel
This entry shows the number of active DS-Lite connections.
SNMP ID:
1.81.5
Telnet path:
Status > DS-Lite
Tunnel
This action deletes all values of the DS-Lite statistics.
SNMP ID:
1.81.6
Telnet path:
Status > DS-Lite
Additions to the Setup menu
DS-Lite-Tunnel
Dual-Stack Lite, abbreviated DS-Lite, is used so that Internet providers can supply their customers with access to IPv4
servers over an IPv6 connection. That is necessary, for example, if an Internet provider is forced to supply its customer
with an IPv6 address due to the limited availability of IPv4 addresses. In contrast to the other three IPv6 tunnel methods
"6in4", "6rd" and "6to4", DS-Lite is also used to transmit IPv4 packets on an IPv6 connection (IPv4 viaIPv6 tunnel).
For this, the router packages the IPv4 packets in an IPv4-in-IPv6 tunnel and transmits them unmasked to the provider,
who then performs NAT with one of their own remaining IPv4 addresses.
To define a DS-Lite tunnel, the router only needs the IPv6 address of the tunnel endpoint and the routing tag with which
it can reach this address.
SNMP ID:
2.2.40
Telnet path:
Setup > WAN
Name
Enter the name for the tunnel.
SNMP ID:
2.2.40.1
668
Reference Manual
9 IPv6
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 16 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Gateway address
This entry defines the address of the DS-Lite gateway, the so-called Address Family Transition Router (AFTR). Enter a
valid value from the following selection:
1
An IPv6 address, e. g., 2001:db8::1
1
An FQDN (fully qualified domain name) which can be resolved by DNS, e. g., aftr.example.com
1
The IPv6 unspecified address "::" means that the device should obtain the address of the AFTR via DHCPv6 (factory
setting).
1
An empty field behaves the same as the entry "::".
SNMP ID:
2.2.40.2
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Default:
empty
Rtg tag
Enter the routing tag where the router reaches the gateway.
SNMP ID:
2.2.40.3
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 5 characters from [0-9]
Default:
empty
669
Reference Manual
9 IPv6
9.13.2 IPv6 support for RAS services
As of firmware version 9.00, RAS remote stations are able to login via IPv6. The configuration is done in LANconfig under
IPv6 > General and the setup of prefix pools under IPv6 > Router advertisement.
RAS interfaces
There are basically two ways to manage the configuration of RAS remote stations:
The user data or the configurations are locally stored on the device.
The advantage of this alternative is that a RADIUS server is not necessary, which reduces the management
and cost of the network infrastructure.
The user data or the configurations are stored on an external RADIUS server.
The advantage of this alternative is the centralized user management for extensive distributed network
scenarios.
For RAS access via IPv6, you must also set up the corresponding RAS interface.
Entries in the RAS interfaces table have the following meaning:
1
Interface active: Enable or disable this interface here.
1
Interface name: Here you define the name of the RAS interface that the IPv6 remote sites use for access.
1
Interface tag: The interface tag that you enter here is a value that uniquely identifies the network. All packets
received by this device on this network will be internally marked with this tag. The interface tag enables the routes
which are valid for this network to be separated even without explicit firewall rules.
1
Forwarding: Enables or disables the forwarding of data packets to other interfaces.
1
Firewall: If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for each interface individually
here. To globally enable the firewall for all interfaces, navigate to Firewall/QoS > General and check the option
IPv6 firewall/QoS enabled.
If you disable the global firewall, the firewall of an individual interface is also disabled. This applies even if
you have enabled this option.
1
Remote site: Specify the remote site or a list of remote sites for RAS dial-in users.
The following values are possible:
2
A single remote station from the tables under Setup > WAN > PPTP-Peers, Setup > WAN > L2TP-Peers or
Setup > PPPoE-Server > Name-list.
2
The wildcard "*" makes the interface valid for all PPTP, PPPoE and L2TP peers.
2
The "*" wildcard as a suffix or prefix of the peer, such as "COMPANY*" or "*TUNNEL" .
Using the wildcards you can create several peers for IPv6 RAS services based on so-called template interfaces These
template interfaces can be used as normal interfaces for IPv6 services such as DHCPv6 server or router advertisements.
For example, using these, a group of RAS interfaces can be provided from an IPv6 prefix pool.
1
Comment: Enter a descriptive comment for this entry.
670
Reference Manual
9 IPv6
Information on RADIUS attributes for IPv6 RAS services can be found under
RADIUS attribute extensions for IPv6 RAS
services
on page 678.
4
If RAS clients are to be delegated to an IPv6 DNS server or are to receive their prefixes by prefix delegation, you
must create a corresponding entry in the table DHCPv6 networks under IPv6 > DHCPv6.
4
If you wish to authenticate a user by PPP list, you navigate to Communication > Protocols > PPP list and
enable the option Activate IPv6 routing for that user.
Prefix pools
This table contains the pools of prefixes which RAS users receive when they connect remotely via IPv6. The following
settings are possible:
Interface name
Specifies the name of the RAS interface that is valid for this prefix pool.
First prefix
Specifies the first prefix in the pool that is assigned to remote users by the router advertisement, e.g.,
"2001:db8::". Each user is assigned precisely one /64 prefix from the pool.
Last prefix
Specifies the last prefix in the pool that is assigned to remote users by the router advertisement, e.g.
'2001:db9:FFFF::'. Each user is assigned precisely one /64 prefix from the pool.
Prefix length
Specifies the length of the prefix that the remote user is assigned by the router advertisement here. The size
of the dial-in pool depends directly on the first and last prefix. Each user is assigned precisely one /64 prefix
from the pool.
In order for a client to be able to form an IPv6 address from the auto-configuration prefix, the prefix
length must always be 64 bits.
SLAAC
Specifies whether the prefix can be used for a stateless address auto-configuration (SLAAC).
Additions to the Setup menu
RAS-Interface
In this directory, you specify the settings for RAS access via IPv6.
SNMP ID:
2.70.14
671
Reference Manual
9 IPv6
Telnet path:
Setup > IPv6
Interface name
Here you define the name of the RAS interface that the IPv6 remote sites use for access.
SNMP ID:
2.70.14.1
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Rtg tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will contain this tag. The interface tag enables the routes which are valid for this network to be separated
even without explicit firewall rules.
SNMP ID:
2.70.14.2
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Max. 5 characters from 0123456789
Default:
0
Interface status
Enable or disable this interface here.
SNMP ID:
2.70.14.3
Telnet path:
Setup > IPv6 > RAS-Interface
672
Reference Manual
9 IPv6
Possible values:
Active
Idle
Default:
Active
Forwarding
Enables or disables the forwarding of data packets to other interfaces.
SNMP ID:
2.70.14.4
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Yes
No
Default:
Yes
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for each interface individually here. To
globally enable the firewall for all interfaces, change the setting under IPv6 > Firewall > Enabled to yes.
If you disable the global firewall, the firewall for an individual interface is also disabled. This applies even if you
have enabled this option.
SNMP ID:
2.70.14.5
Telnet path:
Setup > IPv6 > RAS-Interface
673
Reference Manual
9 IPv6
Possible values:
Yes
No
Default:
Yes
DaD attempts
Before the device can use an IPv6 address on an interface, it uses 'Duplicate Address Detection (DAD)' to check to see
whether the IPv6 address already exists on the local network. In this way, the device avoids address conflicts in the
network.
This option is the number of attempts with which the device searches for duplicate IPv6 addresses in the network.
SNMP ID:
2.70.14.6
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
1 characters from 0123456789
Default:
0
Remote site
Set a remote station or a list of remote stations for RAS dial-in users.
The following values are possible:
1
An individual remote site from the tables under Setup > WAN > PPTP-Peers or Setup > PPPoE-Server > Name-List.
1
The "*" wildcard makes this interface valid for all PPTP and PPPoE peers.
1
The "*" wildcard as a suffix or prefix of the peer, such as "COMPANY*" or "*TUNNEL", selects interfaces with names
that match.
By using wildcards you can implement template interfaces, which apply to peers which are named accordingly. In this
manner, the name of the IPv6 RAS interface can be used many places in the IPv6 configuration.
SNMP ID:
2.70.14.7
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
16 characters from [A-Z][0-9]@{|}~!$%&'()*+-,/:;<=>?[\]^_.
674
Reference Manual
9 IPv6
Default:
empty
Comment
Enter a descriptive comment for this entry.
SNMP ID:
2.70.14.8
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Prefix pools
In this directory you can define pools of prefixes for remote users and/or the corresponding RAS interfaces (PPTP, PPPoE).
Define the prefixes for Ethernet interfaces under Setup > IPv6 > Router > Router-Advertisements > Prefix-Options
or in LANconfig under IPv6 > Router advertisement > Prefix list.
SNMP ID:
2.70.2.6
Telnet path:
Setup > IPv6 > Router-Advertisement
Interface name
Specify the name of the RAS interface applicable for this prefix pool.
SNMP ID:
2.70.2.6.1
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
675
Reference Manual
9 IPv6
Start-Prefix-Pool
Here you specify the first prefix in the pool that is assigned to remote users by the router advertisement, e.g., "2001:db8::".
Each user is assigned precisely one /64 prefix from the pool.
SNMP ID:
2.70.2.6.2
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 43 characters from [A-F][a-f][0-9]:./
Default:
empty
End-Prefix-Pool
Here you specify the last prefix in the pool that is assigned to remote users by the router advertisement, e.g.
'2001:db9:FFFF::'. Each user is assigned precisely one /64 prefix from the pool.
SNMP ID:
2.70.2.6.3
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 43 characters from [A-F][a-f][0-9]:./
Default:
::
Prefix length
Here you specify the length of the prefix assigned to the remote user by the router advertisement. The size of the dial-in
pool depends directly on the first and last prefix. Each user is assigned precisely one /64 prefix from the pool.
In order for a client to be able to form an IPv6 address from the auto-configuration prefix, the prefix length must
always be 64 bits.
SNMP ID:
2.70.2.6.4
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
676
Reference Manual
9 IPv6
Possible values:
Max. 3 characters from 0123456789
Default:
64
Adv.-OnLink
Indicates whether the prefix is "on link".
SNMP ID:
2.70.2.6.5
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Yes
No
Default:
Yes
Adv.-Autonomous
Specifies whether the client can use the prefix for a stateless address auto-configuration (SLAAC).
SNMP ID:
2.70.2.6.6
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Yes
No
Default:
Yes
677
Reference Manual
9 IPv6
Adv.-Pref.-Lifetime
Specifies the time in milliseconds for which an IPv6 address is "Preferred". The client also uses this lifetime for its generated
IPv6 address. If the lifetime of the prefix has expired, the client no longer uses the corresponding IPv6 address. Is the
"preferred lifetime" of an address expires, it will be marked as "deprecated". This address is then used only by already
active connections until those connections end. Expired addresses are no longer available for new connections.
SNMP ID:
2.70.2.6.7
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 10 characters from 0123456789
Default:
604800
Adv.-Valid-Lifetime
Defines the time in seconds, after which the validity of an IPv6 address expires. Expired addresses are no longer available
for new connections.
SNMP ID:
2.70.2.6.8
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 10 characters from 0123456789
Default:
2592000
9.13.3 RADIUS attribute extensions for IPv6 RAS services
The RADIUS client can request RADIUS attributes, such as the “Framed-IP-Address”, from an external RADIUS server and
provide these, for example, to a PPPoE server in order to authenticate them at PPPoE, PPTP or L2TP servers. The device
accepts the following attributes in access-accept messages:
96
Framed-Interface-ID
This attribute conveys the IPv6 interface identifier that should be configured for the user in the IPv6CP.
97
Framed-IPv6-Prefix
Prefix, which is sent to the user via router advertisements.
678
Reference Manual
9 IPv6
99
Framed-IPv6-Route
This attribute conveys the route to be used for this user. The device supplements the IPv6 routing table with
this route and the next hop to this user.
100
Framed-IPv6-Pool
This indicates the IPv6 pool from which a prefix is to be taken for the user. The IPv6 pool is referenced by its
name and must be present under IPv6 > Router advertisement > Prefix pools.
123
Delegated-IPv6-Prefix
Prefix, which is sent to the user via DHCPv6 prefix delegation.
The newly available RADIUS attributes are implemented according to RFCs 3162 and 4818. An example for a PPP user
test with IPv6 in the FreeRADIUS is as follows:
test Cleartext-Password := "1234"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IPv6-Prefix = "fec0:1:2400:1::/64",
Delegated-IPv6-Prefix = "fec0:1:2400:1100::/56",
Framed-IP-Address = 172.16.3.33,
The user "test" in a dual-stack PPP session receives the IPv4 address 172.16.3.33, the prefix fec0:1:2400:1::/64 via router
advertisement, and the prefix fec0:1:2400:1100::/56 via DHCPv6 prefix delegation.
9.13.4 Loopback addresses for IPv6
As of LCOS 9.00, you can use IPv6 loopback addresses as the sender address for ping commands at the command line.
MeaningParameters
Sets an IPv6 loopback interface as the sender address.
-6
<Loopback-Interface>
Loopback addresses
IPv6 loopback addresses can be specified in the Loopback addresses table. The device sees each of these addresses
as its own address, which is also available if a physical interface is disabled, for example.
Entries in the Loopback addresses table have the following meaning:
1
Name: Enter a unique name for this loopback address.
1
IPv6 address: Enter a valid IPv6 address here.
1
Routing tag: Here you specify the routing tag of the network that the loopback address belongs to. Only packets
with this routing tag will reach this address.
1
Comment: You have the option to enter a comment here.
679
Reference Manual
9 IPv6
Additions to the Setup menu
Loopback
You can set IPv6 loopback addresses here. The device sees each of these addresses as its own address, which is also
available if a physical interface is disabled, for example.
SNMP ID:
2.70.4.3
Telnet path:
Setup > IPv6 > Network
Name
Enter a unique name for this loopback address.
SNMP ID:
2.70.4.3.1
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
IPv6-Loopback-Addr.
Enter a valid IPv6 address here.
SNMP ID:
2.70.4.3.2
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 39 characters from 0123456789ABCDEFabcdef:./
Default:
empty
680
Reference Manual
9 IPv6
Rtg tag
Here you specify the routing tag of the network that the loopback address belongs to. Only packets with this routing
tag will reach this address.
SNMP ID:
2.70.4.3.3
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 5 characters from 0123456789
Default:
0
Comment
You have the option to enter a comment here.
SNMP ID:
2.70.4.3.4
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 64 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
9.13.5 Lightweight DHCPv6 relay agent (LDRA)
Unlike a DHCPv6 relay agent, which has the full IPv6 features (such as ICMPv6) and can route data packets on the
network (layer 3), a lightweight DHCPv6 relay agent as per RFC 6221 enables only the creation and forwarding of
relay-agent information between DHCPv6 clients and DHCPv6 servers (layer 2).
In contrast to DHCPv4 snooping, the LDRA does not simply append the DHCPv6 packets with information about the
relay agent: Instead, it packs the message from the client into a separate option, prepends its own relay-agent header
and then forwards this DCHPv6 packet with its supplementary information to the DHCPv6 server (relay forward message).
The DHCPv6 server evaluates this data packet and sends a similarly packaged response to the relay agent. This then
extracts the message and sends it to the requesting client (relay-reply message).
681
Reference Manual
9 IPv6
In LANconfig you can set up DHCPv6 snooping for each interface under Interfaces > Snooping and a click on DHCPv6
snooping.
After selecting the appropriate interface, you can set the following:
Orientation
This is where you enable or disable DHCPv6 snooping. The following options are possible:
1
Network facing: The LDRA uses this interface to communicate with a DHCPv6 server.
1
Client facing: The LDRA uses this interface to communicate with DHCPv6 clients connected to the network.
The default setting Network facing disables the LDRA.
Trusted port
With this option enabled, the LDRA forwards DHCP requests from clients and also DHCP responses from DHCP
servers. If this interface is classified as not trusted, the LDRA discards DHCPv6 requests to this interface.
Similarly, the LDRA does not forward DHCPv6 responses with the wrong interface ID to the client.
Remote ID
According to RFC 4649, the remote ID uniquely identifies the client making a DHCPv6 request.
Interface ID
The interface ID uniquely identifies the interface used by a client to make a DHCPv6 request.
Server address
You can set the IPv6 address of a DHCPv6 server here.
682
Reference Manual
9 IPv6
4
Leave this field blank if you want to receive responses from all DHCPv6 servers on the network.
Otherwise the LDRA reacts only to DHCPv6 responses from the server you have specified. In this case,
the LDRA discards responses from other DHCPv6 servers.
You can use the following variables for Remote ID and Interface ID:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface where the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Management > General.
Additions to the Setup menu
DHCPv6-Snooping
This is where you can configure the lightweight DHCPv6 relay agent.
SNMP ID:
2.20.41
Telnet path:
Setup > LAN-Bridge
Port
Indicates the physical or logical interface to which this DHCPv6-snooping configuration applies.
SNMP ID:
2.20.41.1
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
683
Reference Manual
9 IPv6
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
WLC-TUNNEL-x
All virtual WLC tunnels
Orientation
Enable or disable DHCPv6 snooping here.
SNMP ID:
2.20.41.2
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Network-facing
Disables DHCPv6 snooping for this interface. The LDRA does not forward any DHCPv6 requests to a
DHCPv6 server.
Client-facing
Enables DHCPv6 snooping for this interface.
Default:
Network-facing
Type
Here you set how the DHCP relay agent handles the "relay agent info" in incoming DHCP packets.
SNMP ID:
2.20.41.3
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Trusted
The LDRA forwards DHCP requests from clients and also DHCP responses from DHCP servers.
684
Reference Manual
9 IPv6
Untrusted
If this interface is classified as untrusted, the LDRA discards DHCPv6-server requests to this interface.
This prevents unauthorized clients from acting as "rogue DHCPv6 servers". Similarly, the LDRA does not
forward DHCPv6 responses with the wrong interface ID to the client.
5
Interfaces that are facing clients should be set as untrusted.
Default:
Trusted
Remote ID
The remote ID according to RFC 4649 uniquely identifies the client that is making a DHCPv6 request.
4
This option is analogous to the DHCP option "remote ID" of the relay agent in the case of IPv4.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface at which the relay agent received the DHCP request. If a WLAN-SSID
is involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.41.4
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
685
Reference Manual
9 IPv6
Interface-ID
The interface ID uniquely identifies the interface used by the client to make a DHCPv6 request.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Adds the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.41.5
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Server address
Here you can specify the IPv6 address of a DHCPv6 server.
4
Leave this field blank if you want to receive responses from all of the DHCPv6 servers on the network. Otherwise
the LDRA reacts only to DHCPv6 responses from the server you have specified. In this case, the LDRA discards
responses from other DHCPv6 servers.
SNMP ID:
2.20.41.6
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Max. 39 characters 0123456789ABCDEFabcdef:.
Default:
empty
686
Reference Manual
9 IPv6
9.13.6 Router advertisement snooping
In an IPv6 network, router advertisements are sent by routers, either periodically or upon request, to present themselves
as a gateway for networked clients. As with DHCPv4, attackers can use this mechanism to deliver a fake network
configuration to the requesting clients.
With RA snooping, the device mediates router advertisements from routers only, and not from clients. By specifying the
address of a router, the router advertisements can be restricted to one specific router as the broadcaster.
In LANconfig you can set up RA snooping for each interface under Interfaces > Snooping and a click on RA snooping.
After selecting the appropriate interface, you can set the following:
Port type
Specify the preferred interface type here. The following options are possible:
1
Router: The device mediates all of the RAs arriving at this interface (default).
1
Client: The device discards all of the RAs arriving at this interface.
Router-Address
If you have selected the interface type Router, enter an optional router address here. If you specify a router
address, the device will only mediate RAs from that router.
With the interface type Client selected, the device ignores this input field.
Additions to the Setup menu
RA-Snooping
You can configure the RA snooping here.
687
Reference Manual
9 IPv6
SNMP ID:
2.20.42
Telnet path:
Setup > LAN-Bridge
Port
Indicates the physical or logical interface to which this RA-snooping configuration applies.
SNMP ID:
2.20.42.1
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
WLC-TUNNEL-x
All virtual WLC tunnels
Orientation
Specify the preferred interface type here.
SNMP ID:
2.20.42.3
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
Router
The device mediates all of the RAs arriving at this interface.
Client
The device discards all of the RAs arriving at this interface.
688
Reference Manual
9 IPv6
Default:
Router
Router-Address
If you have selected the interface type Router, enter an optional router address here. If you specify a router address,
the device will only mediate RAs from that router. With the interface type Client selected, the device ignores this input
field.
SNMP ID:
2.20.42.4
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
Max. 39 characters 0123456789ABCDEFabcdef:.
Default:
empty
9.14 Addition(s) to LCOS 9.10
9.14.1 Prefix-exclude option for DHCPv6 prefix delegation
As of LCOS version 9.10, the DHCPv6 client of the device supports the prefix exclude option for DHCPv6-based prefix
delegation according to RFC 6603.
Prefix-exclude option for DHCPv6 prefix delegation
The DHCPv6 client of the device supports the prefix exclude option for DHCPv6-based prefix delegation according to
RFC 6603.
Providers use this mechanism with DHCPv6 prefix delegation in order to exclude a prefix from the delegated prefix set
from being used on the customer LAN. This means that the device does not require an additional prefix for the WAN
link, but instead it uses the prefix that was excluded from the delegated DHCPv6 prefix set. This prefix is no longer
available for the LAN on the customer site.
689
Reference Manual
9 IPv6
If a device is configured to use the excluded prefix for the LAN, is a syslog message is issued and the prefix is not
advertised on the LAN. To resolve this conflict, you configure a different subnet ID for this LAN under IPv6 > Router
advertisement > Prefix list.
690
Reference Manual
9 IPv6
10 Quality of Service
This chapter dedicates itself to quality: Under the generic term Quality of Service (short: QoS) those LCOS functions are
summarized, which are concerned with the guarantee of certain service availabilities.
10.1 Why QoS?
The main objective of Quality of Service is to transfer certain data packets either particularly safe or as immediately as
possible:
1
It may happen during a data transfer that data packets are not delivered to the addressee. But for some applications
it is very important that all sent packets really do arrive. An e-mail, for example, divided into several small data
packets, can only be assembled together again, when all parts have arrived completely. Whether one or an other
packet arrives with little time delay does not make any difference. These applications often count on the
connection-orientated Transmission Control Protocol (TCP). This protocol ensures that data will be transferred correctly
and chronologically via the net. It automatically adjusts the sending rate downwards if the confirmation of sent data
packets is outstanding for longer times, and also takes care of repeated transmission in case of packet losses.
1
In other applications, e.g. telephony via the Internet (Voice-over-IP, VoIP), it is - differently to the case above - very
important that the data packets arrive at the addressee with only little time delay. But it really doesn’t matter if once
a data packet gets lost in this case. The participant at the other end of the connection will understand the caller,
even if small parts of the speech got lost. This application aims at the fastest sending of data packets as possible.
The connectionless User Datagram Protocol (UDP) is often used for this kind of application. Also this protocol has
very little administrative overhead. But chronological delivery of packets is not guaranteed, data packets are simply
sent out. Because no confirmation receipt exists, lost packets never get delivered again.
10.2 Which data packets to prefer?
The necessity of a QoS concept results only from the fact that the available bandwidth is not always sufficient for
transferring all pending data packets reliably and on time. Load peaks result easily from running simultaneously large
FTP downloads, while exchanging e-mails and using IP telephones over the data line. In order to meet also in these
situations the demands of the desired data transfer, certain data packets must be treated preferentially. It is necessary
for this, that at first a LANCOM recognizes which data packets should be preferred at all.
There are two possibilities to signal the need for a preferential treatment of data packets in the LANCOM:
1
The application, as e.g. the software of certain IP telephones, is itself able to mark the data packets appropriately.
This marking, the “tag”, is set within the header of the IP packets. The two different variants of this marking “ToS”
and “DiffServ” can simply described assume the following states:
2
ToS “Low Delay“
2
ToS “High Reliability“
2
DiffServ “Expedited Forwarding“
2
DiffServ “Assured Forwarding“
5
The IP header bits of the ToS resp. DiffServ field are copied in case of a VPN route also into the enclosing IP
header of the IPSec VPN packet. Thus QoS is available also for VPN routes over the Internet, as long as your
provider treats according packets preferentially also in the WAN.
691
Reference Manual
10 Quality of Service
1
When the application itself has no possibility to mark the data packets appropriately, the LANCOM can ensure the
correct treatment. For this, it uses the existing functions of the firewall, which can classify e.g. data packets according
to subnets or services (applications). Due to these functions it is e. g. possible to treat individually data packets of a
FTP connection or those of a certain department (in a separate subnet).
For treatment of data packets classified by the firewall the following two possibilities can be chosen:
2
Guaranteed minimum bandwidth
2
Limited maximum bandwidth
10.2.1 What is DiffServ?
DiffServ stands for “Differentiated Services” and is a quite recent model to signal the priority of data packets. DiffServ
is based on the known Type-of-Service (ToS) field and uses the same byte within the IP header.
ToS is using the first three bits to describe the priorities (precedence) 0 to 7, as well as four further bits (the ToS bits) to
optimize the data stream (e.g. “Low Delay” and “High Reliability”). This model is rather inflexible, and this is why it has
been used quite rarely in the past.
The DiffServ model uses the first 6 bits to make distinctions of different classes. Up to 64 gradings are thus possible
(Differentiated Services Code Point, DSCP) which enable a finer priorisation of the data stream:
1
To ensure downward compatibility with ToS implementations, the previous precedence levels can be depicted with
the “Class Selectors” (CS0 to CS7). Thereby, the level “CS0” denotes so-called “Best Effort” (BE) and stands for usual
transfer of data packets without special treatment.
1
The “Assured Forwarding” classes are used for a secured transfer of data packets. The first digit of the AF class
describes each the priority of the transfer (1 to 4), the second digit the “drop probability“ (1 to 3). Packets with AFxx
marking are transferred in a secured way, and thus not dropped.
Finally, the class “Expedited Forwarding” marks those packets, that shall be transferred preferentially, before all other
packets.
Dec.DSCP bitsCode pointDec.DSCP bitsCode
point
Dec.DSCP bitsCode point
30011110AF3310001010AF110000000CS0 (BE)
34100010AF4112001100AF128001000CS1
36100100AF4214001110AF1316010000CS2
38100110AF4318010010AF2124011000CS3
46101110EF20010100AF2232100000CS4
22010110AF2340101000CS5
26011010AF3148110000CS6
28011100AF3256111000CS7
10.2.2 Guaranteed minimum bandwidths
Hereby you give priority to enterprise-critical applications, e.g. Voice-over-IP (VoIP) PBX systems or certain user groups.
For LANCOM devices with VoIP functions that were already integrated or added in with a software option, the QoS
settings for SIP calls are defined automatically.
Full dynamic bandwidth management for sending
Concerning the sending direction, the bandwidth management takes place dynamically. This means that e.g. a guaranteed
minimum bandwidth is only available, as long as the corresponding data transfer really exists.
An example:
692
Reference Manual
10 Quality of Service
For the transmission of VoIP data of an appropriate VoIP gateway, a bandwidth of 256 Kbps is to be guaranteed always.
Thereby, each individual VoIP connection consumes 32 Kbps.
As long as nobody telephones, the entire bandwidth is at the disposal to other services. Per adjacent VoIP connection
32 Kbps less is available to other applications, until 8 VoIP connections are active. As soon as a VoIP connection is
terminated, the corresponding bandwidth is available again to all other applications.
5
For correct functioning of this mechanism, the sum of the configured minimum bandwidth must not exceed the
effectively available transmission bandwidth.
Dynamic bandwidth management also for reception
For receiving bandwidth control, packets can be buffered and only belatedly confirmed. Thus TCP/IP connections regulate
themselves automatically on a smaller bandwidth.
Each WAN interface is assigned a maximum reception bandwidth. This bandwidth will be accordingly degraded by every
QoS rule that guarantees a minimum bandwidth of reception on this interface.
1
If the QoS rule has been defined connection-related, the reserved bandwidth will be unblocked immediately after
releasing the connection and the maximum available bandwidth will increase accordingly on the WAN interface.
1
If the QoS rule has been defined globally, then the reserved bandwidth will be unblocked only after the ending of
the last connection.
10.2.3 Limited maximum bandwidths
Hereby you limit e.g. the entire or connection-related maximum bandwidth for server accesses.
An example:
You operate both a Web server and a local network on a shared Internet access.
To prevent that your productive network (LAN) is paralyzed by many Internet accesses to your Web server, all server
accesses are limited to half of the available bandwidth. Furthermore, in order to guarantee that your server services are
available equally to many users at the same time, a certain maximum bandwidth per each server connection is set.
Combination possible
Minimum and maximum bandwidths can be used together in combination. Thus the available bandwidth can be distributed
accordingly depending on your requirements, e.g. on certain user groups or applications.
10.3 The queue concept
10.3.1 Queues in transmission direction
Quality of Service requirements are realized in LCOS by using different queues for the data packets. For the transmission
side, the following queues are utilized:
1
Urgent queue I
This queue is always processed at first before all others. The following data packets are handled here:
2
Packets with ToS “Low Delay“
2
Packets with DiffServ “Expedited Forwarding“
2
All packets that have been assigned a certain minimum bandwidth, as long as the guaranteed minimum bandwidth
is not exceeded.
2
TCP control packets can be likewise dispatched by this queue preferentially .
1
Urgent queue II
693
Reference Manual
10 Quality of Service
This is for all packets that have been assigned a guaranteed minimum bandwidth, but whose connection has exceeded
this minimum bandwidth.
As long as the interval for the minimum bandwidth is not exceeded (i.e. up to the end of the current second), all
packets in this queue are treated without further special priority. All packets of this queue, of the "secured queue"
and the "standard queue" share now the existing bandwidth. The packets are taken in order from the queues when
sending in exactly the same sequence, in which they have been placed into these queues. If the interval runs off, all
blocks, which are at this time still in the "Urgent queue II" up to the exceeding of the in each case assigned minimum
bandwidth, are placed again into the "Urgent queue I". The rest remains in the "Urgent queue II".
With this procedure it is guaranteed that prioritized connections do not crush the remaining data traffic.
1
Secured queue
This queue does not have a separate priority. However, packets in this queue are never dropped (transmission
guaranteed).
2
Packets with ToS “High Reliability“
2
Packets with DiffServ “Assured Forwarding“
1
Standard queue
The standard queue contains all not classified data traffic. Packets in this queue are dropped at first when packets
cannot be delivered fast enough.
The queue concept can, however, only work out when a “traffic congestion“ of data packets has been accumulated at
the interface from LAN to the WAN. Such a congestion is created when the interface within the LANCOM can submit
fewer data to the WAN than data are delivered in peak periods from the LAN. This is e.g. the case, if the interface to the
WAN is an integrated ADSL interface with comparatively low transmission speed (“upstream”). The integrated ADSL
modem automatically reports back to the LANCOM how many data packets it is still able to receive, and thus brakes the
data stream already within the router. As a result, the queues will automatically fill up.
INTERNET
LAPTO P/ W-LAN
PC
Phone
Router
100 MBps
n x 64 kBps
54 MBps
Queues
128 KBps
Different is the case, if an Ethernet interface represents the connection to the WAN. From the LANCOM’s point of view,
the connection to the Internet via an external broadband modem looks like an Ethernet segment. On the distance from
the LANCOM to the DSL modem, data will be transferred with full LAN speed of 10 or 100 Mbps. Because of an equal
input and output speed, no natural congestion will be produced then. Furthermore, the Ethernet between the LANCOM
and the broadband modem does not report anything about the capacity of the connection. The consequence: a congestion
will only be happen within the broadband modem. But because no queues are deployed therein, surplus data will be
lost. Thus a prioritization of “preferred” data is not possible!
INTERNET
LAPTO P/ W-LAN
PC
Phone
Router
100 MBps
n x 64 kBps
54 MBps
128 KBps
MODEM
100 MBps
dropped data
To solve this problem, the transfer rate of the LANCOM’s WAN interface will be reduced artificially. This interface will
thereby be adjusted to the transfer rate that is available for the actual data transport towards the WAN. For a standard
DSL connection, the DSL interface is thus adjusted in the LANCOM to the appropriate upstream rate (e.g. 128 kbps).
Data rates indicated by providers are mostly likely net rates. The gross data rate, which is available for the interface is
a little bit higher than the net data rate guaranteed by the provider. If you know the gross data rate of your provider,
694
Reference Manual
10 Quality of Service
you can enter this value for the interface and slightly increase in this way the data throughput. However, with entering
the net data rate you play safe in any case!
10.3.2 Queues for receiving direction
Apart from the data transfer rate in transmission direction, the same consideration applies also to the receiving direction.
Due to its 10 or 100 Mbps Ethernet interface, the LANCOM’s WAN interface is fed by clearly fewer data from the
broadband modem than would actually be receivable. All data packets received on the WAN interface are transferred
to the LAN with equal rights.
In order to be able to prioritize incoming data as well, thus an artificial “brake” must be added also in this direction.
Like already incorporated for the upstream direction, the data transfer rate of the interface is therefore adapted to the
provider’s offer in the downstream direction. For a standard DSL connection thus e.g. a downstream rate of 768 kbps
applies. Again, the gross data rate can be entered here, if known.
Reducing the receiving bandwidth makes possible to treat received data packets suitably. Preferred data packets will be
directly passed on to the LAN up to the guaranteed minimum bandwidth, all remaining data packets are running into
congestion. This congestion produces generally a delayed confirmation of the packets. For a TCP connection, the sending
server will react to this delay by reducing its sending frequency and adapting itself to the available bandwidth.
The following queues operate on the receiving side:
1
Deferred Acknowledge Queue
Each WAN interface contains additionally a QoS reception queue, which takes up those packets that should be
„slowed down“. The storage period of each individual packet depends on its length and on the actual permitted
reception bandwidth on the receiving side. Packets with a minimum reception bandwidth assigned by a QoS rule
are passing through without any further delay, as long as the minimum bandwidth is not exceeded.
1
Standard reception queue
All packets that do not need special treatment because of an active QoS rule on the receiving side end up here.
Packets of this queue are directly passed on resp. confirmed without consideration of maximum bandwidths.
10.4 Reducing the packet length
The preferential treatment of data packets belonging to important applications can be endangered - depending on the
situation - by very long data packets of other applications. This is the case e.g. when IP telephony and a FTP data transfer
are simultaneously active on the WAN connection.
PC
server
Phone
Phone
The FTP transfer uses quite large data packets of 1500 byte, whereas, the Voice over IP connection sends packets of e.g.
24 byte net in relatively short intervals. If FTP packets are in the sending queue of the LANCOM just at the moment when
a VoIP packet is to be transferred, then the VoIP packet can only be sent after the line is free again. Depending on the
transfer rate of the connection, this may cause a noticeable delay of the speech transmission.
PC
server
PhonePhone
RouterRouter
This annoying behavior can be compensated if all data packets, which are not belonging to the connection preferred by
QoS, do not exceed a certain packet length. While doing so, the data packets of the FTP connection will be divided into
695
Reference Manual
10 Quality of Service
such small sections that the time-critical VoIP connection is able to deliver the packets without noticeable delay within
the required time slots. A resulting delay has no disadvantageous effect to the TCP-secured FTP transfer.
PC
server
PhonePhone
RouterRouter
Two different procedures exist to influence the packet length:
1
The LANCOM can inform the peers of a data connection that they should only send data packets up to a certain
length. Thereby, an appropriate PMTU (Path Maximum Transmission Unit) is enforced on the sending side. This
procedure is called PMTU reduction”.
The PMTU reduction can be used for sending as well as for receiving direction. For the sending direction, the data
source of the own LAN is adjusted with the PMTU reduction to a smaller packet size, for the receiving direction the
data source of the WAN, e.g. web or FTP servers in the Internet.
Provided that the data connection already exists when the VoIP connection is started, the senders regulate packet
lengths very quickly to the permitted value. When setting up new data connections while a VoIP connection is already
established, the maximum permitted packet length is negotiated directly during the connection phase.
5
The reduced packet length on the data connection still remains also after terminating the VoIP connection,
as long as the sender checks the PMTU value again.
1
The LANCOM is able to split packets to be sent above an adjustable maximum size (e.g. 256 byte) into smaller units
itself. But such a procedure called ”fragmentation” is not supported by all servers of the Internet, because dealing
with fragmented packets is considered as a security risk, and therefore is turned off by many servers. That’s why
disturbances can occur e.g. while downloading or while transmitting web pages.
Thus, this procedure is recommended only for connections without involving unknown servers, e.g. for a direct
connection of branches to their head office via VPN connection, over which the Internet traffic is not running
simultaneously.
10.5 QoS parameters for Voice over IP applications
An important task when configuring VoIP systems is to guarantee a sufficient voice quality. Two factors considerably
influence the voice quality of a VoIP connection: The voice delay on its way from sender to addressee, as well as the loss
of data packets, which do not arrive or do not arrive in time at the addressee. The “International Telecommunications
Union” (ITU) has examined in extensive tests, what human beings perceive as sufficient voice quality, and has published
as the result in the ITU G.114 recommendation.
For LANCOM devices with VoIP functions that were already integrated or added in with a software option, the QoS
settings for SIP calls are defined automatically.
Packet loss
Jitter
Delay
10 ms
100 ms
150 ms
300 ms
5 %
10 %
20 %
In case of a delay of not more than 100 ms, and a packet loss of less than 5%, the quality is felt like a “normal” telephone
connection. In case of more than 150 ms delay and less than 10% packet loss, the telephone user perceives still a very
696
Reference Manual
10 Quality of Service
good quality. Up to 300 ms and 20%, some listeners feel this quality like still suitable, beyond that the connection is
considered as no more suitable for voice transmission.
Apart from the average delay time, also a variation in this delay is perceived by the human ear. Delay differences of the
voice information from sender to addressee (jitter) are still tolerated up to 10 ms, and values beyond considered as
irritating.
Accordingly, a VoIP connection should be configured such that the criteria for good speech quality are met: Packet loss
up to 10%, delay up to 150 ms and jitter up to 10ms.
1
Jitter can be removed in the receiving station by an appropriate buffer. In this buffer (jitter buffer) the packets are
stored intermediately, and passed on at a constant rate to the addressee. By this intermediate buffering, the delay
variations due to individual transmission times of the individual packets can be removed.
1
The delay is influenced by several components:
2
Time of processing (packeting, coding and compression by the sender and the addressee), duration of handing
over the packet from application to the interface (serialization), and the time for transmitting via the WAN distance
(propagation) contribute to the fixed part of delay.
2
The variable part is determined by the jitter resp. by the setting of the jitter buffer.
These two parts together compose a delay, which should ideally not exceed 150 ms.
Router
INTERNET
Phone
Router
Phone
Delay < 150 ms
Serialization
Prozessing Prozessing
Propagation
1
Apart from the general loss by network transmission, the packet loss is significantly influenced by the jitter buffer.
If packets arrive with a larger delay than it can be balanced by the jitter buffer, the packets will be discarded and
will increase the packet loss. The larger the jitter buffer, the smaller is the loss. Conversely, the entire delay will
increase with the jitter buffer size. That means for configuration, that the jitter buffer should be selected as small as
the quality can be considered still as sufficient.
In detail, delay is determined especially by the codec used, the resulting packet size and the available bandwidth:
150ms
In comparison: satellite quality
Processing Serialization Propagation Jitter buffer
1
The time for processing is determined by the used codec. For a sampling time of 20 ms, exactly each 20 ms a new
packet is generated. Times for compression can mostly be neglected.
The time for handing over the packet to the interface is defined by the quotient of packet size and available bandwidth
:
Packet size in bytes
15001024512256128641
21514673361890,1456 Kbps
18712864321680,1364 Kbps
93643216840,06128 Kbps
4732168420,03256 Kbps
231684210,016512 Kbps
161152,61,30,60,010768 Kbps
8531,30,60,30,0051536 Kbps
A 512 byte packet of an FTP connection occupies the line at 128 Kbps upstream cablefor at least 32 ms.
697
Reference Manual
10 Quality of Service
Besides, the packets of the VoIP connection are often much larger than the pure net payload. The additional headers of
the IP and Ethernet packets, as well eventual IPsec headers have to be added as well. The net load results from the
product of net data rate and sampling time of the used codec. For all codecs, each 40 bytes UDP header and at least 20
bytes for the IPSec header must be added (RTP and IPSec headers can be larger, depending on the configuration).
ATMBrutto BpsATMNetto BpsEthernet/PPPoEIP-PayloadPayloadWithout IPSec
20ms20ms20ms20ms20msCode
106000,096000,0222200160G711-64
106000,096000,0222200160G722-64
84800,076800,0162140100G726-40
84800,076800,014212080G726-32
63600,057600,012210060G726-24
63600,057600,01028040G726-16
63600,057600,0826020G729-8
42400,038400,0785616G723-6,3
ATMBrutto BpsATMNetto BpsEthernet/PPPoEIP-PayloadPayloadWithout IPSec
30ms30ms30ms30ms30msCode
98834,489510,4302280240G711-64
98834,489510,4302280240G722-64
70596,063936,0212190150G726-40
70596,063936,0182160120G726-32
56476,851148,815213090G726-24
42357,638361,612210060G726-16
42357,638361,6927030G729-8
42357,638361,6866424G723-6,3
ATMBrutto BpsATMNetto BpsEthernet/PPPoEIPSEC-PayloadIP-PayloadPayloadWith IPSec
20ms20ms20ms20ms20ms20msCode
148400,0134400,0282260200160G711-64
148400,0134400,0282260200160G722-64
106000,096000,0222200140100G726-40
106000,096000,020218012080G726-32
106000,096000,018216010060G726-24
84800,076800,01621408040G726-16
84800,076800,01421206020G729-8
84800,076800,01381165616G723-6,3
ATMBrutto BpsATMNetto BpsEthernet/PPPoEIPSEC-PayloadIP-PayloadPayloadWith IPSec
30ms30ms30ms30ms30ms30msCode
112953,6102297,6362340280240G711-64
112953,6102297,6362340280240G722-64
698
Reference Manual
10 Quality of Service
ATMBrutto BpsATMNetto BpsEthernet/PPPoEIPSEC-PayloadIP-PayloadPayloadWith IPSec
84715,276723,2272250190150G726-40
84715,276723,2242220160120G726-32
70596,063936,021219013090G726-24
70596,063936,018216010060G726-16
56476,851148,81521307030G729-8
56476,851148,81461246424G723-6,3
1
IP payload: Voice payload + 40 byte header (12 byte RTP; 8 byte UDP; 20 byte IP header)
2
IPSec payload: IP paket + padding + 2 byte (padding length & next header) = multiple of the IPSec initialization
vector
5
The values in the table apply to the use of AES. With other encryption methods the resulting package may
vary on a minor degree.
5
Further information on bandwidth requirements for Voice over IP with IPSec is available in the LANCOM
techpaper Performance Analysis of LANCOM Routers.
1
The time for transmission via Internet depends on the distance (about 1 ms per 200 km), and on the thereby passed
routers (about 1 ms per hop). This time can be approximated by the half average ping time to the remote station.
1
The jitter buffer can be adjusted directly at many IP telephones, e.g. as fixed number of packets, which should be
used for buffering. The telephones load then up to 50% of the adjusted packets and begin afterwards to replay. The
jitter buffer correspond therefore to half of the entered packets multiplied with the sampling time of the codec.
1
Conclusion: The total delay is composed as follows for the according bandwidth, a ping time of 100 ms to the remote
station and a jitter buffer of 4 packets for both codecs in this example:
SumJitter bufferPropagationSerializationProcessingCodec
172 ms60 ms50 ms32 ms30 msG.723.1
142 ms40 ms50 ms32 ms20 msG.711
1
The transfer time of the packets to the interface (serialization) assumes a PMTU of 512 bytes on a 128 Kbps connection.
Therefore, for slower interfaces or other codecs it is eventually necessary to adjust jitter buffers and/or PMTU values.
5
Please notice that the bandwidths are required in the sending and receiving direction, as well as just for one
single connection.
10.6 QoS in sending or receiving direction
For controlling data transfer by means of QoS one can select whether the according rule applies to the sending or to the
receiving direction. But which direction refers to sending and receiving for a given a data transfer depends on the
particular point of view. The following two variants apply:
1
The direction corresponds to the logical connection setup
1
The direction corresponds to the physical data transfer over the appropriate interface
The differences are unveiled by looking at a FTP transfer. A client of the LAN is connected to the Internet through a
LANCOM.
1
During an active FTP session, the client sends by the PORT command the information to the server, on which port
the DATA connection is expected. As the result, the server establishes the connection to the client and sends the
699
Reference Manual
10 Quality of Service
data in the same direction. In this case, the logical connection as well as the real data stream over the interface go
from the server to the client, and the LANCOM takes both as the receiving direction.
1
Different is the case of a passive FTP session. Here the client itself establishes the connection to the server. The logical
connection setup thus is from client to server, but the data transmission over the physical interface flows in the
reverse direction from server to client.
With standard settings, a LANCOM assumes the sending or receiving direction depending on the logical connection
setup. Because such a point of view may not be easy to follow in certain application scenarios, the point of view can
alternatively be changed to the flow of the physical data stream.
5
The differentiation between sending and receiving direction applies only to the installation of maximum
bandwidths. For a guaranteed minimum bandwidth, as well as for fragmentation and PMTU reduction always
the physical data transfer via the respective interface applies as the direction!
10.7 QoS configuration
10.7.1 Evaluating ToS and DiffServ fields
ToS or DiffServ?
For configuration with LANconfig adjust on index card 'General' whether the 'Type of service field' or alternatively the
'DiffServ field' is to be observed for prioritization of data packets. When both options are turned off, the ToS/DiffServ
field will be ignored.
LANconfig: IP router / general / routing methods
WEBconfig: Setup / IP router / Routing method
Feature settings for routing method values are the following:
1
Standard: The ToS/DiffServ field is ignored.
1
TOS: The ToS/DiffServ field is considered as ToS field, the bits “Low delay” and “High reliability” will be evaluated.
1
DiffServ: The ToS/DiffServ field is interpreted as DiffServ field and evaluated as follows:
700
Reference Manual
10 Quality of Service
Kind of transmissionDSCP code points
normal transmissionCSx (including CS0 = BE)
secured transmissionAFxx
preferred transmissionEF
DiffServ in Firewall rules
The code points from the DiffServ field can be evaluated by Firewall rules for further control of QoS parameters such as
minimum bandwidth or PMTU reduction.
According to your selection of the DSCP type (BE, CS, AF, EF) the valid values can be adjusted in additional drop down
lists. Alternatively, the DSCP decimal value can be entered directly. A table listing valid values can be found under .
LANconfig: Firewall/QoS / Rules / Filter rules / Quality of Service
WEBconfig: Setup / IP router / Firewall E Rule list
The Firewall rule is extended by condition “@d” and the DSCP (Differentiated Services Code Point). The code point can
either be indicated with its name (CS0 - CS7, AF11 to AF 43, EF or BE) or its decimal resp. hexadecimal depiction.
“Expedited Forwarding” can therefore be indicated as “@dEF”, “@d46” or “@d0x2e”. Furthermore, collective names (CSx
resp. AFxx) are possible.
Examples:
1
%Lcds0 @dAFxx %A: Accept (secured transmission) on DiffServ “AF”, limit “0”
1
%Qcds32 @dEF: Minimum bandwidth for DiffServ “EF” of 32 kbps
1
%Fprw256 @dEF: PMTU reduction for reception for DiffServ “EF” to 256 bytes
These examples reserve a desired bandwidth for Voice over IP phone calls. The first element “%Lcds0 @dAFxx %A“
accepts DSCP “AFxx” marked packets of signalling calls. Voice data marked with “EF” is transferred preferentially by the
entry “%Qcds32 @dEF“, and a bandwidth of 32 Kbps is guaranteed thereby as well. In parallel, the PMTU is reduced to
256 byte by “%Fprw256 @dEF“, which enables ensuring the required bandwidth in receiving direction at all.
5
Further information about defining Firewall rules can be found in chapter .
701
Reference Manual
10 Quality of Service
10.7.2 Defining minimum and maximum bandwidths
A minimum bandwidth for certain applications is defined in LANconfig by a Firewall rule according to the following
conditions:
1
The rule does not need an action, because QoS rules always implicitly assume “transfer” as action.
1
The guaranteed bandwidth is defined on index card 'QoS'.
1
The option 'Action only for default route' limits the rule to those packets, which are sent or received via default route.
2
The option 'Action only for VPN route' limits the rule to those packets, which are sent or received via VPN tunnel.
2
The option 'Forced' defines a static reservation of bandwidth. Bandwidth reserved in this way cannot be used
for any other connections, even while the preferred connection is inactive.
2
The option 'Per connection' resp. 'Globally' specifies, whether the minimum bandwidth set here is valid for each
single connection corresponding to this rule (’per connection’), or, if this should be the upper limit for the sum
of all connections together (’globally’).
1
Like for other Firewall rules, index cards 'Stations' and 'Services' determine for which stations in the LAN / WAN and
for which protocols this rule applies.
LANconfig: Firewall/QoS / Rules / Filter rules / Quality of Service
WEBconfig: Setup / IP router / Firewall / Rule list
A required minimum bandwidth is introduced by “%Q”. Here it is implicitly assumed that the respective rule is an “Accept”
action, and that the packets will thus be transmitted.
A maximum bandwidth is simply defined by a limit rule, which discards by a “Drop” action all packets, which exceed
the defined bandwidth.
Examples:
1
%Qcds32: Minimum bandwidth of 32 kbps for each connection
1
%Lgds256 %d: Maximum bandwidth of 256 kbps for all connections (globally)
5
Further information about defining Firewall rules can be found in chapter .
702
Reference Manual
10 Quality of Service
10.7.3 Adjusting transfer rates for interfaces
5
Devices with built-in ADSL/SDSL modem resp. with an ISDN adapter make these settings independently for the
respective interface. For a LANCOM model with Ethernet and ISDN interface, these settings have to be made
solely for the Ethernet interface.
1
An Ethernet WAN (DSL/cable) interface can be switched off completely in this dialogue.
1
As upstream and downstream rate the gross data rates are entered, which are usually a little bit higher than the net
data rates indicated by the provider as the guaranteed data rate (see also ).
1
The “external overhead” considers information added to the packets during the data transfer. Concerning applications
with small data packets (e.g. Voice over IP), this extra overhead is quite noticeable. Examples for the external overhead:
NoteExternal overheadTransfer
additional headers, loss by not completely used ATM cells36 bytesPPPoEoA
additional headers, loss by not completely used ATM cells24 bytesPPTP
additional headers, loss by not completely used ATM cells22 bytesIPoA (LLC)
additional headers, loss by not completely used ATM cells18 bytesIPoA (VC-MUX)
direct transfer of Ethernet packets0Cable modem
LANconfig: Interfaces / WAN
WEBconfig: Setup / Interfaces / DSL Interfaces
5
Only upstream and downstream rates are indicated by Kbps, external overhead in bytes/packet.
10.7.4 Sending and receiving direction
703
Reference Manual
10 Quality of Service
For configuration with WEBconfig or Telnet, the interpretation of the data transfer direction is specified in a new Firewall
rule by parameters “R” for receive, “T” for transmit (send) and “W” for reference to the WAN interface:
LANconfig: Firewall/QoS / Rules / Filter rules / Quality of Service
WEBconfig: Setup / IP router / Firewall / Rule list
A restriction of data transfer to 16 Kbps in sending direction applying to the physical WAN interface is e.g. made by the
following Firewall rule:
1
%Lcdstw16%d
10.7.5 Reducing the packet length
The length reduction of the data packets is defined by a Firewall rule according to the following conditions:
1
The reduction refers to all packets, which will be sent to the interface and which do not correspond to the rule.
1
Not packets of certain protocols are reduced, rather than all packets globally on that interface
For LANCOM devices with VoIP functions that were already integrated or added in with a software option, fragmentation
and PMTU reduction can be set separately for SIP calls.
For configuration with WEBconfig or Telnet, the reduction is entered in a new Firewall rule by parameter “P” for PMTU
reduction (Path MTU, MTU = Maximum Transmission Unit) and “F” for the fragment size.
LANconfig: Firewall/QoS / Rules / Filter rules / Quality of Service
WEBconfig: Setup / IP router / Firewall / Rule list
5
PMTU reduction and fragmentation refer always to the physical connection. Indicating parameter “W” for WAN
sending direction is not required here and hence will be ignored if existing.
The following example shows a setting for Voice over IP telephony:
ProtocolActionDestinationSourceRule
UDP%Qcds32 %Prt256IP addresses of IP telephones
in the LAN, all ports
IP addresses of IP telephones
in the LAN, all ports
VOIP
This rule defines the minimum bandwidth for sending and receiving to 32 Kbps, forces and reduces the PMTU while
sending and receiving to packets of 256 byte size. For the TCP connection, the maximum segment size of the local
704
Reference Manual
10 Quality of Service
workstation is determined to 216, so that the server will send packets of maximum 256 byte (reduction of the PMTU in
sending and receiving direction).
10.8 QoS for WLANs according to IEEE 802.11e (WMM/WME)
With the extension to the 802.11 standard, 802.11e, Quality of Service can be provided for transfers via WLAN. Among
others, 802.11e supports the prioritization of certain data-packet types. This extension is an important basis for the use
of voice applications in WLANs (Voice over WLAN, VoWLAN).
The WiFi alliance certifies products that support Quality of Service according to 802.11e, and refer to WMM (WiFi
Multimedia, formerly known as WME or Wireless Multimedia Extension). WMM defines four categories (voice, video,
best effort and background) which make up separate queues to be used for prioritization.
The 802.11e standard sets priorities by referring to the VLAN tags or, in the absence of these, by the DiffServ fields of
IP packets. Delay times (jitter) are kept below 2 milliseconds, a magnitude which is inaudible to the human ear. 802.11e
controls access to the transfer medium with EDCF, the Enhanced Distributed Coordination Function.
5
Priorities can only be set if the WLAN client and the access point both support 802.11e or WMM, and also if the
applications are able to mark the data packets with the corresponding priorities.
A LANCOM access point can activate 802.11e for each of its physical WLAN networks separately.
LANconfig: Interfaces / Wireless LAN / Physical WLAN settings / Performance
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Performance
705
Reference Manual
10 Quality of Service
11 Virtual Private Networks (VPN)
11.1 What does VPN offer?
A VPN (Virtual Private Network can be used to set up cost-effective, public IP networks, for example via the Internet.
While this may sound unspectacular at first, in practice it has profound effects. To illustrate this, let's first look at a typical
corporate network without VPN technology. In the second step, we will see how this network can be optimized by the
deployment of VPN.
11.1.1 Conventional network infrastructure
First, let's have a look at a typical network structure that can be found in this form or similar forms in many companies:
HEADQUARTER
ISDN Modem RouterISDN Router
LAN
server
LAPTO P
INTERNET
ISDN Router
BRANCH
LAN
PC
ISDN Modem
LAPTO P
PC
A CB B
Computers using remote access,
e.g. home working
The corporate network is based on the internal network (LAN) in the headquarters. This LAN is connected to the outside
world in three ways:
1. A subsidiary is connected to the LAN, typically using a leased line.
2. PCs dial into the central network via modem or ISDN connections (Remote Access Service – RAS).
3. The central LAN has a connection to the Internet so that its users can access the Web, and send and receive e-mail.
All connections to the outside world are based on dedicated lines, i. e. switched or leased lines. Dedicated lines are very
reliable and secure. On the other hand, they involve high costs. In general, the costs for dedicated lines are dependent
on the distance. Especially in the case of long-distance connections, keeping an eye out of cost-effective alternatives
can be worthwhile.
The appropriate hardware must be available in the headquarters for every type of required connection (analog dial-up,
ISDN, leased lines). In addition to the original investment costs, ongoing costs are also incurred for the administration
and maintenance of this equipment.
706
Reference Manual
11 Virtual Private Networks (VPN)
11.1.2 Networking via the Internet
The following structure results when using the Internet instead of direct connections:
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
VPN GatewayBRANCH
LAN
PC
LAPTO P
PC
A
CB
Computers using remote access,
e.g. home working
All participants have fixed or dial-up connections to the Internet. Expensive dedicated lines are no longer needed.
1. All that is required is the Internet connection of the LAN in the headquarters. Special switching devices or routers
for dedicated lines to individual participants are superfluous.
2. The subsidiary also has its own connection to the Internet.
3. The RAS PCs connect to the headquarters LAN via the Internet.
The Internet is available virtually everywhere and typically has low access costs. Significant savings can thus be achieved
in relation to switched or dedicated connections, especially over long distances.
The physical connection no longer exists directly between two participants; instead, the participants rely on their connection
to the Internet. The access technology used is not relevant in this case: ideal is the use of broadband technologies such
as DSL (Digital Subscriber Line) in combination with flatrate contracts. But also a conventional ISDN line can be used.
The technologies of the individual participants do not have to be compatible to one another, as would be the case for
conventional direct connections. A single Internet access can be used to establish multiple simultaneous logical connections
to a variety of remote stations.
The resulting savings and high flexibility makes the Internet (or any other IP network) an outstanding backbone for a
corporate network.
Two technical properties of the IP standard speak against using the Internet as a part of a corporate network, however:
1
The necessity of public IP addresses for all participants
1
The lack of data security of unprotected data transfers
11.1.3 Private IP addresses on the Internet?
The IP standard defines two types of IP addresses: public and private. A public IP address is valid worldwide, while a
private IP address only applies within a closed LAN.
Public IP addresses must be unique on a worldwide basis. Private IP addresses can occur any number of times worldwide;
they must only be unique within their own closed network.
Normally, PCs in a LAN only have private IP addresses, while the router to the Internet also has a public address. All PCs
behind this router have access to the Internet via its public IP address (IP masquerading). In such a case, only the router
itself is responsive via the Internet. PCs behind the router are not responsive to the Internet without intervention by the
router.
Routing at the IP level with VPN
IP connections must be established between routers with public IP addresses in order to link networks via the Internet.
These routers provide the connections between multiple subnetworks. When a computer sends a packet to a private IP
address in a remote network segment, the local router forwards the packet to the router of the remote network segment
via the Internet.
707
Reference Manual
11 Virtual Private Networks (VPN)
The VPN gateway handles the conversion between private and public IP addresses. Without VPN, computers without
public IP addresses would not be able to communicate with one another via the Internet.
11.1.4 Secure communications via the Internet?
The idea of using the Internet for corporate communications has been met with skepticism. The reason for this is that
the Internet lies beyond a company's field of influence. Unlike dedicated connections, data on the Internet travels through
the network structures of third parties that are frequently unknown to the company.
In addition, the Internet is based on a simple form of data transfer using unencrypted data packets. Third parties can
monitor and perhaps even manipulate the contents of these packets. Anyone can access the Internet. As a result, third
parties may gain unauthorized access to the transferred data.
VPN – Security through encryption
VPN was developed as a solution to this security problem. If necessary, it can encrypt the complete data communications
between two participants. The packets are then unreadable for third parties.
The latest and most secure encryption technologies can be used for VPN. A very high level of security can thus be reached.
VPN-protected data traffic via the Internet offers a degree of security that at least corresponds to that of dedicated lines.
Codes usually referred to as "keys" are agreed upon between the participants and used for data encryption. Only the
participants in the VPN know these keys. Without a valid key, it is not possible to decrypt the data. They thus remain
"private", inaccessible to unauthorized parties.
Send your data through the tunnel – for security’s sake
This also explains the nature of a virtual private network: A fixed, physical connection between the devices of the type
required for a direct connection does not exist at any time. Rather, the data flows via suitable routes through the Internet.
With the proper technology, third parties can monitor and even record data traffic. As the packets are encrypted by VPN,
the actual content of the packets is inaccessible. Experts compare this state to a tunnel: it's open at either end, but
perfectly shielded in between. Secure connections within public IP networks are thus also referred to as "tunnels".
server
VPN Gateway
PC
INTERNET
VPN Gateway
VPN Tunnel
The goal of modern network structures has thus been achieved: secure connections via the largest and most low-cost
public IP network: the Internet.
11.2 LANCOM VPN: an overview
11.2.1 VPN example application
VPN connections are used in many different fields of application. In most cases, a variety of communications technologies
is used for transferring both data and audio, and VPN unites these systems into an integrated network. The following
example illustrates a typical application that is often used in practice.
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
VPN GatewayBRANCH
LAN
LAPTO P
LAPTO P
via HotSpot
Home Office
708
Reference Manual
11 Virtual Private Networks (VPN)
The principal components and features of these applications:
1
The coupling of networks, for example between headquarters and a branch office
1
Connecting external locations without fixed IP addresses via VPN router
1
Connecting home offices without fixed IPs via ISDN or analog modems
1
Connecting to Voice-over-IP telephone exchanges
1
Connecting mobile users, for example when using public WLAN access
11.2.2 LANCOM VPN functions
This section lists all of the functions and properties of LANCOM VPN. This overview will provide a great deal of information
for VPN experts. It is very compact, but contains a lot of complex, specialized terminology. Knowledge of the technical
basics of VPN are required to understand this section. Don't worry: it's no problem if you skip this section. The information
contained here is not required to set up and use LANCOM VPN.
1
VPN in accordance with IPSec standard
1
VPN tunnel via leased lines, switched connections and IP networks
1
IPSec main and aggressive mode
1
LANCOM Dynamic VPN: Public IP addresses can be static or dynamic (initiation of a connection towards remote sites
with dynamic IP addresses requires ISDN)
1
IPSec protocols AH, ESP and IPCOMP in transport and tunnel mode
1
Hash algorithms:
2
HMAC-MD5-96, Hash length 128 bit
2
HMAC-SHA-1-96, Hash length 160 bit
1
Symmetrical encryption methods
2
AES, key length 128, 192 and 256 bit
2
Triple-DES, key length 168 bit
2
Blowfish, key length 128 - 448 bit
2
CAST, key length 128 bit
2
DES, key length 56 bit
1
IKE Config Mode
1
IKE key exchange with Preshared Keys
1
IKE with RSA signature and digital certificates (X.509)
1
Key exchange via Oakley, Diffie-Hellman algorithm with key lengths 768 bit, 1024 bit or 1536 bit, well-known groups
1, 2 and 5
1
Key management in accordance with ISAKMP
1
Apart from conventional IPSec implementations, LANCOM devices offer extended functionality, such as the LANCOM
Dynamic VPN that allows the use of the high-security IKE Main Mode even with dynamic IP addresses.
1
In combination with the LANCOM Advanced VPN Client, a separate pre-shared key can be used for each connection
even when using IKE Aggressive Mode connections.
11.3 VPN connections in detail
Two types of VPN connections are available:
1
VPN connections linking two local networks. This type of connection is also known as a "LAN-LAN coupling".
1
The connection of an individual computer with a network, generally via a dial-in connection (Remote Access Service
– RAS).
709
Reference Manual
11 Virtual Private Networks (VPN)
11.3.1 LAN-LAN coupling
The coupling of two remote networks is known as a LAN-LAN coupling. With such a connection, the devices in one LAN
can access those of the remote LAN (assuming they have the necessary access rights).
In practice, LAN-LAN couplings are frequently used between company headquarters and subsidiaries, or for connections
to partner companies.
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
VPN Gateway
BRANCH
LAN
A VPN-enabled router (VPN gateway) is located at either end of the tunnel. The configuration of both VPN gateways
must be matched to one another.
The connections are transparent for the remaining devices in the local networks, i. e., they appear to have a direct
connection. Only the two gateways must be configured for the VPN connection.
Internet access in parallel
The Internet access for VPN can be used simultaneously for other Internet applications, such as web-browsing or e-mail.
For security reasons, the parallel Internet access may be unwanted in some cases. For instance, if a branch office should
be enforced to access the Internet only via a central firewall. For such applications the parallel Internet access can be
disabled as well.
11.3.2 Dial-in connections (Remote Access Service)
Individual remote computers (hosts) can access the resources of the LAN via dial-up connections. Practical examples of
this are employees working from home or field staff that dial into the company network.
If the dial-up connection of an individual computer to a LAN is to be realized via VPN, that computer first connects to
the Internet. A special VPN client software then sets up a tunnel to the VPN gateway of the LAN using this Internet
connection.
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
using VPN clientusing VPN client
PC
LAPTO P
The VPN gateway of the LAN must support the establishment of VPN tunnels with the VPN client software of the remote
PC.
11.4 What is LANCOM Dynamic VPN ?
LANCOM Dynamic VPN is a LANCOM Systems technology which permits VPN tunnels to be connected to remote stations
that do not have a static, but only a dynamic IP address.
710
Reference Manual
11 Virtual Private Networks (VPN)
Who needs LANCOM Dynamic VPN and how does it work? We will answer this question in two steps: First, a look at the
basics of IP addressing will show the problem of static IP addresses. The second step shows the solution thereof with
LANCOM Dynamic VPN.
11.4.1 A look at IP addressing
Every participant on the Internet needs an IP address. Participants even need a special kind of IP address - a public one.
The administration of public IP addresses is handled from central locations in the Internet. Each public IP address may
only occur once on the entire Internet.
Local IP-based networks do not use public, but private IP addresses. For this reason, a number of address ranges within
the entire IP address range have been reserved for private IP addresses.
A computer connected to both a local network and directly to the Internet therefore has two IP addresses: a public one
for communication with the rest of the Internet and a private one by which the computer can be reached within the local
network.
Static and dynamic IP addresses
Public IP addresses must be applied for and managed, which involves costs. There is also only a limited number of public
IP addresses. For this reason, not every Internet user has his or her own fixed (static) IP address.
The alternative to static IP addresses are the so-called dynamic IP addresses. A dynamic IP address is assigned to an
Internet user by the Internet Service Provider (ISP) upon dialling-in, and remains valid for the duration of the connection.
The ISP takes an unused address selected at random from their pool of IP addresses. This IP address is only temporarily
assigned to the user for the duration of a given connection. When the connection is ended, the IP address is once again
free and the ISP can assign it to another user.
Many flatrate connections, too, are realised with via dynamic IP addresses. Every 24 hours or so, the connection is forcibly
interrupted. The new connection is generally assigned with a new and different IP address.
Advantages and disadvantages of dynamic IP addresses
This process has a very important advantage for ISPs: they only need relatively small pools of IP addresses. Dynamic IP
addresses are also favorable for users: it's not necessary for them to apply for static IP addresses in advance - they can
connect to the Internet immediately. It's also not necessary for them to manage IP addresses. This saves trouble and
costs. The other side of the coin: A user without a static IP address cannot be addressed directly from the Internet.
This is a major problem when setting up VPNs. If, for example, Computer A would like to communicate with Computer
B using a VPN tunnel on the Internet, Computer A needs the remote computer's IP address. If B only has a dynamic
address, A cannot know that address and therefore cannot contact B.
The LANCOM Dynamic VPN offers the answer here.
11.4.2 This is how LANCOM Dynamic VPN works
Let's use two examples to explain how LANCOM Dynamic VPN works (designations refer to the IP addressing type of
the two VPN gateways):
1
dynamic – static
1
static – dynamic
1
dynamic – dynamic
Dynamic – static
If a user on computer B in LAN 2 wishes to connect to computer A in LAN 1, then gateway 2 receives a request and
tries to establish a VPN tunnel to gateway 1. Gateway 1 has a static IP address and can be directly contacted over the
Internet.
711
Reference Manual
11 Virtual Private Networks (VPN)
A problem arises in that the IP address from gateway 2 is assigned dynamically, and gateway 2 must communicate its
current IP address to gateway 1 when attempting to connect. In this case, LANCOM Dynamic VPN takes care of transmitting
the IP address during connection establishment.
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
Home Office
LAN
PC
VPN Router
A
Gateway 2 with
dynamic IP address
Gateway 1 with
static IP address
B
1. Gateway 2 connects to the Internet and is assigned a dynamic IP address.
2. Gateway 2 contacts Gateway 1 via its known public IP address. LANCOM Dynamic VPN enables the identification
and transmission of the actual IP address of Gateway 2. Gateway 1 initiates the VPN tunnel then.
The great advantage of LANCOM devices with this application: Instead of the “Aggressive Mode” that is normally used
when connecting VPN clients to the headquarters, the far more secure “Main Mode” can be applied. Although with
Main Mode more unencrypted messages can be exchanged during the IKE handshake, the method is overall more secure
than Aggressive Mode.
5
An ISDN line is not necessary for establishing this type of connection. The dynamic end communicates its IP
address encrypted via the Internet protocol ICMP (or alternatively via UDP).
Static – dynamic
If, on the other hand, computer A in LAN 1 requires a connection to computer B in LAN 2, for example when headquarters
carries out remote maintenance at the external locations, then gateway 1 receives the request and attempts to establish
a VPN tunnel to gateway 2. Gateway 2 only has a dynamic IP address and cannot be directly contacted over the Internet.
With LANCOM Dynamic VPN, the VPN tunnel can be set up nevertheless. The connection is established in three steps:
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
Home Office
LAN
PC
VPN Router
B
Gateway 2 with
dynamic IP address
Gateway 1 with
static IP address
C
Call via ISDN
A
D
1. Gateway 1 calls Gateway 2 via ISDN. It takes advantage of the ISDN functionality of sending its own subscriber
number via the D-channel free of charge. Gateway 2 determines the IP address of Gateway 1 from the preconfigured
VPN remote stations using the received subscriber number.
If Gateway 2 does not receive a subscriber number via the D-channel (if that particular ISDN service feature is not
available, for example) or an unknown number is transferred, the authentication will be performed via the B-channel.
Once the negotiation was successful, Gateway 1 sends its IP address and closes the connection on the B-channel
immediately.
2. Now its Gateway 2's turn: It first connects to its ISP and is assigned a dynamic IP address.
3. Gateway 2 authenticates itself at Gateway 1. The static IP address of gateway 1 is known, of course.
4. Gateway 1 now knows the address of Gateway 2 and sets up the VPN tunnel to Gateway 2.
The advantage of LANCOM devices, for example when connecting from the headquarters to branch offices: The functions
in LANCOM Dynamic VPN also allows access to networks without a flatrate, i.e. networks that are not always online.
The ISDN connection and an associated MSN act to substitute the another address, such as a static IP address or the
dynamic address translation via dynamic DNS services, a solution often used with flatrate connections.
5
The described connection set up requires an ISDN connection for both VPN gateways. But usually no charges
will arise for this procedure.
5
Please note .
712
Reference Manual
11 Virtual Private Networks (VPN)
Dynamic – dynamic
With LANCOM Dynamic VPN, VPN tunnels can also be set up between two gateways that both only have dynamic IP
addresses. Let's modify the previous example so that in this case Gateway 1 also has a dynamic IP address. Once again,
Computer A would like to connect to Computer B:
HEADQUARTER
VPN Gateway
LAN
server
INTERNET
Home Office
LAN
PC
VPN Router
A
Gateway 2 with
dynamic IP address
Gateway 1 with
dynamic IP address
B
Call via ISDN
C
D
1. Gateway 1 connects to its ISP and is assigned a public, dynamic IP address.
2. It then calls Gateway 2 via ISDN to send this dynamic address. Three procedures are used to send the address:
1
As information in the LLC element of the D-channel. In the D-channel protocol of Euro-ISDN (DSS-1), the
so-called LLC (Lower Layer Compatibility) element can be used to send additional information to the remote
station. This transfer takes place before the B-channel connection is established. Once the address has been sent
successfully, the remote station rejects the call. Charges are thus not incurred for a B-channel connection. The
IP address is sent nevertheless for free in this case.
5
The LLC element is generally available as a standard feature in Euro-ISDN that does not require registration
or activation. It may be disabled by telephone companies or individual exchanges, however. The LLC
element is not available in 1TR6, the German national ISDN. The procedure described above thus will
not work with 1TR6.
1
As a subaddress via the D-channel. If it is not possible to send the address via the LLC element, Gateway 1 will
attempt to send the address as a so-called subaddress. Like the LLC element, the subaddress is an information
element of the D-channel protocol that permits short items of information to be sent free of charge. In this case,
the telephone company must enable the 'subaddressing' feature first; this is generally subject to a charge. As
with the LLC element, the call is rejected by the remote station once the IP address has been transferred
successfully. The connection thus remains free of charge.
1
Via the B-channel. If both attempts to send the IP address via the D-channel fail, then a conventional connection
via the B-channel must be established to send the IP address. The connection is dropped immediately after the
IP address has been sent. This connection is subject to the usual charges.
3. Gateway 2 connects to the ISP and receives a dynamic IP address.
4. Gateway 2 authenticates itself at Gateway 1. The static IP address of gateway 1 is known, of course.
5. Gateway 1 now knows the address of Gateway 2 and sets up the VPN tunnel to Gateway 2.
5
Dynamic VPN works only between LANCOM that each feature at least one ISDN port that can be used for the
ISDN connection.
5
Please note ..
Dynamic IP addresses and DynDNS
It is also possible to establish a connection between two stations using dynamic IP addresses by using so-called dynamic
DNS services (DynDNS). The address of the tunnel end-point is not defined as an IP number (which is, of course, dynamic
and subject to frequent change) but as a static name instead (e.g. MyLANCOM@DynDNS.org).
Two things are needed for translating a name to its current IP address: A dynamic DNS server and a dynamic DNS client:
1
The first, available from numerous providers in the Internet, is a server that is in communication with Internet DNS
servers.
713
Reference Manual
11 Virtual Private Networks (VPN)
1
The dynamic DNS client is integrated in the device. It can make contact to any one of a number of dynamic-DNS
service providers and, assuming that a user account has been set up, automatically update its current IP address for
the DNS name translation. This can be set up very conveniently with a Wizard under LANconfig (also see ):
5
For reasons of security and availability, LANCOM Systems recommends the use of Dynamic VPN in preference
to dynamic DNS-based VPN solutions. Dynamic VPN is based on direct connections via the ISDN network and
ensures a higher degree of availability than dynamic DNS services in the Internet.
11.4.3 Information to the Dynamic VPN registration
When using dynamic VPN with IP address transmission over ISDN you must activate this feature. This operating mode
is usually then required, when you configure a VPN tunnel with dynamic IP addresses on both sides without dynamic
DNS services. All other operation modes of dynamic VPN (for transmitting the IP address by ICMP, to provoke a callback
etc.) do not require a registration.
The registration is anonymous, i.e. no personal or firm data is transmitted.
5
The registration of the dynamic VPN option requires administrator rights.
When scanning the device for instance right after the program start LANconfig automatically recognizes if the device
must be activated. After confirming the arising hint the LANconfig automatically transmits the required data of the device
714
Reference Manual
11 Virtual Private Networks (VPN)
to the registration server of LANCOM Systems. The release code ist automatically transmitted back to the device and
activated. The state of this procedure is visible in LANconfig.
For the registration with WEBconfig the serial number of the device ist required. You can find this information on the
bottom side of your device.
When using WEBconfig you can find a link on the first page which leads you to the registrating server of LANCOM
Systems. There you must enter the serial number of your device and your e-mail address. After transmitting the data you
receive a release code for the device.
To load this release code into your router, please proceed as follows:
Log on with administrator rights on WEBconfig. Select Enable Software Option, which is placed on the entry page.
On the following page enter the release code and confirm by clicking on Apply.
11.5 Configuration of VPN connections
Three questions are answered in the configuration of VPN connections:
1
Between which VPN gateways (remote stations) is the connection established?
1
What security parameters are used to secure the VPN tunnel between the two gateways?
715
Reference Manual
11 Virtual Private Networks (VPN)
1
Which networks or computers can intercommunicate via these tunnels?
5
This section introduces the basic considerations for configuring VPN connections. Considered first of all is the
simple connection of two local networks. Special cases such as dialling in to LANs with individual computers
(RAS) or the connection of structured networks will be covered subsequently.
11.5.1 VPN tunnel: Connections between VPN gateways
Virtual Private Networks (VPNs) are used to interconnect local networks over the Internet. This involves the routing of
the private LAN IP addresses via an Internet connection between two gateways with public IP addresses.
For the secure routing of private IP addresses over the Internet, a VPN connection, also known as a VPN tunnel, is
established between the two LANs.
The VPN tunnel has two important tasks:
1
To shield the transported data from unauthorized access
1
To route private IP addresses via an Internet connection that can normally only be used to route public IP addresses.
The VPN connection between the two gateways is defined by the following parameters:
1
The end-points of the tunnel, the VPN gateways, each of which are accessible via public IP addresses (static or
dynamic)
1
The IP connection between the two gateways
1
The private IP address range that are to be routed between the VPN gateways
1
Setting relevant to security, such as passwords, IPSec keys etc. to shield the VPN tunnel
This information is contained in the so-called VPN rules.
VPN Gateway
INTERNET
server
PC
PC
PC
VPN Gateway
server
PC
PC
PC
IP network: 10.1.0.0
Net mask: 255.255.0.0
IP network: 10.2.0.0
Net mask: 255.255.0.0
IP address:
80.146.81.251
IP address:
217.213.77.120
VPN tunnel with IPSec encryption
11.5.2 Set up VPN connections with the Setup Wizard
If possible, make use of the Setup Wizard within LANconfig to set up VPN connections between local networks. The
Wizard guides you through the configuration and makes all the necessary settings for you. Carry out the configuration
on both routers, one after the other.
716
Reference Manual
11 Virtual Private Networks (VPN)
1. Choose your device from the selection window in LANconfig and select the Setup Wizard button or use the menu
bar Tools / Setup Wizard.
1. Follow the Wizard’s instructions and enter the necessary data. The Wizard will inform you when the required
information is complete. You can then close the Wizard with Finish.
2. Once you have completed the set-up of both routers, you can start testing the network connection. Try to communicate
with a computer in the remote LAN (e. g. with ping). The device should automatically connect to the remote station
and make contact to the requested computer.
This Wizard automatically sets up the VPN connections essential for typical LAN-LAN coupling. In the following situations,
the VPN connections will have to be configured manually:
1
Where no Windows computer with LANconfig is available. In this case, the necessary parameters are set with
WEBconfig or via the Telnet console.
1
Where only selected portions of the LAN (intranet) are to communicate with other computers via the VPN connection.
This is the case where, for example, the intranet is connected to further subnets with routers, or when only selected
portions of the intranet should have access to the VPN connection. In such cases, additional parameters are defined
supplementary to those entered in the Setup Wizard.
1
Configuring VPN connections to third-party devices.
11.5.3 1-Click-VPN for networks (site-to-site)
The site-to-site coupling of networks is now very simple with the help of the 1-Click-VPN wizard. It is even possible to
simultaneously couple multiple routers to a central network.
1. In LANconfig, mark the routers at branch offices which are to be coupled to a central router via VPN.
2. Use drag&drop by mouse to place the devices onto the entry for the central router.
717
Reference Manual
11 Virtual Private Networks (VPN)
1. The 1-Click-VPN Site-to-Site Wizard will be started. Enter a name for this access and select the address under which
the router is accessible from the Internet.
1. Select whether connection establishment is to take place via the name or IP address of the central router, or via an
ISDN connection. Enter the address or name of the central router, or its ISDN number.
2. The final step is to define how the networks are to intercommunicate:
1
The INTRANET at headquarters only is to be provided to the branch offices.
1
All private networks at the branch offices can also be connected to one another via headquarters.
5
All entries for the central device are made just once and are then stored to the device properties.
11.5.4 1-Click-VPN for LANCOM Advanced VPN Client
VPN accesses for employees who dial into the network with the LANCOM Advanced VPN Client are very easy to set up
with the Setup Wizard and exported to a file. This file can then be imported as a profile by the LANCOM Advanced VPN
Client. All of the information about the LANCOM VPN Router's configuration is also included, and then supplemented
with randomly generated values (e.g. for the preshared key).
1. Use LANconfig to start the 'Set up a RAS Account' wizard and select the 'VPN connection'.
2. Activate the options 'LANCOM Advanced VPN Client' and 'Speed up configuration with 1-Click-VPN'.
3. Enter a name for this access and select the address under which the router is accessible from the Internet.
4. In the final step you can select how the access data is to be entered:
1
Save profile as an import file for the LANCOM Advanced VPN Client
1
Send profile via e-mail
1
Print out profile
5
Sending a profile via e-mail could be a security risk should the e-mail be intercepted en route!
To send the profile via e-mail, the device configuration must be set up with an SMTP account with the necessary
access data. Further, the configuration computer requires an e-mail program that is set up as the standard e-mail
application and that can be used by other applications to send e-mails.
When setting up the VPN access, certain settings are made to optimize operations with the LANCOM Advanced VPN
Client, including:
1
Gateway: If defined in the LANCOM VPN Router, a DynDNS name is used here, or alternatively the IP address
1
FQUN: Combination of the name of the connection, a sequential number and the internal domain in the LANCOM
VPN Router.
718
Reference Manual
11 Virtual Private Networks (VPN)
1
Domain: If defined in the LANCOM VPN Router, the internal domain is used here, or alternatively a a DynDNS
name or IP address
1
VPN IP networks: All IP networks defined in the device as type 'Intranet'.
1
Preshared key: Randomly generated key 16 ASCII characters long.
1
Connection medium: The LAN is used to establish connections.
1
VoIP prioritization: VoIP prioritization is activated as standard.
1
Exchange mode: The exchange mode to be used is 'Aggressive Mode'.
1
IKE config mode: The IKE config mode is activated, the IP address information for the LANCOM Advanced VPN
Client is automatically assigned by the LANCOM VPN Router.
11.5.5 Inspect VPN rules
VPN rules represent a combination of various pieces of information and they are not directly defined in a LANCOM device;
instead, they are compiled from a variety of sources. This is why it is not possible to inspect the VPN rules with LANconfig
or any other configuration tool.
Information about the current VPN rules in the device can be retrieved with the Telnet console. Start a Telnet connection
to the VPN gateway and enter the command show vpn in the console:
The output informs you of the network relationships that are relevant to VPN connections to other networks.
In this example, the local network at a branch office (network 192.168.2.0, netmask 255.255.255.0) is connected to
the network at the headquarters (network 10.0.0.0, netmask 255.255.255.0). The public IP address of the local gateway
is 80.146.81.251, and that of the remote VPN gateway is 217.213.77.120.
5
Entering “any:0” displays the protocols and ports that can be used over the connection.
Further output is displayed by the command “show vpn long”. The information displayed here covers network relationships
and also the parameters that are relevant to security, such as IKE and IPSec proposals.
719
Reference Manual
11 Virtual Private Networks (VPN)
11.5.6 Manually setting up VPN connections
Manually setting up VPN connections involves the tasks described previously:
1
Definition of the tunnel endpoints
1
Definition of the security-related parameters (IKE and IPSec)
1
Definition of the VPN network relationships, i.e. the IP address ranges to be connected. Should the IP ranges overlap
at both ends of the connection, please refer to the section .
1
When coupling Windows networks (NetBIOS/IP): Without WINS servers at both ends of the VPN connection (such as
when linking a home office), the LANCOM can take over the necessary NetBIOS proxy functions. To this end, the
NetBIOS module in the LANCOM must be activated, and the corresponding VPN remote site must be entered into
the NetBIOS module as the remote site. Should WINS servers be present in both of the coupled networks, then the
NetBIOS module should be deactivated so that the LANCOM does not perform NetBIOS proxy functions.
5
To use the LANCOM NetBIOX proxy either LANCOM Dynamic VPN must be applied, because it transmits the
required addresses, or the IP address of the remote station as a primary NBNS must be entered in the IP
parameter list (\-LANconfig: Communication / Protocols).
1
When using LANCOM Dynamic VPN: Entry for the corresponding remote site in the PPP list with a suitable password
for the Dynamic VPN handshake. The username entered here must correspond with the name entered in the remote
device that describes the VPN connection to this local device. Activate "IP routing". If Windows networks are also
to be coupled, then the NetBIOS entry should be activated here.
The tunnel endpoints, i.e. the local VPN gateway and each of the VPN remote stations, are entered into the VPN connection
list.
Manually configuring the VPN connection involves the following steps:
1. Create an entry for the remote VPN gateway in the connection list and enter its public IP address.
2. The security parameters for the VPN connection are normally taken from the prepared list, and all that is required
here is to define an IKE key.
3. For a Dynamic VPN connection, create a new entry in the PPP list with the name of the remote VPN gateway as the
remote station, with the name of the local VPN gateway as the User Name, and set a suitable password. Be sure to
activate the IP routing for this PPP connection and, if required, the routing of “NetBIOS over IP” as well. The remaining
PPP parameters, such as the procedure for checking the remote station, can be defined in the same way as for other
PPP connections.
4. The main task in setting up VPN connections is in defining the network relationships. Which IP address ranges at
each end of the VPN tunnel should be included in the secured connection?
11.5.7 IKE config mode
When configuring VPN dial-in connections, there is as an alternative to fixed IP addresses for the remote stations that
dial in, in that a pool of IP addresses can be made available to them. To this end, the "IKE-CFG" mode is additionally
added to the entries in the connection list. This can assume the following values:
1
Server: With this setting, the device functions as the server for this VPN connection. The assignment of an IP address
to the client can take place in two ways:
2
If the remote site is entered in the routing table, the IP address defined here will be assigned to the client.
2
If the remote site is not entered in the routing table, an IP address which is available from the IP pool will be
taken for the dial-in connections.
720
Reference Manual
11 Virtual Private Networks (VPN)
5
The remote site must be configured as IKE-CFG client in this case, and thus has to request an IP address from
the server. To dial in with a LANCOM Advanced VPN Client, the option Use IKE Config Mode has to be
activated in the connection profile.
1
Client: With this setting, the device functions as the client for this VPN connection and requests an IP address from
the remote site (server). The device acts in a similar manner to a VPN client.
1
Off: If the IKE-CFG mode is switched off, no IP addresses will be assigned for the connection. Fixed IP addresses
must be defined for both ends of the connection.
LANconfig: VPN / General / Connection list
WEBconfig: LCOS menu tree / Setup / VPN E VPN-Peers
11.5.8 Prepare VPN network relationships
The firewall integrated into LANCOM routers is a powerful instrument for defining source and target address ranges
between which data transfer (and limitations to it) can be enabled or prohibited. These functions are also used for setting
up the network relationships for the VPN rules.
In the simplest case, the firewall can generate the VPN rules automatically.
721
Reference Manual
11 Virtual Private Networks (VPN)
1
The local intranet serves as the source network, i.e. the same private IP address range that the local VPN gateway
itself belongs to.
1
For automatically generated VPN rules, the target networks are those network ranges that have a remote VPN gateway
set as their router.
To activate the automated rule generation, simply switch on the corresponding option in the firewall automatic when
using the VPN installation Wizard under LANconfig. When coupling two simple local networks, the automatic VPN can
interpret the necessary network relationships from the IP address range in its own LAN and from the entry for the remote
LAN in the IP routing table.
VPN Gateway
INTERNET
server
PC
PC
PC
VPN Gateway
server
PC
PC
PC
IP network: 10.1.0.0
Net mask: 255.255.0.0
IP network: 10.2.0.0
Net mask: 255.255.0.0
VPN Gateway1:
80.146.81.251
VPN Gateway2:
217.213.77.120
IP routing table:
10.2.0.0/16 -> Gateway2
IP routing table:
10.1.0.0/16 -> Gateway1
The description of the network relationships is more complicated if the source and target networks are not only represented
by the intranet address ranges of the connected LANs:
1
When only a portion of the local intranet is to be available to the remote network, then the automatic method is
unsuited as the IP address range that is open to the VPN connection is too large.
IP: 10.1.0.1 to 10.1.0.50
Net mask: 255.255.0.0
IP: 10.2.0.2 to 10.2.0.99
Net mask: 255.255.0.0
1
In many network structures, the local network is connected by further routers to sections of other networks with their
own IP address ranges. Additional settings are required to include these address ranges in the network relationship.
VPN Gateway
INTERNET
server
PC
PC
PC
VPN Gateway
server
PC
PC
PC
IP network: 10.1.0.0
Net mask: 255.255.0.0
IP network: 10.2.0.0
Net mask: 255.255.0.0
Router
PC
server
IP network: 10.1.0.0
Net mask: 255.255.0.0
In these cases, the network relationships that describe the source and target networks must be entered manually.
Depending on the situation, the scope of the automatically generated VPN rules may be extended, although sometimes
it is better to deactivate the automatic VPN system to prevent unwanted network relationships.
The necessary network relationships are defined by the appropriate firewall rules under the following circumstances:
1
In the firewall rules, the option “Consider this rule when generating VPN rules” must be activated.
5
The firewall rules for generating VPN rules are active even when the actual firewall function in the LANCOM
device is not required and is switched off!
1
Make sure that the firewall action is set to “Transfer”.
1
Sources and targets for the connection can be entered as individual stations, certain IP address ranges, or whole IP
networks.
5
It is vital that target networks are defined in the IP routing table so that the router in the LANCOM devices
can forward the appropriate data packets to the other network. You can make use of the entries that already
exist there and simply enter a higher-level network as the target. The intersecting portion of the target network
722
Reference Manual
11 Virtual Private Networks (VPN)
defined by the firewall and the subordinate entries in the IP routing table is integrated into the network
relationships for the VPN rules.
Example: The target networks 10.2.1.0/24, 10.2.2.0/24 and 10.2.3.0/24 are entered into the IP routing table and
can be accessed via the router VPN-GW 2. An entry for the target network 10.2.0.0/16 is sufficient for these three
subnets to be included in the VPN rules.
5
The definition of source and target networks must agree at both ends of the VPN connection. It is not possible,
for example, to map a larger target address range to a smaller source address range at the opposite end.
Decisive here are the IP address ranges allowed by the VPN rules and not the networks defined in the firewall
rules. These can be very different from the network relationships in the VPN rules because of the intersecting
ranges.
1
VPN connections can also be limited to certain services or protocols according to your requirements. This means that
the VPN connection can be limited to use only with a Windows network, for example.
5
These limitation should be defined by a separate set of rules that applies only to the firewall and that will not
be used in generating VPN rules. Combined firewall/VPN rules can very quickly become highly complex and
difficult to comprehend.
11.5.9 Configuration with LANconfig
The section demonstrates how LANconfig can be used to configure a LAN-LAN coupling with additional subnets. In this
section, VPN gateway 1 will be configured and then the configuration of gateway 2 with the help of WEBconfig will be
demonstrated.
VPN Gateway
INTERNET
PC
VPN Gateway
server
PC
PC
Router
10.2.0.0/16
LAN
10.1.0.2
Router
10.5.0.0/16
LAN
10.4.0.5
Router
10.3.0.0/16
LAN
10.1.0.3
10.1.0.0/16
Gateway 1:
gw1.dyndns.org
server
10.4.0.0/16
Gateway 2:
gw2.dyndns.org
1. When configuring VPN, access the “IKE param.” tab and create a new IKE key for the connection:
723
Reference Manual
11 Virtual Private Networks (VPN)
1. Under the “General” tab, create a new entry in the list of Connection parameters. Select the IKE key created earlier
for this. PFS and IKE groups can also be selected in the same way as IKE and IPSec proposals from the options
prepared earlier.
1. You should then generate a new entry in the Connection list with the name of the remote gateway as “name for the
connection”. For LANCOM Dynamic VPN connections the entry “Remote gateway” must remain empty. Otherwise
enter the public address of the remote station: either the fixed IP address or the name for translation by DNS.
1. When using LANCOM Dynamic VPN: Change to the “Communication” configuration area. Using the “Protocols” tab,
make a new entry in the PPP list. Select the remote VPN gateway as the remote site, enter the User Name as the
724
Reference Manual
11 Virtual Private Networks (VPN)
name of the VPN connection that the remote VPN gateway uses to address the local device, and enter a suitable
password that is identical at both locations, but for safety reasons should not be identical to the pre-shared key.
1. Be sure to activate "IP routing" and, if required, "NetBIOS over IP".
2. Change to the “IP Router” configuration area. On the “Routing” tab, make a new entry in the routing table for those
parts of networks that are to be accessible in the remote and in the local LAN. In each case, define the router as the
remote VPN gateway and switch the IP masquerading off.
1. For the “VPN gateway 1”, the following entries are necessary so that the remote network sections can be reached.
IP masqueradingRouterNet maskIP address
NoVPN gateway 2255.255.0.010.4.00.0
NoVPN gateway 2255.255.0.010.5.0.0
For those subnetworks connected to your own LAN, define the router as the IP address for the appropriate LAN
router.
IP masqueradingRouterNet maskIP address
No10.1.0.2255.255.0.010.2.0.0
No10.1.0.3255.255.0.010.3.0.0
These entries enable VPN gateway 1 to forward packets arriving from the remote network to the correct sections of
the local network.
725
Reference Manual
11 Virtual Private Networks (VPN)
2. Change to the “Firewall/QoS” configuration area. On the “Rules” tab, add a new firewall rule with the name “VPN
GATEWAY 1 OUT” and activate the option “This rule is used to create VPN rules”. This ensures that IP networks
described in this rule will be used in establishing VPN network relationships.
5
It is recommended to keep the rules used for making network relationships (source and target IP) separate from
those firewall rules that for instance affect the services used in communications. Combining both aspects can
leed to a higher number of internal managed VPN relationships and therefore to a loss of performance in the
VPN tunnels.
1. On the “Actions” tab for these firewall rules, set the “Packet Action” to “Transmit”.
726
Reference Manual
11 Virtual Private Networks (VPN)
1. On the “Stations” tab for these firewall rules, define the source of the data transfers as the subnets at the local site,
and set the destination as all of the subnets at the remote site.
1. Now for the incoming data transmissions, generate a firewall rule named “VPN GATEWAY 1 IN” with the same
parameters as the rule just described. The only difference is that the source and the destination networks are swapped.
727
Reference Manual
11 Virtual Private Networks (VPN)
11.5.10 Configuration with WEBconfig
1. Under Configuration / VPN / IKE-Param. / IKE key set a new IKE key for the connection:
1. Under Configuration / VPN / General / Connection parameters define a new “VPN layer” for the connection
parameters. Select the IKE key created earlier for this.
1. Under Configuration / VPN / Connection list generate a new entry with the name of the remote gateway set to
“Name”. For the “Remote gateway”, enter the public address of the remote station: either the fixed IP address or
the name for translation by DNS.
728
Reference Manual
11 Virtual Private Networks (VPN)
1. When using LANCOM Dynamic VPN: Under Configuration / Setup / WAN module / PPP list make a new entry.
Select the remote VPN gateway as the remote site, enter the User Name as the name of the VPN connection that
the remote VPN gateway uses to address the local device, and enter a suitable password that is identical at both
locations.
1. Be sure to activate "IP routing" and, if required, "NetBIOS over IP".
2. Under Configuration / Setup / IP router module / IP routing table generate a new entry for each network
portion that should be accessible in the remote and in the local LAN. In each case, define the router as the remote
VPN gateway and switch the IP masquerading off.
1. For the “VPN gateway 2”, the following entries are necessary so that the remote network sections can be reached.
IP masqueradingRouterNet maskIP address
NoVPN gateway 1255.255.0.010.1.0.0
NoVPN gateway 1255.255.0.010.2.0.0
NoVPN gateway 1255.255.0.010.3.0.0
729
Reference Manual
11 Virtual Private Networks (VPN)
For those subnetworks connected to your own LAN, define the router as the IP address for the appropriate LAN
router.
IP masqueradingRouterNet maskIP address
No10.4.00.5255.255.0.010.5.0.0
These entries enable VPN gateway 2 to forward packets arriving from the remote network to the correct sections of
the local network.
2. Under Configuration / Firewall/QoS / Object table make an entry for each part of the network that should be
used as a source or destination for the VPN connection via “VPN GATEWAY 1” (“VPN-GW1-LOCAL” and
“VPN-GW1-REMOTE”). Enter each subnet in the form “%A10.1.0.0 %M255.255.0.0”.
1. Under Configuration / Firewall/QoS / Rules table define a new firewall rule named “VPN-GW1-OUT”. Set the
objects to “CPN-GW1-LOCAL” and “VPN-GW1-REMOTE”, the protocol to “ANY” and the action to “ACCEPT”. Activate
the option “VPN rule” so that the IP networks described in this rule will be used in establishing VPN network
relationships.
5
As a rule, it is recommended that you keep the rules used for making network relationships separate from those
firewall rules that affect the services used in communications, for example.
730
Reference Manual
11 Virtual Private Networks (VPN)
1. Now for the incoming data transmissions, generate a firewall rule named “VPN-GWY1-IN” with the same parameters
as the rule just described. The only difference is that the source and the destination networks are swapped.
11.5.11 Establishing Security Associations collectively
Security Associations (SAs) are the basis for establishing a VPN tunnel between two networks. Parameters defined by a
SA include:
1
Source and destination network IP addresses
1
Encyption, integrity check and authentication methods
1
The key for the connection
1
The key's lifetime
Security Associations are defined by automatically or manually generated VPN rules (also see in the reference manual).
The establishment of Security Associations is normally initiated by an IP packet which is to be sent from a source network
to a destination network. With keep-alive connections, this is an ICMP packet which is sent to the remote site by an
entry in the polling table.
VPN Gateway
INTERNET
VPN Gateway
Router
LAN
10.1.x.x
LAN
server
Router
LAN
10.2.x.x
192.x.x.x
172.x.x.x
In complex network scenarios it is possible for multiple network relationships to be defined between two VPN gateways.
If a single IP packet is transferred, then the SAs are established for this single packet and its corresponding network
relationship only. To establish the other SAs, IP packets fitting to the other network relationships are needed.
It takes time to establish SAs based on data packets, and this can lead to the loss of packets as long as the SAs are not
yet installed. This is often an undesirable side effect, particularly with keep-alive connections. Instead, all SAs relevant
to the network relationships defined in the remote site should be established immediately. However, since the negotiation
of SAs can make heavy demands on CPU performance—particularly in complex scenarios—the behavior can be defined
with the parameter "Establish SAs collectively".
1
Establish SAs collectively
2
Yes: All SAs defined in the device will be established.
2
No [default]: Only the SA which corresponds explicitly to a packet waiting for transfer is to be established.
2
Only with KeepAlive: All of the defined SAs will be established for remote stations in the VPN connection list with
a hold time set to '9999' (Keep Alive).
731
Reference Manual
11 Virtual Private Networks (VPN)
WEBconfig: LCOS menu tree / Setup / VPN
5
In most cases and particularly where automatically generated VPN rules are in use, the setting which establishes
only explicitly corresponding SAs is perfectly sufficient.
The SAs currently in effect can be seen under /Status/VPN.
11.5.12 Diagnosis of VPN connections
If the VPN connections fail to work after the configuration of the parameters, the following diagnostic methods can be
applied:
1
The command show vpn spd on the Telnet console calls the “Security Policy Definitions”.
1
Use the command show vpn sadb to access information about the negotiated “Security Associations” (SAs).
1
The command trace + vpn [status, packet] calls up the status and error messages for the current VPN negotiations.
2
The error message “No proposal chosen” indicates a fault in the configuration at the remote site.
2
The error message “No rule matched”, on the other hand, indicates a fault in the configuration of the local
gateway.
11.6 Working with digital certificates
The security of communications via VPN fulfils three core requirements:
1
Confidentiality: The transmitted data cannot be read by unauthorized persons (via encryption).
1
Integrity: The data cannot be changed during transmission (via authentication).
1
Authenticity: The receiver can be certain that received data has genuinely been sent by the supposed sender (via
authentication).
A number of encryption and authentication methods exist which provide satisfactory solutions for the first two aspects,
confidentiality and integrity. The use of digital certificates aims to provide assurance about the authenticity of the
communications partner.
11.6.1 Basics
Encryption methods can be divided into two categories: Symmetrical and the asymmetrical encryption.
Symmetrical encryption
This is a method known for thousands of years and is based on the fact that the sender and the recipient both have
access to a message by knowing a secret shared key. This key can take on a wide variety of forms: The Romans used a
stick of a certain diameter for encryption and decryption.
Today's digital communications rely in the main upon a password as the key. Using this password and an encryption
algorithm, the data from the sender are changed. The recipient uses the same key and the fitting encryption algorithm
so that the data become legible again. Other persons who do not know the key cannot read the data. A common
symmetrical method of encryption is 3DES, for example.
100100101
001010010
110101000
001101001
100100101
001010010
110101000
001101001
AliceAlice Bob
Secret key Secret key
Encrypted message Plain text message
Example:
732
Reference Manual
11 Virtual Private Networks (VPN)
1
Alice wants to send a confidential message to Bob. To do this, she encrypts the message with a secret key and a
suitable method, e.g. 3DES. She sends the encrypted message to Bob informing him of the encryption method she
used.
1
Bob has the same key as Alice. Since he knows which encryption method was used, he can decrypt the message and
transform it back into plain text.
Symmetrical encryption is simple and efficient but has two serious disadvantages:
1
A different key is required for every secret communications relationship. If Alice and Bob are joined by Carol, three
keys are necessary for secure data communications between all parties; with four participants, the number of keys
required is six; with 12 participants, 66 keys are required and with 1000 participants, almost 500,000 keys are
necessary! In a worldwide network with ever increasing demands for secure communications and higher numbers
of participants, the serious nature of this problem is obvious.
1
While this first disadvantage could be solved with technology, the second problem that is the core problem for
symmetrical encryption: The secret key must be known at both ends of the communication and must not fall into the
hands of unauthorized persons. Thus it is not possible for Alice simply to send the key to Bob per e-mail before the
data connection has been secured sufficiently—which is the whole point of the encryption. She has to give the key
to Bob in person, or at least make use of a communications method which is safe from eavesdroppers. This is a task
which is almost impossible to handle in these times of worldwide dynamic communications.
Asymmetric encryption
A totally new approach was developed in the 1970s; that of asymmetric encryption. This method no longer relies on a
secret key that is known at both ends, but on a pair of keys instead:
1
The first part of the key pair is used to encrypt the data that are to be sent to the key owner. This key, subsequently
called the public key, can be made publicly available to anybody interested in communication.
1
The second part of the key pair is the private key that is only used to decrypt the received message. This key is secret
and may not fall into the hands of unauthorized persons.
The main difference to symmetrical methods: A publicly available key is used in this so-called "public key method". An
example of an asymmetrical encryption method is RSA.
Let's take another look at the example with Alice and Bob:
INTERNET
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
Alice Bob
Bob’s public key
Bob’s private key
Encrypted message
Plain text message
Key pair from
Bob with the
private and
public keys
Bob’s public key
1
For secure communications, Bob first of all generates a key pair with a private key and a public key that belong
together. The method used for generating this key ensures that the private key cannot be backwardly computed with
knowledge of the public key. Bob can now publicize the public key without worry. He can send it to Alice per e-mail
or simply publish it on a web server.
1
Alice now encrypts the message for Bob with his public key. This now illegible message can only be decrypted by
using Bob's private key. Even if the data are intercepted on the way from Alice to Bob, no-one but Bob can regenerate
the plain text message.
The asymmetrical encryption offers the following advantages over symmetrical variants:
1
A key pair is not required for every communications relationship, but for each participant only. Even with 1000
participants, each user needs only his/her personal key pair, of which only the public key is publicly available. Instead
of 500,000 secret keys, the public key method requires just 1000 key pairs.
1
The risky transmission of a secret key to the communications partner is simply not necessary as knowledge is only
required of the public key on the other side of the communications relationship. This is the solution to a significant
problem in the dynamic encryption of data between multiple participants.
733
Reference Manual
11 Virtual Private Networks (VPN)
Combination of symmetrical and asymmetrical encryption
Asymmetrical encryption methods have quickly become established due to the security they offer. However, security has
its price: Asymmetrical encryption methods are slow. The mathematics involved in the encryption and decryption of
messages is far more complex that with symmetrical encryption methods and thus require more computing time—a
critical factor when transmitting larger quantities of data.
The advantages of symmetrical and asymmetrical encryption can be used in suitable combinations of these methods. In
this way, the higher security of the asymmetrical encryption is used to protect the transmission of the secret key. The
actual data for transmission are then encrypted with the faster symmetrical method.
INTERNET
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
• • • • • • • • •
Alice
Bob
Bob’s public key
Bob’s private key
Key pair from Bob with the
private and public keys
Secret key
Alice’s secret key
Encrypted message
Plain text message
Bob’s public key
Secret key
1
First of all, Bob generates a key pair and publicizes the public key.
1
Alice uses the public key to encrypt a secret symmetrical key and sends this to Bob. For each transmission, this secret
key is newly defined according to a random procedure.
1
Bob is the only one who can decrypt this secret key by using his private key.
1
Alice and Bob then use this secret key to encrypt and decrypt the clearly much larger volume of the payload data.
Public key infrastructure
The combination of symmetrical and asymmetrical encryption methods enable initially unsecured connections to be used
to establish secure data communications. Until now, the aspect of authenticity has been ignored. How should Alice know
that the public key really does come from Bob? The use of public keys thus depends directly on the trust in the authenticity
of the communications partner.
To secure this trust, a confirmation of the key pairs for use with asymmetrical encryption can be issued by publicly
recognized and trustworthy authorities. In Germany, for example, the highest authority for the confirmation of digital
keys is the Regulatory Authority for Telecommunications and Post (RegTP). The RegTP in turn issues accreditations to
suitable service providers who are viewed as equally trustworthy.
5
The RegTP web site (www.regtp.de) features up-to-date lists of accredited certification service providers and
notification of revoked accreditations. Accredited service providers include numerous tax advisers and legal
associations.
The task of this organization is to attribute a public key to just one person or organization. This attribution is recorded
and officially publicized in a certificate. Consequently these providers are known as Certification Authorities, or CAs for
short. The uppermost certification authority is known as the Root CA.
Bob can now approach a CA to have his public key certified as belonging to him. He submits his public key to the CA
who then confirm that the key belongs to Bob.
734
Reference Manual
11 Virtual Private Networks (VPN)
The CA issues a certificate which lists the public key and further information about Bob, such as his identity, among
other things.
Certification
Authority (CA)
Bob’s public key Bob’s private key
Key pair from Bob with the
private and public keys
Alice
Bob
Bob’s public key
Certificate with
Bob’s public key -
Information
about identity -
Signature of the
CA
The certificate carries the signature of the CA to show that the confirmation itself is genuine. The certificate takes up
just a small amount of data and is suitable for exchange with an asymmetric method. With a signature, however, the
asymmetric method is used in the opposite direction:
1
The CA, too, has a key pair consisting of private and public keys. Since this is a trustworthy authority, their key pair
can be considered as reliable.
1
The CA calculates a hash value for the certificate, encrypts this and uses it in the signature in Bob's certificate. This
acts to confirm the attribution of Bob's public key to his identity.
This procedure behaves in the opposite manner to the normal asymmetrical encryption. In this case, the encryption
does not fulfil the task of protecting the data from unauthorized persons, but confirms the signature of the CA instead.
1
Any data communications participant anywhere in the world with the public key from the CA is now in a position to
check the signed certificate.
Only the CA is in a position to use their private key to generate signatures that can be decrypted again by using the
CA's public key. This signature guarantees that the certificate is genuinely sourced from the issuing CA.
11.6.2 Advantages of certificates
In some cases the use of certificates for securing VPN connections can be an alternative to the otherwise widespread
preshared key (PSK) method:
1
Increase security of VPN client connections (with IKE Main Mode)
Main Mode cannot be used when using PSK connections between peers that use dynamic IP addresses. In these
cases, the aggressive mode must be used with its lower degree of security. Using certificates allows peers with
dynamic IP addresses, such as dial-in computers with LANCOM Advanced VPN Client, to use the Main Mode and
thus to increase the level of security.
1
Higher security of the used keys and passwords
Preshared keys are just as susceptible as other passwords, too. The way that users treat these passwords is a major
factor in the securing of connections. With a certificate-based VPN establishment, the keys in the certificates are
automatically generated with the desired key length. What's more, the random keys generated by computers offer
more security from attack than the preshared keys of the same key length thought up by people.
1
Possibility of authenicating remote sites
When connecting with certificates oth remote stations must authenticate themselves. Further information can be
contained in the certificates, which can be used for testing remote sites. The time limit of the certificates provide an
additional protection, e.g. for users, who are only supposed to have access for a limited period of time.
1
Providing tokens and smartcards
When saving certificates on external data media the integration of “Strong Security” environments, the readout of
passwords from computers of networks is inhibited.
The advantages of certificates have to be considered in relation to the considerable increase in effort of introducing and
maintaining a public key infrastructure (PKI).
735
Reference Manual
11 Virtual Private Networks (VPN)
11.6.3 Structure of certificates
Contents
A certificate contains a variety of information which is important for it to fulfil its purpose. Some information is obligatory,
some is optional. A certificate can also be stored in a variety of different formats. An X.509-standard certificate contains
the following information, for example:
1
Version: This is the relevant version of the X.509 standard. The current (06.2005) version is 'v3'.
1
Serial number: This is a unique number that identifies the certificate.
1
Signature algorithm: This identifies the algorithm that the issuer used to sign the certificate. The digital signature of
the issuer is also to be found here.
1
Validity: Certificates are valid for a limited period of time. This entry indicates the duration of the certificate's validity.
1
Issuer: This identifies the issuer, for example by name, e-mail address, nationality, etc.
1
Subject: This identifies the certificate's owner, for example by name, institution, e-mail address, nationality, city, etc.
1
Subject public key: Information indicating the method used to generate the public key used by the certificate's owner.
The owner's public key is also to be found under this item.
Target application
When the certificates are generated, the possible uses of the certificate usually have to be selected. Some certificates
are intentionally designed for transfer with web browsers or e-mails only, and others are more generally applicable to
any use.
5
When you generate certificates, make sure that you enter its intended purpose.
Formats
The ITU standard X.509 is a wide spread format for certificates. When displayed as text, this type of certificate looks like
the following:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature algorithm: md5WithRSAEncryption
Issuer: C=XY, ST=Austria, L=Graz, O=TrustMe Ltd, OU=Certificate Authority,
CN=CA/Email=ca@trustme.dom
Validity
Not Before: Oct 29 17:39:10 2000 GMT
Not After : Oct 29 17:39:10 2001 GMT
Subject: C=DE, ST=Austria, L=Vienna, O=Home, OU=Web Lab,
CN=anywhere.com/Email=xyz@anywhere.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c4:40:4c:6e:14:1b:61:36:84:24:b2:61:c0:b5:
736
Reference Manual
11 Virtual Private Networks (VPN)
d7:e4:7a:a5:4b:94:ef:d9:5e:43:7f:c1:64:80:fd:
9f:50:41:6b:70:73:80:48:90:f3:58:bf:f0:4c:b9:
90:32:81:59:18:16:3f:19:f4:5f:11:68:36:85:f6:
1c:a9:af:fa:a9:a8:7b:44:85:79:b5:f1:20:d3:25:
7d:1c:de:68:15:0c:b6:bc:59:46:0a:d8:99:4e:07:
50:0a:5d:83:61:d4:db:c9:7d:c3:2e:eb:0a:8f:62:
8f:7e:00:e1:37:67:3f:36:d5:04:38:44:44:77:e9:
f0:b4:95:f5:f9:34:9f:f8:43
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
email:xyz@anywhere.com
Netscape Comment:
mod_ssl generated test server certificate
Netscape Cert Type:
SSL Server
Signature Algorithm: md5WithRSAEncryption
12:ed:f7:b3:5e:a0:93:3f:a0:1d:60:cb:47:19:7d:15:59:9b:
3b:2c:a8:a3:6a:03:43:d0:85:d3:86:86:2f:e3:aa:79:39:e7:
82:20:ed:f4:11:85:a3:41:5e:5c:8d:36:a2:71:b6:6a:08:f9:
cc:1e:da:c4:78:05:75:8f:9b:10:f0:15:f0:9e:67:a0:4e:a1:
4d:3f:16:4c:9b:19:56:6a:f2:af:89:54:52:4a:06:34:42:0d:
d5:40:25:6b:b0:c0:a2:03:18:cd:d1:07:20:b6:e5:c5:1e:21:
44:e7:c5:09:d2:d5:94:9d:6c:13:07:2f:3b:7c:4c:64:90:bf:
ff:8e
File types
There are various file types for digital certificates and private keys depending on the issuer. The following types are
common:
1
*.pfx and *.p12: PKCS#12 files
1
*.pem, *.cer and *.crt: BASE-64-coded certificates
1
*.cer, *.crt and *.der: DER coded certificates
1
*.key: BASE64 or DER coded keys
1
*.pvk: Microsoft-specific key format
Apart from the straightforward certificates, there is another file type that is of significance in the world of certificate-secured
VPN connections: The PCK#12 files which can contain multiple components such as a certificate and a private key. To
process the PKCS#12 file, a password has to be entered which was set when the certificate was exported.
5
BASE64-coded certificates have a header that typically features the following lines: ----- BEGIN
CERTIFICATE -----
737
Reference Manual
11 Virtual Private Networks (VPN)
Validity
A further option is to refer to a certificate revocation list (CRL). CRLs list certificates that have lost their validity, for
example if an employee has left the company and his certificate has been withdrawn. This information allows those who
are checking certificates to refer to the appropriate CRL.
11.6.4 Security
Certain security aspects have to be observed even when dealing with certificates:
1
Only ever transfer private keys via secure connections, e.g. with HTTPS.
1
Passwords for keys or PKCS#12 files should be passphrases that are long enough and secure.
11.6.5 Certificates for establishing VPN connections
Along with basic information about certificates, this section now considers their concrete application in establishing VPN
connections. For connection establishment with the support of certificates, certain information must be available at both
ends of the connection (e.g. when connecting a branch office to the network at headquarters via LANCOM routers):
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Root CA
certificate
Branch
certificate
Branch
private key
Root CA
certificate
Headquarter
certificate
Headquarter
private key
1
The branch office has the following components:
2
The Root CA's certificate with the CA's public key
2
A certificate for its own device with its own public key and the confirmation of identity. The hash value of this
certificate is signed with the CA's private key.
2
Its own private key
1
The headquarters has the following components:
2
The Root CA's certificate with the CA's public key
2
A certificate for its own device with its own public key and the confirmation of identity. The hash value for this
certificate is signed with the CA's private key.
2
Its own private key
Put simply, the following procedures are carried out during the VPN connection exchange in Main Mode (symmetrical
in both directions):
1. In an initial exchange of packets the peers negotiate, for example, the methods of encryption and authentication
that are to be used. At this phase, both ends are not fully certain about who they are negotiating with, although
this is not yet critical.
2. At the next stage, common key material is negotiated for the continued communications, including among other
things symmetrical keys and asymmetrical key pairs. At this phase, too, the two ends are not yet fully certain about
who the keys are being negotiated with.
3. In the next stage, the certificate is used in a check to ensure that the peer involved in negotiating the key material
really is the intended communication partner:
1
The branch office uses the current negotiation's key material to calculate a checksum (hash value) that can only
be calculated by the two peers involved (branch office and headquarters) and only so long as the connection
exists.
1
The branch office encrypts the hash with its own private key, generating a signature with it.
1
The branch office then transmits this signature together with its own certificate to the peer at headquarters.
738
Reference Manual
11 Virtual Private Networks (VPN)
1
The headquarters then checks the signature of the certificate received from the branch office. This can be done
with the help of the public key at the Root CA, which is identical for both peers. If the signature in the branch
office's certificate (generated with the CA's private key) can be decrypted with the CA's public key, then the
signature is valid and the certificate is trustworthy.
1
In the next stage, the headquarters checks the signature of the encrypted hash. The branch office's public key
in the corresponding certificate was found to be valid at the previous stage. The headquarters can thus check if
the signed hash can be decrypted with the branch office's public key. The headquarters can calculate the same
hash as the branch office using the key material for the current connection. If this check is successful then the
peer "branch office" can be considered as authentic.
11.6.6 Certificates from certificate service providers
Certificates on offer from public certifiers are available in various security classes. The higher security classes require
more effort on behalf of the applicants to demonstrate the authenticity of their identity to the CA. The Trustcenter AG
in Hamburg, for example, uses the following classes:
1
Class 0: These certificates are issued without an identity check and serve only for customer tests.
1
Class 1: For this class, the existence of an e-mail address is the only check. These certificates are useful for private
users wishing to sign their e-mails, for example.
1
Class 2: This level, too, does not involve any personal proof of identity. The submission of an application along with,
for example, a certificate of company registration is sufficient. This level is suitable for communications between
companies that already know each other.
1
Class 3: This level involves a personal check of the person or company. The information in the issued certificates is
compared with a passport or a notarized copy of the certificate of company registration. This level is suitable for
advanced applications such as e-business or online banking.
In your dealings with public certificate service providers, be sure to check in detail the security class or the proof of
identity. This is the only way to be sure that the certificates really do meet with your security requirements.
11.6.7 Establishing a proprietary CA
Referring to public CAs for secure enterprise communications can only be recommended under certain conditions.
1
There is considerable effort involved in the issue of new certificates and this can be slow.
1
The keys in use are transferred via connections which are inadequately secured.
1
Communication is based upon the trust in the CA.
An alternative for company communications is to establish a proprietary CA. Suitable packages are the Microsoft CA on
a Microsoft Windows 2003 server or, as an open source version, OpenSSL. A proprietary CA empowers you to issue and
manage all of the necessary certificates for secure data exchange with complete independence from any external parties.
Companies are recommended to use a proprietary CA rather than public certifiers. There are, however, several important
issues to be considered when planning a CA. For example, even as early as during the installation of a Windows CA, the
validity period for the Root CAs has to be defined and cannot be altered subsequently. Other aspects of planning include:
1
The certificate policy or the level of security that is to be achieved with certificates
1
The available name space
1
Key lengths
1
The duration of certificate validity
1
Managing blocking lists
Precise planning is strongly recommended since corrections at a later date often imply considerable amounts of effort.
11.6.8 Requesting a certificate with Stand-alone Windows CA
5
For operations with a LANCOM, a combination of PKCS#12 file with root certificate, a proprietary device certificate
and the device's public key offer the best services.
739
Reference Manual
11 Virtual Private Networks (VPN)
1. Using your browser, access the start page of the Microsoft Certificate Services.
2. For the certificate type, select 'Advance Certificate Request'.
3. The next step is to selection the option 'Generate and submit a certificate request '.
5
If, and only if, the root certificate is already available as a file, select the option 'BASE64'.
4. In the following step the information for identification is entered.
740
Reference Manual
11 Virtual Private Networks (VPN)
1. In the same dialog, select the certificate template as 'Other...' and then delete the value in 'Object ID'.
741
Reference Manual
11 Virtual Private Networks (VPN)
1. Mark 'Create new key set'. The public and private keys for the current user will now automatically be generated by
the CA.
1. Select the key size according to certificate policy and activate the option to mark keys as exportable.
5
The key is not exported at this point and so a file name does not have to be specified. An export would create
a Microsoft-specific *.pvk file, a format which is unsuitable for use with a LANCOM.
742
Reference Manual
11 Virtual Private Networks (VPN)
2. Finally, select the hash algorithm 'SHA-1' and send your certificate request with a click on Submit.
5
You can check on the status of your certificate request at any time via the Windows CA start page. Certificate
requests can only be viewed from the same computer used to submit the request.
1. The certificate can be installed on your computer once the CA administrator has checked the request and created
the certificate.
5
Certificates can only be installed on the same computer that was used for the request.
11.6.9 Export the certificate to a PKCS#12 file
The installation stores the certificate in your operating system but it is not yet available as a separate file. You will need
this for installation to the LANCOM, though. For access to a certificate in file form, it has to be exported first.
743
Reference Manual
11 Virtual Private Networks (VPN)
Export via the Windows console root
1. Open the Management console with the command mmc at the command line and select the menu item File /
Add/Remove Snap-In.
1. Click on Add... and select 'Certificates'. Confirm with Add, then mark 'My user account' and click on Finish.
2. To export the desired certificate to a file, go to the Management console and click in the group Certificates - current
user / My certificates/ Certificates with the right mouse key and, from the context menu, select All tasks /
Export.
744
Reference Manual
11 Virtual Private Networks (VPN)
1. In the Certificate Export Wizard, activate the option to export the private key. You can optionally delete the private
key from the system after exporting.
5
The option 'Include all certificates in the certification path' must be activated so that the root certificate is also
exported to the PKCS#12 file.
1. You will be requested to enter a password to protect the private key. Ensure that you choose a secure password of
sufficient length (passphrase). You will need this password later to install the certificated in the LANCOM.
5
The term password is synonymous with other terms used in the different environments, e.g. "PIN".
Export via the Control Panel
As an alternative, you can open certificates on your system via the Control Panel.
1. To do this, click on Start / Control Panel / Internet Options, the 'Contents' tab and the button Certificates.
2. Choose the required certificate and click on Export.
5
The actions required in the Certificate Export Wizard that follows are identical to those described under .
745
Reference Manual
11 Virtual Private Networks (VPN)
11.6.10 Create certificates with OpenSSL
OpenSSL is a further possibility for creating proprietary certificates and to test certified connections. OpenSSL is an
OpenSource project available for Linux and Windows at no cost; as a command-line tool, however, it does not offer the
user-friendliness of other CA variants.
5
The configuration file openssl.cnf must be adapted to your specific needs. Further information is available in the
OpenSSL documentation.
Installing OpenSSL
1. Download the current version of OpenSSL from http://www.slproweb.com/products/Win32OpenSSL.html.
2. Install the package and, in the directory ./bin/PEM/demoCA create the following subdirectories:
1
/certs
1
/newcerts
1
/crl.
3. In the file openssl.cnf, change the path in the [CA_default] group to: dir= ./PEM/demoCA
4. OpenSSL is started with a double-click on openssl.exe in the ./bin directory.
Issue a certificate for Root CA
1. Create a key for the CA with the command:
1
genrsa -des3 -out ca.key 2048
5
Remember the password that you enter after the request for the CA key as you will need it again later!
This command creates the file 'ca.key' in the current directory.
2. Create a certificate request for the CA with the command:
1
req -key ca.key -new -subj /CN="Test_CA" -out ca.req
5
You will be requested to enter the password for the CA key here.
This command creates the file 'ca.req' in the current directory.
3. Create a certificate from the certificate request with the command:
1
x509 -req -in ca.req -signkey ca.key -days 365 -out ca.crt
5
Here, too, you will be requested to enter the password for the CA key.
This command signs the certificate request 'ca.req' with the key 'ca.key' and then issues the certificate 'ca.crt'.
Issue certificates for users or devices
1. Create a key for the device or user with the command:
1
genrsa -out device.key 2048
This command creates the file 'device.key' in the current directory.
2. Create a certificate request for the device or user with the command:
1
req -key device.key -new -subj /CN=DEVICE -out device.req
This command creates the file 'device.req' in the current directory.
746
Reference Manual
11 Virtual Private Networks (VPN)
5
Apart from this instruction further changes are necessary in the file "openssl.cnf" for the definition of a
Extension.
3. Create a certificate from the certificate request with the command:
1
x509 -extfile openssl.cnf -req -in device.req -CAkey ca.key -CA ca.crt -CAcreateserial -days 90 -out device.crt
This command signs the certificate request 'device.req' with the key 'ca.key' and then issues the certificate 'device.cert'.
The configuration file openssl.cnf is also involved in the procedure.
4. Export the certificate for the device or user with the command:
1
pkcs12 -export -inkey device.key -in device.crt -certfile ca.crt
-out device.p12
This command combines and saves the key 'device.key', the certificate 'device.crt' and the root certificate 'ca.crt' in
the file 'device.p12'. This PKCS#12 file can be uploaded directly to the required device.
11.6.11 Upload certificates to the LANCOM
The following components must be available in a LANCOM for the establishment of VPN connections that are secured
by certificate.
1
The Root CA's certificate with the CA's public key
1
A certificate for its own device with its own public key and the confirmation of identity. The hash value for this
certificate is signed with the CA's private key.
1
Its own private key
If you have followed the instructions for issuing certificates with a Windows CA and their export, then this information
will now be available in the form of a combined PKCS#12 file. Alternatively you have used a different method and the
individual components are available as separate files.
5
The certificate file can at this time only be uploaded to the devices with WEBconfig. Make sure that you use an
HTTPS connection as the passphrase for the PKCS#12 file is transmitted unencrypted
1. Use WEBconfig to log on to the required device; you will need administrator rights.
2. Select the entry for Upload Certificate or File.
1. Select the components that you wish to upload to the device:
1
Root certificate
1
Device certificate
747
Reference Manual
11 Virtual Private Networks (VPN)
1
Private key for the device
1
PKC#12 file with a combination of root certificate, device certificate and private key
5
The relevant password must be entered depending on the type of file to be uploaded.
The uploaded files can then be viewed in a list under LCOS menu tree / Status / File system / Content .
5
A combined PKCS#12 file is divided up into the necessary components upon upload.
11.6.12 Storing and uploading certificates
Various certificates can be used in a LANCOM for the encryption of certain services. These certificates can be uploaded
to the devices by using LANconfig. Furthermore, the certificates in a device can also be read by LANconfig and stored
to a file.
1. Select the device which you want to upload a certificate into, or from which you want to save a copy.
2. Click on the device with the right mouse key and from the context menu select Configuration management /
Save certificate as file or Upload certificate from file.
1. Select the storage location and the type of certificate to be saved or uploaded and confirm your selections with
Save/Open.
5
By selecting several devices, a certificate file can be uploaded to several devices at once. It is however not possible
to simultaneously save the certificates from multiple devices. Depending on the type of certificate file, a passphrase
may be necessary for uploading.
748
Reference Manual
11 Virtual Private Networks (VPN)
Addition(s) to LCOS 7.80
Enhanced certificate support
In order to support multiple certificate hierarchies, LCOS as of version 7.80 allows up to nine PKCS#12 files to be uploaded
to the device. Also, further files with individual additional CA certificates can be uploaded, which enclose the certificates
either individually or as PKCS#12 containers. All certificate hierarchies can be managed manually or with SCEP, and they
can use CRLs.
LANconfig: Device / Configuration management / Upload certificate from file
WEBconfig: File management / Upload certificate or file
The certificates in the device can be viewed in the status area:
WEBconfig: Status / Status / Certificates / Device certificates
The internal file system for the device classifies the device certificates as applications "VPN-1" to "VPN-9".
To use the certificate, either the certificate subject or this abbreviation can be used as "local identity" in the IKE keys of
type ASN.1-Distinguished Name.
5
Using this abbreviation to reference the certificates allows subjects containing special characters to be used,
such as German umlauts. This is not usually possible when working with the command-line interface configuration.
The abbreviation is entered as "Application" when configuring the certificates for the SCEP client.
749
Reference Manual
11 Virtual Private Networks (VPN)
11.6.13 Set up VPN connections to support certificates
5
VPN connections, which support certificates, can only be set up, if the LANCOM has the correct time. If the device
does not has the actual correct time, the validity of the certificates can not be evaluated. The certificates will be
rejected and no connection will be set up.
Several areas of the configuration have to be changed to set up VPN connections to support certificates.
1
IKE proposals
1
IKE proposal lists
1
IKE key
1
VPN parameters
1
Connection parameters
5
Some of the values may already be available in your device depending on its firmware version. In this case you
just have to check that the values are set correctly.
5
If you are reconfiguring a remote device for certificate support with the method described below, and that device
can only be reached via a VPN tunnel, then it is imperative that you reconfigure the remote device first before
adjusting the connection in the local device. Changing the local configuration first would make the remote device
unattainable!
1. The proposals lists are to be supplemented with two new proposals with the exact description of 'RSA-AES-MD5'
and 'RSA-AES-SHA', both of which use 'AES-CBC' for encryption and 'RSA signature' as the authentication mode,
and which differ only in their hash method (MD5 and SHA1). I
LANconfig: VPN / IKE param. / IKE proposals
WEBconfig: LCOS menu tree / Setup / VPN E Proposals / IKE
750
Reference Manual
11 Virtual Private Networks (VPN)
1. A new list will be required in the proposals lists with the exact name 'IKE_RSA_SIG' which contains the two new
proposals 'RSA-AES-MD5' and 'RSA-AES-SHA'.
LANconfig: VPN / IKE param. / IKE proposal lists
WEBconfig: LCOS menu tree / Setup / VPN E Proposals / IKE proposal lists
1. In the list of IKE keys, all certificate connections must be set up with the corresponding identities.
LANconfig: VPN / IKE-Param. / IKE key
WEBconfig: LCOS menu tree / Setup / VPN / Proposals / IKE-Keys
1
Once it is no longer required, the preshared key can be deleted.
2
The type of the identities is reset to ASN.1 Distinguished Names (local and remote).
2
The identities are entered exactly as they stand in the certificates. The individual values such as 'CN', 'O' or 'OU'
can be separated by commas or slashes.
All of the values entered in the certificates must be listed in the same order. If necessary, check the certificate contents
by using the Control Panel. To do this, click on Start / Control Panel / Internet Options, the 'Contents' tab and
the button Certificates.
751
Reference Manual
11 Virtual Private Networks (VPN)
Open the certificate and use the 'Details' tab to select the corresponding value. For the applicant you will find, for
example, the necessary ASN.1 Distinguished Names and their abbreviations here. The values listed from top to bottom
in the certificates must be entered into the IKE key from left to right. Observe the use of upper and lower case!
5
Special characters in the ASN.1 Distinguished Names can be entered by typing in the hexadecimal ASCII
codes after a leading backslash. For example, "\61" corresponds to a small "a".
5
The display of certificates under Microsoft Windows shows for some values older short forms, for instance
'S' instead of 'ST' for 'stateOrPrivinceName' or 'G' instead of 'GN' for 'givenName'. Only use the new short
forms 'ST' and 'GN'.
1
In the IKE connection parameters, the default IKE proposal lists for incoming aggressive-mode and main-mode
connections must be set to the proposal list 'IKE_RSA_SIG'. Also observe the settings in the default IKE group which
are adjusted in the following step as necessary.
1. LANconfig: VPN / Parameter
WEBconfig: LCOS menu tree / Setup / VPN
752
Reference Manual
11 Virtual Private Networks (VPN)
2. Finally, the VPN connection parameters must be set up to use the correct IKE proposals ('IKE_RSA_SIG'). The values
for 'PFS group' and 'IKE group' must agree with the values set in the IKE connection parameters. Configuration with
LANconfig
LANconfig: VPN / General / Connection parameters
WEBconfig: LCOS menu tree / Setup / VPN E VPN layers
Addition(s) to LCOS 7.80
Wildcard matching of certificates
Introduction
Generally speaking, the local identity and remote identity for certificate-based VPN connections are the certificate subjects.
In the VPN configuration, these are stored in the form of (often complex) ASN.1 Distinguished Names (DN). During VPN
negotiation, the local identity is used to select the certificate which is to be transmitted to the remote station, whereas
the local value for the remote identity is compared with the received identity of the remote station and the subject of
the received certificate.
Until now, the local and the remote identities had to be entered in full into the VPN configuration. Not only is this prone
to error, it is sometimes desirable to specify only a part of the certificate subject. This is practical where different certificates
with similar subjects are to be accepted automatically, for example where certificates can change, or where multiple
parallel certificate hierarchies operate simultaneously.
This is facilitated by flexible identity comparison. The certificate subjects have to contain the components of an ASN.1
Distinguished Name (DN) (Relative Distinguished Names – RDNs) as included in the configured identities. The RDNs can
be in any order. Also, the RDN values can include the wildcards '?' and '*'. If the RDNs are to include wildcards, these
must be entered in the form '\?' or '\*'. Examples:
1
Subject = '/CN=John Doe/O=*ACME*', DN = '/CN=John?Doe*'
1
Subject = '/CN=John Doe/O=*ACME*', DN = '/O=\*ACME\*'
Configuration
This flexible method of identification comparison is activated or deactivated in the VPN configuration.
WEBconfig: LCOS menu tree / Setup / VPN
1
Flexible ID comparison
Possible values:
2
Yes, No
753
Reference Manual
11 Virtual Private Networks (VPN)
Default:
2
No
Flexible identity comparison is used when checking the (received) remote identity and also for selecting the certificate
based on the local identity.
11.6.14 Set up certificate-based VPN connections with the Setup Wizard
LANconfig is equipped with Setup Wizards with which you can set up certificate-based LAN coupling or RAS access via
VPN.
5
VPN connections that support certificates can only be set up if the LANCOM is programmed with the correct
time and if the corresponding certificates are loaded into the device.
LAN coupling
1. Choose the Wizard that connects two local area networks over VPN. In the appropriate dialog, select VPN connection
authentication with certificates (RSA signature).
2. Enter the identities contained in the certificates for the local and remote devices. Be sure to use the information from
each certificate in full and in the right order: The ASN.1-Distinguished Names listed in Windows from top to bottom
in the certificates must be entered into LANconfig from left to right.
5
Microsoft Windows displays some values in the certificates with outdated abbreviations, such as 'S' instead of
'ST' for 'stateOrProvinceName', or 'G' instead of 'GN' for 'givenName'. In these cases make sure that you use
the current abbreviations 'ST' and 'GN'.
5
The Telnet command show vpn cert displays the content of the device certificate in a LANCOM, including
the entered Distinguished Names (DN) under "Subject". The Distinguished Names are displayed in reverse order
here until LCOS 6.00 and in the usual order as of LCOS 6.10!
1. If available choose the optimized connection establishment with IKE and PFS group 2. Only choose group 5 for IKE
and PFS if this is required by the remote device. This will be the case if, for example, the VPN remote device is
configured with LANconfig 3.52 or earlier.
2. Enter the names of the VPN remote site, the IP address, the netmask for the remote network and, if applicable, the
domain for the DNS forwarding. If required, activate the "Extranet" function and the "NetBIOS routing".
754
Reference Manual
11 Virtual Private Networks (VPN)
RAS connections
RAS connections that support certificates can be set up for the LANCOM Advanced VPN Client or for any other VPN client
with user-defined parameters. The LANCOM Standard VPN Client does not support certificates.
5
Various parameters are requested depending on the choice of client or the options. This description shows all
of the possible Wizard dialogs, some of which may not necessarily be relevant for your application.
1. Choose the Wizard that provides remote access over VPN. In the appropriate dialog, select VPN connection
authentication with certificates (RSA signature). The default "Exchange Mode" is the Main Mode.
1. The configuration normally presents standard IKE parameters for incoming main mode connections in the standard
IKE proposal list 'IKE_RSA_SIG'. If possible use the list of prepared IKE parameters.
2. If you wish to use different parameters for incoming main mode connections, you can adapt the standard IKE
parameters to fit your requirements. You can either create a new list 'WIZ-IKE-MAIN-MODE' or you can select one
of the existing IKE proposal lists as the new "Standard IKE proposal list". The list defined here will be used for all
incoming main mode connections in the future. For a new IKE proposal list, you can select the encryption and
authentication methods that are to be used by the client during the IKE negotiation.
755
Reference Manual
11 Virtual Private Networks (VPN)
1. Enter the identities contained in the certificates for the local and remote devices. Be sure to use the information from
each certificate in full and in the right order: The ASN.1-Distinguished Names listed in Windows from top to bottom
in the certificates must be entered into LANconfig from left to right.
5
Microsoft Windows displays some values in the certificates with outdated abbreviations, such as 'S' instead of
'ST' for 'stateOrProvinceName', or 'G' instead of 'GN' for 'givenName'. In these cases make sure that you use
the current abbreviations 'ST' and 'GN'.
5
The Telnet command show vpn cert displays the content of the device certificate in a LANCOM, including
the entered Distinguished Names (DN) under "Subject". The Distinguished Names are displayed in reverse order
here until LCOS 6.00 and in the usual order as of LCOS 6.10!
1. If available choose the optimized connection establishment with IKE and PFS group 2. Only choose group 5 as the
PFS group if this is required by the client.
756
Reference Manual
11 Virtual Private Networks (VPN)
1. The following dialogs define the encryption and authentication methods, the authentication header and the data
compression that the client will use for the transfer of the payload data with IPSec. Use the preset values as much
as possible as long as the client does not demand different settings.
1. Enter the IP address of the client and for the address range that is to be accessible in the local network. If required,
activate "NetBIOS routing".
11.6.15 Set up LANCOM Advanced VPN Client for certificate connections
To use the LANCOM Advanced VPN Client to dial-in to a LANCOM router, the appropriate profile settings must be adjusted
to allow for the use of certificates.
1. In the IPSec General Settings for the profile, set the IKE policy to 'RSA signature'.
1. Switch the identity to 'ASN1 Distinguished Names'. The 'identity' can remain blank since this information is taken
from the certificate.
757
Reference Manual
11 Virtual Private Networks (VPN)
1. For the IP address assignment use the 'IKE Config Mode'.
1. For the Certificate Check you can optionally place a limitation on the certificates accepted by the LANCOM Advanced
VPN Client. To do this, you define the user and/or the issuer of the incoming certificate and, if applicable, the
associated "fingerprint".
1. After storing the adapted connection profile, click on the menu item Configuration / Certificates to open the
settings for the User Certificate.
1
Select the certificate type 'from PKCS#12 file' and set the required certificate file .
2
To work with various certificates, activate the option 'Certificate Selection' and enter the path for the folder
where the certificate files are stored .
758
Reference Manual
11 Virtual Private Networks (VPN)
2
Define whether or not the PIN (password) has to be entered before connection establishment . Alternatively, you
can save the PIN in the LANCOM Advanced VPN Client under the menu item Connection / Enter PIN .
2
If Certificate Selection is activated, the certificate corresponding to the connection can be chosen from a list
displayed in the main window of the LANCOM Advanced VPN Client, as befits the selected profile.
11.6.16 Simplified RAS with certificates
When dialling in, the identity of computers that use varying IP addresses is unknown at the initial stages of the IKE
negotiation (Phase 1), so communication is facilitated by using default values for IKE proposal lists and IKE proposal
groups. During negotiation, the identity is communicated and this is used to determine the parameters for phase 2 (IPSec
proposal list and PFS group). For this to occur, every single user must be entered individually into the VPN router
configuration.
With certificate-based RAS, the identity is communicated via the certificate. To avoid having to make individual user
entries in the router configuration, common parameters for phase 2 can be defined for all users who are identified by
certificate. All the user requires for simplified RAS is a valid certificate with a signature from the publisher of the root
certificate in the device. Furthermore, the parameters used by the client during dial-in must agree with the default values
in the VPN router.
5
Information about configuring the VPN client is available in the relevant documentation from the software
manufacturer.
759
Reference Manual
11 Virtual Private Networks (VPN)
This function has to be activated to configure the simplified dial-in. The default parameters can be altered according to
requirements.
LANconfig: VPN / General and VPN / General / Defaults
WEBconfig: LCOS menu tree / Setup / VPN
5
By activating the simplified RAS with certificates, all clients that have a valid certificate signed by the publisher
of the device's root certificate can dial in to the corresponding network. No further configuration of the router
is necessary! Unwanted dial-ins are then prevented exclusively by using a CRL and blocking the certificates there.
11.6.17 Simplified network connection with certificates – proadaptive VPN
In cases where large network infrastructures are coupled via VPN, it is advantageous for the costs and effort in configuring
a new subnetwork to be limited to the local VPN router and that the central dial-in router configuration remains unchanged.
In order to achieve this simplified network connection, the dial-in devices transmit their identity with the help of a digital
certificate.
If simplified dial-in with certificates is activated for the LANCOM Router at the headquarters, then the remote routers
can suggest a network to be used for the connection during the IKE negotiation in phase 2 This network is entered, for
example, when setting up the VPN connection on the remote router. The LANCOM Router at the headquarters accepts
the suggested network when the option 'Allow remote station to select the remote network' is activated. Moreover, the
parameters used by the client during dial in must agree with the default values in the VPN router.
760
Reference Manual
11 Virtual Private Networks (VPN)
5
When configuring the dial-in remote stations, be sure to note that each remote station requests a specific network
so that no network address conflicts arise.
LANconfig: VPN / General and VPN / General / Defaults
WEBconfig: LCOS menu tree / Setup / VPN
5
By activating the simplified RAS dial in, all remote routers that have a valid certificate signed by the publisher
of the device's root certificate can dial in to the corresponding network. No further configuration of the router
is necessary! Unwanted dial-in connections are then prevented exclusively by blocking the certificates and using
a CRL. The simplified connection of networks with certificates is therefore limited to LANCOM Router models
that support certificate revocation lists (CRL).
11.6.18 Request certificates using CERTREQ
During IPSec negotiations authenticated with the use of RSA signatures, some VPN gateways expect the remote station
to request the certificates to be exchanged via a "certificate request" (CERTREQ). Among other things, this allows the
gateway to select the certificate to be used providing that the gateway trusts more than one CA.
In order to establish a connection to these VPN gateways, the LANCOM VPN Router sends a corresponding CERTREQ
when the connection is initiated. This is received by the publisher of the root certificate stored in the LANCOM.
11.6.19 Certificate revocation list - CRL
Certificates for VPN connections have a validity period by a start date and an end date. During this period, the certificate
can be used to establish a VPN connection. Should an employee leave the company, then it should be possible for
certificates, for example that were used for mobile VPN access, to be declared as invalid. This prevents continued access
to the company network and does not require any changes to the VPN router configuration.
The certificate is physically located with the ex-employee and cannot be changed, which is why a certificate revocation
list is of use. Certificates which are no longer valid are entered into the CRL, which are supported by Microsoft CA and
OpenSSL, for example. The CRL is available from a suitable server. The URL to be used by a router to download the CRL
761
Reference Manual
11 Virtual Private Networks (VPN)
into its own memory is entered into the root certificate of the VPN router and/or into the configuration of the device
itself.
The CRL is renewed by the CA on a regular basis, enabling changes in the CRL, such as withdrawn certificates, to be
recognized by the VPN routers in good time. During the setup at the CA, a schedule is defined for the regular updating
of the CRL. After an update to the CRL and its storage to the server (manual or automatic), the VPN router then has to
update its infomation, too. To do this, the router reads out the validity period of the CRL and, briefly before expiry,
attempts to load a current version. Alternatively, a regular update which depends on the validity period of the CRL can
be set in the LANCOM.
When a connection is being established, the VPN router checks if the remote station's certificate is in the current CRL.
Connections to remote stations without a valid certificate are rejected.
Configuring the CRL function
Configuration of the CRL function involves the definition of the path to the CRL and additional parameters such as the
update interval.
LANconfig: VPN / IKE Auth.
WEBconfig: LCOS menu tree / Setup / VPN / Certificates-and-Keys / CRLs
1
CRL function [Default: Off]
2
Enabled: During the certificate check, the CRL (if available) will be considered as well.
5
If this option is activated but no valid CRL is available (e.g. if the server can't be reached), then all connections
will be rejected and existing connections will be interrupted.
1
Use alternative URL [Default: No
2
No: Only the URL defined in the root certificate is to be used.
2
Yes, always: The alternative URL will always be used even if a URL is entered into the root certificate.
2
Yes, alternative: The alternative URL will only be used if there is no URL entered into the root certificate.
762
Reference Manual
11 Virtual Private Networks (VPN)
1
Alternative URL
2
This is an alternative URL which can be used to retrieve a CRL.
1
Single prefetch [Default: 300 seconds]
2
The point in time prior to expiry of the CRL when the new CRL can be loaded. This value is increased by a random
value to prevent server overload from multiple simultaneous queries. Once within this time frame, any coinciding
regular planned updates will be stopped.
5
If the first attempt to load the CRL fails, new attempts are made at regular short intervals.
1
Continous prefetch [Default: 0 seconds]
2
The time period after which periodic attempts are made to retreive a new CRL. Useful for the early retreival of
CRLs published at irregular intervals. The entry '0' disables regular retreival.
5
If with regular updates the CRL cannot be retreived, no further attempts will be started until the next regular
attempt.
1
Validity tolerance
2
Even after expiry of the CRL, certificate-based connections will continue to be accepted for the period defined
here. This tolerance period can prevent the unintentional rejection or interruption of connections if the CRL server
should be temporarily unavailable.
5
Within the time period defined here, even certificates in the CRL which have expired can still be used to
maintain or establish a connection.
CRL status display in LANmonitor
Information about the validity period and the publisher of the current CRL in the LANCOM can be inspected in LANmonitor.
11.6.20 Diagnosis of VPN certificate connections
If the VPN connection establishment does not work as desired, then entering the following commands at the LANCOM
console can provide useful information.
1
trace + vpn-status
Displays a trace of the current VPN connections.
1
show vpn long
Displays the contents of the VPN configuration, including the entered Distinguished Names (DN).
1
show vpn ca
Displays the content of the root certificate.
1
show vpn cert
Displays the content of the device certificate.
5
The Distinguished Names are displayed in reverse order here until LCOS 6.00 and in the usual order as of
LCOS 6.10!
763
Reference Manual
11 Virtual Private Networks (VPN)
11.6.21 Addition(s) to LCOS 8.00
Alternative URLs for CRLs
Introduction
The address from where a Certificate Revocation List (CRL) can be retrieved is usually included in the certificates (as
crlDistributionPoint). LCOS provides a table for alternative URLs. After the system boot the corresponding CRLs are
automatically loaded from these URLs and used in addition to the lists mentioned in the certificates.
Configuration
The table for alternative URLs can be found in the following menus:
LANconfig: Certificates / SCRL-Client / Alternative URLs
WEBconfig: LCOS menu tree / Setup / Certificates / CRLs / Alternative-URL-Table
1
Alternative-URL
Geben Sie hier die URL an, von der eine CRL abgeholt werden kann.
2
Possible Values:
Valid URL, max. 251 characters.
2
Default:
Empty
11.6.22 Addition(s) to LCOS 8.50
OCSP client for certificate validation
Introduction
The Online Certificate Status Protocol (OCSP) provides a way to verify the status of certificates, for example when
establishing VPN connections. The devices use this protocol to investigate whether the issuer has revoked the certificate
before its expiry, so marking it as invalid.
Certificate issuers update the status of all issued certificates on a special server, the OCSP responder. The OCSP client
(e.g. a VPN router that wants to establish a connection) uses the HTTP protocol to send an OCSP request to the responder
to verify the certificate. The responder answers with a signed response, which the OCSP client uses to verify its validity.
The message from the OCSP responder describes one of the following conditions:
1
Good: The verified certificate has not been revoked.
1
Revoked: The verified certificate has been revoked and may not be used to establish VPN connections.
1
Unknown: The OCSP responder cannot determine the status of the certificate. This may be because the OCSP responder
does not recognize the certificate issuer because the certificate has been faked and therefore has not been entered
into the database of the OCSP responder.
You can use the OCSP to complement or substitute certificate verification by certificate revocation lists (CRL). OCSP offers
the following advantages when compared to CRLs:
1
The issuers generate the CRLs at specific time intervals and, in the ideal case, distribute the CRLs to the devices which
use the certificates for establishing VPN connections. The reliability of this check thus depends on the speed with
which CRLs in the devices are updated. However, certificate verification through an OCSP responder is always "online",
i.e. it is automatically updated. The operator of the OCSP responder can automatically synchronize their data with
that of the CA or CAs, thus ensuring that they are up to date at all times.
764
Reference Manual
11 Virtual Private Networks (VPN)
1
Using certificate revocation lists for certificate verification takes up a considerable amount of device memory, especially
if the CRLs are large. Querying certificate status from an OCSP responder, on the other hand, is independent of the
number of CAs and certificates being used, and is therefore more scalable.
1
As the CRL method does not allow for unknown certificates, this method cannot detect fake certificates. The OCSP
responder, depending on its configuration, responds to a request about an unknown certificate with a negative
evaluation.
Additions to the menu system
Responder profile table
This table contains information on the Certificate Authorities (CAs), whose certificates are evaluated by the OCSP client
by sending a request to an OCSP responder.
Telnet path: /Setup/Certificates/OCSP-Client
Profile name
Enter here the name of an OCSP-responder profile to be referenced by the OCSP client in the CA profile table.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Maximum 32 alphanumerical characters
Default: Blank
URL
Enter the URL for the OCSP client to access the OCSP responder.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Valid URL with a maximum of 251 alphanumeric characters
Default: Blank
CA profile table
This table contains information on the Certificate Authorities (CAs), whose certificates are evaluated by the OCSP client
by sending a request to an OCSP responder.
Telnet path: /Setup/Certificates/OCSP-Client
Profile name
Enter here the name of a CA profile to be used by the OCSP client for a particular CA.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Maximum 32 alphanumerical characters
Default: Blank
CA distinguished name
Enter the distinguished name of the CA, whose certificates are evaluated by the OCSP client with this profile name.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
765
Reference Manual
11 Virtual Private Networks (VPN)
1
Maximum 251 alphanumerical characters
Default: Blank
Prefer AIA
Certificates used for establishing VPN connections optionally include the URL of the relevant OCSP responder in the field
Authority Info Access (AIA). This item defines whether the OCSP client prefers to use the URL from this entry in the CA
profile table or the URL from the AIA field, if available.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
No: The OCSP client always uses the URL from this CA-profile table entry and ignores the URL in the AIA field.
1
Yes: The OCSP client uses the URL from the AIA field (if specified) and ignores the URL from this CA profile table
entry.
Default: No
Responder profile name
This item selects the responder profile used by the OCSP client to evaluate certificates from this CA.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Select from the list of profile names in the table
2.39.6.2 Responder profile table
, maximum 32 alphanumeric
characters.
Default: Blank
5
If the field for the responder profile name is left empty, the machine evaluates the certificates from the CA defined
here not with OCSP, but with the help of a CRL.
Source interface
This is where you can configure an optional sender address to be used instead of the one otherwise automatically selected
for the destination address.
If you have configured loopback addresses, you can specify them here as sender address.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Name of the IP networks whose address should be used
1
"INT" for the address of the first intranet
1
"DMZ" for the address of the first DMZ
1
LB0 to LBF for the 16 loopback addresses
1
Any valid IP address
Default: 00.0.0
5
If the list of IP networks or loopback addresses contains an entry named 'DMZ' then the associated IP address
will be used. Name of a loopback address.
Certificate evaluation
This item defines how the device behaves if certificate evaluation fails. During connection establishment, the OCSP client
first queries the OCSP responder about the validity of the certificate.If the certificate is about to expire, the OCSP client
automatically repeats the query about the validity before the certificate expires.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
766
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
1
Strict: The device will block connection establishment if the OCSP responder answers requests for the certificate used
during connection establishment in one of the following ways:
2
The OSCP responder does not answer
2
The OSCP responder responds that the certificate is unknown
2
The OSCP responder recognizes the certificate and marks it as revoked
1
Loose: The device will block connection establishment if the OCSP responder answers requests for the certificate
used during connection establishment in one of the following ways:
2
The OSCP responder does not answer
2
The OSCP responder responds that the certificate is unknown
Default: Strict
5
If necessary, you can log and review the results of certificate evaluation by the OCSP responder with SYSLOG,
SNMP traps and relevant traces.
Syslog events
The OCSP client can optionally generate SYSLOG messages with information on the results of certificate checks by the
OCSP responder.
Telnet path: /Setup/Certificates/OCSP-Client/Ca-Profile-Table
Possible values:
1
Yes: The OCSP client generates SYSLOG messages
1
No: The OCSP client does not generate SYSLOG messages
Default: Yes
11.7 Multi-level certificates for SSL/TLS
New with LCOS 7.6:
1
Multi-level certificates for SSL/TLS
11.7.1 Introduction
Larger or geographically dispersed organizations often make use of multi-level certificate hierarchies that rely on one or
more intermediate CAs to issue certificates. The interim CAs themselves are certified by the Root CA.
CA
Root CA
CA
America
User 01 User 02 User 03 User 04
To authenticate final certificates, it must be possible to check the entire certificate hierarchy.
767
Reference Manual
11 Virtual Private Networks (VPN)
11.7.2 SSL/TLS with multi-level certificates
For applications based on SSL/TLS (e. g. EAP/802.1x, HTTPS or RADSEC), the SSL (server) certificate together with the
private key and intermediate level CA certificate(s) are loaded into the device as a PKCS#12 container.
The remote devices establishing a connection only have to send their own device certificates to the LANCOM. The
certificate chain is checked for validity in the LANCOM.
11.7.3 VPN with multi-level certificates
For the certificate-based establishment of VPN connections, the following are stored to the file system in the LANCOM:
A private key, a device certificate, and the CA certificate. With single-layer certificate solutions this can be handled with
the individual files or with a PKCS#12 file. After uploading and entering the password, a container is separated into the
three components indicated above.
In the case of a multi-level certificate hierarchy, however, a PKCS#12 container has to be used that includes the CA
certificates from all levels in the certificate chain. After uploading and entering the password, the private key, the device
certificate and the certificate from the next CA "above" the LANCOM are unpacked—the other certificates remain in the
PKCS#12 container. The unpacked certificates and the certificates from the container are imported when the VPN
configuration is updated. A remote station establishing a VPN connection transfers its own device certificate only and
not the entire chain. The LANCOM then checks this certificate against the hierarchy available to it.
5
The certificate structures in the two stations must match to one another, i.e. the hierarchy in the VPN device
making the request should not demand certificates that are not included in the other VPN device's hierarchy.
11.8 Certificate enrollment via SCEP
An increasing number of certificate-based VPN connections are being used to provide secure communications via public
networks. The high levels of security provided by certificates comes at the price of significantly higher levels of effort in
the administration and distribution of certificates. Most of this effort arises at branch offices or home offices within a
geographically dispersed network structure.
A LANCOM VPN Router router requires the following components to establish a certificate-based VPN connection from
a remote site to network at headquarters:
1
The Root CA's certificate with the CA's public key. The headquarters also requires a certificate issued by the same
CA.
1
The device's own certificate with its own public key. This certificate is signed with the CA's private key and serves
identity confirmation.
1
Own private key.
5
The current version of LCOS supports only a public key infrastructure (PKI) with a root CA.
In the case of a conventionally structured VPN with certificates, the keys and certificates have to be loaded into each
device manually and exchanged before they expire. The Simple Certificate Enrollment Protocol (SCEP) enables a secure
and automatic distribution of certificates via a suitable server, so reducing the effort of roll-out and maintaining
certificate-based network structures. There is no need for the key pair for the device to be generated by an external
application and subsequently transferred to the device. Instead, the key pair is generated directly by the LANCOM VPN
Router itself; the private portion of the key never has to leave the device, which results in a significant gain in security.
A LANCOM VPN Router can automatically retrieve the CA root certificate and its own certificate from a central location.
11.8.1 SCEP server and SCEP client
Provisioning and administration of the certificates is handled by an SCEP server that fulfills the usual function of a
Certificate Authority (CA) as well as the SCEP functions. This server can, for example, be implemented as a Windows
768
Reference Manual
11 Virtual Private Networks (VPN)
2003 Server CA by using a special plug-in (mscep.dll). There are also a number of other CA solutions which work with
SCEP, such as the OpenSource solution OpenCA (www.openca.org).
The SCEP extension such as with mscep.dll creates an additional instance on the server and processes requests from
SCEP clients for forwarding to the actual CA. This instance is referred to as the Registration Authority (RA).
The VPN devices (i.e. the LANCOM VPN Router) are SCEP clients that attempt to automatically retrieve the necessary
certificates from the central server. Also generally required by the SCEP procedure are the RA (Registration Authority)
certificates as signed by the CA. For VPN operations the LANCOM VPN Routers mainly require valid system certificates
(device certificates). Any other certificates which may be in use only apply to the SCEP procedure.
11.8.2 Distributing certificates
In brief, the procedure for distributing certificates via SCEP is as follows:
A
B
C
G
E
D
F
H
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Branch office
pair key
Root CA
certificate
Certificate
request
Device
certificate
Device
certificate
Device
certificate
Certificate
request
Root CA
certificate
Headquarter
certificate
Headquarter
private key
1. Generate key pair in the LANCOM VPN Router.
A key pair is generated in the LANCOM VPN Router. The public part of this key pair is later sent together with the
request to the SCEP server. The private key remains in the SCEP client (LANCOM VPN Router). The fact that the private
key never has to leave the device is a major security gain over manual certificate distribution, for example with
PKCS#12 containers.
2. Retrieve CA and RA certificates.
For communication with the RA/CA, the appropriate RA and CA certificates must be available in the LANCOM VPN
Router. To ensure that CA certificates retrieved via SCEP do genuinely originate from the CA, an automated check
can be carried out with the use of a fingerprint which is defined in advance. SCEP itself has no mechanism for clients
to conduct automated authentication of CA certificates. If the administrator of the LANCOM VPN Router does not
have direct access to the CA then the fingerprint can be checked manually, for example with a telephone call to the
CA admin.
3. Generate and encrypt the request for a device certificate.
To place a request for a system or device certificate, the SCEP client collects all of the configured information such
as the identity of the requester device and, if applicable, the "challenge phrase" or password for automatic request
processing by the SCEP server. This request is signed with the private key.
4. Send the request to the SCEP.
The SCEP client then sends the request along with its public key to the SCEP server.
5. Check the certificate request on the SCEP server and issue the device certificate.
The SCEP server can decrypt the request and subsequently issues a system or device certificate to the requester. SCEP
has two different methods for request processing:
769
Reference Manual
11 Virtual Private Networks (VPN)
1
Automatic processing requires the requester's authenticity to be assured by means of the challenge phrase. The
challenge phrase can, for example, be generated automatically by a Windows CA server using mscep.dll. The
phrase is valid for one hour. If the challenge phrase submitted with the certificate request agrees with the valid
value, the system certificate is issued automatically.
1
For manual processing, the SCEP server puts the certificate request "on hold" until the acceptance or rejection
has been received from the CA administrator. While waiting, the SCEP client regularly checks with the SCEP server
to see if the certificate has been issued yet.
6. Retrieve device certificate from the SCEP server
Once the certificate has been issued, the client's regular polling informs it that the certificate is ready for retrieval.
7. Check the device certificate and present it for VPN operation
11.8.3 Configuring SCEP
To configure SCEP, global parameters are defined for SCEP operations and for the CAs where the device certificates are
to be retrieved.
5
In addition to the configuration of the SCEP parameters, it may be necessary to adapt the VPN configurations.
WEBconfig: LCOS menu tree / Setup / VPN / Certificates-and-Keys / SCEP
Global SCEP parameters
1
Active
Switches SCEP on or off.
2
Values: Yes, No
2
Default: No
1
Retry-After-Error-Interval
Interval in seconds between retries after errors of any type.
2
Default: 22
1
Check-Pending-Requests-Interval
Interval in seconds for checks on outstanding certificate requests.
2
Default: 101
1
Device-Certificate-Update-Before
Preparation time in days for the timely request for new system certificates (device certificates).
2
Default: 2
1
CA-Certificate-Update-Before
Preparation time in days for the timely retrieval of new RA/CA certificates.
2
Default: 1
Actions
1
Reinit
Starts the manual reinitialization of the SCEP parameters. As with the standard SCEP initialization, the necessary RA
and CA certificates are retrieved from the CA and stored within the LANCOM Router's file system so that they are
not yet ready for use in VPN operations.
770
Reference Manual
11 Virtual Private Networks (VPN)
2
If the available system certificate fits to the retrieved CA certificate, then the system certificate, CA certificate and
the device's private key can be used for VPN operations.
2
If the existing system certificates do not fit to the retrieved CA certificate, then the next step is for the SCEP server
to submit a new certificate request. Only once a new system certificate that fits to the retrieved CA certificate
has been issued and retrieved can the system certificate, CA certificate and the device's private key can be used
for VPN operations.
1
Update
Manually triggers a request for a new system certificate, irrespective of the remaining period of validity. A new key
pair is generated at the same time.
1
Clear-SCEP-Filesystem
Starts a clean-up of the SCEP file system.
2
Deleted are: RA certificates, pending certificate requests, new and inactive CA certificates, new and inactive
private keys.
2
Retained are: System certificates currently in use for VPN operations, associated private keys, and the CA certificates
currently in use for VPN operations.
Configuring the CAs
1
Name
Configuration name of the CA.
1
URL
The CA's URL.
1
DN
Distinguished name of the device. With this parameter the CAs are assigned to system certificates (and vice versa)
on the one hand. On the other hand this parameter is also important for evaluating whether received or available
certificates match with the configuration.
1
Enc-Alg
This algorithm encrypts the payload of the certificate request.
2
Values: DES, 3-DES, Blowfish.
2
Default: DES.
1
Identifier
CA identifier (as required by some web server to identify the CA).
1
RA-Autoapprove
Some CAs provide the option of using an earlier certificate issued by this CA as proof of authenticity for future
requests. This option defines whether an existing system certificate should be used to sign new requests.
2
Values: Yes, No.
2
Default: No.
1
CA-Signature-Algorithm
The certificate request is signed with this algorithm.
2
Values: MD5, SHA1.
2
Default: MD5.
1
CA-Fingerprint-Algorithm
771
Reference Manual
11 Virtual Private Networks (VPN)
Algorithm for signing the fingerprint. This determines whether the CA certificate is to be checked by means of
fingerprint, and which algorithm is used for this. The CA fingerprint has to agree with the checksum which results
when this algorithm is applied.
2
Values: Off, MD5, SHA1.
2
Default: Off.
1
CA-Fingerprint
The authenticity of a received CA certificate can be checked by means of the the checksum (fingerprint) entered here
(corresponding to the set CA fingerprint algorithm).
Configuring the system certificates
1
Name
The certificate's configuration name.
1
CADN
Distinguished name of the CA. With this parameter the CAs are assigned to system certificates (and vice versa) on
the one hand. On the other hand this parameter is also important for evaluating whether received or available
certificates match with the configuration.
1
Subject
Distinguished name of the subject of the requester.
1
ChallengePwd
Password (for the automatic issue of device certificates on the SCEP server).
1
SubjectAltName
Further information about the requester, e.g. domain or IP address.
1
KeyUsage
Any comma-separated combination of:
2
digitalSignature
2
nonRepudiation
2
keyEncipherment
2
dataEncipherment
2
keyAgreement
2
keyCertSign
2
cRLSign
2
encipherOnly
2
decipherOnly
2
critical (possible but not recommended)
1
Extended Key Usage
Any comma-separated combination of:
2
critical
2
serverAuth
2
clientAuth
2
codeSigning
2
emailProtection
2
timeStamping
2
msCodeInd
2
msCodeCom
772
Reference Manual
11 Virtual Private Networks (VPN)
2
msCTLSign
2
msSGC
2
msEFS
2
nsSGC
2
1.3.6.1.5.5.7.3.18 für WLAN-Controller
2
1.3.6.1.5.5.7.3.19 für Access Points im Managed-Modus
1
Device-Certificate-Keylength
The length of the key to be generated for the device itself.
1
Application
Shows the application of the registered certificates. It will be asked for the registered certificates only for the
corresponding application.
11.9 NAT Traversal (NAT-T)
The insufficient number of publicly valid IP addresses has lead to the development of procedures such as IP masquerading
or NAT (Network Address Translation), where a whole local network is masked by a single, publicly valid IP address. In
this way, all clients in a LAN use the same IP address to exchange data with public networks such as the Internet. The
assignment of the incoming and outgoing data packets to the different participants in the network is ensured by connecting
the internal IP addresses to corresponding port numbers.
This process has proven its worth in the last few years and has since become the standard in almost all Internet routers.
However, new difficulties arise when the hidden data packets are processed using VPN. As data connections over VPN
are highly secured, mechanisms such as authentication and encryption are of great importance here.
Converting internal IP addresses to the gateway's central, publicly valid IP address and converting source and target
ports can lead to problems in many applications, for example where the UDP port 500 that is usually used during the
IKE negotiation has been changed and the IKE can no longer be successfully completed as a result. The address change
using NAT is therefore assessed by a VPN gateway as a security-critical data packet change, the VPN negotiation fails
and no connection is made. In fact these problems occur, for example, when you dial in using some UMTS mobile
telephone networks where the network operator's servers do not support the address conversion in combination with
IPSec-based VPNs.
So you can successfully create a VPN connection even in such cases, NAT-T (NAT Traversal) provides a process that can
overcome the problems described when handling data packets with changed addresses.
5
NAT-T can only be used with VPN connections that use ESP (Encapsulating Security Payload) for authentication.
Unlike AH (Authentication Header), ESP does not consider the IP header of the data packets when determining
the hash value for authentication. The hash value calculated by the receiver is therefore also equivalent to the
hash value entered in the packets.
If the VPN uses AH for authentication, then in principle no connection can be established over sections with Network
Access Translation, as the AH hash values similarly change when the IP addresses change, and the recipient would
classify the data packets as untrustworthy.
The NAT Traversal process eliminates the problems that occur when establishing a VPN connection at the end points of
the VPN tunnel. The following scenarios can be distinguished from one another:
773
Reference Manual
11 Virtual Private Networks (VPN)
1
A member of the field staff uses a LANCOM Advanced VPN Client to dial into the company VPN router without "VPN
pass-through" support (i.e. IPSec masking) but with Network Address Translation.
HEADQUARTERS
VPN Gateway
LAN
Router
INTERNET
LAPTO P
LANCOM Advanced VPN Client
with NAT-T
Router with VPN pass-through
with NAT
VPN Router
with NAT-T
A B
C
1
Both tunnel end points LANCOM Advanced VPN Client and VPN router support NAT-T and can therefore also
establish a VPN connection through the intermediary router.
2
Router as a NAT device between the VPN end points performs straight forward NAT address conversion.
This router does not require NAT but firewall ports 500 and 4500 must be open in order to enable NAT communication
between both tunnel end points.
1
In the second example application, the travelling field worker dials in to the network at the headquarters with his
notebook and a mobile telephone or modem .
HEADQUARTERS
VPN Gateway
LAN
Router
INTERNET
LAPTO P
LANCOM Advanced VPN Client
with NAT-T
Router without VPN
pass-through, with NAT
VPN Router
with NAT-T
A B
D
Mobile Phone
C
1
At the headquarters, the VPN router is located behind a terminating router , which only provides Internet access
with the address conversion.
2
Both tunnel end points LANCOM Advanced VPN Client and VPN router support NAT-T and can therefore establish
a VPN connection, as in the first example.
2
In the terminating router , the firewall ports 500 and 4500 have to be activated, as does port forwarding.
1
In both of these cases, the two ends of the connection are the straight-forward NAT routers and . Teh VPN connection
is established between the LANCOM Advanced VPN Client and VPN router .
HEADQUARTERS
VPN Gateway
LAN
Router
INTERNET
LAPTO P
LANCOM Advanced VPN Client
with NAT-T
Router without VPN
pass-through, with NAT
Router
Router without VPN
pass-through, with NAT
VPN Router
with NAT-T
A B
DC
1
The two routers and have to permit the NAT-T connection between the two tunnel endpoints in that the firewall
ports 500 and 4500 are activated, and port forwarding has to be activated in the terminating router at the
headquarters, as well.
To enable this process, both ends of the VPN connection have to work with NAT-T. The process of establishing the VPN
connection (reduced to the NAT-T-relevant operations) appears as follows:
1. At an early stage of the IKE negotiation, there is a check to see if both ends of the VPN connection are
NAT-T-compatible.
2. In the second step, there is a check to see if the address is converted to NAT on the section between the two tunnel
end points, and at what point in the connection the NAT devices are located.
3. To deal with problems with ports that may have changed, all negotiation and data packets are subsequently sent
only via UDP port 4500 when a NAT device has been detected.
5
If the LANCOM functions as a NAT router between the VPN end points, ensure that UDP ports 500 and 4500
are activated in the firewall when you use NAT-T! This port is activated automatically if you use the firewall
assistant in LANconfig.
774
Reference Manual
11 Virtual Private Networks (VPN)
If the VPN connections are first created on devices with LCOS version 5.20 or above using the VPN assistant and later
with the firewall assistant from LANconfig, then no additional firewall settings are required for the NAT router.
1. In the diagram below, the data packets are packed again into UDP packets (UDP encapsulation) and are also sent
using port 4500. As a result of this additional encapsulation, changing the IP addresses for the VPN negotiation is
no longer relevant and the VPN tunnel can be established without any problems. At the other end of the connection,
the IP data is released again by the additional UDP header and can be processed by the router without further action.
IPv4 header
ESP
TCP header
Payload
UDP
NAT-T
Payload
TCP header
IPv4 header IPv4 header
IPv4 header
ESP
In order to use this process, both ends of the VPN connection (such as the WLANmonitor and a LANCOM router) have
to use NAT-T.
LANconfig: VPN / General
WEBconfig: LCOS menu tree / Setup / VPN E NAT-T Operating
11.10 Extended Authentication Protocol (XAUTH)
11.10.1 Introduction
RADIUS servers are often used to authenticate users for remote sites dialing-in over WAN connections (such as via PPP).
Over time, conventional WAN connections increasingly gave way to secure (encrypted) and more cost-effective VPN
connections. However, the structure of VPN connections over IPSec with IKE does not permit unidirectional authentication
of users by RADIUS or similar technologies.
The Extended Authentication Protocol (XAUTH) provides the ability to extend authentication in the negotiation of IPSec
connections by an additional level in which user data can be authenticated. An additional authentication with XAUTH
user name and XAUTH password is performed between the first and second IKE negotiation phases. This authentication
775
Reference Manual
11 Virtual Private Networks (VPN)
is protected by the encryption negotiated in advance. A RADIUS server can be used for this authentication, enabling
existing RADIUS databases to continue to be used in the migration of dial-in clients to use VPN connections. Alternatively,
authentication can use an internal user table of the device.
5
In order make XAUTH particularly secure, dial-in via RSA-SIG (certificates) was to be used instead of the preshared
key method (PSK) whenever possible. Here it is important to ensure that the VPN gateway accepts only the
certificate of the correct remote site (and not all certificates issued by the same CA).
11.10.2 XAUTH in LCOS
In the LANCOM, the XAUTH protocol uses entries in the PPP table for remote site authentication. Use of the entries in
the PPP table is dependent on which direction the connection is established, i.e. on the XAUTH operating mode:
ClientServerXAUTH operating mode
User name from the PPP table.Remote site from the PPP table.XAUTH user name
The entry selected from the PPP table
is that for which the PPP remote site
The PPP-table entry is selected for
which the PPP remote site
corresponds to the VPN remote site
used.
corresponds to the transferred XAUTH
user name.
The PPP remote site must also match
the VPN remote site used.
Password from the PPP table.Password from the PPP table.XAUTH password
5
In LCOS version 7.60 in XAUTH operating mode, the XAUTH user name has to agree with the name of the VPN
remote site. For this reason only one user can be authenticated by XAUTH for each VPN remote site. Authentication
by RADIUS server is not available with LCOS 7.60.
11.10.3 Configuring XAUTH
The application of the XAUTH protocol is set up separately for each VPN remote site. Only the XAUTH operating mode
is specified.
LANconfig: VPN / General / Connection list
776
Reference Manual
11 Virtual Private Networks (VPN)
WEBconfig: Setup / VPN / VPN peers
1
XAUTH
Enables the use of XAUTH for the VPN remote site selected.
Possible values:
2
Client: In the XAUTH client operating mode, the device starts the initial phase of IKE negotiation (Main mode or
Aggressive mode) and then waits for the authentication request from the XAUTH server. The XAUTH client responds
to this request with the user name and password from the PPP table entry in which the PPP remote site corresponds
to the VPN remote site defined here. There must therefore be a PPP remote site of the same name for the VPN
remote site. The user name defined in the PPP table normally differs from the remote site name.
2
Server: In the XAUTH server operating mode, the device (after successful negotiation of the initial IKE negotiation)
starts authentication with a request to the XAUTH client, which then responds with its user name and password.
The XAUTH server searches for the user name in the PPP table and, if a match is found, it checks the password.
The user name for this entry in the PPP table is not used.
2
Off: No XAUTH authentication is performed for the connection to this remote site.
Default:
2
Off
5
If XAUTH authentication is enabled for a VPN remote site, the IKE-CFG option must be set to the same value.
11.11 Backup via alternative VPN connection
11.11.1 Introduction
The subject of backup connections is vital to the availability of business-critical applications, especially at distributed
sites with several branch offices connected via VPN to the main office. The subject of backups is easy to resolve where
routers at the branch offices relate directly to redundant routers at the main office: If a router at the main office can be
not reached over the Internet, the branch office simply dials-in to another router at the main office. RIP ensures that the
devices can communicate over the available routes.
However, in very large networks branch offices are rarely connected directly to the main office. Instead, several sites
initially merge at switching nodes, and these in turn are connected to the main office. If the branch office temporarily
loses contact to the switching node, the branch office could establish a direct backup connection to main office.
HEADQUARTER
BRANCH OFFICE
ROUTER
VPN GATEWAY VPN GATEWAY VPN GATEWAY
BRANCH OFFICE
ROUTER
BRANCH OFFICE
ROUTER
SWITCHING NODE SWITCHING NODE SWITCHING NODE
Redundant VPN
gateways
Switching nodes
VPN primary connections
Backup connections
However, this only works via an ISDN connection, often an undesirable solution due to the costs and limited bandwidth.
A parallel backup connection directly over VPN does not achieve the objective for the following reasons:
777
Reference Manual
11 Virtual Private Networks (VPN)
1
Only the switching nodes are defined as VPN remote sites in the main office – all routes to the branch offices pass
through these switching nodes. If a branch office attempts to establish a direct connection to the main office, the
attempt is rejected. And even if this connection were successful, the routes to the branch offices via the switching
nodes remain in place at the main office because the switching node is, from the viewpoint of the main office, still
accessible.
1
The switching node knows nothing about any potential direct connection from branch office to main office. It therefore
cannot access the destinations in the network at the branch office by detouring via the main office.
1
Both the network of the switching node and the network of the branch office are accessible from the main office via
the standard VPN connection. However, a direct VPN connection of the branch office to the main office only provides
access to the branch-office network. It is because of these different characteristics that the router at the main office
cannot accept the direct connection as a backup for the standard connection.
1
The branch office can no longer establish the standard connection to the switching node because the principle of
unambiguousness in IPsec rules does not permit a second connection with the same set of rules. Along with the
specifications on encryption, IPSec rules also contain "network relationships", i.e. the IP addresses of the networks
at both ends of the connection. These network relationships may only appear once in the VPN rule set. For a backup,
however, two rules would have to exist for the same network relationship – once for the backup connection and
once for the newly established primary connection.
11.11.2 Backup-capable network infrastructure
In order to also build up an operational backup solution for these applications, the points described in the following
sections must be satisfied.
Basic prerequisites
The basic prerequisite for the backup function described here are; the configuration of a "Dynamic VPN" connection
between branch offices and switching nodes; and the functions “Simplified RAS with certificates“ and “Allow remote
site to select the remote network“ must be enabled in the VPN gateways at the main office.
Hierarchy for establishing VPN connections
In order for branch offices to connect to the network at the main office for backup purposes, a defined hierarchy must
be observed when establishing the connection. Connections are only established from the "lower" to the "upper" networks,
i.e. from the branch office to the switching node, from the switching node to the main office.
HEADQUARTER
BRANCH OFFICE
ROUTER
VPN GATEWAY VPN GATEWAY VPN GATEWAY
BRANCH OFFICE
ROUTER
BRANCH OFFICE
ROUTER
SWITCHING NODE SWITCHING NODE SWITCHING NODE
Establishing VPN connection
Thus connections only have to be accepted passively at the main office. The switching nodes also accept the branch
office connections passively, but establish the connections to the main office actively. This hierarchy is a prerequisite for
the later definition of VPN rules.
Network definitions
The branch offices establish network relationships with the switching nodes and with the main office - this must be
allowed by the appropriate rules. In addition, either all conceivable network relationships must be stored individually or
778
Reference Manual
11 Virtual Private Networks (VPN)
the networks have to be defined such that all required network relationships can be allowed with a single rule. This is
possible if, for example, the IP addresses in the networks have the following structure:
1
Central network 10.1.1.0/255.255.255.0
1
Switching nodes 10.x.1.0/255.255.255.0
1
Branch offices 10.x.y.0/255.255.255.0
Using the following VPN rule in the VPN gateways at the main office permits all required network relationships, i. e. all
remote sites from the 10.x... range of addresses can establish connections to all gateways:
1
Source 10.0.0.0/255.0.0.0
1
Destination 10.0.0.0/255.0.0.0
Because branch offices communicate with the main office via the intermediate level of the switching nodes, corresponding
VPN rules must also be created in the switching nodes. If communication with other sub-nodes and branch offices is
also to be made possible, all of the required network relationships are permitted with the following VPN rule in the
switching nodes:
1
Source 10.x.0.0/255.255.0.0
1
Destination 10.0.0.0/255.0.0.0
Routing information
During normal operation, the routes from main office to individual branch offices run via the switching nodes. These
routes must be adapted for backup situations. For this adaptation to be performed automatically, "Simplified RAS with
certificates" is enabled in the VPN gateways at the main office. This allows a shared configuration to apply for all incoming
connections (using default settings) if the certificates of the remote sites have been signed with the root certificate of
the VPN gateways in the main office. This also allows remote sites to select the remote network. The routers at the branch
offices can then suggest a network (during IKE negotiations in phase 2) to be used for the connection.
5
Enabling the two functions “Simplified RAS with certificates“ and “Allow remote site to select the remote network“
is a necessary condition for the backup function described here.
The routing information at the switching nodes must also be adapted in backup situations. The switching nodes are
normally accessed directly from the branch offices. In backup situations, the switching nodes must be able to receive
the data from the branch offices via the main office detour. This is made possible with a route that transmits the entire
combined network (10.x.0.0/255.255.0.0 in the example or, if communication with other nodes is to be possible:
10.0.0.0/255.0.0.0) to the main office.
In order for the routes to be switched automatically, “Allow remote site to select the remote network“ must also be
activated at the switching nodes.
This results in the following sequence of events when establishing VPN connections:
1
The switching node establishes the connection to the main office and requests all network relationships to the branch
offices (i. e. it requests the 10.x.0.0/255.255.0.0 network).
1
The branch office establishes the connection to the switching node and requests its network (10.x.y.0/255.255.255.0).
Data can now be transferred from the branch office to the main office via the switching node.
The following happens if the VPN connection between branch office and main office now fails:
1
The switching node detects the loss by polling (DPD) and removes the route to the branch office.
1
At some point the branch office establishes the backup connection to the main office and requests its network
(10.x.y.0/255.255.255.0).
Data can now be transferred from the branch office to the main office.
If the networks have been combined and the switching nodes always route the combined network (as in the example,
network 10.x.0.0/255.255.0.0 or 10.0.0.0/255.0.0.0) to the main office, data can be transmitted from the branch
office to the switching node via the main office.
779
Reference Manual
11 Virtual Private Networks (VPN)
Once the backup event is over, the branch office reestablishes the primary connection to the switching node:
1
The branch office tears down the backup connection and the main office deletes the route to the branch office.
1
The branch office again requests its network (10.x.y.0/255.255.255.0) from the switching node.
Smooth communication between branch office and switching node now exists again.
Because the branch office network is a sub-network of the network in the switching node, immediate communication
between branch office and main office via the switching node is also possible again. The main office no longer has
its own route to the branch office and therefore resumes transfers data for the branch office via the switching node
again.
5
If network addresses cannot be structured as described above, the route to the branch office must be
configured statically at the main office and point to the switching node. If the branch office then establishes
the backup connection, the statically registered route is overwritten by the dynamically registered route. If
the backup connection is torn down again, the dynamic route is deleted and the static route re-enabled. If,
in this case, communication between branch offices and switching node is to be guaranteed for backup as
well, the routes to the branch offices must also be configured statically in the switching nodes.
Establishing a backup connection
In order to conform to the basic principle of unambiguous IPSec rules, backup situations require VPN rules for the primary
connection to be deleted first, and then new rules for the backup connection are created.
If the establishment of a backup connection fails, the backup module selects the next backup connection (if several are
configured). If the next backup connection uses an ISDN connection, it is established completely normally, i.e. no IPSec
rules need be reformulated.
If the backup at the main office is based on ISDN, it is important to avoid coupling the backup connection with the
normal VPN connections to the other branch offices. In the event of a backup, these primary VPN connections carry not
only the data traffic to the branch offices, but all traffic to the switching nodes and all other branch offices as well. This
coupling can be prevented in two ways:
1
A very high distance for the branch-office network is entered into the ISDN backup connection. This way the route
can be overwritten by the routes automatically communicated via the VPN.
1
Alternatively, the routes can be controlled using WAN RIP. For this, an ISDN connection with WAN RIP support is
set up for every B-channel.
Re-establishing the primary connection
The device attempts to restore the primary connection while the backup connection is being established. During this
attempt to connect, the VPN rule set must not be recreated again – otherwise the backup connection would fail or an
existing VPN connection would simply be torn down.
To prevent this, initial "Dynamic VPN" negotiations with the primary connection's remote site are performed. If these
negotiations are successful, the primary connection can be reestablished. To this end, the backup connection is
disconnected and the backup status is reset. This prevents the backup connection from being reestablished immediately.
Only after this is the primary connection reestablished with the original VPN rules.
5
The use of the "Dynamic VPN" connection between branch office and switching node is a necessary condition
for the backup function described here.
11.11.3 Configuring the VPN backup
For configuring the VPN backup, the devices at the branch offices, main office and switching nodes must be considered
separately.
1
Branch office
780
Reference Manual
11 Virtual Private Networks (VPN)
"Dynamic VPN" over ICMP/UDP must be configured for the primary connection.
2
2
The backup connection has no requirement for "Dynamic VPN".
2
The backup is configured in the backup table, as with ISDN backup.
2
At the branch office, the main office must be configured as a backup remote site.
1
Main office
2
Simplified RAS with certificates must be enabled.
2
Selection of the remote network by the remote site must be enabled.
781
Reference Manual
11 Virtual Private Networks (VPN)
2
A configuration in the backup table is not necessary here.
1
Switching nodes
2
The VPN connection to the main office must be completely configured.
2
Simplified RAS with certificates must be enabled.
2
Selection of the remote network by the remote site must be enabled.
5
If the system does not have "combined networks" (i.e. the branch office network is a sub-network of the
switching node and the switching node network is a sub-network of the central network), then the switching
node's route to the branch office must point to the main office in order for the branch office to be able to
reach the switching node in backup situations. In normal operation, this route is overwritten by the route
passed by the branch office in the VPN (because remote sites may provide network relationships) and is
therefore only used when the direct connection is torn down and the branch office establishes the backup
connection.
11.12 Specific examples of connections
This section covers the 4 possible types of VPN connections with concrete examples. These 4 different connection types
are categorized by the type of IP address of the two VPN gateways:
1
static/dynamic
1
dynamic/static (the dynamic peer initiates the connection)
1
static/dynamic (the static peer initiates the connection)
1
dynamic/dynamic
There is a section for each of these types, together with a description of all required configuration information in the
familiar table form.
782
Reference Manual
11 Virtual Private Networks (VPN)
11.12.1 Static/static
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Static public IP: 193.10.10.1
Static private IP: 10.10.1.1
10.10.1.x
ISDN
Static public IP: 193.10.10.2
Static private IP: 10.10.2.1
10.10.2.x
A VPN tunnel via the Internet serves as the connection between the LANCOM Headquarters and branch office. Both
gateways have static IP addresses. Thus, both can initiate the connection.
Branch_officeHeadquartersEntry
staticstaticType of local IP address
staticstaticType of remote IP address
Branch_officeHeadquartersName of the local device
HeadquartersBranch_officeName of the remote device
secretsecretShared Secret for encryption
193.10.10.1193.10.10.2IP address of the remote device
10.10.1.010.10.2.0IP-network address of the remote network
255.255.255.0255.255.255.0Netmask of the remote network
11.12.2 Dynamic/static
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Static public IP: 193.10.10.1
Static private IP: 10.10.1.1
10.10.1.x
ISDN
Dynamic public IP: x.x.x.x
Static private IP: 10.10.2.1
10.10.2.x
The VPN gateway Branch office initiates a VPN connection to the gateway Headquarters. Branch office has a dynamic
IP address that was chosen and assigned by the Internet service provider upon dialling in, whereas Headquarters has
a fixed, static address. When the connection is set up, Branch office transmits its actual IP address to Headquarters.
This is accomplished by a special ICMP packet (alternatively UDP, port 87).
Branch_officeHeadquartersEntry
dynamicstaticType of local IP address
staticdynamicType of remote IP address
Branch_officeHeadquartersName of the local device
HeadquartersBranch_officeName of the remote device
confidentialconfidentialPassword for the secure transmission of the IP address
secretsecretShared Secret for encryption
193.10.10.1–IP address of the remote device
10.10.1.010.10.2.0IP-network address of the remote network
255.255.255.0255.255.255.0Netmask of the remote network
5
An ISDN line is not necessary for establishing this type of connection. The dynamic end communicates its IP
address encrypted via the Internet protocol ICMP (or alternatively via UDP).
783
Reference Manual
11 Virtual Private Networks (VPN)
11.12.3 Static/dynamic (with LANCOM Dynamic VPN)
In this case (other than the example above), the peer with the static IP address initiates the VPN connection.
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Static public IP: 193.10.10.1
Static private IP: 10.10.1.1
ISDN no.(030) 12345
ISDN identifier 03012345
10.10.1.x
ISDN
Dynamic public IP: x.x.x.x
Static private IP: 10.10.2.1
ISDN no.(069) 54321
ISDN identifier 06954321
10.10.2.x
The VPN gateway Headquarters initiates a VPN connection to Branch office. Headquarters has a static IP address,
Branch office a dynamic one.
5
The entries for the ISDN connection are needed for the transmission of the actual dynamic IP address solely. The
Internet access wizard configures the connection to the Internet.
5
Alternatively, this application can be solved with the help of dynamic DNS. In this constellation, the headquarters
with its static IP address connects to the branch office with the help of a dynamic DNS name which is assigned
to the current dynamic IP address. More information is available under .
Branch_officeHeadquartersEntry
dynamicstaticType of local IP address
staticdynamicType of remote IP address
Branch_officeHeadquartersName of the local device
HeadquartersBranch_officeName of the remote device
0301234506954321ISDN-calling number of the remote device
0301234506954321ISDN-caller ID of the remote device
confidentialconfidentialPassword for the secure transmission of the IP address
secretsecretShared Secret for encryption
193.10.10.1IP address of the remote device
10.10.1.010.10.2.0IP-network address of the remote network
255.255.255.0255.255.255.0Netmask of the remote network
5
The described connection set up requires an ISDN connection for both VPN gateways.
11.12.4 Dynamic/dynamic (with LANCOM Dynamic VPN)
HEADQUARTERS
VPN Gateway
LAN
VPN Gateway
LAN
INTERNET
BRANCH
Dynamic public IP: x.x.x.x
Static private IP: 10.10.1.1
ISDN no.(030) 12345
ISDN identifier 03012345
10.10.1.x
ISDN
Dynamic public IP: x.x.x.x
Static private IP: 10.10.2.1
ISDN no.(069) 54321
ISDN identifier 06954321
10.10.2.x
A VPN tunnel via the Internet serves as the connection between the LANCOM Headquarters and branch office. Both
sites have dynamic IP addresses. Thus, both can initiate the connection.
5
The entries for the ISDN connection are needed for the transmission of the actual dynamic IP address solely. The
Internet access wizard configures the connection to the Internet.
784
Reference Manual
11 Virtual Private Networks (VPN)
5
Alternatively, this application can be solved with the help of dynamic DNS. Instead of a static IP address, a
dynamic DNS name helps to find the dynamic IP address that is currently in use. More information is available
under .
Branch_officeHeadquartersEntry
dynamicdynamicType of local IP address
dynamicdynamicType of remote IP address
Branch_officeHeadquartersName of the local device
HeadquartersBranch_officeName of the remote device
0301234506954321ISDN-calling number of the remote device
0301234506954321ISDN-caller ID of the remote device
confidentialconfidentialPassword for the secure transmission of the
IP address
secretsecretShared Secret for encryption
10.10.1.010.10.2.0IP-network address of the remote network
255.255.255.0255.255.255.0Netmask of the remote network
5
Dynamic VPN works only between LANCOM that each feature at least one ISDN port that can be used for the
ISDN connection
11.12.5 VPN connections: High availability with VPN load balancing
Multiple VPN gateway addresses
In decentralized company structures that rely on VPN for networking the various locations, the availability of the central
VPN gateway is of particular significance. The company-wide communications only remain reliable as long as these
central dial-in nodes are working properly.
HEADQUARTERS
VPN Gateway
LAN
INTERNET
VPN Gateway
LAN
BRANCH
VPN Gateway
VPN Gateway
VPN Gateway
LAN
BRANCH
VPN Gateway PC Home Office
Dynamic VPN endpoint
With the option of configuring several "remote gateway" addresses as "dynamic VPN endpoints" for a VPN connection,
LANCOM VPN gateways offer a high level of availability by using redundant devices. This involves multiple gateways at
the headquarters being set up with identical VPN configurations. On location at the satellite sites, all of these available
gateways are entered as possible remote stations for the VPN connection. If one of the gateways is unavailable, the
remote router automatically redirects the request to one of the other routers.
To ensure that the computers in the LAN at the headquarters know which VPN gateway it to be used to reach a particular
satellite station, the outband router currently connected to the remote site is propagated via RIPv2 to the network at
the headquarters.
5
A powerful mechanism for high availability with constant load balancing between the VPN gateways at the
headquarters is attained with the configuration of the satellite stations to select the remote site for VPN connection
on a random basis.
785
Reference Manual
11 Virtual Private Networks (VPN)
Configuration
During configuration, additional destinations for a VPN connection should be entered in the list of "Remote gateways".
The list consists of the following entries:
1
Name: Name of the remote site from the VPN connection list, the "target" of the VPN connection.
1
Gateway 2 to Gateway 9: Address of the alternative gateways, as an IP address or DNS-translatable address.
1
Begin with: In which order should the entries are to be tried. You can select from:
2
Last used: Selects the entry for the VPN connection which was successfully used most recently.
2
First: Selects the first of the configured remote stations.
2
Random: Selects one of the configured remote stations at random. This setting provides an effective measure for
load balancing between the gateways at the headquarters.
5
The entry for the gateway in the VPN connection list can be left blank if all of the possible gateways are
entered into the list of "Remote gateways".
LANconfig: VPN / General / Remote gateway
WEBconfig: LCOS menu tree / Setup / Config E Remote-gateway-list
The following options are available for defining the strategy for the utilization of the configured remote-gateway addresses:
1
last used
1
first
1
random
Example:
The following command sets three gateways as target at the headquarters, one of which is to be selected at random:
set VPN_HEADQUARTERS 213.217.69.75 213.217.69.76 213.217.69.77 * * * *
* random
11.13 How does VPN work?
In practice, a VPN must fulfill a number of requirements:
1
Unauthorized third parties must not be able to read the data (encryption)
1
It should not be possible to manipulate the data (data integrity)
1
Unambiguous identification of the sender of data (authentication)
786
Reference Manual
11 Virtual Private Networks (VPN)
1
Simple key management
1
Compatibility to VPN devices from a variety of manufacturers
LANCOM VPN achieves these five major goals by applying the widely used IPSec standard.
11.13.1 IPSec—The basis for LANCOM VPN
The original IP protocol does not contain any provisions for security. Security problems are compounded by the fact that
IP packets do not go directly to a specific recipient, but are sent scattershot to all computers on a given network segment.
Anyone can help themselves and read the packets. This leaves the door open to the misuse of data.
IP has been developed further for this reason. A secure version is now available: IPSec. LANCOM VPN is based on IPSec.
IPSec stands for “IPSecurity Protocol” and was originally the name used by a working group of the IETF, the Internet
Engineering Task Force. Over the years, this group has developed a framework for a secure IP protocol that is generally
referred to as IPSec today.
It is important to note that IPSec itself is not a protocol, but merely the standard for a protocol framework. IPSec actually
consists of a variety of protocols and algorithms for encryption, authentication and key management. These standards
will be introduced in the following sections.
Security in an IP environment
IPSec has been implemented almost completely within level 3 of the OSI model, i.e. in the network layer. The transfer
of data packets using the IP protocol is realized on level 3 of IP networks.
IPSec thus replaces the IP protocol. Under IPSec, the packets have a different internal structure than IP packets. Their
external structure remains fully compatible to IP, however. IPSec packets can therefore be transported without problems
by existing IP networks. The devices in the network responsible for the transport of the packets cannot distinguish IPSec
packets from IP packets on the basis of their exterior structure.
The exceptions in this case are certain firewalls and proxy servers that access the contents of the packets. Problems can
arise from the (often function dependent) incompatibilities of these devices to the existing IP standard. These devices
must therefore be adapted to IPSec.
IPSec will be firmly implemented in the next generation of the IP standard (IPv6). For this reason, we can assume that
IPSec will remain the most important standard for virtual private networks in the future.
11.13.2 Alternatives to IPSec
IPSec is an open standard. It is not dependent on individual manufacturers and is being developed by the IETF with input
from the interested public. The IETF is a nonprofit organization that is open to everyone. The broad acceptance of IPSec
is the result of this open structure which unites a variety of technical approaches.
Nevertheless, there are other approaches for the realization of VPNs. We will only mention the two most important of
these here. They are not realized at the network level like IPSec, but at the connection and application levels.
Security at the connection level – PPTP, L2F, L2TP
Tunnels can already be set up at the connection level (level 2 of the OSI model). Microsoft and Ascend developed the
Point-to-Point Tunneling Protocol (PPTP) early on. Cisco presented a similar protocol with Layer 2Forwarding (L2F). Both
manufacturers agreed on a joint effort and the IETF produced the Layer 2Tunnel Protocol (L2TP).
Their main advantage over IPSec is that any network protocol can be used with such a network connection, especially
NetBEUI and IPX.
A major disadvantage of the described protocols is the lack of security at the packet level. What's more, these protocols
were designed specifically for dial-up connections.
787
Reference Manual
11 Virtual Private Networks (VPN)
Security at higher levels – SSL, S/MIME, PGP
Communications can also be secured with encryption at higher levels of the OSI model. Well known examples of this
type of protocol are SSL (Secure Socket Layer) mainly used for web browser connections, S/MIME (Secure Multipurpose
Internet Mail Extensions) for e-mails and PGP (Pretty Good Privacy) for e-mails and files.
In all of the above protocols, an application handles the encryption of the data, for example the Web browser on one
end and the HTTP server on the other.
A disadvantage of these protocols in the limitation to specific applications. In addition, a variety of keys is generally
required for the different applications. The configuration must be managed on the individual computers and can not be
administered conveniently on the gateways only, as is the case with IPSec. Security protocols at the application level
tend to be more intelligent as they know the significance of the data being transferred. They are usually much more
complex, however.
All of these layer-2 protocols only support end-to-end connections; they are therefore not suitable for coupling entire
networks.
On the other hand, these mechanisms do not require the slightest changes to the network devices or access software.
And unlike protocols in lower network levels, they are still effective when the data content is already in the computer.
Combinations are possible
All of the alternatives listed above are compatible to IPSec and can therefore be used parallel to it. This permits a further
increase of the security level. It would be possible, for example, to dial into the Internet using an L2TP connection, set
up an IPSec tunnel to a Web server and exchange HTTP data between the Web server and the browser in secure SSL
mode.
Each additional encryption would reduce the data throughput, however. Users can decide on a case-by-case basis whether
the security offered by IPSec alone is sufficient. Only in rare cases is a higher level of security really necessary. Particularly
as the degree of security can be adjusted within IPSec.
11.14 The standards behind IPSec
IPSec is based on a variety of protocols for the individual functions. These protocols are based on, and complement one
another. The modularity achieved with this concept is an important advantage of IPSec over other standards. IPSec is
not restricted to specific protocols but can be supplemented at any time by future developments. The protocols integrated
to date also offer such a high degree of flexibility that IPSec can be perfectly adapted to virtually any requirements.
11.14.1 IPSec modules and their tasks
IPSec has to perform a number of tasks. One or more protocols have been defined for each of these tasks.
1
Authentication of packets
1
Encryption of packets
1
Transfer and management of keys
11.14.2 Security Associations – numbered tunnels
A logical connection (tunnel) between two IPSec devices is known as an SA (Security Association). SAs are managed
independently by the IPSec device. An SA consists of three values:
1
Security Parameter Index (SPI)
ID to distinguish multiple logical connections to the same target device with the same protocols
1
Target IP address
1
Security protocol used
788
Reference Manual
11 Virtual Private Networks (VPN)
Designates the security protocol used for the connection: AH or ESP (further information will be provided on these
protocols in the following sections).
An SA applies only to one communication direction of the connection (simplex). A complete send and receive connection
requires two SAs. In addition, an SA only applies for one used protocol. Two separate SAs are also required if AH and
ESP are used, i.e. two for each communication direction.
The SAs are managed in an internal database of the IPSec device that also contains the advanced connection parameters.
These parameters include the algorithms and keys used, for example.
11.14.3 Encryption of the packets – the ESP protocol
The ESP protocol (Encapsulating Security Payload) encrypts the packets as protection against unauthorized access. This
was once the only function of ESP, but in the course of the further development of the protocol it was expanded with
options for the protection of integrity and verification of authenticity. In addition, ESP also features effective protection
against replayed packets. ESP thus offers all of the functions of AH – in some cases, however, the use of AH parallel to
ESP is advisable.
How ESP works
The structure of ESP is more complex than that of AH. ESP also inserts a header behind the IP header as well its own
trailer and a block of ESP authentication data.
IP header ESP header
Data
ESP trailer ESP-Auth.
Transport and tunnel mode
Like AH, ESP can be used in two modes: transport and tunnel mode.
In transport mode, the IP header of the original packet is left unchanged and the ESP header, encrypted data and both
trailers are inserted.
The IP header contains the unchanged IP address. Transport mode can therefore only be used between two end points,
for the remote configuration of a router, for example. It cannot be used for the coupling of networks via the Internet –
this would require a new IP header with the public IP address of the recipient. In such cases, ESP can be used in tunnel
mode.
In tunnel mode, the entire packet including the original IP header is encrypted and authenticated and the ESP header
and trailers are added at the entrance of the tunnel. A new IP header is added to this new packet, this time with the
public IP address of the recipient at the end of the tunnel.
Encryption algorithms
As a higher-level protocol, IPSec does not require specific encryption algorithms. The manufacturers of IPSec products
are thus free in their choice of the processes used. The following standards are common:
1
AES – Advanced Encryption Standard AES is the official encryption standard for use by US authorities, and therefore
one of the most important standards worldwide. Following a worldwide competition in the year 2000 to find the
best of the numerous encryption algorithms, the National Institute of Standards and Technology (NIST) selected the
Rijndael algorithm (pronounced: “Rinedoll”) and declared it as the AES in 2001.
AES is a symmetric key algorithm with variable block and encryption lengths. It has been developed by the Belgian
scientists Joan Daemen and Vincent Rijmen, and features outstanding security, flexibility and efficiency.
1
DES – Data Encryption Standard DES was developed by IBM for the NSA (National Security Agency) in the early 1970s
and was the worldwide security standard for years. The key length of this symmetrical process is 56 bits. Today, it is
considered to be insecure due to its short key length and in the year 2000 the NIST replaced it with the AES (Rijndael
algorithm). It is no longer suitable for use.
789
Reference Manual
11 Virtual Private Networks (VPN)
1
Triple DES (a.k.a. 3-DES) A further development of DES. The conventional DES algorithm is applied three times
consecutively. Two or three different keys, each with a length of 56 bits are used. The key for the first run is reused
for the third DES run. The result is a nominal key length of 168 bit, with an effective key length of 112 bits.
Triple-DES combines the sophisticated DES technology with a sufficiently long key and is therefore considered to be
highly secure. Triple-DES is slower than other processes, however.
1
Blowfish This development by the renowned cryptographer Bruce Schneier is a symmetrical encryption process.
Blowfish achieves outstanding data throughput on multifunction processors. The process is reputed to be extremely
efficient and secure.
1
CAST (from the authors Carlisle Adams and Stafford Tavares) is a symmetrical process with a key length of 128 bits.
CAST permits the modification of parts of the algorithm at runtime.
5
The encryption settings can be modified in the LCOS menu tree within LANconfig. Modifications of this sort are
generally only required when setting up VPN connections between devices from different manufacturers. LANCOM
gateways offer the encryption as standard either after AES (128 bit), Blowfish (128 bit) or Triple-DES (168 bit).
11.14.4 Authentication – the AH protocol
The AH protocol (Authentification Header) guarantees the integrity and authenticity of the data. Integrity is frequently
regarded as a component of authenticity. In the following, we will consider integrity to be a separate problem that is
resolved by AH. In addition to integrity and authenticity, AH also provides effective protection against the replay of
received packets (Replay Protection).
AH adds its own header to IP packets immediately after the original IP header. The most important part of this AH header
is a field containing authentication data, often referred to as the Integrity Check Value (ICV).
Data
IP header
AH header
Authentification data
ICV
The AH process in the sender
In the sender, the authentication data is generated in 3 steps.
1. A checksum is calculated for the complete package using a hash algorithm.
2. This checksum is once again sent through a hash algorithm together with a key known to both the sender and the
recipient.
3. This results in the required authentication data which is inserted in the AH header.
Data
IP header
AH header
Checksum (hash
code)
Authentification data
ICV
790
Reference Manual
11 Virtual Private Networks (VPN)
Checking of integrity and authenticity by the recipient
The AH protocol works in a very similar manner at the recipient's end. The recipient also uses his key to calculate the
authentication data for the received packet. The comparison with the sent ICV of the packet determines the integrity
and authenticity of the packet.
Data
IP header
AH header
Authentification data
ICV
Authentification data
ICV
Checksum (hash
code)
Identical?
Determining the checksum for the integrity check
AH adds a checksum to each packet before it is sent to guarantee the integrity of the transferred packets. At the recipients
end, AH checks whether the checksum and the contents of the package match. If this is not the case, the packet was
either incorrectly transferred or deliberately manipulated. Such packets are discarded immediately and are not forwarded
to higher protocol levels.
A variety of so-called hash algorithms are available to determine the checksum. Hash algorithms are distinguished by
the fact that their results (the hash code) are a unique fingerprint of the original data. Conversely, the original data
cannot be determined on the basis of the hash code. In addition, minimum changes of the input value entail a completely
different hash code with a high-grade hash algorithm. Systematic analyses of several hash codes thus are made more
difficult.
LANCOM VPN supports the two most common hash algorithms: MD5 and SHA-1. Both methods work without keys, i.e.
on the basis of fixed algorithms. Keys do not play a role until a later step of AH: the final generation of the authentication
data. The integrity checksum is only a necessary intermediate result on the way there.
Generation of the authentication data
In the second step, AH generates a new hash code using the checksum and a key, the final authentication data. A variety
of standards are available under IPSec for this process as well. LANCOM VPN supports HMAC (Hash-based Message
Authentication Code). The hash functions MD5 and SHA-1 are available as hash algorithms. The HMAC versions are
accordingly known as HMAC-MD5-96 and HMAC-SHA-1-96.
This clarifies why AH leaves the packet itself unencrypted. Only the checksum of the packet and the local key are added
to the packet together with the ICV, the authentication data, in encrypted form as a verification criterion.
Replay protection – protection against replayed packets
In addition to the ICV, AH assigns a unique sequence number to each packet. The recipient can thus recognize which
packets were intercepted by a third party and resent. Attacks of this type are known as “packet replay“.
5
AH does not cater for the masking of IPSec tunnels unless additional measures, such as NAT-Traversal or an
outer Layer-2-Tunneling (e.g. PPPT/L2TP), are used that offer “changeable” IP headers.
11.14.5 Key management – IKE
The Internet Key Exchange Protocol (IKE) permits the integration of subprotocols for managing the SAs and for key
administration.
791
Reference Manual
11 Virtual Private Networks (VPN)
Within IKE, two subprotocols are used in LANCOM VPN: Oakley for the authentication of partners and key administration,
and ISAKMP for managing the SAs.
Setting up the SAs with ISAKMP/Oakley
Establishing an SA involves a sequence of steps (with dynamic Internet connections, these steps follow the exchange of
the public IP addresses):
1. The initiator sends a plain-text message to the remote station via ISAKMP with the request to set up an SA and with
proposals for the security parameters of the SA.
2. The remote station replies with the acceptance of a proposal.
3. Both devices now generate key pairs, each consisting of a public and private key, for Diffie-Hellman encryption.
4. In two further messages, the devices exchange their public keys for Diffie-Hellman. The further communication is
encrypted with Diffie-Hellman.
5. Both ends use numbers that have been transferred (with the Diffie-Hellman method) and the Shared Secret to generate
a common secret key that is used to encrypt the subsequent communication. Both sides additionally authenticate
their Shared Secrets by using hash codes. Phase 1 of the SA setup is thus completed.
6. Phase 2 is based on the encrypted and authenticated connection established in Phase 1. In Phase 2, the session keys
for the authentication and symmetrical encryption of the actual data transfer are generated at random and transferred.
5
Symmetrical processes are used for the encryption of the actual data transfer. Asymmetrical processes (also
known as public-key encryption) are more secure as they do not require the exchange of secret keys. However,
they require considerable processing resources and are thus significantly slower than symmetrical processes. In
practice, public-key encryption is generally only used for the exchange of key material. The actual data encryption
is then performed using the fast symmetrical process.
The regular exchange of new keys
ISAKMP ensures that new key material is regularly exchanged between the two devices during the SA. This takes place
automatically and can be checked using the 'Lifetime' setting in the advanced configuration of LANconfig.
11.15 Addition(s) to LCOS 8.00
11.15.1 VPN Pathfinder
Introduction
In some environments it is impossible to establish a secured VPN connection over an existing Internet connection due
to an interim firewall that blocks the ports used by IPsec. To be able to set up an IPsec-secured VPN connection in such
a situation, LANCOM VPN routers support the technology known as VPN Pathfinder.
The first attempt always tries to establish data communications with standard IPsec. If the connection cannot be established
(e.g. because IKE port 500 is blocked by a cellular network), then an attempt is then automatically made to establish a
connection that encapsulates the IPsec VPN in an additional SSL header (port 443, like https).
Note that VPN Pathfinder technology only works when both ends of the connection support this function and that the
corresponding options have been activated. VPN Pathfinder is available in LANCOM VPN routers with LCOS 8.0 or higher,
and with the LANCOM Advanced VPN Client 2.22 or higher.
Configuring VPN Pathfinder technology
For the active establishment of a connection from one LANCOM VPN device to another VPN remote by using VPN
Pathfinder technology, activate the option in the VPN name-list entry that corresponds to the remote site.
792
Reference Manual
11 Virtual Private Networks (VPN)
1
LANconfig: VPN / General / Connection list
1
WEBconfig: LCOS menu tree / Setup / VPN / VPN remote sites
1
SSL-IPsec (Pathfinder)
With this option you activate VPN Pathfinder technology when actively establishing a connection to this remote site.
Possible values:
2
On, off
Default:
2
Off
5
Note that when the VPN Pathfinder option is activated, the VPN connection can only be established when
the remote site also supports this technology, and when the remote site is set up to receive passive VPN
connections that use VPN Pathfinder.
Activate the option in the general VPN settings to enable passive connection establishment to a LANCOM VPN device
from another VPN remote that works with VPN Pathfinder technology (LANCOM VPN device or LANCOM Advanced VPN
client).
1
LANconfig: VPN / General
793
Reference Manual
11 Virtual Private Networks (VPN)
1
WEBconfig: LCOS menu tree / Setup / VPN
1
Accept SSL-IPsec (VPN Pathfinder)
With this option your system accepts passive attempts to connect when the remote site supports VPN Pathfinder
technology.
Possible values:
2
On, off
Default:
2
Off
5
The LANCOM Advanced VPN Client supports automatic fallback to VPN Pathfinder. With this setting, the
VPN client initially attempts to establish a connection without using the additional SSL encapsulation. If the
connection cannot be made, the device then tries to connect with the additional SSL encapsulation.
Status displays for VPN Pathfinder technology
The status displays show whether VPN-Pathfinder technology is being used on each of the active VPN connections.
1
WEBconfig: LCOS menu tree / Setup / VPN / Connections
794
Reference Manual
11 Virtual Private Networks (VPN)
11.16 Addition(s) to LCOS 8.60
11.16.1 Improved phase 1 rekeying
Throughout the operation of an active VPN connection, the stations constantly check whether communications are
subject to a previously agreed security association (SA). If the framework conditions change (e. g. a change of the client's
IP address through relocation to a different radio cell), you must renegotiate this security association. This is done with
"rekeying".
As of version 2.30, the LANCOM Advanced VPN Client transmits a special identification number (ID) during phase 1
rekeying. A LANCOM VPN gateway detects rekeying based on this ID and links the previous security association with
the client. This makes re-authentication unnecessary.
11.16.2 MPPE encryption for PPTP tunnels
The encryption protocol MPPE (Microsoft Point-To-Point Encryption) secures data transmission over PPP and VPN
connections with key lengths of up to 128 bit.
MPPE uses the "stateless mode" for encryption to ensure that both communication partners are synchronized. In this
mode, the session key changes with each transmitted data packet. The two stations also synchronize their encryption
tables (where the keys are stored for data encryption) each time.
VPN-capable devices from LANCOM use MPPE to encrypt data transfer by PPTP tunnel.
In LANconfig you find this setting under Communication > Protocols > PPTP list
If you have enabled the MPPE encryption protocol, connections to clients are established only under the following
conditions:
1
The client establishes a connection secured with MPPE. The router rejects the request for other protocols.
1
The client uses as a minimum the key length specified in the router. With shorter key lengths the router refuses to
connect and, with stronger encryption, the router switches to the appropriate key length.
Additions to the menu system
Encryption
Enter the key length here.
Telnet path:
Setup > WAN > PPTP-peers
Possible values:
Off
40 bit
56 bit
128 bit
Default:
Off
795
Reference Manual
11 Virtual Private Networks (VPN)
11.17 Addition(s) to LCOS 8.62
11.17.1 Default proposals for IKE and IPSec
The proposals for IKE and IPSec all now support a key length of 256 bits in the default settings.
5
A firmware upgrade initially does not enable this change, to avoid any problems for existing installations. To
accept the changes, you must perform a reset of the device or reset the tables. For new devices with LCOS 8.62
or later, the new defaults are already active.
11.17.2 myVPN
The LANCOM myVPN app offers you a very easy way to set up a VPN connection to your company network from your
iPhone, iPad or iPod (or from any iOS device in general). The LANCOM myVPN app offers the following functions:
1
Highly secure, mobile VPN connections made easy
1
Facilitates the complex VPN configuration of the integrated VPN client of iOS devices and the LANCOM router
1
PIN operation for the authentication during the VPN tunnel establishment
1
Access control via adjustable firewall rules on LANCOM VPN gateways
1
LANCOM myVPN user management and automatic detection of myVPN-activated LANCOM gateways
1
For version 4.1 iOS devices and later
After its installation, the LANCOM myVPN app retrieves a VPN profile from your LANCOM VPN device and automatically
configures all of the necessary settings on the iOS device. You can then use the internal features of iOS to establish a
VPN connection to your company network in just a few steps.
Using the Setup Wizard in LANconfig to set up a VPN profile for the LANCOM myVPN app
This is how to use the Setup Wizard to provide an access account for a VPN client on an iOS device:
1. Start LANconfig, for example from the Windows start menu with Start > Programs > LANCOM > LANconfig.
LANconfig now automatically searches the local network for devices.
2. Choose the required device from the selection window in LANconfig and select the Setup Wizard button or use the
menu under Tools > Setup Wizard.
3. Select the item Provide remote access (RAS, VPN) and then click on Next.
You can skip the following information dialog with Next.
796
Reference Manual
11 Virtual Private Networks (VPN)
4. From the drop-down list select the option LANCOM myVPN client and click on Next.
5. Enter a name for this access account and select the address at which the VPN client on the iOS device can reach the
router from the Internet. To continue, click on Next.
The Setup Wizard will suggest a name that you can accept if you wish.
797
Reference Manual
11 Virtual Private Networks (VPN)
6. If the VPN device doesn't have a pool of IP addresses configured already, the following dialog will prompt you to
specify a unique range of IP addresses as a pool. During dial-in the VPN device will assign a free IP address from
this pool to the iOS device.
5
If the VPN device already has configured a pool of IP addresses for VPN clients, it will automatically use this
address pool and skip the dialog shown above.
7. The Setup Wizard displays the profile name and the PIN that was auto-generated for the VPN client. If you want to
print out the PIN now, select the option Print PIN now. Click on Next.
8. By clicking on Finish the Setup Wizard stores all the settings on the corresponding VPN device. If applicable, it then
starts with the printout of the myVPN PIN.
The myVPN module is now enabled on the selected VPN device. On your iOS device, you can now start the myVPN
app and enter the PIN to retrieve the VPN profile.
Retrieve the VPN profile with the LANCOM myVPN app
This is how you can use the LANCOM myVPN app on your iOS device to retrieve a VPN profile from a LANCOM VPN
device:
5
The purpose of the LANCOM myVPN app is to set up the VPN client on iOS devices with the correct parameters
and in a quick and easy way. The establishment of the VPN connection to the company network itself is handled
directly by the VPN client in the iOS device.
798
Reference Manual
11 Virtual Private Networks (VPN)
1. Download the LANCOM myVPN app from the Apple App Store.
2. Open the app on your iPhone or iPad.
799
Reference Manual
11 Virtual Private Networks (VPN)
3. Optional: Enable the option Search remotes to find VPN devices with an activated LANCOM myVPN module and
which is available to iOS devices via WLAN.
5
The iOS device now lists all VPN devices which are accessible via WLAN and which have an active LANCOM
myVPN module. However, the inclusion of an entry in this list does not necessarily mean that your iOS device
can retrieve a LANCOM myVPN profile from this VPN device.
800
Reference Manual
11 Virtual Private Networks (VPN)
4. Optional: Select the option Add device manually to enter the IP address or name of VPN devices that the iOS device
can access via an Internet connection (3G or WLAN). In the dialog that follows, enter the IP address or the name of
the VPN device and confirm with Yes.
5. The app now displays all VPN devices that offer profiles for the LANCOM myVPN app.
801
Reference Manual
11 Virtual Private Networks (VPN)
6. Tap on the entry in the list to select the desired VPN device and then enter the PIN required for retrieving the VPN
profile.
5
If you enter your PIN incorrectly 5 times, the myVPN module on the LANCOM VPN device will be completely
locked for a definite period. In this state, VPN connections remain possible for iOS devices that previously
set up their VPN access accounts successfully. However, iOS devices cannot retrieve myVPN profiles from
this VPN device so long as the lock is in place. An administrator can re-enable the myVPN module.
802
Reference Manual
11 Virtual Private Networks (VPN)
7. In the case that the following dialog contains a notice about a non-signed certificate, simply confirm with the Yes
button.
8. In the next dialog, confirm the request to install the profile with the Install button.
803
Reference Manual
11 Virtual Private Networks (VPN)
Confirm the necessary changes to the settings on your iOS device.
9. The next step of the installation routine is to enter the password for the VPN access account. By default the VPN
password is the PIN for the myVPN profile. If you enter the password for the VPN access account here, the iOS device
can then establish VPN connections to your company network without requesting a password again. If you leave
804
Reference Manual
11 Virtual Private Networks (VPN)
the box for the VPN password empty, you will be requested for the VPN password every time you connect using the
iOS device. Confirm your selection with the Next button.
5
For security reasons we recommend that you do not save the VPN-access password on the device. It is a
better policy to enter it each time you make the connection.
805
Reference Manual
11 Virtual Private Networks (VPN)
10. The VPN profile is now fully installed on your iOS device and is ready for establishing a VPN connection to your
company network. Confirm that the installation has been concluded by clicking on the Done button.
Once retrieved from an iOS device, the myVPN profile is disabled on the LANCOM VPN device. You can check your status
with LANconfig by navigating to the configuration area VPN > myVPN and viewing the myVPN accounts list:
5
By disabling the myVPN profile, other IOS device are prevented from installing the same myVPN profile and thus
using the same VPN access credentials. However, disabling the myVPN profile has no effect on the VPN connection
itself.
Establishing and closing the VPN connection on the iOS device
After you have installed the VPN profile on your iOS device with the LANCOM myVPN app, you establish and close the
VPN connection to your company network as follows:
1. Activate the VPN tunnel in the configuration area Settings under the option VPN.
806
Reference Manual
11 Virtual Private Networks (VPN)
2. The following dialog already displays the user name from the myVPN profile. Enter the password for the VPN
connection and confirm with OK.
5
By default, the password for the VPN connection is the PIN for the myVPN profile.
5
The password is already displayed if you entered the password for the VPN connection while installing the
myVPN profile. In this case the connection is established directly without showing this window.
3. Close the VPN connection on your iOS device in the configuration area Settings under the option VPN.
Deleting a VPN profile from the iOS device
To delete the VPN profile you can use the LANCOM myVPN app:
1. Navigate to Settings > General > Profiles to the list of available profiles on your iOS device.
807
Reference Manual
11 Virtual Private Networks (VPN)
2. Select the profile, click on Remove and confirm the action again in the next dialog with Remove.
808
Reference Manual
11 Virtual Private Networks (VPN)
Additions to LANconfig
Configuring the LANCOM myVPN app
Under VPN > myVPN you can manually adjust the settings for the LANCOM myVPN app.
Check the myVPN enabled box to allow the LANCOM myVPN app to load a VPN profile.
Specify the Device name here if a trusted SSL certificate is installed on this device. This ensures that the IOS device does
not issue a warning about an untrusted certificate when the profile is retrieved.
Use the field Remote gateway to enter the WAN address of the router or its name as resolved by public DNS servers.
If the myVPN app cannot find the remote gateway by means of automatic search, you should enter this gateway into
the myVPN app.
The item PIN length sets the length of new PINs generated by the setup wizard (default = 4).
Activate the option Send myVPN notifications by SYSLOG to send messages about the myVPN app to SYSLOG.
Activate the option Send myVPN notifications by e-mail to send messages about the myVPN app to a specified e-mail
address.
These messages include:
1
Successful profile retrieval
1
Disabled login for LANCOM myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
Specify the E-mail address to which messages about the myVPN app are to be sent.
5
The transmission of e-mails must be enabled in the VPN device.
809
Reference Manual
11 Virtual Private Networks (VPN)
The item myVPN accounts is used to assign the myVPN PIN to the VPN profiles.
Here you determine which VPN profile is to supply data to the myVPN app upon retrieval of the profile.
You set the myVPN PIN that is to be entered when the LANCOM myVPN app is to retrieve the profile.
5
Security notice: As a security feature of myVPN, the repeated incorrect entry of a PIN causes the device to
temporarily disable profile retrieval, and a notification is sent by SYSLOG and by e-mail. After five failed attempts,
the device disables profile retrieval for 15 minutes. Five more failed attempts, profile retrieval is disabled for a
day. In case of further failed attempts, the time periods vary. Manually releasing this lock resets the corresponding
counter. Please also be aware that an attempt to retrieve the profile while access is disabled (e. g. when the
profile has previously been retrieved successfully) is also considered by the device to be a failed attempt.
You activate the profile by checking the Account enabled box.
5
After the profile has been retrieved successfully, the device automatically disables the corresponding profile to
avoid the repeated download by another device.
Once you save these settings to the device, the myVPN module is active on the selected VPN device. On your iOS device,
you can now start the LANCOM myVPN app and enter the PIN to retrieve the VPN profile.
Additions to the menu system
myVPN
The "myVPN" function is used by devices with the iOS operating system. These are able to automatically retrieve VPN
profiles and the internal iOS VPN client is configured to suit. At the router's end, you must configure the VPN profile and
the parameters for myVPN. With the aid of the LANCOM myVPN app and a suitable PIN, you can configure your device
for VPN dial-in in just a few easy steps.
More information on the myVPN app is available on the
LANCOM homepage
.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Operating
Use this switch to activate myVPN for this device.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Yes
No
810
Reference Manual
11 Virtual Private Networks (VPN)
Default:
No
PIN length
This item sets the length of new PINs generated by the setup wizard.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Maximum length: 12
Minimum length: 4
Default:
4
Device hostname
Enter the device name here if a trustworthy SSL certificate is installed on this device. This ensures that the IOS device
does not issue a warning about an untrusted certificate when the profile is retrieved.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 31 characters from
0-9
a-z
A-Z
#@{|}~!$%&'()*+-,/:;<=>?[\]^_.`
Default:
Blank
Mapping
This table assigns the myVPN PIN to the VPN profiles.
Telnet path:
Telnet path:Setup > Vpn > myVPN
PIN
Define here the PIN to be entered into the myVPN app in order to retrieve the profile.
The myVPN setup wizard also uses this PIN in the PPP list for the actual VPN login. If you change your PIN here, you
must also change it in LANconfig under Communication > Protocols > PPP list if you wish to avoid having a different
PIN.
811
Reference Manual
11 Virtual Private Networks (VPN)
5
Security notice: As a security feature of myVPN, the repeated incorrect entry of a PIN causes the device to
temporarily disable profile retrieval, and a notification is sent by SYSLOG and by e-mail. After three failed attempts,
the device disables profile retrieval for 15 minutes. A further three failed attempts cause the profile retrieval to
be disabled for 24 hours. In case of further failed attempts, the time periods vary. Manually releasing this lock
resets the corresponding counter. Please also be aware that an attempt to retrieve the profile while access is
disabled (e. g. when the profile has previously been retrieved successfully) is also considered by the device to be
a failed attempt.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
Max. 12 digits from 1234567890
Default:
Blank
VPN profile
Here you can determine which VPN profile is to supply data to the myVPN app upon retrieval of the profile.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
16 characters from
0-9
a-z
A-Z
@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
Blank
Operating
This switch activates the profile retrieval by means of the myVPN app. After the profile has been retrieved successfully,
the device automatically disables the corresponding profile to avoid the repeated download by another device.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
No
Yes
Default:
No
812
Reference Manual
11 Virtual Private Networks (VPN)
Re-enable login
The command do re-enable-login releases the lock that was caused by failed attempts. If required, this
generates a message about the re-enabling via SYSLOG or e-mail.
Telnet path:
Telnet path:Setup > Vpn > myVPN
E-mail notification
Activate this option to send messages about the myVPN app to a specific e-mail address. These messages include:
1
Successful profile retrieval
1
Disabled login for myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
No
Yes
Default:
No
E-mail address
Specify the e-mail address to which messages about the myVPN app are to be sent.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 63 characters from
0-9
a-z
A-Z
@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
Blank
Syslog
Activate this option to send messages about the myVPN app to SYSLOG. These messages include:
1
Successful profile retrieval
1
Disabled login for myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
813
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
No
Yes
Default:
No
Remote gateway
Here you enter the WAN address of the router or its name as resolved by public DNS servers. If the myVPN app cannot
find the remote gateway by means of automatic search, you should enter the gateway into the app as well.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 63 characters from
0-9
a-z
A-Z
#@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
Blank
11.18 Addition(s) to LCOS 8.80
11.18.1 Deleting all VPN errors with one command
As of LCOS 8.80, you have the ability to delete all of the VPN errors in a device with a single command.
Additions to the menu system
Additions to the Status menu
Delete conn errors
Connections (Status > VPN > Connections), which show an error in the Last errorcolumn.
Telnet path:
Status > VPN
814
Reference Manual
11 Virtual Private Networks (VPN)
11.18.2 Default proposals for IKE and IPSec
The proposals for IKE and IPSec now support a key length of 256 bits in the default settings.
5
A firmware upgrade initially does not enable this change, so avoiding any problems for existing installations. To
accept the changes, you must perform a reset of the device or reset the tables. For new devices with LCOS 8.62
or later, the new defaults are already active.
11.18.3 Selecting DH group 14 for VPN connections
The IKE and PFS group for VPN connections now support the DH group 14 with a key length of 2048.
Additions to the Setup menu
VPN
This menu contains the configuration of the Virtual Private Network (VPN).
Telnet path:
Setup
Aggressive mode IKE group default
This IKE group is used for aggressive-mode connections when the remote address cannot be identified by its IP address
but by a subsequently transmitted ID.
Telnet path:
Setup > VPN
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
Main mode IKE group default
This IKE group is used for main-mode connections when the remote address cannot be identified by its IP address but
by a subsequently transmitted ID.
Telnet path:
Setup > VPN
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
815
Reference Manual
11 Virtual Private Networks (VPN)
Default:
2: MODP-1024
Quick mode PFS group default
This IPSec group is used for simplified dial-in with certificates.
Telnet path:
Setup > VPN
Possible values:
0: No PFS
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
Layer
Define other parameters for the individual VPN connections here.
Telnet path:
Setup > VPN
PFS group
Perfect Forward Secrecy (PFS) is a security feature of encryption algorithms. The PFS group specifies the length of the
Diffie-Hellman key used to encrypt the IKE negotiation.
Telnet path:
Setup > VPN > Layer
Possible values:
0: No PFS
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
IKE group
The IKE group specifies the length of the Diffie-Hellman key used to encrypt the IKE negotiation.
816
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > VPN > Layer
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
11.18.4 Replay detection
Replay detection is a feature of the IPSec standard for the detection of so-called replay attacks. In a replay attack, an
unauthorized station logs data and sends this, either repeatedly or with a delay, to a remote site to simulate a different
identity.
Replay detection defines a certain number of consecutive packets (a "window" with the length of "n"). Because the IPSec
standard provides the packages with a continuous sequence number, the receiving VPN device can determine whether
a packet contains a sequence number from the permitted window. If, for example, the current highest received sequence
number is 10,000 and the window width is 100, then a sequence number of 9,888 is outside the permitted window.
Replay detection discards received packets if:
1
they contain a sequence number before the current window, in which case they are seen as being too old, or if
1
they contain a sequence number which has already been received by the VPN device, in which case replay detection
evaluates this package as part of a replay attack
Please consider the following aspects when configuring the replay-detection window:
1
If you select too large a window, then replay detection may overlook a replay attack
1
If you make the window too small, replay detection may drop legitimate packets that became reordered during data
transfer, so generating errors on the VPN connection
5
You have to weigh-up the application of replay detection for your particular case. Only activate replay detection
if the security of the VPN connection is more important to you than interference-free data transfer.
Additions to the menu system
Anti-replay window size
Used for detecting replay attacks, this parameter defines the size of the window (i.e. number of packets) within which
a VPN device considers the sequential number of the received packets to be up-to-date. The VPN device drops packets
that have a sequence number older than or duplicated within this window.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 5 numbers
Default:
0
817
Reference Manual
11 Virtual Private Networks (VPN)
Special values:
A value of 0 disables replay detection.
11.18.5 myVPN
The LANCOM myVPN app offers you a very easy way to set up a VPN connection to your company network from your
iPhone, iPad or iPod (or from any iOS device in general). The LANCOM myVPN app offers the following functions:
1
Highly secure, mobile VPN connections
1
Handles the complex VPN configuration of the VPN client integrated into iOS devices and of the LANCOM router
1
PIN-protected authentication for VPN tunnel creation
1
Access control with configurable firewall rules on the LANCOM VPN gateway
1
LANCOM myVPN user management and automatic detection of myVPN-enabled LANCOM gateways
1
For version 4.1 iOS devices and later
After its installation, the LANCOM myVPN app retrieves a VPN profile from your LANCOM VPN device and automatically
configures all of the necessary settings on the iOS device. You can then use the internal features of the iOS to establish
a VPN connection to your company network in just a few steps.
Using the Setup Wizard in LANconfig to set up a VPN profile for the LANCOM myVPN app
This is how to use the Setup Wizard to provide an access account for a VPN client on an iOS device:
1. Start LANconfig, for example from the Windows start menu with Start > Programs > LANCOM > LANconfig.
LANconfig now automatically searches the local network for devices.
2. Choose the required device from the selection window in LANconfig and select the Setup Wizard button or use the
menu under Tools > Setup Wizard.
3. Select the item Provide remote access (RAS, VPN) and then click on Next.
You can skip the following information dialog with Next.
818
Reference Manual
11 Virtual Private Networks (VPN)
4. From the drop-down list select the option LANCOM myVPN client and click on Next.
5. Enter a name for this access account and select the address at which the VPN client on the iOS device can reach the
router from the Internet. To continue, click on Next.
The Setup Wizard will suggest a name that you can accept if you wish.
819
Reference Manual
11 Virtual Private Networks (VPN)
6. If you have not yet configured a pool for allocating IP addresses to the connecting VPN devices, the wizard will
prompt you the first time to specify a range of IP addresses for the pool in the following dialog. When connecting,
the VPN device automatically assigns a free IP address to the iOS device from this pool.
5
If you have already configured a pool for allocating IP addresses to the connecting VPN devices, the VPN
device automatically uses an address from the address pool, and the wizard skips the dialog shown here.
7. The Setup Wizard displays the profile name and the PIN that was auto-generated for the VPN client. If you want to
print out the PIN now, select the option Print PIN now. Click on Next.
8. By clicking on Finish the Setup Wizard stores all the settings on the corresponding VPN device. If applicable, it then
starts printing out the myVPN PIN.
The myVPN module now enabled on the selected VPN device. On your iOS device, you can now start the myVPN app
and enter the PIN to retrieve the VPN profile.
Retrieve the VPN profile with the LANCOM myVPN app
This is how you can use the LANCOM myVPN app on your iOS device to retrieve a VPN profile from a LANCOM VPN
device:
5
The purpose of the LANCOM myVPN app is to set up the VPN client on iOS devices with the correct parameters
and in a quick and easy fashion. The establishment of the VPN connection to the company network itself is
handled directly by the VPN client in the iOS device.
820
Reference Manual
11 Virtual Private Networks (VPN)
1. Download the LANCOM myVPN app from the Apple App Store.
2. Open the app on your iPhone or iPad.
821
Reference Manual
11 Virtual Private Networks (VPN)
3. Optional: Enable the option Automatic search to find VPN devices with an activated LANCOM myVPN module,
which are available to iOS devices via WLAN.
5
The iOS device now lists all VPN devices which are accessible via WLAN and which have an active LANCOM
myVPN module. However, the inclusion of an entry in this list does not necessarily mean that your iOS device
can retrieve a LANCOM myVPN profile from this VPN device.
822
Reference Manual
11 Virtual Private Networks (VPN)
4. Optional: Select the option Add device manually to enter the IP address or name of VPN devices that the iOS device
can access via an Internet connection (3G or WLAN). In the dialog that follows, enter the IP address or the name of
the VPN device and confirm with Yes.
5. The app now displays all VPN devices that offer profiles for the LANCOM myVPN app.
823
Reference Manual
11 Virtual Private Networks (VPN)
6. Tap on the entry in the list to select the desired VPN device and then enter the PIN required for retrieving the VPN
profile.
5
If you enter your PIN incorrectly 5 times, the myVPN module on the LANCOM VPN device will be completely
locked for a specific time period. In this state, VPN connections remain possible for iOS devices that previously
set up their VPN access accounts successfully. However, iOS devices cannot retrieve myVPN profiles from
this VPN device so long as the lock is in place. An administrator can re-enable the myVPN module.
824
Reference Manual
11 Virtual Private Networks (VPN)
7. If the following dialog contains a notice about an unsigned certificate, simply confirm it with Yes.
8. In the next dialog, confirm the request to install the profile with the Install button.
825
Reference Manual
11 Virtual Private Networks (VPN)
Confirm the necessary changes to the settings on your iOS device.
9. The next step of the installation routine is to enter the password for the VPN access account. By default, the VPN
password is the PIN for the myVPN profile. If you enter the password for the VPN access account here, the iOS device
can establish a VPN connection to your company network without requesting a password. If you leave the box for
the VPN password empty, you will be asked for the VPN password every time you connect using the iOS device.
Confirm your selection with the Next button.
5
For security reasons we recommend that you do not save the VPN access password on the device, but that
you enter it each time you wish to connect.
826
Reference Manual
11 Virtual Private Networks (VPN)
10. The VPN profile is now fully installed on your iOS device and is ready for setting up a VPN connection to your company
network. Confirm that the installation has been concluded by clicking on the Complete button.
Once installed on an iOS device, the LANCOM VPN device disables the installation routine for this myVPN profile. You
can check your status with LANconfig by navigating to the configuration area VPN > myVPN and viewing the myVPN
accounts list:
5
By disabling the myVPN profile, other IOS device are prevented from installing the same myVPN profile and thus
using the same VPN access credentials. However, disabling the myVPN profile has no effect on the VPN connection
itself.
Opening and closing the VPN connection on the iOS device
After you have installed the VPN profile on your iOS device with the LANCOM myVPN app, you open and close the VPN
connection to your company network as follows:
1. Enable the VPN tunnel in the configuration area Settings under the option VPN.
827
Reference Manual
11 Virtual Private Networks (VPN)
2. The following dialog already displays the user name from the myVPN profile. Enter the password for the VPN
connection and confirm with OK.
5
By default, the password for the VPN connection is the PIN for the myVPN profile.
5
The password does not have to be entered if you entered it while installing the myVPN profile for the VPN
connection. In this case, this window is not displayed, and the connection will be established immediately.
3. Close the VPN connection on your iOS device in the configuration area Settings under the option VPN.
Deleting a VPN profile from the iOS device
To delete the VPN profile from your iOS device:
1. Navigate to Settings > General > Profiles to the list of available profiles on your iOS device.
828
Reference Manual
11 Virtual Private Networks (VPN)
2. Select the profile, click on Delete and confirm the action again in the next dialog with Delete.
829
Reference Manual
11 Virtual Private Networks (VPN)
Enhancements to LANconfig
Configuring the LANCOM myVPN app
Under VPN > myVPN you can manually adjust the settings for the LANCOM myVPN app.
Check the myVPN enabled box to allow the LANCOM myVPN app to load a VPN profile.
Specify the Device name here if a trusted SSL certificate is installed on this device. This ensures that the IOS device does
not issue a warning about an untrusted certificate when the profile is retrieved.
Use the field Remote gateway to enter the WAN address of the router or its name as resolved by public DNS servers.
If not found automatically, enter the remote gateway into the LANCOM myVPN app.
Specify the PIN length to be used by the setup wizard for generating new PINs (default = 4).
You can allow or prevent the profile download via WAN connections.
You can limit the number of login failures accepted by the myVPN app in the field Lock profile downlod after.
Activate the option Send myVPN notifications by SYSLOG to send messages about the myVPN app to SYSLOG.
Activate the option Send myVPN notifications by e-mail to send messages about the myVPN app to a specified e-mail
address.
These messages include:
1
Successful profile retrieval
1
Disabled login for LANCOM myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
Specify the E-mail address to which messages about the LANCOM myVPN app are to be sent.
5
E-mail must be configured on the VPN device.
830
Reference Manual
11 Virtual Private Networks (VPN)
The item myVPN accounts is used to assign the myVPN PIN to the VPN profiles.
Here you determine which VPN profile is to supply data to the myVPN app upon retrieval of the profile.
You set the myVPN PIN that is to be entered when the LANCOM myVPN app is to retrieve the profile.
5
Security notice: As a security feature of myVPN, the repeated incorrect entry of a PIN causes the device to
temporarily disable profile retrieval, and a notification is sent by SYSLOG and by e-mail. After three failed attempts,
the device disables profile retrieval for 15 minutes. After five further failed attempts, profile retrieval is disabled
for a day. In case of further failed attempts, the time periods vary. Manually releasing this lock resets the
corresponding counter. Please also be aware that an attempt to retrieve the profile while access is deactivated
(e. g. when the profile has previously been retrieved successfully) is also considered by the device to be a failed
attempt.
You activate the profile by checking the Account enabled box.
5
After the profile has been retrieved successfully, the device automatically disables the corresponding profile to
avoid the repeated download by another device.
Once you save these settings to the device, the myVPN module is active on the selected VPN device. On your iOS device,
you can now start the LANCOM myVPN app and enter the PIN to retrieve the VPN profile.
Additions to the menu system
myVPN
The "myVPN" function is used by devices with the iOS operating system to automatically retrieve VPN profiles and take
over the configuration of the internal VPN client. You configure the VPN profile and the parameters for myVPN on the
router. With the aid of the LANCOM myVPN app and a suitable PIN, you can configure your device for VPN connection
in just a few easy steps.
More information on the myVPN app is available on the
LANCOM homepage
.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Operating
Use this switch to activate myVPN for this device.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Yes
No
831
Reference Manual
11 Virtual Private Networks (VPN)
Default:
No
PIN length
This item sets the length of new PINs generated by the setup wizard.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Maximum length: 12
Minimum length: 4
Default:
4
Device hostname
Enter the device name here if a trustworthy SSL certificate is installed on this device. This ensures that the iOS device
does not issue a warning about an untrusted certificate when the profile is retrieved.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 31 characters from
0-9
a-z
A-Z
#@{|}~!$%&'()*+-,/:;<=>?[\]^_.`
Default:
Blank
Mapping
This table assigns the myVPN PIN to the VPN profiles.
Telnet path:
Telnet path:Setup > Vpn > myVPN
PIN
This is where you can store the PIN for retrieving the myVPN app profile.
The myVPN setup wizard also uses this PIN in the PPP list for the actual VPN login. If you change your PIN here, you
must also change it in LANconfig under Communication > Protocols > PPP-list if you wish to avoid having a different
PIN.
832
Reference Manual
11 Virtual Private Networks (VPN)
5
Security notice: As a security feature of myVPN, the repeated incorrect entry of a PIN causes the device to
temporarily disable profile retrieval, and a notification is sent by SYSLOG and by e-mail. After three failed attempts,
the device disables profile retrieval for 15 minutes. After three further failed attempts the device disables profile
retrieval for 24 hours. In case of further failed attempts, the time periods vary. Manually releasing this lock resets
the corresponding counter. Please also be aware that an attempt to retrieve the profile while access is deactivated
(e. g. when the profile has previously been retrieved successfully) is also considered by the device to be a failed
attempt.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
Max. 12 digits from 1234567890
Default:
Blank
VPN profile
This setting determines which VPN profile the myVPN app should retrieve.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
16 characters from
0-9
a-z
A-Z
@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
Blank
Active
This switch activates the profile retrieval by means of the myVPN app. After the profile has been retrieved successfully,
the device automatically disables the corresponding profile to avoid the repeated download by another device.
Telnet path:
Telnet path:Setup > Vpn > myVPN > Mapping
Possible values:
No
Yes
Default:
No
833
Reference Manual
11 Virtual Private Networks (VPN)
Re-enable login
The command do re-enable-login releases the lock that was caused by failed attempts. If required, this
generates a message about the re-enabling via SYSLOG or e-mail.
Telnet path:
Telnet path:Setup > Vpn > myVPN
E-mail notification
Enable this option to send messages about the myVPN app to a specific e-mail address. These messages include:
1
Successful profile retrieval
1
Disabled login for myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
No
Yes
Default:
No
E-mail address
Specify the e-mail address to which messages about the myVPN app are to be sent.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 63 characters from
0-9
a-z
A-Z
@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
Blank
SYSLOG
Enable this option to send messages about the myVPN app to SYSLOG. These messages include:
1
Successful profile retrieval
1
Disabled login for myVPN due to too many failed attempts
1
Re-enabling of the login (irrespective of whether this is done manually or if the specified time period has expired)
834
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
No
Yes
Default:
No
Remote gateway
Here you enter the WAN address of the router or its name as resolved by public DNS servers. If the myVPN app cannot
find the remote gateway by means of automatic search, you should enter the gateway into the app as well.
Telnet path:
Telnet path:Setup > Vpn > myVPN
Possible values:
Max. 63 characters from
0-9
a-z
A-Z
#@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
Blank
Error count for login block
This parameter limits the number of failed logins for the myVPN application.
If the user exceeds the maximum number of failed attempts, the device will lock access for 15 minutes the first time,
and for 24 hours the second time.
The console command Re-enable-login removes these blocks (see
Re-enable login
.
Telnet path:
Setup > Vpn > myVPN
Possible values:
5-30
Default:
5
Allow access from WAN
This parameter allows or prevents the user from downloading myVPN profiles from the WAN.
835
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > Vpn > myVPN
Possible values:
Yes
No
Default:
Yes
11.18.6 Intelligent precalculation of DH keys
The negotiation of a VPN connection is based on the creation of keys according to the Diffie-Hellman method. Depending
on the key length, however, calculating a DH key can take some time. If a VPN gateway with 100 VPN connections
temporarily loses its Internet connection, recalculating these 100 DH keys may take a while before all of the VPN clients
can establish a connection to the VPN gateway again.
With the precalculation of DH keys, the device can accelerate the renegotiation of VPN connections:
The precalculation of keys has a low priority. When the CPU of the device is not busy with other, higher priority tasks, it
builds up a stock of public DH keys.
Additions to the Setup menu
VPN
This menu contains the configuration of the Virtual Private Network (VPN).
Telnet path:
Setup
Isakmp
This menu contains the configuration of the Isakmp.
Telnet path:
Setup > VPN
DH groups
This menu contains the configuration for the precalculation of DH keys.
Telnet path:
Setup > VPN > Isakmp
Precalculation
This option enables or disables the precalculation of DH keys.
Telnet path:
Setup > VPN > Isakmp > DH-Groups
836
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
Yes
No
Default:
Yes
Group config
This table specifies the number of DH keys to calculate for each DH group.
Telnet path:
Setup > VPN > Isakmp > DH-Groups
DH group
This value indicates the corresponding DH group.
Telnet path:
Setup > VPN > Isakmp > DH-Groups > Group-config
Possible values:
1
2
5
14
Default:
A DH group is fixed for each line.
Precalculation target
This value specifies the number of DH keys to be calculated for this DH group.
5
If you don't specify a value here but you have enabled precalculation, the device will take the number from the
policies stored in the SPD table (Security Policy Definitions).
Telnet path:
Setup > VPN > Isakmp > DH-Groups > Group-config
Possible values:
Max. 9 characters from
0123456789
Default:
0
837
Reference Manual
11 Virtual Private Networks (VPN)
11.18.7 Additions to the Setup menu
VPN
This menu contains the configuration of the Virtual Private Network (VPN).
Telnet path:
Setup
Aggressive mode IKE group default
This IKE group is used for aggressive-mode connections when the remote address cannot be identified by its IP address
but by a subsequently transmitted ID.
Telnet path:
Setup > VPN
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
Main mode IKE group default
This IKE group is used for main-mode connections when the remote address cannot be identified by its IP address but
by a subsequently transmitted ID.
Telnet path:
Setup > VPN
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
Quick mode PFS group default
This IPSec group is used for simplified dial-in with certificates.
Telnet path:
Setup > VPN
838
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0: No PFS
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
Layer
Define other parameters for the individual VPN connections here.
Telnet path:
Setup > VPN
PFS group
Perfect Forward Secrecy (PFS) is a security feature of encryption algorithms. The PFS group specifies the length of the
Diffie-Hellman key used to encrypt the IKE negotiation.
Telnet path:
Setup > VPN > Layer
Possible values:
0: No PFS
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
Default:
2: MODP-1024
IKE group
The IKE group specifies the length of the Diffie-Hellman key used to encrypt the IKE negotiation.
Telnet path:
Setup > VPN > Layer
Possible values:
1: MODP-768
2: MODP-1024
5: MODP-1536
14: MODP-2048
839
Reference Manual
11 Virtual Private Networks (VPN)
Default:
2: MODP-1024
11.18.8 Enhancements to LANconfig
Selecting the IKE group in LANconfig
In LANconfig, the settings for the default IKE groups are located under VPN > Defaults:
In LANconfig, the settings for the default IKE groups for VPN connections are located under VPN > General > Connection
parameters:
11.19 Addition(s) to LCOS 8.82
11.19.1 Hash function SHA2-256 selectable via LANconfig
As of LCOS version 8.82, you can also select the hash algorithm SHA-2-256 for IKE and IPSec proposals over LANconfig
for devices that are equipped appropriately.
840
Reference Manual
11 Virtual Private Networks (VPN)
An overview of LANCOM VPN
Functions of LANCOM VPN
This section lists all of the functions and properties of LANCOM VPN. Experts in the VPN sector are offered a highly
compressed summary of the performance of the function. Understanding the terminology requires a sound knowledge
of the technical fundamentals of VPN. However, for commissioning and normal operation of the LANCOM VPN, this
information is not required.
1
VPN according to IPSec standard
1
VPN tunnel via leased lines, switched connections and IP networks
1
IKE Main and Aggressive mode
1
LANCOM Dynamic VPN: Public IP addresses can be static or dynamic (establishing a connection with remote sites
using dynamic IP addresses requires ISDN)
1
IPSec protocols ESP, AH and IPCOMP in transport and Tunnel mode
1
Hash algorithms:
2
HMAC-MD5-96, hash length 128 bits
2
HMAC-SHA-1-96, hash length 160 bits
2
HMAC-SHA-2-256, hash length 256 bits
1
Symmetrical encryption methods
2
AES, key lengths of 128, 192 and 256 bits
2
Triple DES, Key length 168 bits
2
Blowfish, key length 128 - 448 bits
2
CAST, key length 128 bits
2
DES, key length 56 bits
1
Compression with "Deflate“ (ZLIB) and LZS
1
IKE config mode
1
IKE with preshared keys
1
IKE with RSA signature and digital certificates (X.509)
1
Key exchange via Oakley, Diffie-Hellman algorithm with a key length of 768 bits, 1024 bits, 1536 bits and 2048 bits
(well known groups 1, 2, 5 und 14)
1
Key management according to ISAKMP
Additions to the Setup menu
IKE authentication algorithm
Hash algorithm for the encryption
Telnet path:
Setup > VPN > Proposals > IKE
Possible values:
MD5
SHA1
SHA2-256
Default:
MD5
841
Reference Manual
11 Virtual Private Networks (VPN)
ESP authentication algorithm
ESP authentication method for this proposal
Telnet path:
Setup > VPN > Proposals > IPSEC
Possible values:
No authentication
HMAC-MD5
HMAC-SHA1
HMAC-SHA2-256
Default:
No authentication
AH authentication algorithm
AH authentication method for this proposal
Telnet path:
Setup > VPN > Proposals > IPSEC
Possible values:
No authentication
HMAC-MD5
HMAC-SHA1
HMAC-SHA2-256
Default:
No authentication
11.20 Addition(s) to LCOS 9.00
11.20.1 VPN remote access wizard in WEBconfig:
As of LCOS 9.00 you have the option of using WEBconfig to create VPN-client dial-in accounts using the LANCOM
Advanced VPN Client or an alternative VPN client. This is possible as the existing Setup-Wizard Provide remote access
has been extended with the VPN option. The setup steps are the same as those for LANconfig.
4
The 1-Click VPN configuration is not available in WEBconfig due to restrictions on browser access.
11.20.2 L2TPv2 (Layer-2 Tunneling Protocol version 2)
With L2TP, an L2TP access concentrator (LAC) tunnels the PPP request from a client via a public connection (e.g. Internet,
ATM, frame relay) to an L2TP network server (LNS). The LNS serves as a gateway to the remote network. There, a connected
RADIUS server initially authenticates the client, if necessary. The LNS then sends the IP address to the LAC and starts
842
Reference Manual
11 Virtual Private Networks (VPN)
the L2TP tunnel. The LAC communicates the IP address to the client. As of this moment, the client has joined the remote
network via an L2TP connection.
Within the firmware, the LAC and the PPP client are collected in a role. Thus a device operating as a LAC starts the control
channel and the PPP session. For network virtualization, multiple PPP sessions are supported in an L2TP tunnel. An
L2TP-enabled device is able to operate as an LAC and also as an LNS.
Data types
L2TP uses two types of data:
Control data
The control data are used to establish, maintain and tear down the tunnel connections. The control data
includes a data-flow control to ensure that the sender and receiver correctly exchange the control data.
Payload data
The payload data are encapsulated in PPP frames, which are exchanged between the LAC and the LNS via
the tunnel. In contrast to the control data, payload data contains no data flow control. Thus there is no
guarantee that the sender and receiver are exchanging data correctly.
Unlike PPTP, which transfers control and payload data via different protocols (TCP and GRE), L2TP only uses UDP for
both data types. You also have the option to operate multiple logical payload-data channels on each control-data channel.
Configuring the L2TP tunnel
With LANconfig, you configure L2TP under Communication > Remote sites.
The tunnel configuration for the control data of an L2TP tunnel to a tunnel endpoint is located under L2TP endpoints.
Name
Name of the tunnel endpoint
IP address
IP address of the tunnel endpoint (IPv4, IPv6, FQDN).
843
Reference Manual
11 Virtual Private Networks (VPN)
Routing tag
The routing tag of the route to the tunnel endpoint
Port
UDP Port
Polling interval
Polling interval in seconds
Host name
Name used by the device to authenticate at the tunnel endpoint
Password
Password used by the device to authenticate at the tunnel endpoint
Authenticate remote end
Enable this option if two tunnel endpoints (LAC and LNS) are required to mutually authenticate one another
before establishing a tunnel. In this case, the tunnel endpoint name and password for this device are configured
as the tunnel endpoint and the option to Authenticate remote end is similarly enabled.
Obfuscate tunnel negotiation
If the tunnel negotiations between the LAC and the LNS are to be encrypted, you enable this option. The two
L2TP partners encrypt and decrypt the L2TP messages with the help certain AVPs (attribute value pairs) of a
common preshared secret.
Under L2TP list, you make the link between the L2TP remote sites and a previously configured tunnel endpoint.
An entry in this table is necessary only under the following conditions:
1
Outgoing connections
1
Incoming connections with an idle timeout not equal to "20" or
1
If incoming links specify the use of a specific tunnel only.
Remote site
Name of the L2TP remote device
L2TP endpoint
Name of the tunnel endpoint used by this remote site.
Short hold time
Determines how long the L2TP tunnel endpoint keeps the tunnel open when inactive.
In the case of incoming tunnel requests, a check is performed either by RADIUS or by means of an entry for the requesting
host in the L2TP endpoints table. If the table contains an entry with the same IP address (or no IP address is specified
for this entry), the device permits tunnel establishment to this host.
844
Reference Manual
11 Virtual Private Networks (VPN)
For additional protection, for example to enable encryption of the L2TP sessions via IPSec, the device can additionally
check the routing tag of the remote site from which it received the data. This option is enabled with L2TP source routing
tag check enabled.
You have the option to configure up to 32 additional gateways per tunnel endpoint by clicking on Further remote
endpoints.
5
Ensure that all additionally specified L2TP endpoints are configured identically to the referenced tunnel endpoint.
Remote site
Name of the tunnel endpoint, as configured in the table of L2TP endpoints.
Begin with L2TP endpoint
Option for selecting the next gateway. The following options are available:
1
Last used: Select the last successful address
1
First: Select the first gateway in the list
1
Random: Random selection from the gateways in the list
On the following tabs you configure the names and the respective routing tags of the alternative gateways.
Authentication via RADIUS
RADIUS authentication for L2TP is possible in two cases:
1
Tunnel authentication: The RADIUS server checks to see whether a LAC is allowed to establish a L2TP connection.
845
Reference Manual
11 Virtual Private Networks (VPN)
1
PPP session: The RADIUS server checks the user data of the corresponding PPP session.
For this reason, the configuration of the RADIUS server for L2TP-tunnel authentication and the PPP user data are carried
out independently of one another.
In the case of tunnel authentication by RADIUS, the settings in LANconfig are configured under Communication >
RADIUS in the section Tunnel authentication via RADIUS for L2TP.
RADIUS server
Enables or disables the RADIUS server for the authentication of the tunnel endpoint, regardless of a PPP-session
authentication. The following options are possible:
1
Deactivated: The RADIUS server is not enabled for the authentication of tunnel endpoints.
1
Activated: The RADIUS server handles the authentication of tunnel endpoints.
1
Exclusive: Enables the use of the external RADIUS server as the only possibility for authenticating PPP
remote sites. The PPP list is ignored.
Protocols
Protocol for communication between the internal RADIUS server and the tunnel endpoint.
Address
IP address or DNS name of the RADIUS server.
Port
The port the RADIUS server
Source address
Optional sender address of the device. If you have configured loopback addresses, these can also be specified
here. Following input formats are allowed:
1
Name of the IP network (ARF network) whose address is to be used instead
1
"INT" for the address of the first intranet
1
"DMZ" for the address of the first DMZ
1
LB0 to LBF for the 16 loopback addresses
1
Any valid IP address
Secret
Shared secret between the RADIUS server and the device
Password
Dummy password for tunnel authentication
If an L2TP tunnel request arrives from a remote host (Start Control Connection Request), the device sends a request to
the RADIUS server that has been enabled for L2TP. This request contains among other things the name of the host, the
dummy password, the IP address of the device, and also the service type "Outbound User". The RADIUS server authenticates
846
Reference Manual
11 Virtual Private Networks (VPN)
the host and sends a "RADIUS accept" to the device together with; the tunnel password to be used; the tunnel type
"L2TP" with the tag "0"; and also the Tunnel-Client-Auth-ID, which must match with the host name transmitted earlier
by the device. The device checks this data and, if the result is positive, it takes the tunnel password to authenticate the
dial-in client and, if applicable, to obfuscate the L2TP tunnel negotiations.
4
Configuring the RADIUS server to authenticate PPP sessions is conducted as described in the section Other
services > RADIUS > Configuration of RADIUS as authenticator or NAS > Dial-in using PPP and RADIUS.
Operation as an L2TP access concentrator (LAC)
In the following example, the device operating as a L2TP access concentrator (LAC) establishes an L2TP tunnel to an
L2TP network server (LNS) with the IP address 192.168.1.66.
Proceed as follows to configure the device as a LAC:
1. Under Communication > Remote sites in the table L2TP endpoints create an entry for an LNS as the remote
L2TP gateway.
2. Enter a name for this site under Communication > Protocols in the table L2TP list and connect it with the L2TP
endpoint you created previously.
It is possible to connect several remote sites with an L2TP tunnel. This allows multiple PPP sessions to be transported
through an L2TP tunnel. For this purpose, configure in this table several remote sites with the same L2TP endpoint.
847
Reference Manual
11 Virtual Private Networks (VPN)
3. Under Communication > Protocols in the table PPP list create an entry for the L2TP tunnel.
4. For this site, go to Configuration > IP router > Routing and create an entry in the corresponding IPv4 or IPv6
routing table.
Operation as the L2TP network server (LNS) for RAS clients
In order to configure the device as the L2TP network server (LNS) for authenticating RAS clients without configuring a
RADIUS server in the device, you have two options:
848
Reference Manual
11 Virtual Private Networks (VPN)
1. Under Communication > Remote sites in the table L2TP endpoints, create an entry "DEFAULT".
The entry for the IP address is "0.0.0.0", because the IP address of the L2TP-LAC is unknown to the device.
2. Then, under Communication > Remote sites in the table L2TP list, configure a "DEFAULT" entry.
If the L2TP tunnel is to be connected permanently, set the short hold time to "9999".
3. Alternatively, you make a separate entry for the RAS client (e.g., "CLIENT") under Communication > Remote sites
in the L2TP endpoints table.
849
Reference Manual
11 Virtual Private Networks (VPN)
4. You then configure a new entry for the client under Communication > Protocols in the PPP list.
Operation as an L2TP network server (LNS) with authentication via RADIUS
In the following example, the device functions as an L2TP network server (LNS). RADIUS is used to authenticate the
incoming L2TP tunnel and the PPP sessions.
Proceed as follows to configure the device as an LNS:
1. Under Communication > Remote sites in the table L2TP endpoints, create an entry "DEFAULT".
2. Then, under Communication > Remote sites in the table L2TP list, configure a "DEFAULT" entry.
850
Reference Manual
11 Virtual Private Networks (VPN)
3. Configure the RADIUS server under Communication > RADIUS.
4
You only configure the lower section Tunnel authentication via RADIUS for L2TP if L2TP tunnel
authentication should be done via the RADIUS server.
4. Configure the RADIUS server in order for it to be able to authenticate the L2TP tunnel and the PPP sessions.
If a LAC needs to authenticate itself at the L2TP tunnel with the station name "router1" and the password "abcde",
you configure the appropriate entry in the RADIUS server (e.g. FreeRADIUS) as follows:
router1 Cleartext-Password := "password"
Service-Type = Outbound-User,
Tunnel-Type = L2TP,
Tunnel-Password = "abcde",
Tunnel-Client-Auth-ID = "router1"
For the authentication of the PPP session of a user with the username "test" and the password "test", you configure
the appropriate entry in the RADIUS server as follows:
test Cleartext-Password := "1234"
Service-Type = Framed-User,
Framed-Protocol = PPP
Additions to the Status menu
L2TP
Layer-2 tunneling protocol
SNMP ID:
1.84
Telnet path:
State
851
Reference Manual
11 Virtual Private Networks (VPN)
Rx-Packets
The number of received packets.
SNMP ID:
1.84.1
Telnet path:
Status > L2TP
Tx-Packets
The number of sent packets.
SNMP ID:
1.84.2
Telnet path:
Status > L2TP
TX retries
Retries on the control channel.
SNMP ID:
1.84.3
Telnet path:
Status > L2TP
Call errors
Number of failed attempts to establish a session.
SNMP ID:
1.84.4
Telnet path:
Status > L2TP
Endpoints
This table contains Information about the currently active tunnels. Once a tunnel has been established it is immediately
deleted from the table, if no error occurred. The error is automatically deleted when the tunnel is established again, or
it can be deleted manually. The syntax for this is: set <Peer> {last error} (none)
852
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
1.84.5
Telnet path:
Status > L2TP
L2TP endpoint
Name of the tunnel endpoint
SNMP ID:
1.84.5.1
Telnet path:
Status > L2TP > Endpoints
State
Current state of the tunnel endpoint.
SNMP ID:
1.84.5.2
Telnet path:
Status > L2TP > Endpoints
Last error
The last detected error.
SNMP ID:
1.84.5.3
Telnet path:
Status > L2TP > Endpoints
Possible values:
(none)
No error
DNS resolution failed
DNS resolution failed
No route to gateway
There is no route to the gateway
853
Reference Manual
11 Virtual Private Networks (VPN)
Invalid gateway address
The gateway IP address is not valid
No response
No response was received from the gateway
Message timeout
A control message was not answered
Tunnel already exists
A tunnel to this gateway already exists
Authorization failed
The authentication failed
Bad protocol version
An incorrect version of L2TP is being used
Shutting down
The device is booting at the moment
State machine error
Generic Error
No tunnel exists
Unknown tunnel ID
Invalid length
Invalid length of a parameter
Invalid value
Invalid value of a parameter
No resources
No resources available
Invalid session ID
Invalid session ID
Vendor-specific error
Vendor-specific error
Try another
Try a different gateway
Unknown mandatory attribute
Unknown mandatory attribute
Unknown
An unknown error occurred
Mode
Active (LAC) or passive (LNS) establishment.
SNMP ID:
1.84.5.4
Telnet path:
Status > L2TP > Endpoints
854
Reference Manual
11 Virtual Private Networks (VPN)
Phys. connection
Name of the physical connection used.
SNMP ID:
1.84.5.5
Telnet path:
Status > L2TP > Endpoints
Gateway
Resolved IP address of the current gateway.
SNMP ID:
1.84.5.6
Telnet path:
Status > L2TP > Endpoints
Sessions
Number of connections using the tunnel.
SNMP ID:
1.84.5.7
Telnet path:
Status > L2TP > Endpoints
Conn. time:
This entry shows how long the connection already exists. The query via SNMP returns the connection duration in seconds,
TELNET returns the system time of the connection establishment.
SNMP ID:
1.84.5.8
Telnet path:
Status > L2TP > Endpoints
Embedded error message
Error messages in plain text
855
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
1.84.5.9
Telnet path:
Status > L2TP > Endpoints
Number of endpoints
Number of existing tunnels.
SNMP ID:
1.84.6
Telnet path:
Status > L2TP
Sessions
This table contains Information about the currently active sessions. IPv6 parameters do not appear in the table, they can
be found in the IPv6 statistics for the various interfaces. Once a session has been established it is immediately deleted
from the table, if no error occurred. The error is automatically deleted when the session is established again, or it can
be deleted manually. The syntax for this is: set <Peer> {last error} (none)
SNMP ID:
1.84.7
Telnet path:
Status > L2TP
Remote site
Name of the remote device/session.
SNMP ID:
1.84.7.1
Telnet path:
Status > L2TP > Connections
State
Current connection state of the session.
856
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
1.84.7.2
Telnet path:
Status > L2TP > Connections
Last error
The last recorded error.
SNMP ID:
1.84.7.3
Telnet path:
Status > L2TP > Connections
Mode
Indication of whether session establishment was active or passive.
SNMP ID:
1.84.7.4
Telnet path:
Status > L2TP > Connections
SH-Time
Session idle timeout.
SNMP ID:
1.84.7.5
Telnet path:
Status > L2TP > Connections
L2TP endpoint
Name of the tunnel being used.
SNMP ID:
1.84.7.6
857
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Status > L2TP > Connections
Peer address
IPv4 address of remote device.
SNMP ID:
1.84.7.7
Telnet path:
Status > L2TP > Connections
IP address
Own IPv4 address.
SNMP ID:
1.84.7.8
Telnet path:
Status > L2TP > Connections
DNS default
IPv4 address of the primary DNS server.
SNMP ID:
1.84.7.9
Telnet path:
Status > L2TP > Connections
DNS backup
IPv4 address of the secondary DNS server.
SNMP ID:
1.84.7.10
Telnet path:
Status > L2TP > Connections
858
Reference Manual
11 Virtual Private Networks (VPN)
NBNS default
IPv6 address of the primary NBNS server.
SNMP ID:
1.84.7.11
Telnet path:
Status > L2TP > Connections
NBNS backup
IPv4 address of the secondary NBNS server.
SNMP ID:
1.84.7.12
Telnet path:
Status > L2TP > Connections
Conn. time:
This entry shows how long the connection already exists. The query via SNMP returns the connection duration in seconds,
TELNET returns the system time of the connection establishment.
SNMP ID:
1.84.7.13
Telnet path:
Status > L2TP > Connections
Number of connections
Number of existing connections.
SNMP ID:
1.84.8
Telnet path:
Status > L2TP
Delete values
Action to reset the counter. Syntax: Do delete-values
859
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
1.84.9
Telnet path:
Status > L2TP
Additions to the Setup menu
L2TP-operating
This item determines whether RADIUS should be used to authenticate the tunnel endpoint.
SNMP ID:
2.2.22.20
Telnet path:
Setup > WAN > RADIUS
Possible values:
No
There is no RADIUS authentication.
Yes
RADIUS authentication occurs if, in the table 'L2TP Endpoints', the field 'Auth-Peer' is set to 'Yes', but
no password was entered.
Exclusive
RADIUS authentication always occurs if, in the table 'L2TP Endpoints', the field 'Auth-Peer' is set to
'Yes', irrespective of whether a password was entered.
Default:
No
L2TP server host name
IP address of the RADIUS server.
5
The internal RADIUS server of the device does not support tunnel authentication. An external RADIUS server is
required for this purpose.
SNMP ID:
2.2.22.21
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
860
Reference Manual
11 Virtual Private Networks (VPN)
L2TP-Auth.-Port
The UDP port of the RADIUS server.
SNMP ID:
2.2.22.22
Telnet path:
Setup > WAN > RADIUS
Possible values:
0 … 65535
L2TP-loopback address
The sender address used for RADIUS requests.
SNMP ID:
2.2.22.23
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
L2TP protocol
The protocol to be used.
SNMP ID:
2.2.22.24
Telnet path:
Setup > WAN > RADIUS
Possible values:
RADIUS
RADSEC
Default:
RADIUS
861
Reference Manual
11 Virtual Private Networks (VPN)
L2TP secret
The shared secret between the router and the RADIUS server.
SNMP ID:
2.2.22.25
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 64 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
L2TP-Password
The password stored together with the host in the RADIUS server. After authentication, the password for the tunnel is
sent by the RADIUS server.
SNMP ID:
2.2.22.26
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 64 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
L2TP endpoints
The table contains the basic settings for the configuration of an L2TP tunnel.
5
To authenticate RAS connections by RADIUS and without configuring a router, this table needs a default entry
with the following values:
Identifier: DEFAULT
Poll: 20
Auth-peer: Yes
Hide: No
All other fields must be left empty. With 'Auth-Peer' set to 'No' in the DEFAULT entry, all hosts will be accepted
unchecked and only the PPP sessions are authenticated.
SNMP ID:
2.2.35
Telnet path:
Setup > WAN
862
Reference Manual
11 Virtual Private Networks (VPN)
Identifier
The name of the tunnel endpoint. If an authenticated L2TP tunnel is to be established between two devices, the entries
'Identifier' and 'Hostname' need to cross match.
SNMP ID:
2.2.35.1
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
IP address
The IP address of the tunnel endpoint. An FQDN can be specified instead of an IP address (IPv4 or IPv6).
SNMP ID:
2.2.35.2
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg tag
The tag assigned to the route to the tunnel endpoint is specified here.
SNMP ID:
2.2.35.3
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
0 … 65535
Port
UDP port to be used.
SNMP ID:
2.2.35.4
863
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
0 … 65535
Default:
1701
Poll
The polling interval in seconds.
SNMP ID:
2.2.35.5
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
0 … 65535
Default:
20
Host name
User name for the authentication If an authenticated L2TP tunnel is to be established between two devices, the entries
'Identifier' and 'Hostname' need to cross match.
SNMP ID:
2.2.35.6
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
Max. 64 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Password
The password for the authentication This is also used to hide the tunnel negotiations, if the function is activated.
SNMP ID:
2.2.35.7
864
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
Max. 32 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Auth-Peer
Specifies whether the remote station should be authenticated.
SNMP ID:
2.2.35.8
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
No
Yes
Default:
No
Hide
Specifies whether tunnel negotiations should be hidden by using the specified password.
SNMP ID:
2.2.35.9
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
No
Yes
Default:
No
L2TP additional gateways
This table allows you to specify up to 32 redundant gateways for each L2TP tunnel.
865
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36
Telnet path:
Setup > WAN
Identifier
The name of the tunnel endpoint as also used in the table of L2TP endpoints.
SNMP ID:
2.2.36.1
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Begin with
This setting specifies which redundant gateway is used first.
SNMP ID:
2.2.36.2
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Last used
This selects the last successfully used gateway.
first
This always selects the first gateway.
random
A random gateway is selected at each attempt.
Default:
Last used
Gateway-1
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
866
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.3
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-1
The routing tag of the route where Gateway-1 can be reached.
SNMP ID:
2.2.36.4
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-2
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.5
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-2
The routing tag of the route where Gateway-29 can be reached.
SNMP ID:
2.2.36.6
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
867
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0 … 65535
Gateway-3
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.7
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-3
The routing tag of the route where Gateway-3 can be reached.
SNMP ID:
2.2.36.8
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-4
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.9
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-4
The routing tag of the route where Gateway-4 can be reached.
868
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.10
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-5
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.11
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-5
The routing tag of the route where Gateway-5 can be reached.
SNMP ID:
2.2.36.12
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-6
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.13
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
869
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-6
The routing tag of the route where Gateway-6 can be reached.
SNMP ID:
2.2.36.14
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-7
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.15
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-7
The routing tag of the route where Gateway-7 can be reached.
SNMP ID:
2.2.36.16
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-8
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
870
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.17
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-8
The routing tag of the route where Gateway-8 can be reached.
SNMP ID:
2.2.36.18
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-9
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.19
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-9
The routing tag of the route where Gateway-9 can be reached.
SNMP ID:
2.2.36.20
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
871
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0 … 65535
Gateway-10
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.21
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-10
The routing tag of the route where Gateway-10 can be reached.
SNMP ID:
2.2.36.22
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-11
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.23
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-11
The routing tag of the route where Gateway-11 can be reached.
872
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.24
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-12
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.25
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-12
The routing tag of the route where Gateway-12 can be reached.
SNMP ID:
2.2.36.26
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-13
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.27
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
873
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-13
The routing tag of the route where Gateway-13 can be reached.
SNMP ID:
2.2.36.28
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-14
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.29
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-14
The routing tag of the route where Gateway-14 can be reached.
SNMP ID:
2.2.36.30
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-15
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
874
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.31
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-15
The routing tag of the route where Gateway-15 can be reached.
SNMP ID:
2.2.36.32
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-16
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.33
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-16
The routing tag of the route where Gateway-16 can be reached.
SNMP ID:
2.2.36.34
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
875
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0 … 65535
Gateway-17
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.35
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-17
The routing tag of the route where Gateway-17 can be reached.
SNMP ID:
2.2.36.36
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-18
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.37
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-18
The routing tag of the route where Gateway-18 can be reached.
876
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.38
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-19
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.39
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-19
The routing tag of the route where Gateway-19 can be reached.
SNMP ID:
2.2.36.40
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-20
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.41
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
877
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-20
The routing tag of the route where Gateway 20 can be reached.
SNMP ID:
2.2.36.42
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-21
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.43
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-21
The routing tag of the route where Gateway-21 can be reached.
SNMP ID:
2.2.36.44
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-22
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
878
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.45
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-22
The routing tag of the route where Gateway-22 can be reached.
SNMP ID:
2.2.36.46
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-23
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.47
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-23
The routing tag of the route where Gateway-23 can be reached.
SNMP ID:
2.2.36.48
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
879
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0 … 65535
Gateway-24
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.49
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-24
The routing tag of the route where Gateway-24 can be reached.
SNMP ID:
2.2.36.50
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-25
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.51
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-25
The routing tag of the route where Gateway-25 can be reached.
880
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.52
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-26
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.53
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-26
The routing tag of the route where Gateway-26 can be reached.
SNMP ID:
2.2.36.54
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-27
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.55
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
881
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-27
The routing tag of the route where Gateway-27 can be reached.
SNMP ID:
2.2.36.56
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-28
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.57
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-28
The routing tag of the route where Gateway-28 can be reached.
SNMP ID:
2.2.36.58
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-29
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
882
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.59
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-29
The routing tag of the route where Gateway-29 can be reached.
SNMP ID:
2.2.36.60
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-30
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.61
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-30
The routing tag of the route where Gateway-30 can be reached.
SNMP ID:
2.2.36.62
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
883
Reference Manual
11 Virtual Private Networks (VPN)
Possible values:
0 … 65535
Gateway-31
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.63
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-31
The routing tag of the route where Gateway-31 can be reached.
SNMP ID:
2.2.36.64
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
Gateway-32
The first alternative IP address (IPv4 or IPv6) or FQDN of the tunnel endpoint.
SNMP ID:
2.2.36.65
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Rtg-Tag-32
The routing tag of the route where Gateway-32 can be reached.
884
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.36.66
Telnet path:
Setup > WAN > L2TP-Additional-Gateways
Possible values:
0 … 65535
L2TP-Peers
In this table, the tunnel endpoints are linked with the L2TP remote stations that are used in the routing table. An entry
in this table is required for outgoing connections if an incoming session should be assigned an idle timeout not equal
to zero, or if the use of a particular tunnel is to be forced.
SNMP ID:
2.2.37
Telnet path:
Setup > WAN
Remote site
Name of the L2TP remote station.
SNMP ID:
2.2.37.1
Telnet path:
Setup > WAN > L2TP-Peers
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
L2TP endpoint
Name of the tunnel endpoint
SNMP ID:
2.2.37.2
Telnet path:
Setup > WAN > L2TP-Peers
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
885
Reference Manual
11 Virtual Private Networks (VPN)
SH-Time
Idle timeout in seconds.
SNMP ID:
2.2.37.3
Telnet path:
Setup > WAN > L2TP-Peers
Possible values:
0 … 9999
L2TP-Source-Check
The default setting checks the sender address of an incoming tunnel. The tunnel is established if the address is part of
the configured gateway for the tunnel or if no gateways have been configured at all. It is also possible to check the
routing tag of incoming packets. Note that only routing tags not equal to zero will be checked.
SNMP ID:
2.2.38
Telnet path:
Setup > WAN
Possible values:
Address
Tag+address
Default:
Address
11.20.3 Support of the DH groups 15 and 16
As of version 9.00, for the encryption of VPN connections LANconfig offers you improved options for key exchange
according to the Diffie-Hellmann algorithm. The DH groups 15 and 16 can be used for this on compatible devices. The
relevant settings are located in the configuration menu under VPN > General > Connection parameters > Addand
also under VPN > Defaults.
Additions to the Setup menu
IKE-Auth-Alg
Hash algorithm for the encryption. The available values depend on the device you want to configure.
SNMP ID:
2.19.4.11.4
886
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > VPN > Proposals > IKE
Possible values:
MD5
SHA1
SHA2-256
SHA2-384
SHA2-512
Default:
MD5
DH group
This value displays the corresponding DH group.
SNMP ID:
2.19.3.29.2.1
Telnet path:
Setup > VPN > Isakmp > DH-Groups > Group-config
Possible values:
Selection from the list of predefined DH groups
PFS-Grp
Perfect Forward Secrecy (PFS) is a security feature of encryption algorithms. The PFS group specifies the length of the
Diffie-Hellman key used to encrypt the IKE negotiation.
SNMP ID:
2.19.7.3
Telnet path:
Setup > VPN > Layer
Possible values:
0
No PFS
1
MODP-768
2
MODP-1024
887
Reference Manual
11 Virtual Private Networks (VPN)
5
MODP-1536
14
MODP-2048
15
MODP-3072
16
MODP-4096
Default:
14
IKE-Grp
The IKE group specifies the length of the Diffie-Hellman key used to encrypt the IKE negotiation.
SNMP ID:
2.19.7.4
Telnet path:
Setup > VPN > Layer
Possible values:
1
MODP-768
2
MODP-1024
5
MODP-1536
14
MODP-2048
15
MODP-3072
16
MODP-4096
Default:
2
AggrMode-IKE-Group-Default
This IKE group is used for aggressive-mode connections when the remote address cannot be identified by its IP address
but by a subsequently transmitted ID.
888
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.19.11
Telnet path:
Setup > VPN
Possible values:
1
MODP-768
2
MODP-1024
5
MODP-1536
14
MODP-2048
15
MODP-3072
16
MODP-4096
Default:
2
MainMode-IKE-Group-Default
This IKE group is used for main-mode connections when the remote address cannot be identified by its IP address but
by a subsequently transmitted ID.
SNMP ID:
2.19.14
Telnet path:
Setup > VPN
Possible values:
1
MODP-768
2
MODP-1024
5
MODP-1536
14
MODP-2048
15
MODP-3072
889
Reference Manual
11 Virtual Private Networks (VPN)
16
MODP-4096
Default:
2
QuickMode-PFS-Group-Default
This IPSec group is used for simplified dial-in with certificates.
SNMP ID:
2.19.20
Telnet path:
Setup > VPN
Possible values:
0
No PFS
1
MODP-768
2
MODP-1024
5
MODP-1536
14
MODP-2048
15
MODP-3072
16
MODP-4096
Default:
2
11.21 Addition(s) to LCOS 9.10
11.21.1 SCEP-CA function in VPN environments
As of LCOS version 9.10, it is possible to use the existing CA with SCEP function in the VPN environment.
890
Reference Manual
11 Virtual Private Networks (VPN)
11.21.2 SCEP algorithms updated
As of LCOS version 9.10, the SCEP client and server additionally support AES192 and AES256 and also SHA256, SHA384,
and SHA512.
4
The default entries remain unchanged so as to maintain compatibility with the remote stations in the event of
a firmware update. Only use the latest algorithms when the remote stations have also been updated accordingly.
Configuring the CAs
The configuration is carried out with LANconfig under Certificates > SCEP client with the button CA table.
Name
Configuration name of the CA.
URL
URL of the CA.
Distinguished name
Distinguished name of the CA. With this parameter the CAs are assigned to system certificates (and vice versa)
on the one hand. On the other hand this parameter is also important for evaluating whether received or
available certificates match with the configuration.
You can also use reserved characters by using a preceding backslash ("\"). The supported reserved characters
are:
1
Comma (",")
1
Slash ("/")
1
Plus ("+")
1
Semicolon (";")
1
Equals ("=")
You can also use the following internal firmware variables:
1
%% inserts a percent sign.
1
%f inserts the version and the date of the firmware currently active in the device.
1
%r inserts the hardware release of the device.
1
%v inserts the version of the loader currently active in the device.
1
%m inserts the MAC address of the device.
1
%s inserts the serial number of the device.
891
Reference Manual
11 Virtual Private Networks (VPN)
1
%n inserts the name of the device.
1
%l inserts the location of the device.
1
%d inserts the type of the device.
Identifier
CA identifier (as required by some web server to identify the CA).
Encryption algorithm
This algorithm encrypts the payload of the certificate request. Possible values are:
1
DES (Default)
1
3-DES
1
Blowfish
1
AES128
1
AES192
1
AES256
Signature algorithm
The certificate request is signed with this algorithm. Possible values are:
1
MD5 (default)
1
SHA1
1
SHA256
1
SHA384
1
SHA512
Fingerprint algorithm
Algorithm for signing the fingerprint. This determines whether the CA certificate is to be checked by means
of fingerprint, and which algorithm is used for this. The CA fingerprint has to agree with the checksum which
results when this algorithm is applied. Possible values are:
1
Off (default)
1
MD5
1
SHA1
1
SHA256
1
SHA384
1
SHA512
Fingerprint
The authenticity of a received CA certificate can be checked by means of the the checksum (fingerprint) entered
here (corresponding to the set CA fingerprint algorithm).
Usage type
Indicates the intended application of the specified CA. The CA entered here is only queried for the corresponding
application. Possible values are:
1
VPN
1
EAP/TLS
1
WLAN controller
1
General
5
If a general CA exists no further CAs can be configured. Otherwise the choice of CA would be unclear.
892
Reference Manual
11 Virtual Private Networks (VPN)
RA autoapprove
Some CAs provide the option of using an earlier certificate issued by this CA as proof of authenticity for future
requests. This option defines whether an existing system certificate should be used to sign new requests.
Possible values are:
1
Yes
1
No (Default)
Source address
This is where you configure an optional source address to be used instead of the one otherwise automatically
selected for the source address. If you have configured loopback addresses, you can specify them here as
source address.
You can enter an address in various forms:
1
Name of the IP network (ARF network), whose address should be used.
1
"INT" for the address of the first intranet.
1
"DMZ" for the address of the first DMZ (Note: If there is an interface named "DMZ", its address will be
taken).
1
LB0 ... LBF for one of the 16 loopback addresses or its name
1
Furthermore, any IP address can be entered in the form x.x.x.x.
4
If the source address set here is a loopback address, these will be used unmasked on the remote
client.
Additions to the Setup menu
Enc-Alg
The encryption algorithm is specified here as used by the SCEP protocol (Simple Certificate Enrollment Protocol). Both
the certification authority (CA) and the certificate holder (client) must support the algorithm. A number of methods are
available:
4
If possible you should employ one of the last methods (3DES, BLOWFISH, AES) if the certification authority (CA)
and all the clients support it. The default value here is DES encryption to ensure interoperability.
SNMP ID:
2.39.1.14.4
Telnet path:
Setup > Certificates > SCEP-Client > CAs
Possible values:
DES
Data Encryption Standard: The DES algorithm uses a 64-bit key. This is the SCEP standard encryption.
DES is an algorithm developed by the National Bureau of Standards (NBS) in the USA. The DES algorithm
uses a 64-bit key which allows combinations of a substitution cipher, transposition cipher and
exclusive-OR (XOR) operations. The 64-bit block size consists of an effective key length of 56 bits and
8 parity bits. The algorithm is based on the Lucifer cipher.
3DES
Triple-DES: This is an improved method of DES encryption using two keys of 64-bits in length.
893
Reference Manual
11 Virtual Private Networks (VPN)
BLOWFISH
The BLOWFISH algorithm works with a variable key length of between 32 and 448 bits. It is a fast and
highly secure algorithm. It has major advantages over other symmetrical methods such as DES and
3DES.
AES
Advanced Encryption Standard: The AES algorithm has a variable block size of 128, 192 or 256 bits and
a variable key length of 128, 192 or 256 bits, providing a very high level of security.
Default:
DES
CA signature algorithm
Here you select the signature algorithm used by the Certificate Authority (CA) to sign the certificate. This method must
be supported by the certification authority (CA) and the certificate recipient (client) as the client uses this signature to
check the integrity of the certificate. Two cryptographic hash functions are relatively widespread.
SNMP ID:
2.39.1.14.6
Telnet path:
Setup > Certificates > SCEP-Client > CAs
Possible values:
MD5
Message Digest Algorithm 5: The MD5 algorithm generates a 128-bit hash value. MD5 was developed
in 1991 by Ronald L. Rivest. The results reveal no conclusive information about the key. This method
takes a message of any length to generate a 128-bit message digest, which is attached to the unencrypted
message. The recipient compares the message digest with that determined from the information.
SHA1
Secure Hash Algorithm 1: The SHA1 algorithm generates a 160-bit hash value. This is used to calculate
a unique checksum for any data. Generally this data makes up messages. It is practically impossible to
come across two messages with exactly the same SHA value.
SHA256
Like SHA1 but with a 256-bit hash value.
SHA384
Like SHA1 but with a 384-bit hash value.
SHA512
Like SHA1 but with a 512-bit hash value.
Default:
MD5
894
Reference Manual
11 Virtual Private Networks (VPN)
CA fingerprint algorithm
Here you select the fingerprint algorithm that the Certificate Authority (CA) uses to calculate the signature's fingerprint.
Both the certification authority (CA) and the certificate holder (client) must support the algorithm.
The fingerprint is a hash value of data (key, certificate, etc.), i.e. a short number string that can be used to check the
integrity of the data.
SNMP ID:
2.39.1.14.8
Telnet path:
Setup > Certificates > SCEP-Client > CAs
Possible values:
Off
MD5
Message Digest Algorithm 5: The MD5 algorithm generates a 128-bit hash value. MD5 was developed
in 1991 by Ronald L. Rivest. The results reveal no conclusive information about the key. This method
takes a message of any length to generate a 128-bit message digest, which is attached to the unencrypted
message. The recipient compares the message digest with that determined from the information.
SHA1
Secure Hash Algorithm 1: The SHA1 algorithm generates a 160-bit hash value. This is used to calculate
a unique checksum for any data. Generally this data makes up messages. It is practically impossible to
come across two messages with exactly the same SHA value.
SHA256
Like SHA1 but with a 256-bit hash value.
SHA384
Like SHA1 but with a 384-bit hash value.
SHA512
Like SHA1 but with a 512-bit hash value.
Default:
MD5
Encryption algorithm
The encryption algorithm is specified here as used by the SCEP protocol (Simple Certificate Enrollment Protocol). Both
the certification authority (CA) and the certificate holder (client) must support the algorithm. A number of methods are
available:
4
If possible you should employ one of the last methods (3DES, BLOWFISH, AES) if the certification authority (CA)
and all the clients support it. The default value here is DES encryption to ensure interoperability.
SNMP ID:
2.39.2.3
895
Reference Manual
11 Virtual Private Networks (VPN)
Telnet path:
Setup > Certificates > SCEP-CA
Possible values:
DES
Data Encryption Standard: The DES algorithm uses a 64-bit key. This is the SCEP standard encryption.
DES is an algorithm developed by the National Bureau of Standards (NBS) in the USA. The DES algorithm
uses a 64-bit key which allows combinations of a substitution cipher, transposition cipher and
exclusive-OR (XOR) operations. The 64-bit block size consists of an effective key length of 56 bits and
8 parity bits. The algorithm is based on the Lucifer cipher.
3DES
Triple-DES: This is an improved method of DES encryption using two keys of 64-bits in length.
BLOWFISH
The BLOWFISH algorithm works with a variable key length of between 32 and 448 bits. It is a fast and
highly secure algorithm. It has major advantages over other symmetrical methods such as DES and
3DES.
AES
Advanced Encryption Standard: The AES algorithm has a variable block size of 128, 192 or 256 bits and
a variable key length of 128, 192 or 256 bits, providing a very high level of security.
Default:
DES
Signature algorithm
Here you select the signature algorithm used by the Certificate Authority (CA) to sign the certificate. This method must
be supported by the certification authority (CA) and the certificate recipient (client) as the client uses this signature to
check the integrity of the certificate. Two cryptographic hash functions are relatively widespread.
SNMP ID:
2.39.2.6
Telnet path:
Setup > Certificates > SCEP-CA
Possible values:
MD5
Message Digest Algorithm 5: The MD5 algorithm generates a 128-bit hash value. MD5 was developed
in 1991 by Ronald L. Rivest. The results reveal no conclusive information about the key. This method
takes a message of any length to generate a 128-bit message digest, which is attached to the unencrypted
message. The recipient compares the message digest with that determined from the information.
SHA1
Secure Hash Algorithm 1: The SHA1 algorithm generates a 160-bit hash value. This is used to calculate
a unique checksum for any data. Generally this data makes up messages. It is practically impossible to
come across two messages with exactly the same SHA value.
896
Reference Manual
11 Virtual Private Networks (VPN)
SHA256
Like SHA1 but with a 256-bit hash value.
SHA384
Like SHA1 but with a 384-bit hash value.
SHA512
Like SHA1 but with a 512-bit hash value.
Default:
MD5
Fingerprint algorithm
Here you select the fingerprint algorithm that the Certificate Authority (CA) uses to calculate the signature's fingerprint.
Both the certification authority (CA) and the certificate holder (client) must support the algorithm.
The fingerprint is a hash value of data (key, certificate, etc.), i.e. a short number string that can be used to check the
integrity of the data.
SNMP ID:
2.39.2.7
Telnet path:
Setup > Certificates > SCEP-CA
Possible values:
MD5
Message Digest Algorithm 5: The MD5 algorithm generates a 128-bit hash value. MD5 was developed
in 1991 by Ronald L. Rivest. The results reveal no conclusive information about the key. This method
takes a message of any length to generate a 128-bit message digest, which is attached to the unencrypted
message. The recipient compares the message digest with that determined from the information.
SHA1
Secure Hash Algorithm 1: The SHA1 algorithm generates a 160-bit hash value. This is used to calculate
a unique checksum for any data. Generally this data makes up messages. It is practically impossible to
come across two messages with exactly the same SHA value.
SHA256
Like SHA1 but with a 256-bit hash value.
SHA384
Like SHA1 but with a 384-bit hash value.
SHA512
Like SHA1 but with a 512-bit hash value.
Default:
MD5
897
Reference Manual
11 Virtual Private Networks (VPN)
11.21.3 Loopback address for L2TP connections
As of LCOS version 9.10 it is possible to specify a loopback address for L2TP connections.
4
If a loopback address is entered as the source address and the routing tag has a value of "0", the device uses
the routing tag of the loopback address.
Additions to the Setup menu
Source address
Here you can optionally specify a loopback address for the device to use as the target address instead of the one that
would normally be selected automatically.
4
If the list of IP networks or source addresses contains an entry named 'DMZ', then the associated IP address will
be used.
5
If the source address set here is a loopback address, this will be used unmasked even on masked remote clients.
SNMP ID:
2.2.35.10
Telnet path:
Setup > WAN > L2TP-Endpoints
Possible values:
Valid entry from the list of possible addresses.
Name of the IP networks whose addresses are to be used.
"INT" for the address of the first intranet
"DMZ" for the address of the first DMZ
LB0 to LBF for the 16 loopback addresses
Any valid IP address
empty
Default:
11.21.4 Download link for the public portion of the CA certificate
As of LCOS version 9.10, the public part of the CA certificate is available by means of a download link.
898
Reference Manual
11 Virtual Private Networks (VPN)
Download link for the public portion of the CA certificate
You can download the public part of the CA certificate without having to authenticate by using the link
http://<URL>/getcacert/cacert.crt. The transmission uses the MIME type application/x-x
509-ca-cert, so that software with the appropriate functionality will immediately offer to the install the certificate.
4
The download is only possible if the CA is enabled. An error message appears if the CA is disabled.
If the CA is enabled, WEBconfig is also able to download the certificate under Extras > Download current CA certificate.
11.21.5 Configurable one-time password (OTP) for SCEP-CA
As of LCOS version 9.10, it is also possible to create one-time passwords (OTP) for SCEP-CA.
Configuring challenge passwords
In LANconfig, you configure the certificate parameters under Certificates > Certificate handling in the section
Certificate issuing.
Validity period
Here you specify the validity period of the certificate in days.
General challenge password
An additional “Password” can be entered here, which is transmitted to the CA. This can be used by default
to authenticate revocation requests. If CAs operate Microsoft-SCEP (mscep), the one-time passwords issued
by the CA can be entered here for the authentication of requests.
899
Reference Manual
11 Virtual Private Networks (VPN)
The Challenge table contains the certificate recipients' (clients') own passwords.
Distinguished name
The “Distinguished name” must be entered here. With this parameter the CAs are assigned to system certificates
(and vice versa) on the one hand. On the other hand this parameter is also important for evaluating whether
received or available certificates match with the configuration. Separated by commas or forward slashes, this
is a list where the name, department, state and country can be specified for the gateway. The following are
examples of how an entry might appear: CN=myCACN, DC=mscep, DC=ca, C=DE,
ST=berlin, O=myOrg /CN=LANCOM CA/O=LANCOM SYSTEMS/C=DE
MAC address
Enter the MAC address of the client whose password is to be managed by the challenge-password table.
Challenge
Enter the challenge (password) for the client here.
Validity
Enter the validity period of the password here. By selecting “one-time” the password becomes a one-time
password (OTP) so that, for example, it can only be used for authentication once.
Under CA encryption you configure the security parameters for the CA encryption.
Encryption algorithm
The encryption algorithm is specified here as used by the SCEP protocol. Both the certification authority (CA)
and the certificate holder (client) must support the algorithm. The following methods are available:
1
DES
1
3DES
1
BLOWFISH
1
AES128
1
DES192
1
DES256
Signature algorithm
Here you select the signature algorithm used by the Certificate Authority (CA) to sign the certificate. This
method must be supported by the CA and the certificate recipient (client) as the client uses this signature to
check the integrity of the certificate. The following cryptographic hash functions are available for selection:
1
MD5
900
Reference Manual
11 Virtual Private Networks (VPN)
1
SHA1
1
SHA2-256
1
SHA2-384
1
SHA2-512
Fingerprint algorithm
Here you select the fingerprint algorithm that the Certificate Authority (CA) uses to calculate the signature's
fingerprint. Both the CA and the certificate recipient (client) must support the method.
The fingerprint is a hash value of data (key, certificate, etc.), i.e. a short number string that can be used to
check the integrity of the data. The following cryptographic hash functions are available for selection:
1
MD5
1
SHA1
1
SHA2-256
1
SHA2-384
1
SHA2-512
Additions to the Setup menu
Challenge
Enter the validity period of the password here. By selecting “one-time” the password becomes a one-time password
(OTP), so it can only be used for authentication once.
SNMP ID:
2.39.2.5.3.5
Telnet path:
Setup > Certificates > SCEP-CA > CA-certificates > Challenge-Passwords
Possible values:
One-time
Permanent
Default:
Permanent
11.21.6 Deleting VPN error messages in the status table
As of LCOS version 9.10 the device automatically deletes VPN-connection error messages from the status table after a
defined period. By default, this option is disabled (time = 0 minutes).
By default, the device retains the VPN error messages in the status table. Depending on the installation LANmonitor may
display a large number of open error messages, which clutters the display. For this reason the WEBconfig setting under
Setup > Config > Error-Aging-Minutes enables you to define a period of time in minutes after which the device
automatically deletes these error messages from the status table.
4
To document sporadic errors, disable this option with the entry 0.
901
Reference Manual
11 Virtual Private Networks (VPN)
Additions to the Setup menu
Error aging minutes
Here you set the length of time in minutes after which the device deletes VPN errors from the status table.
4
To document sporadic errors, disable this option with the entry 0.
SNMP ID:
2.11.65
Telnet path:
Setup > Config
Possible values:
Max. 4 characters from 0123456789
Default:
0
Special values:
0
Disables this option. Errors will remain in the status table.
11.21.7 IPv4 addresses for VPN tunnels in the IP parameter list
As of LCOS version 9.10, devices supporting VPN manage the IPv4 addresses for VPN tunnels in the IP parameter list.
Additions to the Setup menu
IP-List
If certain remote sites do not automatically transmit the IP parameters needed for a connection, then enter these values
here.
Use this table to configure the extranet address of a VPN tunnel, for example.
SNMP ID:
2.2.20
Telnet path:
Setup > WAN
Remote site
Enter the name for the remote station here.
When configuring a VPN tunnel, this entry corresponds to the appropriate service under Setup > VPN > VPN-Peers or
Setup > VPN > IKEv2 > Connections.
902
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.2.20.1
Telnet path:
Setup > WAN > IP-List
Possible values:
Select from the list of defined peers.
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Masq.-IP-Addr.
Almost all Internet providers usually have the remote device assign a dynamic IP address to your router when it establishes
the connection. If your Internet provider has assigned you static IP addresses, or if you wish to operate masquerading
for your VPN network, you assign it to the respective connection here. If the masquerading IP address is not set, then
the address assigned when the connection was established is used for masquerading.
4
You need to set a masquerading address for a VPN connection if you wish to mask a private network behind this
address in the VPN network.
4
This setting is also necessary if a private address (172.16.x.x) is assigned during PPP negotiation. Normal
masquerading is thus impossible as this type of address is filtered in the Internet.
SNMP ID:
2.2.20.9
Telnet path:
Setup > WAN > IP-List
Possible values:
Valid IPv4 address, max. 15 characters from [0-9].
Default:
0.0.0.0
Masquerading
You can use IP masquerading to hide a hide a logical network behind a single address (that of the router). If, for example,
you have an Internet connection, you can us it to connect your entire network to the Internet.
Almost all Internet providers usually have the remote device assign a dynamic IP address to your router when it establishes
the connection. If your Internet provider has assigned fixed IP addresses, you can assign them to the relevant connection
in the IP parameter list.
Select “on” to enable IP masquerading for all LAN interfaces. If you wish to assign fixed IP addresses to computers in
the demilitarized zone (DMZ) and yet you still wish to activate IP masquerading for the computers on the other LAN
interfaces (intranet), then select “Intranet”.
If you want this entry to mask a VPN connection, select “on”.
903
Reference Manual
11 Virtual Private Networks (VPN)
SNMP ID:
2.8.2.5
Telnet path:
Setup > IP-Router > IP-Routing-Table
Possible values:
No
IP masking off
On
Intranet and DMZ masquerading
Intranet
Intranet - Intranet masquerading only
Default:
No
Extranet address
In LCOS versions before 9.10, this field contained the IPv4 address used by the local stations to mask their own IP address
in certain scenarios.
As of LCOS version 9.10, masquerading uses the entry under Setup > WAN > IP-List in the field Masq.-IP-Addr..
SNMP ID:
2.19.9.2
Telnet path:
Setup > VPN > VPN-Peers
Possible values:
Max. 15 characters from [0-9].
Default:
empty
904
Reference Manual
11 Virtual Private Networks (VPN)
12 Virtual LANs (VLANs)
12.1 What is a Virtual LAN?
The increasing availability of inexpensive layer 2 switches enables the setup of LANs much larger than in the past. Until
now, smaller parts of a network had been combined with hubs. These individual segments (collision domains) had been
united via routers to larger sections. Since a router represents always a border between two LANs, several LANs with
own IP address ranges arose by this structure.
By using switches, it is possible to combine much more stations to one large LAN. By the specific control of data on the
individual ports, the available bandwidth can be utilized much better than by using hubs, and the configuration and
maintenance of routers within the network can omitted.
But also a network structure based on switches has disadvantages:
1
Broadcasts are sent like hubs over the entire LAN, even if the respective data packets are only important for a certain
segment of the LAN. A sufficient number of network stations can thus lead to a clear reduction of the available
bandwidth in the LAN.
1
The entire data traffic on the physical LAN is “public”. Even if single segments are using different IP address ranges,
each station of the LAN is theoretically able to tap data traffic from all logical networks on the Ethernet segment.
The protection of individual LAN segments with Firewalls or routers increases again the requirements to network
administration.
One possibility to resolve these problems are virtual LANs (VLANs), as described in IEEE 802.1p/q. By this concept, several
virtual LANs are defined on a physical LAN, which do not obstruct each other, and which also do not receive or tap data
traffic of the respective other VLANs on the physical Ethernet segment.
12.2 This is how a VLAN works
By defining VLANs on a LAN the following goals should be achieved:
1
Data traffic of certain logical units should be shielded against other network users.
1
Broadcast traffic should also be reduced to logical units, not bearing a burden on the entire LAN.
1
Data traffic of certain logical units should be transmitted with a specific priority compared to other network users.
An example to clarify: A switch is connected to a hub within a LAN, which connects four stations from the marketing
department to the network. One server and two stations of the accounting department are directly connected to the
switch. The last section is the base station of a wireless network, where four WLAN clients reside from the sales department.
905
Reference Manual
12 Virtual LANs (VLANs)
The stations from marketing and sales should be able to communicate with each other. Additionally, they should be able
to access the server. The accounting department needs also access to the server, but should otherwise be shielded against
the other stations.
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
ACCESS POINT
PCPCserver
PC
PC
PC
PC
SWITCH
HUB
LAN segment marketing WLAN sales
Accounting stations
12.2.1 Frame tagging
In order to shield or, if necessary, to priorities data traffic of a virtual LAN against the other network users, data packets
must have an additional feature (a “tag”). That’s why the respective process is also called “frame tagging”.
Frame tagging must be realized such that the following requirements are fulfilled:
1
Data packets with and without frame tagging must be able to exist in parallel on a physical LAN.
1
Stations and switches in a LAN, which do not support VLAN technology, must ignore the data packets with frame
tagging and/or treat them as “normal” data packets.
The tagging is realized by an additional field within the MAC frame. This field contains two important information for
the virtual LAN:
1
VLAN ID: A unique number describes the virtual LAN. This ID defines the belonging of data packets a logical (virtual)
LAN. With this 12 bit value it is possible to define up to 4094 different VLANs (VLAN IDs “0” and “4095” are reserved
resp. inadmissible).
5
VLAN ID “1” is used by many devices as the Default VLAN ID. Concerning unconfigured devices, all ports
belong to this Default VLAN. However, this assignment can also be changed by configuration.
1
Priority: The priority of a VLAN-tagged data packet is indicated by a 3 bit value. “0” represents the lowest priority,
“7” the highest one. Data packets without VLAN tag are treated with priority “0”.
This additional field makes the MAC frames longer than actually allowed. These “overlong” packets can only be recognized
and evaluated by VLAN-capable stations and switches. Frame tagging incidentally leads to the desired behavior for
network users without VLAN support:
1
Switches without VLAN support simply pass on these data packets and ignore the additional fields within the MAC
frame.
1
Stations without VLAN support are not able to recognize the protocol type due to the inserted VLAN tag and discard
the packets silently.
5
Older switches in the LAN are perhaps not able to pass on correctly the overlong frames between the individual
ports and will reject the tagged packets.
12.2.2 Conversion within the LAN interconnection
Certain stations shall be grouped to logical units by virtual LANs. But the stations themselves are usually neither able to
generate the required VLAN tags, nor able to handle them.
Data traffic between network users always runs over different interfaces of the distributors in the LAN. These distributors
(switches, base stations) have got the task to insert VLAN tags according to the desired application into the data packets,
to evaluate them and, if necessary, to remove them again. Because logical units are each connected to different interfaces
of the distributors, the rules for generating and processing of the VLAN tags are assigned to the single interfaces.
906
Reference Manual
12 Virtual LANs (VLANs)
Coming back again to the first example:
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
ACCESS POINT
PCPCserver
PC
PC
PC
PC
SWITCH
HUB
LAN segment marketing WLAN sales
VLAN ID=3
VLAN ID=3
Data packet with VLAN tag
Data packet without VLAN tag
A workstation from the marketing sends a data packet to a workstation of the sales department. The marketing hub
passes the packet simply on to the switch. The switch receives the packet at its port no. 1, and recognizes that this port
belongs to a VLAN with the VLAN ID “3”. It inserts an additional field into the MAC frame with the appropriate VLAN
tag, and issues the packet only on ports (2 and 5), which also belong to VLAN 3. The base station of the sales department
will receive the packet on its LAN interface. By its settings, the base station can recognize that the WLAN interface
belongs also to VLAN 3. It will remove the VLAN tag from the MAC frame, and issues the packet again on the wireless
interface. The WLAN client can handle the packet then, which has a “usual” length again, like each other data packet
without VLAN tagging.
12.2.3 VLAN Q-in-Q tagging
VLANs compliant with IEEE302.1q are generally used to connect multiple networks that share a common physical medium
but which are to be kept separate from one another. In some cases VLANs are operated on public networks that are
operated by providers in order to keep the various company networks separate. Consequently VLAN tags may be used
both in the LAN and over the WAN path—VLAN tagged LAN packets therefore require an additional VLAN tag for
transmission over WAN. For control over VLAN tagging, the actions performed by each port can be defined separately.
12.2.4 Application examples
Main application of virtual LANs is to install different logical networks on a physical Ethernet segment, whose data traffic
is protected against the other logical networks.
The following sections present examples for the operation of virtual LANs on behalf of this background.
Management and user traffic on a LAN
Several hot spots are installed on an university campus, so that students equipped with notebooks and WLAN cards have
access to the Internet and to the server of the library. The hot spots are connected to the university LAN. Via this LAN
the administrators also access the base stations to carry out several management tasks via SNMP.
INTERNET
LAPTO P/ W-LANLAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
server
ACCESS POINT ACCESS POINT
SwITCH
PC
Router
LAPTO P/ W-LANLAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
Data traffic without
VLAN tag
VLAN ID=3
907
Reference Manual
12 Virtual LANs (VLANs)
By setting up a virtual LAN between the base stations and the administrator’s switch, management data is shielded
against all “public” traffic on the LAN.
Different organizations on one LAN
The flexibility of the modern world of work raises new challenges for administrators concerning planning and maintenance
of network structures. The occupation of the rooms by leaseholders changes permanently in public office buildings, and
also inside of a company, teams are often newly assembled. In both cases, the individual units must have an independent,
protected LAN. But this task is very burdensome to realize by hardware changes, or even not at all, because e.g. only
one single central cabling exists in the office building.
PCPC
ACCESS POINT
LAPTO P/ W-LAN
LAPTO P/ W-LAN LAPTO P/ W-LAN
PCPC
SWITCHserver
PC
PC
SWITCH
SWITCH
SWITCH
Company A, sales
Company A,
accounts department
Company A,
administration
Company B
VLAN ID=11
VLAN ID=5VLAN ID=3
VLAN ID=3, 5
VLAN ID=3, 5, 11
central network cabling
Virtual LANs enable to perform this task in a very smart way. Also when departments or companies change at a later
time inside of the building, the network structure can be easily adjusted.
All network users in this example use the central Ethernet, which is, like the connected devices, supervised by a service
provider. Company A has three departments on two floors. The sales department can communicate with the administration
department via VLAN ID 3, the accounts department with the administration via VLAN ID 5. The networks of accounts
department and sales do not see each other. Company B is also shielded by VLAN ID 11 against all other networks, only
the service provider can access all devices for maintenance purposes.
12.3 Configuration of VLANs
The configuration of LANCOM Router devices within the VLAN realm has to perform two important tasks:
1
Defining virtual LANs and assigning them a name, a VLAN ID and the affected interfaces.
1
Defining for the interfaces how to proceed with data packets with or without VLAN tags.
12.3.1 VLAN and ARF
In some cases it can suffice to configure the VLAN settings on the basis of the IP network (Advanced Routing and
Forwarding, ARF). Here, a VLAN ID is defined for an IP network. All outbound packets from this network are tagged with
this VLAN ID. Incoming packets have to be tagged with this VLAN ID in order for them to be assigned to the network.
Please observe the relevant instructions in the section on ARF.
12.3.2 VLAN and WLAN Controllers
For large scale applications, LANCOM Access Points and LANCOM Wireless Routers can be managed from a central
WLAN-Controller. The WLAN-Controller handles the definition of the wireless LAN networks (SSIDs) and it can assign a
VLAN ID to these SSIDs. By assigning a VLAN ID to an SSID on the WLAN-Controller and the activation of the management
VLAN (ID greater than 0), the VLAN module on the managed Access Point is activated automatically. Please also observe
the instructions in the section on central WLAN management.
908
Reference Manual
12 Virtual LANs (VLANs)
12.3.3 General settings
LANconfig: interfaces / VLAN
WEBconfig: LCOS menu tree / Setup / VLAN
To activate the VLAN module
You should only activate the VLAN module , if you are familiar with the effects of using VLAN.
5
Wrong VLAN settings can obviate the access to the configuration of the device.
VLAN tagging mode
When transmitting VLAN tagged networks via provider networks that use VLAN themselves, providers sometimes use
special VLAN tagging IDs. In order to set VLAN transmission on the LANCOM to accommodate this, the Ethernet2 type
of the VLAN tag can be set as a 16-bit hexadecimal value as 'tag value' under Setup/LAN Bridge/VLAN or in
LANconfig in the configuration area under 'Interfaces' using the 'VLAN' tab in the field 'VLAN tag'. The default is '8100'
(802.1p/q VLAN tagging) other typical values for VLAN tagging could be '9100' or '9901'
909
Reference Manual
12 Virtual LANs (VLANs)
12.3.4 The networktable
In the network table are those virtual LANs defined, in which the LANCOM should participate.
LANconfig: Interfaces / VLAN / VLAN table
WEBconfig: LCOS menu tree / Setup / VLAN / network table
1
Name: The VLAN name serves only as a description during configuration. This name is used at no other place.
1
VLAN ID: This number marks the VLAN unambiguously. Possible values range from 1 to 4094.
1
Port list: All LANCOM interfaces belonging to the VLAN are entered into this list. Given a device with a LAN interface
and a WLAN port, e.g. ports “LAN-1” and “WLAN-1” can be entered. In case of port ranges, the individual ports
must be separated by a tilde: “P2P-1~P2P-4”.
5
The first SSID of the first WLAN modul is named WLAN-1, the other SSIDs are WLAN-1-2 up to WLAN-1-8. If the
device has two WLAN moduls the SSIDs are WLAN-2, WLAN-2-2 up to WLAN-2-8.
12.3.5 The port table
The port table configures the individual ports of the device for use by the VLAN. The table has got an entry for each port
of the device with the following values:
LANconfig: Interfaces / VLAN / Port table
WEBconfig: LCOS menu tree / Setup / VLAN / Port table
1
Port: Name of the port, not editable.
1
Tagging mode
Controls the processing and assignment of VLAN tags at this port.
2
Never: Outbound packets are not given a VLAN tag at this port. Incoming packets are treated as though they
have no VLAN tag. If incoming packets have a VLAN tag, it is ignored and treated as though it were part of the
packet's payload. Incoming packets are always assigned to the VLAN defined for this port.
2
Unconditional: Outgoing packets at this port are always assigned with a VLAN tag, irrespective of whether they
belong to the VLAN defined for this port or not. Incoming packets must have a VLAN tag, otherwise they will be
dropped.
910
Reference Manual
12 Virtual LANs (VLANs)
2
Mixed: Allows mixed operation of packets with and without VLAN tags at the port. Packets without a VLAN tag
are assigned to the VLAN defined for this port. Outgoing packets are given a VLAN tag unless they belong to the
VLAN defined for this port.
2
Ingress-mixed: Arriving (ingress) packets may or may not have a VLAN tag; outbound (egress) packets are never
given a VLAN tag.
2
Default: Ingress mixed
1
Allow all VLANs (allows packets from other VLANs to enter this port)
This option defines whether tagged data packets with any VLAN ID should be accepted, even if the port is not a
"member" of this VLAN.
1
Port VLAN ID
This port ID has two functions:
2
Untagged packets received at this port in 'Mixed' or 'Ingress-mixed' mode are assigned to this VLAN, as are all
ingress packets received in 'Never' mode.
2
In the 'Mixed' mode, this value determines whether outgoing packets receive a VLAN tag or not: Packets assigned
to the VLAN defined for this port are given no VLAN tag; all others are given a VLAN tag.
12.4 Configurable VLAN IDs
12.4.1 Different VLAN IDs per WLAN client
VLANs are usually connected to a LAN interface on the LANCOM. Therefore, all packets that pass through this interface
receive the same VLAN ID when the VLAN module is enabled. However, in some cases, administrators will want to assign
different WLAN users to different VLANs.
LANconfig: Wireless-LAN / Stations / Stations
WEBconfig: LCOS menu tree / Setup / WLAN / Access-List
The client-specific VLAN ID can take on values from 0 to 4094. The default value of '0' stands for an unspecified VLAN
ID. In such a case, the client will be assigned to the VLAN port of the logical WLAN.
The following requirements must be met in order to ensure successful client-specific VLAN assignment:
1
VLAN operation must be enabled.
1
The VLAN IDs that are to be assigned to the individual clients must be included in the VLAN network table.
1
The LAN interfaces and all WLAN interfaces that are used by the clients must be assigned to the corresponding VLAN.
911
Reference Manual
12 Virtual LANs (VLANs)
12.4.2 VLAN tags for DSL interfaces
Some DSL networks use VLAN tags in the same way as they are used in local networks to differentiate between logical
networks on shared transmission media. The LANCOM Router can process these VLAN tags correctly if a VLAN ID is
defined for each DSL remote site.
LANconfig: Communication / Remote sites / Remote sites (DSL)
WEBconfig: LCOS menu tree / Setup / WAN / DSL Broadband Peers
1
VLAN ID
ID used to explicitly identify the VLAN over the DSL connection.
12.4.3 Special VLAN ID for DSLoL interfaces
In order to better separate the data traffic on a DLSoL interface from other traffic, 'VLAN ID' can be set up for the DSLoL
interface under Setup/Interfaces/DSLoL or in LANconfig in the configuration area 'Interfaces' using the
'WAN' tab under the interface settings for the DSLoL interface.
12.5 VLAN tags on layer 2/3 in the Ethernet
12.5.1 Introduction
VLAN tags enable a simple form of QoS control even when using switches that cannot evaluate IP headers. The IEEE
802.1p standard defines a priority tag in the VLAN header with a length of 3 bits, which correspond to the first 3 bits
of the DSCP fields (Differentiated Services Code Point - DiffServ) and/or the precedence in the TOS field (Type of Service).
The processing of VLAN tagged packets requires that packets in the receive direction are regarded differently to packets
in the send direction.
912
Reference Manual
12 Virtual LANs (VLANs)
1
Upon receipt of a tagged Ethernet packet, it may be processed in one of three ways:
2
The VLAN tag is ignored.
2
The VLAN tag is always copied to the DiffServ or TOS field.
2
The VLAN tag is copied to the DiffServ or TOS field if this is not marked already, i.e. the precedence is '000'.
1
When a packet is transmitted over Ethernet, the VLAN tag can be set depending on the precedence. This should only
happen if the recipient of the tag can understand it, i.e. tagged packets can be received. Tags are thus only set for
packets which are sent to addresses from which the LANCOM already received tagged packets.
5
When a tagged packet is received, the tag is saved to the associated entry in the connection list. If a packet is
to be sent with a precedence setting, then the VLAN ID recorded earlier is entered into the packet together with
the precedence to form a VLAN tag. Where a connection causes other connections to be opened, e.g. with FTP
or H.323, then the tag is inherited to the new entries.
12.5.2 Configuring VLAN tagging on layer 2/3
Configuring VLAN tagging on layer 2/3 involves the definition of the general routing settings and the behavior upon
receipt and transmission of tagged packets.
LANconfig: IP Router / General
WEBconfig: LCOS menu tree / Setup / IP-Router / Routing-Method
1
Routing method
2
Normal: TOS/DiffServ field is ignored.
2
Type-Of-Service: The TOS/DiffServ field is regarded as a TOS field; the bits 'low delay' and 'high reliability' will
be evaluated.
2
DiffServ: The TOS/DiffServ field is regarded as a DiffServ field. After evaluating the precedence, packets with the
code points 'AFxx' are saved and packets with the code points 'EF' receive preferential treatment. All other packets
are transmitted as normal.
1
DiffServ-Tags from Layer-2
The setting for Layer2-Layer3 tagging regulates the behavior when a data packet is received:
913
Reference Manual
12 Virtual LANs (VLANs)
2
Off: VLAN tags are ignored.
2
On: Priority bits in the VLAN tag are always copied to the precedence of the DSCP.
2
Automatic: Priority bits in the VLAN tag are only copied to the DSCP precedence if this is '000'.
1
To copy DiffServ-Tags from Layer2 to Layer3
The setting for Layer3-Layer2 tagging regulates the behavior when a data packet is transmitted. If this option is
activated, VLAN tags with priority bits originating from the DSCP precedence will be generated if the recipient has
sent at least one tagged packet.
12.6 Addition(s) to LCOS 8.60
12.6.1 Group key per VLAN
The following section provides explanations for the management of group keys in the VLAN.
Introduction
In a VLAN environment, the central network administration generally assigns a unique VLAN ID to each virtual network.
Which VLAN a client belongs to is mostly decided by the physical connection between the client and the network.
The central instance that manages the network (e. g. a VLAN-capable switch) internally assigns its ports to certain VLAN
IDs. A data packet arriving at a port is internally passed on only to the ports with the corresponding VLAN IDs. Packets
are not sent to the other network nodes that are connected to ports with different (or no) VLAN IDs.
In the case of multiple VLANs that offer various service levels, data communications are channeled through different
logical wireless LANs (SSIDs). For example, employees receive access to the corporate network and the Internet via a
specific SSID. Guests receive a different SSID that offers access limited to the Internet.
LANCOM access points also maintain VLAN network tables, which control the assignment of wireless LAN clients to
individual VLANs. In large network environments, a RADIUS server usually handles the rights management and the
assignment of clients to the VLANs. After successful authentication, the RADIUS server returns the data to the corresponding
access point. For the duration of the client association, this data is stored in the AP's VLAN network table.
If necessary, the different WLAN clients associated with the same access point obtain different VLAN IDs. This is handled
by the dynamic VLAN network tables in the access points. VLAN-internal communication is protected by a session key
negotiated when logging onto the access point. This ensures that data communications by clients in different VLANs
remain isolated from each other even though the various clients are using the same logical wireless LAN (SSID) to
communicate with the access point.
A client associating with an access point in a wireless LAN is also assigned with a group key for the reception of broadcast
or multicast messages.
Broadcast and multicast messages do not support VLAN tagging. This is why wireless LAN clients that are located in an
isolated VLAN cannot be excluded from receiving these messages. In the ideal case, the wireless clients ignore broadcast
and multicast messages from outside the VLAN.
Since these messages are increasingly being used for network configuration, the following problems arise:
1
Network protocols such as "UPnP" and "Bonjour" use these messages to announce new services in the network.
Theoretically, wireless LAN clients could set up access to servers that they have no access to at all.
1
The Internet standard IPv6 uses multicast broadcasting to transmit router information to the clients.
There is a risk that wireless LAN clients from outside the VLAN can use this information to evade access to the VLAN
for which they are actually registered.
The widespread use of IPv6 will lead to an increase in this type of client problem.
914
Reference Manual
12 Virtual LANs (VLANs)
To avoid these problems, the access point can assign a separate group key to each VLAN, instead of one that applies to
all wireless LAN clients. Thus the access point sends its broadcast and multicast transmissions not to all existing wireless
clients, but solely to a specific VLAN and the clients registered there. The wireless LAN clients in other VLANs therefore
cannot decrypt these broadcasts.
5
The IEEE 802.11 standard provides for the administration of 4 different keys. One key is always reserved for the
secure unicast communication between the access point and a wireless LAN client.
Thus in principle a maximum of 3 separate VLANs can be managed with their own group keys. Each group key is either
managed automatically by the access point or manually by the network administrator. When the wireless LAN client logs
on to the network, the access point sends it the corresponding VLAN group key to decrypt the broadcast and multicast
transmissions for that VLAN.
This results in 2 possible scenarios:
1
No more than 3 VLANs are set up in the area of an access point: These VLANs are securely separated from each other
by the 3 VLAN group keys.
1
More than 3 VLANs exist within range of an access point: In this case, at least two VLANs share a group key. The
administrator must find the optimal distribution of the shared group keys between the VLANs.
VLAN group keys are managed in 2 tables:
1
The configuration table in which the assignment is carried out manually by the administrator.
1
The status table in which the automatic group key assignment by the access point can be viewed.
Managing VLAN group keys
If you want to use different VLAN IDs on a single logical wireless LAN network (SSID), you have the option to assign the
appropriate group key for broadcast and multicast transmissions. This setting in LANconfig is found under Wireless
LAN > 802.11i/WEP > Extended settings > VLAN group key mapping
The automatic assignment of group keys is carried out in the following steps:
1. When a wireless LAN client logs on, the access point checks whether its VLAN ID is already listed in the status table
and assigned to a group key accordingly.
2. If not, the access point consults the configuration table to check whether there is a manual assignment. Should this
be the case, then it creates a mapped entry in this table.
3. If there is no manual assignment either, the access point adds a new entry for this client and assigns the group key
with the fewest users.
The status table displaying the current automatic VLAN group key assignments for each SSID can be found at LCOS
menu tree > Status > WLAN > VLAN groupkey mapping
915
Reference Manual
12 Virtual LANs (VLANs)
Additions to the menu system
VLAN group key mapping
This table contains the mapping of VLAN group keys to the logical WLAN networks.
Telnet path:
Setup > WLAN > VLAN-groupkey-mapping
Network
Contains the name of a WLAN network registered in the device.
Telnet path:
Setup > WLAN > VLAN-groupkey-mapping
VLAN ID
Contains the VLAN ID assigned to the logical WLAN network.
Telnet path:
Setup > WLAN > VLAN-groupkey-mapping
Possible values:
1 to 4094
Default:
1
Group key index
The table contains the group key index:
Telnet path:
Setup > WLAN > VLAN-groupkey-mapping
Possible values:
1 to 3
916
Reference Manual
12 Virtual LANs (VLANs)
13 Wireless LAN (WLAN)
13.1 Introduction
5
The following sections are a general description of the LCOS operating system functions relating to wireless
networks. The functions provided by your specific device are outlined in the manual supplied with it.
This chapter gives you a brief introduction to wireless networking technology. It also provides an overview of the many
different applications, fraction and capabilities of LANCOM WLAN devices.
A wireless LAN connects individual end-user devices (PCs and mobile computers) to form a local network (also called –
Local Area Network). In contrast to a traditional LAN, communication takes place over a wireless connection and not
over network cables. For this reason it is referred to as a Wireless Local Area Network (WLAN).
A wireless LAN provides the same functionality as a cable-based network: Access to files, servers, printers etc. as well
as the integration of individual work stations into a corporate mail system or access to the Internet.
There are obvious advantages to wireless LANs: Notebooks and PCs can be installed where they are needed—problems
with missing connections or structural changes are a thing of the past with wireless networks. Apart from that, wireless
LANs can also be used for connections over longer distances. Expensive leased lines and the associated construction
measures can be saved.
LANCOM Systems differentiates between two different types of WLAN device, each with its own field of application and
consequently offering specialized functions and configuration options.
1
LANCOM Access Points are generally used to connect one or more WLANs to a cabled LAN. As such, they merely
function as a "bridge" to transfer data to and from the from the clients. Routing into the Internet or to other remote
stations is handled by other network components. LANCOM Access Points generally have just one or more Ethernet
interfaces.
1
In addition to one or more Ethernet interfaces, LANCOM Wireless Routers are equipped with WAN interfaces for
ADSL, DSL and/or ISDN. In a single device, they combine WLAN functions with the task of routing data into the
Internet or to other remote stations.
5
The following sections mostly refer to "access points" as a synonym for both types of device, unless we explicitly
differentiate between a LANCOM Wireless Router and a LANCOM Access Point.
LANCOM Wireless Routers and LANCOM Access Points can be operated either as self-sufficient Access Points with their
own configuration (WLAN modules in "Access Point mode“) or as components in a WLAN infrastructure, which is
controlled from a central WLAN-Controller ("managed mode").
13.2 Application scenarios
Wireless LAN systems can act as an extension to or even as a replacement for cabled networks. In some cases wireless
LANs even provide completely new application possibilities, which can mean a major advance in the way work is organized,
or significant cost savings.
1
Extensive wireless LANs, possibly connected to a LAN, with one or more access points (infrastructure mode)
1
Hotspot or guest access
1
Connecting two LANs over a wireless link (point-to-point mode)
917
Reference Manual
13 Wireless LAN (WLAN)
1
Relay function for connecting networks via multiple access points.
1
Connecting devices with an Ethernet interface via an access point (client mode)
1
Central management by a LANCOM WLAN Controller (managed mode)
1
WDS (Wireless Distribution System)
1
Data transfer to mobile objects in industrial environments.
1
Transmission of VPN-encrypted connections with VPN pass through
1
Simple, direct connection between terminal devices with an access point (ad-hoc mode)
13.2.1 Infrastructure mode
In infrastructure mode, WLAN clients connect to a central access point. The access point provides one or more wireless
LAN networks. It regulates the client's rights to access the radio cell, communications between the clients, and access
to further networks. In larger scale WLAN scenarios (e.g. in companies with offices extending between several buildings
or floors) multiple access points can provide WLAN clients with access to a common, shared network. The clients can
roam between the different access points, if necessary. A common term used here is "campus coverage" because this
solution is used by a large number of colleges and universities to provide students and staff with network access.
LAPTO P/ W-LAN
WLAN Router ANTENNABUILDING
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
13.2.2 Hotspot or guest access
A hotspot is a special variant of the infrastructure mode described above. Whereas the normal infrastructure mode
provides the members of a closed user group with access to a network that includes all the necessary services, a hotspot
provides network access (generally restricted to Internet only) to wireless LAN clients at a fee. In addition to the differences
in Access Point configuration, setting up a hotspot requires authentication, authorization and accounting (AAA) functions
such as those provided by e.g. Public Spot options Hotspots are generally set up at public locations where people have
a short-term need to access the Internet, such as at airports, cafés or hotels.
A hotspot provides network access to a WLAN client for a limited time period and without having to configure the access
point. This method is often used by companies, for example to provide guests with temporary Internet access.
LAPTO P/ W-LAN
WLAN Router ANTENNA
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
AAA
INTERNET
13.2.3 Managed mode
The widespread use of wireless Access Points and wireless routers provides great convenience and flexibility in network
access for businesses, universities and other organizations. With centralized WLAN management, the Access Points in
managed mode are not configured themselves but at a central location, the WLAN-Controller.
The WLAN-Controller authenticates the Access Points and transmits a certificate and the correct configuration to the
approved devices. This allows for convenient configuration of the WLAN from a central point and the changes to the
configuration affect all of the Access Points simultaneously.
918
Reference Manual
13 Wireless LAN (WLAN)
Split management can be used to separate the WLAN configuration from the rest of the router configuration. This allows
router settings and VPN settings to be adjusted locally, for example in a branch office or home office installation, and
the WLAN configuration is regulated by a LANCOM WLAN Controller at the main office.
Access Point Access Point Access Point Access Point
LAPTO P/ W-LANLAPTO P/ W-LAN
WLAN Controller WLAN Controller
RADIUS
Certificate
Configuration
13.2.4 WLAN bridge (point-to-point)
Whereas the scenarios discussed so far have involved connecting multiple WLAN clients to one Access Point
(point-to-multipoint), outdoor wireless LAN systems are particularly advantageous for providing a link between two
Access Points (point to point). By setting up a wireless link between two Access Points, a distant production building on
extensive company premises can be very easily integrated into the company network, for example.
ACCESS POINT ANTENNA
BUILDING
ACCESS POINT
ANTENNA
BUILDING
A point-to-point connection can also be used in difficult terrain (such as mountainous areas or islands) to provide Internet
access in areas where cabling would be too expensive. With a direct line of sight between the two Access Points and a
sufficient fresnel zone, distances of several kilometers can be bridged by this type of wireless link.
WLAN Router ANTENNA
ACCESS POINT
ANTENNA
INTERNET
13.2.5 WLAN bridge in relay mode
In some cases, the distance between the two locations to be connected exceeds the range of a single wireless link. This
may be the case when the distance between the Access Points exceeds the radio range, or when obstacles exist in the
line of site between the two Access Points
In these cases, the two end points can be connected by stringing together multiple Access Points, each of which has
two WLAN modules. Because the intermediate Access Points often operate solely as relay stations, the operating mode
of these Access Points is referred to as "relay mode".
DUAL RADIO AP ANTENNA
BUILDING
ANTENNA
DUAL RADIO AP ANTENNA
BUILDING
ANTENNA
WLAN Router ANTENNE
BUILDING
LAPTO P/ W-LAN
Although LANCOM Access Points can run several P2P links simultaneously on each wireless module in addition to
supporting wireless LAN clients, for performance reasons we recommended the use of LANCOM Access Points with two
wireless modules for the relay stations.
919
Reference Manual
13 Wireless LAN (WLAN)
13.2.6 WLAN bridge to an access point – managed and unmanaged mixed
WLAN-Controllers managed from a central Access Point are generally connected to the network via cabled Ethernet.
Where this is not possible, managed Access Points can be integrated into the LAN via a WLAN bridge, assuming that
these are equipped with two WLAN modules. In this scenario, one WLAN module operates as a managed Access Point
which obtains its configuration from the central WLAN-Controller. The other WLAN module is permanently configured
as a WLAN bridge.
DUAL RADIO AP P2P-Mode
Managed Mode
DUAL RADIO AP Managed ModeP2P-Mode
LAPTO P/ W-LAN
WLAN Controller
LAPTO P/ W-LAN
13.2.7 Wireless Distribution System (point-to-multipoint)
A special type of wireless link is the connection of several distributed Access Points to a central point – the
point-to-multipoint wireless LAN (P2MP) is also referred to as a Wireless Distribution System (WDS). This mode of operation
allows for example several buildings on a company's premises to be connected to the central administrative building.
The central Access Point or Wireless Router is configured as "master" and the remote WDS stations as "slaves".
WLAN Router ANTENNA
HEADQUARTER
ACCESS POINT
ACCESS POINT
ACCESS POINT
ACCESS POINT
PRODUCTION
PRODUCTION
STOCK
STOCK
13.2.8 Client mode
In order for individual devices equipped with an Ethernet interface to be connected to a wireless LAN, LANCOM Access
Points can be switched to client mode, in which they act as conventional wireless LAN adapters and not as access points
(AP). Special client devices are offered alternatively, which can be operated in this mode only. The use of client mode
therefore allows devices fitted with only an Ethernet interface, such as PCs and printers, to be integrated into a wireless
LAN.
ACCESS POINT
LAPTO P/ W-LAN
PRINTER
server
LAN
ACCESS POINT
ACCESS POINT PC
WLAN device
in AP mode
WLAN device
in client mode
WLAN device
in client mode
920
Reference Manual
13 Wireless LAN (WLAN)
13.2.9 Client mode with mobile objects in industry
Completely new applications allow wireless LAN systems in industrial environments to transmit data to mobile objects.
In logistics, for example, this means that fork-lift trucks can stay continuously connected to the company network via
the wireless LAN. In combination with mobile barcode scanners, inventory movements within a warehouse can be
monitored in real time and passed on to an ERP system, which then provides all employees with up-to-the-minute
information on current inventories at all times.
WLAN Router ANTENNA
INDUSTRy
FORK LIFT
FORK LIFT
FORK LIFT
FORK LIFT
13.3 WLAN standards
LANCOM WLAN devices operate with the IEEE 802.11 standard. This is a collection of standards that build on the earlier
IEEE standards for LANs. The best known of these is IEEE 802.3 for Ethernet. Among the various IEEE 802.11 standards,
some specify wireless transmissions in various frequency bands and at different speeds. LANCOM Access Points and
AirLancer client adapters are available which support a number of these standards:
1
IEEE 802.11n with up to 300 Mbps data rate in the 5 GHz or 2.4 GHz frequency bands, featuring new mechanisms
such as MIMO, 40-MHz channels, packet aggregation, and block acknowledgement.
1
IEEE 802.11a with up to 54 Mbps data rate in the 5 GHz frequency band, up to 108 Mbps with Turbo Mode (extension
to the standard).
1
IEEE 802.11g with up to 54 Mbps data rate in the 2.4 GHz frequency band, up to 108 Mbps with Turbo Mode
(extension to the standard).
1
Even though modern WLAN adapters generally operate with 802.11a/g/n, LANCOM Access Points remain compatible
to older WLAN adapters supporting 802.11b with up to 11 Mbps in the 2.4-GHz frequency band.
By observing these IEEE standards, LANCOM WLAN products operate with devices from other manufacturers reliably
and without problems. Depending on the model, your LANCOM Access Point supports the standards IEEE 802.11g
(backwardly compatible to IEEE 802.11b) and/or IEEE 802.11a and IEEE 802.11n draft 2.0.
The WLAN module in the Access Points only operates in one frequency band at a time, i.e. either at 2.4 GHz or 5 GHz.
It is impossible to operate at different frequencies with a single WLAN module. However, Access Points with two WLAN
modules (dual radio) can operate each module at a different frequency. As the standards in the 2.4 GHz band
IEEE 802.11b/g/n are backwardly compatible, various standards can be operated simultaneously on a single WLAN
module, although lower data rates are incurred
13.3.1 Data rates in compatibility mode
Please note that data rates available with IEEE 802.11b/g/n devices depend upon the 2.4-GHz mode being used. If slower
units become active in a wireless network in compatibility mode, the overall datarate will drop
921
Reference Manual
13 Wireless LAN (WLAN)
.
5
Please note that not all of the available frequencies are approved for use in all countries! A table of frequencies
and licensing regulations is to be found in the appendix of the manual for each device.
13.3.2 IEEE 802.11n
The new wireless LAN standard 802.11n features a number of technical developments that provide up to five-times the
wireless-LAN performance in the 5 GHz or 2.4 GHz frequency bands. The changes have not yet been officially approved
by the IEEE, but the foreseeable technological leap is so enticing that the industry is already bringing updated WLAN
devices to market before the standards have been adopted. Current discussions are embodied by what is known as "draft
2.0", which is the basis for devices currently available on the market.
5
Any reference to "802.11n" in this document always implies the current draft 2.0, which is not a standard adopted
by the IEEE.
Some of the improvements refer to the physical layer (PHY), which describes the transmission of individual bits over the
physical medium—in this case the air represents the physical medium. Other additions are concerned with the MAC
(medium access control) that among other things governs access to the transmission medium. The two areas are treated
separately below.
Advantages of 802.11n
The new technology includes the following advantages:
1
Higher effective data throughput
802.11n draft 2.0 includes a number of new mechanisms to significantly increase available bandwidth. Current
wireless LAN standards based on 802.11a/g enable physical data rates (gross data rates) of up to 54 Mbps, which
turn out to be approx. 22 Mbps net. Networks based on 802.11n currently achieve a gross data throughput of up
to 300 Mbps (in reality approx. 120 to 130 Mbps net) – theoretically the standard defines up to 600 Mbps with four
data streams. For the first time, maximum speeds exceed the 100 Mbps of cable-based Fast Ethernet networks, which
are currently standard in most workplaces.
1
Improved and more reliable wireless coverage
The new 802.11n technologies do not just increase date throughput but bring about improvements in the range and
reduce the wireless dead spots in existing a/b/g installations.
922
Reference Manual
13 Wireless LAN (WLAN)
This results in better signal coverage and improved stability for significantly better utilization of wireless networks,
in particular for users in professional environments.
1
Greater range
Data throughput generally decreases when the distance between receiver and transmitter increases. The overall
improved data throughput allows wireless LANs based on 802.11n to achieve greater ranges, as a significantly
stronger wireless signal is received by the Access Point over a given distance than in 802.11a/b/g networks.
Compatibility with other standards
The 802.11n standard is backwardly compatible to previous standards (IEEE 802.11a/b/g). However, some of the
advantages of the new technology are only available when, in addition to the access points, the wireless LAN clients are
also compatible with 802.11n.
In order to allow the co-existence of wireless LAN clients based on 802.11a/b/g (called "legacy clients") 802.11n access
points offer special mechanisms for mixed operation, where performance increases over 802.11a/b/g are not as high.
Only in all-802.11n environments is the "greenfield mode" used, which can exploit all the advantages of the new
technology. In greenfield mode both access points and wireless LAN clients support the 802.11n Draft, and access points
reject connections with legacy clients.
The physical layer
The physical layers describes how data must be transformed in order for them to be transmitted as individual bits over
the physical medium. In this process the following steps are performed in a wireless LAN device:
1
Modulation of digital data into analog carrier signals
1
Modulation of the carrier signal into a radio signal in the selected frequency band, which for a wireless LAN is either
2.4 or 5 GHz.
The second modulation step in IEEE 802.11n occurs in the same way as in conventional wireless LAN standards and is
therefore not covered here. However, there are a number of changes in the way digital data are modulated into analog
signals in 802.11n.
Technical aspects of 802.11n
1
Improved OFDM modulation (MIMO-OFDM)
Like 802.11a/g, 802.11n uses the OFDM scheme (Orthogonal Frequency Division Multiplex) as its method of modulation.
This modulates the data signal not on just one carrier signal but in parallel over several. The data throughput that can
be achieved with OFDM modulation depends on the following parameters, among other things:
1
Number of carrier signals: Whereas 802.11a/g uses 48 carrier signals, 802.11n can use a maximum of 52.
20 MHz 20 MHz
IEEE 802.11a/b/g: 48 carrier IEEE 802.11n draft 2.0: 52 carrier
1
Payload data rate: Airborne data transmission is fundamentally unreliable. Even small glitches in the WLAN system
can result in errors in data transmission. Check sums are used to compensate for these errors, but these take up a
part of the available bandwidth. The payload data rate indicates the ratio between theoretically available bandwidth
and actual payload. 802.11a/g can operate at payload rates of 1/2 or 3/4 while 802.11n can use up to 5/6 of the
theoretically available bandwidth for payload data.
Gross bandwidth
Payload rate for 802.11a/b/g: 1/2
Checksum Payload data
Payload rate for 802.11a/b/g: 3/4
Maximum payload rate for 802.11n: 5/6
923
Reference Manual
13 Wireless LAN (WLAN)
These two features increase the maximum useable bandwidth of 54 Mbps for 802.11a/g to 65 Mbps for 802.11n. This
increase is not exactly spectacular, but it can be further improved by using the following features:
1
MIMO technology
MIMO (multiple input multiple output) is the most important new technology contained in 802.11n. MIMO uses several
transmitters and several receivers to transmit up to four parallel data streams on the same transmission channel (currently
only two parallel data streams have been implemented). The result is an increase in data throughput and improved
wireless coverage.
MIMO AP 802.11n
MIMO Client 802.11n
For example, the Access Point splits the data into two groups which are then sent simultaneously via separate antennas
to the WLAN client. Data throughput can therefore be doubled using two transmitting and receiving antennas.
But how can several signals be transmitted on a single channel simultaneously? This was considered impossible with
previous WLAN applications.
Let us consider how data is transmitted in "normal" wireless LAN networks: Depending on antenna type, an Access
Point's antenna broadcasts data in several directions simultaneously. These electromagnetic waves are reflected by the
surrounding surfaces causing a broadcast signal to reach the WLAN client's antenna over many different paths; this is
also referred to as "multipath propagation". Each of these paths has a different length meaning that individual signals
reach the client with a different time delay.
ACCESS POINT
WLAN-Client
These time-delayed signals interfere with each other at the WLAN client and significantly weaken the original signal.
For this reason, conventional WLAN networks should always have a direct line of sight (LOS) between transmitter and
receiver in order to reduce the influence of reflections.
MIMO technology transforms this weakness in WLAN transmission into a strength that allows an enormous increase in
data throughput. As mentioned above, it is virtually impossible to transmit different signals on the same channel
simultaneously as the receiver cannot distinguish between them. MIMO uses the reflection of electromagnetic waves
and the associated spatial aspect to obtain a third criterion for identifying the signals.
A signal sent by transmitter A and received by receiver 1 follows a different path than a signal from transmitter B to
receiver 2. Due to the different reflections and changes in polarization that both signals experience along their paths,
each of these paths takes on its own characteristics. When data transmission starts, a training phases records the
characteristics of the path by transmitting standardized data. Subsequently, the data received here is used to calculate
which data stream the signals belong to. The receiver decides for itself which of the incoming signals is to be processed,
thus avoiding loss from interference.
MIMO AP 802.11n
MIMO Client 802.11n
A
B
1
2
MIMO thus allows the simultaneous transmission of several signals over one shared medium, such as the air. Individual
transmitters and receivers must be positioned a minimum distance apart from one another, although this is just a few
centimeters. This separation results in differing reflections and signal paths that can be used to separate the signals.
Generally speaking, MIMO can provide up to four parallel data streams, which are also called "spatial streams". However,
the current generation of chips can only implement two parallel data streams as the separation of data streams based
on characteristic path information demands high levels of computing power, which consumes both time and electricity.
924
Reference Manual
13 Wireless LAN (WLAN)
The latter tends to be undesirable particularly for WLAN systems, where attempts are often made to achieve independence
from power sockets at the WLAN client or when using PoE as the electricity supply for the Access Point.
Even if the aim of four spatial streams has not yet been achieved, the use of two separate data connections results in a
doubling of data throughput, which represents a true technological leap in the area of WLAN systems. Combined with
the improvements in OFDM modulation, the data throughput that can be attained increases to 130 Mbps.
The short description "transmitter x receiver" expresses the actual number of transmitting and receiving antennas. 3x3
MIMO describes three transmitting and three receiving antennas. However, the number of antennas does not equate
with the number of data streams: the antennas available only limit the maximum number of spatial streams. The reason
for using more antennas than strictly necessary for data stream transmission relates to the method of allocating the
signals according to their characteristic path: A third signal is used to transmit additional spatial information. If the data
from the first two signals cannot be uniquely identified, their computation can still be performed with the aid of the third
signal. The use of additional antennas does not contribute to an increase in data throughput, but it does result in a more
even, stronger coverage for clients.
1
MIMO in outdoor use
Outdoor 802.11n applications cannot use natural reflections since signal transmission usually takes place over the direct
path between directional antennas. In order to transmit two data streams in parallel, special antennas are employed
that use polarization channels turned through 90° to each other. These so-called "dual-slant" antennas are really two
antennas in one housing. Since a third signal does not offer additional reliability, outdoor applications generally use as
many antennas (or polarization channels) as there are data streams for transmission.
MIMO AP 802.11n
POLARIZATION
DIVERSITY
BUILDING
MIMO AP 802.11n
POLARISATION
DIVERSITY
BUILDING
1
40 MHz channels
As the above explanation of OFDM modulation states, data throughput rises with an increasing number of carrier signals
because this allows several signals to be transmitted simultaneously. If a channel with a bandwidth of 20 MHz supports
no more than 48 (802.11a/g) or 52 (802.11n) carrier signals, the obvious choice would be to use a second channel with
additional carrier signals.
This method was used in the past by a number of manufacturers (including LANCOM Systems) and was referred to as
"turbo mode", allowing data rates of up to 108 Mbps. Turbo mode does not form part of the official IEEE standard but
is frequently employed on point-to-point connections, for example, because compatibility to other manufacturers tends
to play a secondary role.
However, the success of the underlying technology has lead to its incorporation into 802.11n. IEEE 802.11n draft 2.0
uses the second transmission channel in a way that maintains compatibility to IEEE 802.11a/g devices. 802.11n transmits
data over two contiguous channels. One of these assumes the task of a control channel that, among other things, handles
the administration of data transmission. Concentrating these basic tasks into the control channel means that devices
supporting a transmission at 20 MHz only can also be connected. The second channel is an extension that only comes
into effect if the remote client also supports data transmission at 40 MHz. The use of the second channel remains optional
throughout, with transmitter and receiver deciding dynamically whether one or two channels should be employed.
20 MHz 20 MHz
Control channel Extension channel
As the implementation of 40 MHz with separate control and extension channels is more efficient in the 802.11n draft
than in the conventional turbo mode, more than double the amount of carrier signals can be obtained (108 in total).
The maximum data throughput when using improved OFDM modulation and two parallel data streams thus rises to
270 Mbps.
1
Short guard interval
925
Reference Manual
13 Wireless LAN (WLAN)
The final improvement of the 802.11n draft is the improvement in the chronological sequence of data transmission. A
signal that is to be transmitted in a WLAN system is not broadcast at a distinct point in time but is "held up" for a certain,
constant transmission period. In order to prevent interference at the receiving end, a short break is made following the
transmission period before the transmission of the next signal commences. The entire duration of transmission period
and break are referred to in WLAN terminology as "symbol length" and the break itself is known as the "guard interval".
IEEE 802.11a/g uses a symbol length of 4 µs: the information transmitted on the carrier signal changes following
transmission of 3.2 µs and a break of 0.8 µs. 802.11n reduces the break between transmissions to the so-called "short
guard interval" of only 0.4 µs.
3,2 µs 0,8 µs
0,4 µs
OFDM Symbol
3,2 µs
Transmitting data in shorter intervals thus increases the maximum data throughput when using improved OFDM
modulation, two parallel data streams and transmission at 40 MHz to 300 Mbps.
Optimizing net data throughput
The methods described so far are intended to improve the maximum physically possible data throughput. The methods
described below are used in 802.11n networks to optimize net data throughput, i.e. the throughput of actual payload
data.
1
Frame aggregation
In addition to the actual payload data, each data packet includes management information, which is important for the
smooth exchange of data. Frame aggregation is used to combine several data packets (frames) into one large packet.
As a consequence, management information only needs to be specified once for the complete data packet, and the
proportion of payload data to the total data volume increases.
1
Block acknowledgement
Each data packet is acknowledged on receipt. In this way, the transmitter is informed that the packet was received
correctly and does not need to be repeated. This principle also applies to aggregated frames in 802.11n.
However, some packets in an aggregated frame may be delivered successfully while others are not. In order to avoid
having to retransmit an entire aggregated frame from which perhaps just one data packet was not delivered, a separate
acknowledgement is generated for every single WLAN packet in the aggregated frame. These acknowledgements are
again combined to form a block and relayed back to the sender as a group (block acknowledgement). The sender receives
information about the receipt status of every single WLAN packet and can, if necessary, resend only those specific packets
that were not successful.
The MAC layer
1
Frame aggregation
The improvements in the physical layer brought about by the new 802.11n initially describe only the theoretical data
throughput of the physical medium. However, the share of this theoretical bandwidth that is actually available for payload
data is limited by two factors:
1
in addition to the actual payload data, each data packet in a wireless LAN system contains additional information
such as a preamble and MAC address information.
1
Time is lost to the management events that occur when the transmission medium is actually accessed. Thus the
transmitter must negotiate access authorization with the other receivers before transmitting each data packet (frame);
further delays are caused by data packet collisions and other events.
This loss, referred to as "overhead", can be reduced by combining several data packets together to form one large frame
and transmitting them together. In this process, information such as the preamble are only transmitted once for all the
combined data packets and delays due to negotiating access to the transmission medium only occur at longer intervals.
926
Reference Manual
13 Wireless LAN (WLAN)
The use of this method, known as frame aggregation, is subject to certain restrictions:
1
As information such as MAC address only needs to be transmitted once for the aggregated frame, only those data
packets intended for the same address can be combined.
1
All data packets that are to be combined into a single large frame must be available at the sender at the time of
aggregation—as a consequence some data packets may have to wait until enough data packets for the same
destination are available with which they can be combined. This aspect may represent a significant limitation for
time-critical transmissions such as voice over IP.
1
Block acknowledgement
Each data packet directed to a specific address (i.e. not broadcast or multicast packets) is acknowledged immediately
after receipt. In this way, the transmitter is informed that the packet was received correctly and does not need to be
repeated. This principle also applies to aggregated frames in 802.11n.
Two different methods are used for frame aggregation. These are not explained in detail here, but they differ in the way
aggregated frames are acknowledged.
1
Mac Service Data Units Aggregation (MSDUA) combines several Ethernet packets together to form one common
wireless LAN packet. This packet is acknowledged only once and the acknowledgment is valid for all aggregated
packets. If there is no acknowledgement the whole block is resent.
1
Mac Protocol Data Units Aggregation (MPDUA) combines individual wireless LAN packets together to form one large
common wireless LAN packet. In this case, each wireless LAN packet is acknowledged and the acknowledgements
are combined and transmitted as a block. In contrast to MSDUA, the sender receives information about the receipt
status of every single WLAN packet and can, if necessary, resend only those specific packets that were not successful.
Resulting data throughput
The overall data throughput in a 802.11n network is determined by applying the methods described above. A specific
combination of modulation method, payload data rate and number of spatial streams is referred to as modulation coding
scheme (MCS). Data throughput also depends on whether the short guard interval and channel bundling to 40 MHz are
used.
802.11n uses the term "data throughput" instead of the term "data rate" used in older WLAN standards, because data
rate is no longer an adequate description. The following table shows the maximum data throughput when using the
short guard interval with 40 MHz channels.
The net data throughput, i.e. the actual number of IP packets transferred, can be up to 90 Mbps for one 802.11n data
stream and, accordingly, for two spatial streams up to 180 Mbps. The net data throughput currently (early 2008) observed
in practice is usually between 80 and 130 Mbps, depending on how mature the hardware and software are and also on
how well the different manufacturers' chip sets work together.
Data throughput (GI=0.4 µs, 40 MHz)Payload data rateModulationData streams
151/2BPSK1
301/2QPSK1
453/4QPSK1
601/216QAM1
903/416QAM1
1201/264QAM1
1353/464QAM1
1505/664QAM1
301/2BPSK2
601/2QPSK2
903/4QPSK2
1201/216QAM2
927
Reference Manual
13 Wireless LAN (WLAN)
Data throughput (GI=0.4 µs, 40 MHz)Payload data rateModulationData streams
1803/416QAM2
2401/264QAM2
2703/464QAM2
3005/664QAM2
Addition(s) to LCOS 8.60
How the 40-MHz mode works
Additions to the menu system
Allow 40MHz
The default setting automatically optimizes the value for bandwidth. If the momentary operating conditions allow, a
bandwidth of 40MHz will be enabled, which is otherwise limited to 20MHz.
You also have the option of switching this mechanism off, so limiting the bandwidth to the narrower 20MHz.
The 802.11n standard specifies a channel bonding from 20MHz to 40MHz.
Telnet path:/Setup/Interfaces/WLAN/Radio-Settings/Allow-40MHz
13.3.3 IEEE 802.11a: 54 Mbps
IEEE 802.11a specifies the operation of wireless LANs in the 5-GHz frequency band (5.15 GHz to 5.75 GHz) with datarates
of up to 54 Mbps. Actual throughput depends on the distance and the quality of the connection. With longer distances
and lower connection quality datarates sink to 48 Mbps, thereafter to 36 Mbps and so on until a minimum of 6 Mbps
is reached. The range of transmission in the open can reach up to 125m. Inside of buildings this would typically be 25m.
The IEEE 802.11a standard operates with OFDM (Orthogonal Frequency Division Multiplexing).
OFDM is a modulation technique that uses multiple carrier frequencies to form the data signal. The technique modulates
these carrier frequencies with a reduced datarate. OFDM is highly resistant to the effects of echos and other impairments,
and it enables higher datarates.
In ’Turbo Mode’ LANCOM Router base stations can use two radio channels simultaneously to increase datarates to a
maximum of 108 Mbps. Turbo mode works with the IEEE 802.11a standard between LANCOM base stations and AirLancer
wireless network cards. This increase in datarate must be activated in the base station. This can cause a reduction in
transmitting power and range.
13.3.4 IEEE 802.11h – ETSI 301 893
In November 2002, the 5 GHz band was released for private use in Germany, and opened up the path for significantly
faster WLAN connections according to the IEEE 802.11a standard, which had already been available for a while. The
wider use of 5 GHz WLANs was, however, restricted by its exclusive use in closed spaces and the relatively low transmission
power.
With the 802.11h enhancement of September 2003, the private use of the 5 GHz band was finally possible even outside
closed spaces. To protect military applications in the 5 GHz band, the DFS (Dynamic Frequency Selection) and TPC
(Transmission Power Control) procedures were prescribed. However, when using DFS and TPC with a maximum of
1000 mW (or 4000 mW for commercial network operators in compliance with "Broadband Fixed Wireless Access"
regulations), much higher transmission powers can be operated than allowed by previous standards.
ETSI standards
ETSI adopted the first standard for controlling remote data transfers as early as 1996 under the name of Hiperlan (High
Performance Radio Local Area Networks). The first version (Hiperlan Type 1) was intended for use in the frequency range
928
Reference Manual
13 Wireless LAN (WLAN)
of 5.15 to 5.30 GHz with a transmission rate of 20 Mbps. As no manufacturers took up this standard, Hiperlan initially
had no practical significance.
With the new version in 2000, Hiperlan Type 2, ETSI introduced a WLAN solution that operates in the 5 GHz band similar
to IEEE 802.11a, and also provides a gross data rate of 54 Mbps. However, as the frequencies and the OFMD modulation
method that was also used for 802.11a overlapped, it was necessary to adapt the standards between IEEE and ETSI to
avoid disruptions to the systems.
European harmonization
To standardize the use of the 5 GHz band in Europe, the European Commission issued the ETSI 301 893 standard on
July 11, 2005. The member states of the EU were obliged to implement this by October 31, 2005.
Instead of the three sub-bands described in the 802.11a/h standards (5150 - 5350 MHz, 5470 - 5725 MHz and 5725 -
5875 MHz for the UK), the ETSI 301 893 standard regulates the three following areas with different specifications:
1
5150 - 5250 MHz
1
5250 - 5350 MHz
1
5470 - 5725 MHz
The guidelines focus on preventive measures for avoiding disruptions to other systems that use the same frequency band.
This includes radar equipment that counts as "primary applications". The "secondary applications" such as WLAN have
to change the frequency as soon as a conflict is detected.
Special regulations for the 5 GHz band
1
Dynamic Frequency Selection – DFS
Certain requirements must be observed for the outdoor operation of 5-GHz WLANs if you wish to utilize the maximum
permitted performance of 1 or 4 watts. It is vital to avoid interference with radar systems that are active in this spectrum
(e.g. meteorological, military). For this reason the European regulatory authority ETSI requires WLAN devices operating
at 5 GHz to employ the dynamic frequency selection (DFS) mechanism.
This ensures that radar and WLAN systems can co-exist without interfering with one another and that capacity utilization
is spread evenly across available frequencies. When starting a WLAN wireless cell, the access point must check all
channels for the presence of radar systems. The check requires an inactive period of one minute, during which the wireless
cell cannot be used. As a result, the access point generates a list of radar-free channels which is valid for 24 hours. The
best possible channel for operation is selected from this list. During operation, the current channel is continuously checked
for radar activity.
If a radar system subsequently starts operation, the channel must be released immediately. In this case, the access point
selects the next best available channel, informs the participants in the wireless cell of the impending change, and switches
the channel.
5
The currently selected channel can be used for any length of time, unless radar signals are detected or if the
radio cell is restarted (e.g. due to device reconfiguration, firmware upload or reboot).
5
If the system is able to respond to a channel switch instantaneously, the check must be repeated within 24 hours
following a one-minute period of inactivity. The parameter "DFS Rescan Hours" (LCOS menu tree under
"Setup/Interfaces/WLAN/Radio settings") allows a time to be set for conducting the channel check (assuming
that the time is available, for example via NTP).
1
DFS is stipulated for the frequency ranges from 5250 - 5350 MHz, 5470 - 5725 MHz and from 5775 – 5875 (BFWA).
It is optional for the frequency range of 5150 - 5250 MHz.
1
Transmission Power Control – TPC
Automatic adjustment of the transmission power reduces radio interference.
Without DFS and TPC, a maximum of only 200 mW EIRP is permitted. When operating DFS and TPC, a maximum of
200 mW (5150 to 5350 MHz) and 1000 mW EIRP (5470 to 5725 MHz) is permitted as transmitting power (compare
100 mW for 802.11b/g, 2.4 GHz, where DFS and TPC are unnecessary). The higher maximum transmission power
929
Reference Manual
13 Wireless LAN (WLAN)
not only compensates for the higher attenuation of 5 GHz radio waves in air, it also makes significantly longer ranges
possible than in the 2.4 GHz range.
1
BFWA (broadband fixed wireless access)
In Germany in July, 2007, the Federal Network Agency released additional frequencies for broadband fixed wireless
bridges in the 5 GHz band. These additional frequencies located in the range between 5755 MHz - 5875 MHz are
also referred to as BFWA (Broadband Fixed Wireless Access). The additional frequencies are intended for long-distance
point-to-point (P2P) or point-to-multipoint (P2M) links used for providing high-speed Internet access to other users
from a central node. This method is intended to provide rural areas with high-speed Internet access.
The operation of BFWA is restricted to commercial providers only. There are no charges for using these frequencies,
but registration is required by the Federal Network Agency. This band covers 120 MHz and offers 6 channels with a
bandwidth of 20 MHz each. Maximum transmission power is 36 dBm or 4000 mW. TPC and DFS have to be used
when operating BFWA links.
Differences from USA and Asia
The USA and Asia use different frequency bands and maximum signal strengths that are different than the European
standard.
In the USA, three subbands, each 100 MHz wide, are used for wireless networks in the 5 GHz band. The "lower band"
ranges from 5150 - 5250 MHz, the "middle band" ranges from 5250 - 5350 MHz and the "upper band" ranges from
5725 - 5825 MHz. In the lower band, a maximum average EIRP of 50 mW is permitted; in the middle band this is 250
mW and 1 W in the upper band.
In Japan, the use of the 5 GHz band is possible to a limited extent: only the lower band of 5150 - 5250 MHz is approved
for private use.
Available channels in the 5 GHz band
In the available frequency range of 5.13 to 5.875 GHz, the following channels are available in Europe, divided into
frequency ranges to which different conditions of use can apply:
1
5150 -5350 MHz (channels 36, 40, 44 and 48)
1
5250 -5350 MHz (channels 52, 56, 60 and 64)
1
5470 - 5725 MHz (channels 100, 104, 108, 112, 116, 132, 136 and 140)
1
5755 - 5875 MHz
2
Channels 151, 155, 159 , 163, 167: In Germany is for commercial use only and only in combination with DFS
(BFWA).
2
Channels 149, 153, 157, 161, 165: For FCC use in the USA, without DFS.
5
Channels 120, 124 and 128 have been available in the past and are now blocked.
The following overview shows which channels may be used in the different regions:
5
* Note: Please note that the frequency ranges and radio channels in band 3 are subject to certain restrictions
depending on country (e.g. in Germany only permitted for public "Broadband Fixed Wireless Access"
communications providers).
Frequency ranges for indoor/outdoor use in the 5 GHz band
The use of the methods described in ETSI 301 893 for reducing mutual interference in the 5 GHz band (TPC and DFS) is
not stipulated for all fields of application. The following table provides information about the permitted use and
corresponding transmission powers within the EU:
930
Reference Manual
13 Wireless LAN (WLAN)
TPCDFSUseTransmissionpower
(mW/dBm)
Frequency (GHz)
Indoor200/235,15-5,25
44Indoor200/235,25-5,35
44Indoor/Outdoor1000/305,470-5,725
44Outdoor (BFWA)4000/365,755-5,875
5
Other regulations may apply for use in other countries. Please refer to the current wireless network regulations
for the country in which you wish to operate a wireless LAN device, and ensure that you set the country of
operation in the wireless LAN settings.
13.3.5 IEEE 802.11g: 54 Mbps
The IEEE 802.11g standard also works with datarates of up to 54 Mbps in the 2.4 GHz ISM frequency band. Unlike IEEE
802.11b, the IEEE 802.11g standard works with OFDM modulation, as used by the earlier standard IEEE 802.11a. IEEE
802.11g features a specialized compatibility mode for backwards compatibility with the widely available IEEE 802.11b
standard. However, operating this compatibility mode incurs performance losses. IEEE 802.11g is not compatible to IEEE
802.11a as they operate at different frequencies. IEEE 802.11g products offer similar ranges to IEEE 802.11b products.
The 802.11g standard can also be operated with Turbo Mode, which uses two radio channels in parallel to increase
datarates to a maximum of 108 Mbps. Because the 2.4-GHz band has fewer channels to offer than the 5-GHz band,
operating Turbo Mode places clear limits on the choice of available channels.
13.3.6 IEEE 802.11b: 11 Mbps
IEEE 802.11b specifies the operation of local wireless networks in the ISM frequency band (Industrial, Scientific, Medical:
2.4 to 2.483 GHz). Maximum datarates are up to 11 Mbps. Actual throughput depends on the distance and the quality
of the connection. With longer distances and lower connection quality datarates sink to 5.5 Mbps, thereafter to 2 Mbps
and then to 1 Mbps. The range of transmission in the open can reach up to 150 m. Inside of buildings this would typically
be 30 m. IEEE 802.11b is not compatible to IEEE 802.11a as they operate at different frequencies.
To protect against interference from other transmitters operating on the same frequency, the 2.4-GHz frequency band
for IEEE 802.11b offers the DSSS procedure (Direct Sequence Spread Spectrum). Generally, a transmitter occupies only
a very narrow band of the available frequencies. If this band is also being used by another transmitter, interference may
occur. The DSSS method uses a broader band of the available frequency range, making it less sensitive to narrow-band
interference.
13.4 WLAN security
13.4.1 Basics
Even though one constantly hears the blanket term 'Security' when talking about computer networks, it is still important
for the coming exposition to differentiate a little more closely between the requirements it actually entails.
Authentication
The first point in security is access security:
1
Here, a protective mechanism is involved which allows access to the network only to authorized users.
1
On the other hand, however, it must also be ensured that the client is connected to the precise desired access point,
and not with some other access point with the same name which has been smuggled in by some nefarious third
party. Such an authentication can be provided, for example, using certificates or passwords.
931
Reference Manual
13 Wireless LAN (WLAN)
Authenticity
Authenticity: Proof of the authorship of the data and the originality of the data content; the process of establishing this
proof is known as authentication.
Integrity
Once access is provided, one would like to ensure that data packets reach the receiver without any falsification, that is,
that no-one can change the packets or insert other data into the communication path. The manipulation of data packets
themselves cannot be prevented, but changed packets can indeed be identified using suitable checksum processes, and
then dropped.
Confidentiality
Quite separate from access security is confidentiality, that is, unauthorized third parties must not be able to read the
data traffic. To this end, the data are encrypted. This sort of encryption process is exemplified by DES, AES, RC4, or
Blowfish. Along with encryption, of course, there must also be a corresponding decryption on the receiving end, generally
with the same key (a so-called symmetric encryption process). The problem naturally then arises, how the sender can
give the key to the receiver for the first time—a simple transmission could very easily be read by a third party, who could
then easily decrypt the data traffic.
In the simplest case, this problem is left to the user, that is, one simply assumes that the user can make the key known
at both ends of the connection. In this case, one speaks of pre-shared keys, or 'PSK'.
More sophisticated processes come into play when the use of pre-shared keys is impractical, for instance in an HTTP
connection built over SSL—in this case, the user can't retrieve a key from a remote web server quite so easily. In this
case, so-called assymetric encryption methods such as RSA can be used, that is, to decrypt the data, a different key is
used than the one used to encrypt it, meaning that key pairs are used. Such methods are, however, much slower than
symmetric encryption methods, which leads to a two-phase solution:
1
The sender possesses an asymmetric key pair. It transmits the public part of the key pair, i.e. the key for encryption,
to the receiver as a certificate, for example. Since this part of the key pair cannot be used for decryption, there are
no misgivings with regard to security.
1
The receiver selects any symmetrical key. This symmetrical key that is used both for encryption and for decryption,
must now be securely transmitted to the sender. It is encrypted with the sender's public key and returned to the
sender. The only way that the symmetrical key can be decrypted again is with the sender's private key. Potential
eavesdroppers observing the key exchange cannot decrypt this information, and consequently the transmission of
the symmetrical key is secure.
13.4.2 IEEE 802.11i /WPA2
In mid-2004 the IEEE adopted the standard 802.11i, also known as WiFi Protected Access 2 (WPA2). WPA2 is currently
the highest standard of security available for WLANs. It enables the authentication and authorization of users by
IEEE 802.1X. It also supports AES encryption, which is a far more secure technique than WEP or WPA. The following
sections outline some relevant technical aspects.
EAP and IEEE 802.1x
A clear increase in WLAN security can be achieved by using keys that are dynamically negotiated instead of keys with
fixed values. As the process to be used for this purpose, the Extensible Authentication Protocol has emerged. As the
name suggests, the original purpose of EAP is authentication, that is, the regulated access to a WLAN—the possibility
of installing a valid key for the next session is more or less a byproduct. Figure 2 shows the basic process of a session
secured by EAP.
932
Reference Manual
13 Wireless LAN (WLAN)
5
In principle, EAP / 802.1X can be used in combination with WEP. However, this method is generally employed
with WLANs using WPA2.
ACCESS POINT
LAN
LAPTO P/ W-LAN
RADIUS serverAccess pointClient
WLAN registration
normal data traffic
Session key
Sharing of Master Secret
EAP/802.1x negotiation
more normal data traffic
new session key
Figure 2: Schematic process of a WLAN session with EAP/802.1x
In the first phase, the client registers with the access point as usual, and enters the state in which it can now send and
receive over the access point in the formerly used WEP—but not with EAP, because in this state the client still doesn't
have a key to secure its data traffic from eavesdropping. Instead, the client is in an 'intermediate state' from the point
of view of the access point, in which only particular packets from the client are forwarded, and these are only directed
to an authentication server. These packets are the EAP/802.1x mentioned previously. The access point packs these packets
in RADIUS queries and sends them on to the authentication server. The access point converts the replies coming from
the RADIUS server back into EAP packets, and sends them back to the client.
The access point is thus a sort of middle man between client and server. it doesn't have to check the contents of these
packets, it just has to check that no other data traffic to or from the client can occur. Over this "tunnel" through the
access point, the client and server authenticate one another, that is, the server checks the client's access privilege to the
network, and the client checks that it is talking to the right network. "Wild" access points set up by hackers can be
recognized in this way.
A whole series of authentication processes exist which can be used in this tunnel. A current process (and one supported
by Windows XP) is for instance TLS, in which server and client exchange certificates; another is TTLS, in which only the
server supplies a certificate—the client is authenticated using only a username and password.
After the authentication phase, a secure tunnel even without encryption has been set up, in which the access point is
connected in the next step. For this, the RADIUS server sends the so-called 'Master Secret', a session key calculated
during the negotiation, to the access point. The LAN behind the access point is considered secure in this scenario, so
that this transmission can be performed in clear text.
With this session key, the access point now takes over the tunnel and can use it to provide the actual key to the client.
Depending on the capabilities of the access point hardware, this can be a true session key, i.e. a key which will only be
used for data packets between the access point and precisely this client. Older WEP uses a hardware group key, which
the access point will use for communication with multiple clients.
The particular advantage of this procedure is that the access point can regularly change the key over the EAP tunnel,
that is, it can perform a so-called rekeying. In this way, keys can be replaced by new ones long before they run the risk
of being cracked due to IV collisions. A common 'use time' for such keys might be 5 minutes.
WPA with passphrase
The handshake described in the EAP/802.1X section runs strictly under WPA, i.e. the user will never have to define any
keys. In environments in which no RADIUS server is available to provide master secrets (for instance in smaller companies),
WPA therefore provides the PSK method besides authentication using a RADIUS server; here, the user must enter a
passphrase of 8 to 63 characters on the access point and on all stations, from which the master secret is calculated
along with the SSID used using a hash procedure. The master secret is therefore constant in such a PSK network, although
different session keys still result.
In a PSK network both access security and confidentiality depend on the passphrase not being divulged to unauthorized
people. As long as this is the case, WPA-PSK provides significantly improved security against break-ins and eavesdropping
over any WEP variant. For larger installations in which such a passphrase would have to be made known to too large a
user community for it to be kept secret, EAP/802.11i is used in combination with the key handshake described here.
933
Reference Manual
13 Wireless LAN (WLAN)
TKIP
TKIP stands for Temporal Key Integrity Protocol. As the name suggests, it involves an intermediate solution for temporary
use until a truly strong encryption procedure is introduced, but which dealt with the problems of the then popular WEP,
never the less. Employing TKIP is only recommended for operating older WLAN clients which do not support AES.
AES
The most obvious extension is the introduction of a new encryption process, namely AES-CCM. As the name already
hints, this encryption scheme is based on DES's successor AES, in contrast to WEP and TKIP, which are both based on
RC4. Not all older WLAN chips support TKIP, so 802.11i continues to define TKIP, but with the opposite prerequisites:
Any 802.11i-compliant hardware must support AES, while TKIP is optional. In WPA that was exactly the other way
around. Using AES is optional.
The suffix CCM denotes the way in which AES is used in WLAN packets. The process is actually quite complicated, for
which reason CCM is only sensibly implemented in hardware—software-based implementations are possible, but would
result in significant speed penalties due to the processors commonly used in access points.
In contrast to TKIP, AES only requires a 128-bit key, with which both the encryption and protection against undetected
changes to packets is achieved. Furthermore, CCM is fully symmetric, i.e. the same key is used in both communications
directions—a standards compliant TKIP implementation, on the other hand, requires the use of different Michael keys
in the send and receive directions, so that CCM is significantly simpler in use than TKIP.
Similar to TKIP, CCM uses a 48-bit Initial Vector in each packet—an IV repetition is impossible in practice. As in TKIP,
the receiver notes the last IV used and drops packets with an IV which is equal to or less than the comparison value.
Pre-authentication and PMK caching
802.11i is intended to help with the use of WLAN for speech connections (VoIP) in enterprise networks. Especially in
connection with WLAN-based wireless telephony, quick roaming (switching from one access point to another without
lengthy interruptions) is of special significance. In telephone conversations, interruptions of 100 milliseconds are irritating,
but the full authentication process over 802.1x, including the subsequent key negotiation with the access point, can
take significantly longer.
For this reason, the so-called PMK caching was introduced as a first measure. The PMK serves as the basis for key
negotiation in an 802.1x authentication between client and access point. In VoIP environments it is possible that a user
moves back and forth among a relatively small number of access points. Thus it may happen that a client switches back
to an access point in which it was already registered earlier. In this case it wouldn't be sensible to repeat the entire
802.1x authentication again. For this reason, the access point can provide the PMK with a code, the so-called PMKID,
which it transmits to the client. Upon a new registration, the client uses the PMKID to ask whether this PMK is still stored.
If yes, the 802.1x phase can be skipped and the connection is quickly restored. This optimization is unnecessary if the
PMK in a WLAN is calculated from a passphrase as this applies everywhere and is known.
A second measure allows for some acceleration even in the case of first-time registration, but it requires a little care on
the part of the client. The client must already detect a degrading connection to the access point during operation and
select a new access point while it is still in communication with the old access point. In this case it has the opportunity
to perform the 802,1x negotiation with the new access point over the old one, which again reduces the "dead time" by
the time required for the 802.1x negotiation.
13.4.3 TKIP and WPA
As clarified in the last section, the WEP algorithm is flawed and insecure in principle; the measures taken so far were
largely either 'quick fixes' with limited improvement, or so complicated that they were basically impractical for home
use or smaller installations.
After the problems with WEP became public knowledge, the IEEE began with the development of the standard IEEE
802.11i. As an interim solution, the WiFi Alliance defined the Wifi Protected Access (WPA) 'standard'. WPA uses the
following changes:
1
TKIP and Michael as replacement for WEP
934
Reference Manual
13 Wireless LAN (WLAN)
1
A standardized handshake procedure between client and access point for determination/transmission of the session
key.
1
A simplified procedure for deriving the Master Secret mentioned in the last section, which can be performed without
a RADIUS server.
1
Negotiation of encryption procedure between access point and client.
Encryption makes use of components familiar from WEP but benefits from decisive improvements with the "Michael
hash" from improved encryption and the TKIP method for calculation of the RC4 key. Furthermore, the internally
incremented IV transmitted in clear text in the packet is 48 bits long instead of 24--thus the problem with the repeating
IV value is practically excluded.
As a further detail, TKIP also mixes the MAC address of the sender into the calculation of the key. This ensures that the
use of identical IVs by different senders cannot lead to identical RC4 keys and thus again to attack possibilities.
The Michael hash does not, however, represent a particularly tough cryptographic hurdle: if the attacker can break the
TKIP key or get encrypted packets past the CRC check via modifications similar to those for WEP, then not many barriers
remain. For this reason, WPA defines countermeasures if a WLAN module detects more than two Michael errors per
minute: both the client and the access point break data transfer off for one minute, afterwards renegotiating TKIP and
Michael keys.
Negotiating the encryption-method
Since the original WEP definition specified a fixed key length of 40 bits, the registration of a client at an access point
only had to communicate whether encryption should be used or not. Key lengths exceeding 40 bits require that the key
length is announced. WPA provides a mechanism with which client and access point can agree on the encryption and
authentication procedures to be used. The following information is made available:
1
A list of encryption methods which the access point provides for the pairwise key—here, WEP is explicitly disallowed.
1
A list of authentication methods a client may use to show itself to the WLAN as authorized for access—possible
methods are currently EAP/802.1x or PSK.
As mentioned, the original WPA standard specifies only TKIP/Michael as an improved encryption method. With the further
development of the 802.11i standard, the AES/CCM method described below was added. In a WPA network it is now
possible for some clients to communicate with the access point using TKIP, while other clients use AES.
13.4.4 WEP
WEP is an abbreviation for Wired Equivalent Privacy. The primary goal of WEP is the confidentiality of data. In contrast
to signals which are transmitted over cables, radio waves spread out in all directions—even into the street in front of
the house and other places where they really aren't desired. The problem of undesired interception is particularly obvious
in wireless data transmission, even though it can also arise in larger installations with wired networks—however, access
to cables is far more easily restricted than is the case with radio waves.
5
WEP offers far lower security that IEEE 802.1x/WPA2. For reasons of compatibility to older WLAN clients, LANCOM
Access Points continue to support this method of encryption. However, LANCOM Systems expressly recommends
the use of a better form of WLAN security (e. g. IEEE 802.1X/WPA2).
13.4.5 LEPS – LANCOM Enhanced Passphrase Security
LEPS remedies the security issues presented by global passphrases.
The modern encryption methods WPA and IEEE 802.11i provide data traffic in the WLAN with far improved security from
eavesdroppers than the older WEP can. It is very easy to handle a passphrase as a central key; a RADIUS server such as
that for 802.1x installations is not required.
However, the use of WPA and IEEE 802.11i still has some weak spots:
1
A passphrase applies globally for all WLAN clients
1
The passphrase may fall into unauthorized hands if treated carelessly
935
Reference Manual
13 Wireless LAN (WLAN)
1
The "leaked" passphrase then offers any attacker free access to the wireless network
This means in practice that: Should the passphrase "go missing" or an employee with knowledge of the passphrase
leaves the company, then the passphrase in the access point needs to be changed in the interests of security—in every
WLAN client, too. As this is not always possible, an improvement would be to have an individual passphrase for each
user in the WLAN instead of a global passphrase for all WLAN clients. In the case mentioned above, the situation of an
employee leaving the company requires merely his "personal" passphrase to be deleted; all others remain valid and
confidential.
With LEPS (LANCOM Enhanced Passphrase Security), LANCOM Systems has developed an efficient method that makes
use of the simple configuration of IEEE 802.11i with passphrase, but that avoids the potential security loopholes that
come with global passphrases.
LEPS uses an additional column in the ACL (access-control list) to assign an individual passphrase consisting of any 8
to 63 ASCII characters to each MAC address. The connection to the access point and the subsequent encryption with
IEEE 802.11i or WPA is only possible with the right combination of passphrase and MAC address.
This combination makes the spoofing of the MAC addresses futile—and LEPS thus shuts out a potential attack on the
ACL. If WPA or IEEE 802.11i is used for encryption, the MAC address can indeed be intercepted—but this method never
transmits the passphrase over wireless. This greatly increases the difficulty of attacking the WLAN as the combination
of MAC address and passphrase requires both to be known before an encryption can be negotiated.
LEPS can be used both locally in the device and centrally managed with a RADIUS server. LEPS works with all WLAN
client adapters available on the market without any modification. Full compatibility to third-party products is assured
as LEPS only involves configuration in the access point.
5
An additional security aspect: LEPS can also be used to secure single point-to-point (P2P) connections with an
individual passphrase. Even if an access point in a P2P installation is stolen and the passphrase and MAC address
become known, all other WLAN connections secured by LEPS remain secure, particularly when the ACL is stored
on a RADIUS server.
Configuration
The configuration of LEPS merely involves the assignment of an individual passphrase to the MAC address of each client
that is approved for the WLAN. To this end, the MAC filter is set to positive, i.e. the data from clients entered here will
be transmitted.
5
The passphrases should consist of a random string at least 32 characters long.
13.4.6 Standard WEP encryption
Ex-factory, WEP128 encryption is activated for every unconfigured LANCOM Wireless Router as standard. This encryption
is only to be used until the WLAN is configured for the first time.
Ex-factory, LANCOM Access Points are set to "managed mode" as standard, and the WLAN modules are switched off.
For this reason the first-time configuration of LANCOM Access Points via WLAN is not possible. This WEP encryption in
WLAN devices being managed by a LANCOM WLAN Controller is overwritten by the central encryption settings in the
profiles of the WLAN Controller.
The key for the standard WEP encryption consists of the first letter “L” followed by the LAN MAC address of the access
point in ASCII characters. The LAN MAC addresses of the LANCOM devices always begin with the character string
936
Reference Manual
13 Wireless LAN (WLAN)
“00A057”. You will find the LAN MAC address on a sticker on the base of the device. Only use the number labeled as
“MAC address” that starts with “00A057”. The other numbers that may be found are not the LAN MAC address.
A device with the LAN MAC address “00A0570FB9BF” thus has a standard WEP key of “L00A0570FB9BF”. This key is
entered into the ‘Private WEP settings’ of the device for each logical WLAN network as ‘Key 1’.
To use a WLAN adapter to establish a connection to a new LANCOM access point, the WEP128 encryption must be
activated for the WLAN adapter and the standard 13-character WEP key entered.
5
After registering for the first time, switch the WLAN encryption to WPA2/802.11i to ensure that you have a secure
connection.
5
Note that a reset causes the WLAN key settings to be lost from the device and the standard WEP key comes into
effect again. WLAN access can only work after a reset if the standard WEP key is programmed into the WLAN
client as well.
Addition(s) to LCOS 7.70
Standard encryption with WPA2
The factory settings (or those after resetting the device) are different in LANCOM access points than in LANCOM wireless
routers.
1
Unconfigured access points with standard factory settings cannot be commissioned by means of the WLAN interface.
The WLAN modules are switched off and the devices search the LAN for a LANCOM WLAN controller which will
supply a configuration profile.
1
Unconfigured wireless routers with standard factory settings cannot be commissioned by means of the WLAN interface.
Furthermore, encryption with WPA-PSK as described here is used as standard.
The preshared key (PSK) for the standard WPA encryption consists of the first letter “L” followed by the LAN MAC address
of the access point in ASCII characters. The LAN MAC addresses of the LANCOM devices always begin with the character
937
Reference Manual
13 Wireless LAN (WLAN)
string “00A057”. You will find the LAN MAC address on a sticker on the base of the device. Only use the number labeled
as “LAN MAC address” that starts with “00A057”. The other numbers that may be found are not the LAN MAC address.
938
Reference Manual
13 Wireless LAN (WLAN)
A device with the LAN MAC address “00A05713B178” thus has a preshared key of “L00A05713B178”. This key is entered
into the ‘WPA or private WEP settings’ of the device for each logical WLAN network as ‘Key 1/Passphrase’.
To use a WLAN adapter to establish a connection to a LANCOM wireless router that has factory settings, the WPA
encryption must be activated for the WLAN adapter and the standard 13-character preshared key.
5
After registering for the first time, change the WPA preshared key to ensure that you have a secure connection.
13.4.7 Background WLAN scanning
To detect other access points within range, LANCOM Wireless Routers actively scan all of the available channels (just as
a WLAN client would do to find an available access point). If another access point is active, the relevant information is
stored to the scan table. Since this recording occurs in the background in addition to the access points' "normal" radio
activity, it is called a "background scan".
Background scanning is mainly used for the following tasks:
1
Rogue AP detection
1
Fast roaming for WLAN clients
Rogue AP detection
WLAN devices that make unauthorized attempts at accessing a WLAN by posing as an access point or client are called
rogues. An example of rogue APs are access points that a company's employees connect to the network without the
knowledge or permission of the system administrators, thereby consciously or unconsciously making the network vulnerable
to potential attackers via unsecured WLAN access. Not quite as dangerous, but disruptive all the same are access points
that belong to third-party networks yet are within the range of the local WLAN. If such devices also use the same SSID
and channel as the local AP (default settings), then local clients could attempt to log on to external networks.
Unidentified access points within the range of the local network frequently pose a possible threat and security gap. At
the very least, they are a disturbance. Therefore, background scanning identifies rogue APs and helps to decide whether
further measures in securing the local network need to be introduced.
Fast roaming in client mode
However, the background scanning method can be used for objectives other than rogue AP detection. A LANCOM Access
Point in client mode that logs itself on to another access point can also use the roaming procedure in a mobile installation.
This is the case, for example, when a LANCOM Access Point used in an industrial application scenario is mounted to a
forklift that navigates its way through multiple warehouses with separate access points. Under normal circumstances,
the WLAN client would only log on to another access point when the connection to the access point it had been using
until that moment was lost. With the background scanning function, the LANCOM Access Point using the client mode
can collect information about other available access points in advance. In this case the client is not switched to another
access point once the existing connection has been lost completely, but rather when another access point within its
range has a stronger signal.
Evaluating the background scan
The information on the access points found can be viewed in the LANCOM Access Point statistics. The WLANmonitor
presents the scan results quite conveniently and also offers additional functions such as access point grouping or automatic
notification via e-mail whenever a new WLAN device appears.
5
Please refer to for further information.
939
Reference Manual
13 Wireless LAN (WLAN)
13.5 Configuration of WLAN parameters
Changes to the wireless network settings can be made at various points in the configuration:
1
Some parameters concern the physical WLAN interfaces. Some LANCOM models have just one WLAN interface (single
radio access point), and others have a second WLAN module integrated (dual radio access point). The settings for
the physical WLAN interface apply to all of the logical wireless networks supported by this module. These parameters
include, for example, the transmitting power of the antenna and the operating mode of the WLAN module (access
point or client).
1
Other parameters are related solely to the logical wireless network that is supported by a physical interface. These
include, among others, the SSID or activation of the encryption, such as 802.11i with AES.
1
A third group of parameters affect the wireless network operation, but are not significant only to WLANs. These
include, for example, the protocol filter in the LAN bridge.
13.5.1 General WLAN settings
LANconfig: Wireless LAN / General
WEBconfig: LCOS menu tree / Setup / WLAN
1
Country setting
Regulations for the operation of WLAN modules differ from country to country. The use of some radio channels is
prohibited in certain countries. To operate the LANCOM access points while observing the regulations in various
countries, all physical WLAN interfaces can be set up for the country where they are operated.
1
ARP handling
940
Reference Manual
13 Wireless LAN (WLAN)
Mobile stations in the wireless network that are on standby do not answer the ARP requests from other network
stations reliably. If 'ARP handling' is activated, the access point takes over this task and answers the ARP requests
on behalf of stations that are on standby.
1
Broken link detection
The 'Broken link detection' deactivates the WLAN module if the access point loses contact to the LAN.
1
Indoor function for WLAN channels
When selecting the frequency band (2.4 or 5 GHz), among other things, you must determine the channels which may
possibly be used for transmission. From these possible channels, under automatic channel selection, a LANCOM
Wireless Router selects a free channel, for example, in order to avoid interference with other radio signals.
In some countries, there are special regulations on the frequency bands and channels which may be used for WLAN
for indoor and outdoor operation. For example, in France, not all available channels in the 2.4 GHz band may be
used in outdoor operation. In some countries the DFS procedure is required for outdoor operation in the 5 GHz band
in order to avoid interference from radar systems.
With the option 'indoor-only' a LANCOM Wireless Router can be restricted exclusively to operation in closed buildings.
This restriction on the other hand allows the channels to be managed more flexibly under automatic channel selection.
5
Activating the indoor-only function can only be relied upon if the country in which the access point is being
operated has been set.
5
Activating the indoor-only function is only permitted when the access point and all connected clients are
located in a closed space.
1
Mail address
Information about events in the WLAN is sent to this e-mail address.
Addition(s) to LCOS 8.00
Broken link detection
When an access point is not connected to the cabled LAN, it is normally unable to fulfill its primary task, namely the
authorization of WLAN clients for access to the LAN. The broken-link detection function allows a device's WLAN to be
disabled if the connection to the LAN should fail. Clients associated with that access point are then able to login to a
different one (even if it has a weaker signal).
Until LCOS version 7.80, broken-link detection always applied to LAN-1, even if the device was equipped with multiple
LAN interfaces. Furthermore, deactivation affected all of the WLAN modules in the device.
With LCOS version 8.00, broken-link detection could be bound to a specific LAN interface.
The settings for the broken-link detection can be found in the following menus:
LANconfig: Wireless-LAN / General / Physical WLAN settings / Operation
941
Reference Manual
13 Wireless LAN (WLAN)
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Operational
1
Broken link detection
This function allows the WLAN modules in a device to be disabled if the allocated LAN interface has no connection
to the LAN.
Possible values:
2
No: Broken-link detection is disabled.
2
LAN-1 to LAN-n (depending on the LAN interfaces available in the device). All of the WLAN modules in the device
will be deactivated if the LAN interface set here should lose its connection to the cabled LAN.
Default:
2
No
5
The interface descriptors LAN-1 to LAN-n stand for the logical LAN interfaces. To make use of this function,
the physical Ethernet ports on the device must be set with the corresponding values LAN-1 to LAN-n.
5
Broken-link detection can also be used for WLAN devices operating in WLAN client mode. With broken-link
detection activated, the WLAN modules of a WLAN client are only activated when a connection exists between
the relevant LAN interfaces and the cabled LAN.
13.5.2 WLAN security
In this part of the configuration, you can place limitations on the communications available to the users in the wireless
network. This is done by limiting the data transfer between user groups according to individual stations or the protocol
being used. Further, the key for the WLAN encryption is set here.
942
Reference Manual
13 Wireless LAN (WLAN)
General settings
LANconfig: Wireless LAN / Security
1
Data traffic between SSIDs and stations
Depending on the application, it may be required that the WLAN clients connected to an access point can—or
expressly cannot—communicate with other clients. Communications between clients in different SSIDs can be allowed
or stopped with this option. For models with multiple WLAN modules, this setting applies globally to all WLANs and
all modules.
5
Communications between clients in a logical WLAN is controlled separately by the logical WLAN settings
(Inter-Station-Traffic). If the Inter-SSID-Traffic is activated and the Inter-Station-Traffic deactivated, a client
in one logical WLAN can communicate with clients in another logical WLAN. This option can be prevented
with the VLAN settings or protocol filter.
1
Monitor stations to detect stations that are inactive
In particular for public WLAN access points (public spots), the charging of usage fees requires the recognition of
stations that are no longer active. Monitoring involves the access point regularly sending packets to logged-in stations.
If the stations do not answer these packets, then the charging systems recognizes the station as no longer active.
1
Mobile stations can switch between base stations in the local network (roaming)
In addition to controlling the communication between clients, you can also define whether neighboring access points
can exchange information via the IAPP. The Inter Access Point Protocol (IAPP) controls communications between
access points. The "outgoing" access point receives information that a WLAN client associated with it is switching
to another access point, and that the client can be removed from its list.
943
Reference Manual
13 Wireless LAN (WLAN)
Protocol filters
With the protocol filter you can influence the handling of certain protocols during transfer from the WLAN to the LAN.
The use of appropriate rules allows the definition of which data packets should be inspected, interfaces for which the
filter applies and which action should be performed on the data packets.
LANconfig: Wireless LAN / Security / Protocols
WEBconfig: LCOS menu tree / Setup / LAN bridge / Protocol table
Similar to a firewall rule, a protocol filter consists of two parts:
1
The packet conditions defines the conditions that must be satisfied in order for the filter to be applied to a packet.
1
The action defines what happens to the packet if the condition is met.
A packet filter is described by the following parameters:
1
Name: A name of your choice for the filter entry
1
Protocol: The protocol that this filter is valid for. If '0' is entered as the protocol, the filter applies to all packets.
1
Subtype: The sub-protocol for which this filter is valid. If '0' is entered as the sub-protocol, the filter applies to all
packets of the protocol entered.
1
Start port and end port: The port range that this filter is to be valid for. If '0' is entered as the start port, this filter
will be applied to all ports of the corresponding protocol/sub-protocol. If '0' is entered as the end port, the start port
becomes an end port.
5
Lists of the official protocol and port numbers are available in the Internet under www.iana.org.
1
Destination MAC address: The MAC address of the client to which the packet is to be sent. If no destination MAC
address is entered, the filter is applied to all packets.
1
DHCP source MAC: Enabling of DHCP address tracking.
2
Yes: The rule applies if the source MAC address of the packet is listed in the table under Status > LAN
Bridge Statistics > DHCP Table as an address which obtained an IP address using DHCP.
2
No: The rule applies if this is not the case.
2
Irrelevant: The source MAC address is not considered.
944
Reference Manual
13 Wireless LAN (WLAN)
5
If DHCP address tracking is enabled, any IP addresses usually entered are disregarded. Please refer to for
further information.
1
IP network and IP netmask: The IP address of the network mask to which this filter applies. Only those IP packets
whose source and destination IP addresses lie within this network are captured by the rule.
If no network is entered, the filter applies to all packets.
1
Interface list: List of the interfaces to which the filter applies.
All of the LAN interfaces, DMZ interfaces, logical WLAN networks and point-to-point connections in the WLAN may
be entered as interfaces.
The following examples illustrate how interfaces are specified: 'LAN-1' for the first LAN interface, 'WLAN-2-3' for
the third logical WLAN network on the second physical WLAN interface, 'P2P-1-2' for the second point-to-point
connection on the first physical WLAN interface.
Groups of interfaces may be specified in the form 'WLAN-1~WLAN-1-6' (logical WLANs 1 to 6 on the first physical
WLAN interface) or with a wildcard as 'P2P-1-*' (all P2P connections on the first physical interface).
5
Only filter rules with valid entries in the interface list are active. A rule with no specification of the interfaces
does not apply to all of them - it is ignored instead.
1
Action: Action performed for the data packets captured using this rule:
1
Redirect IP address: Destination IP address for the "Redirect" action
On redirection, the destination IP address of the packets is replaced by the Redirect IP address entered here.
Furthermore, the destination MAC address is replaced by the MAC address determined using ARP for the Redirect
IP address.
5
If ARP was unable to determine the destination MAC address, the packet is dropped rather than redirected.
Example:
Redirect
IP
address
ActionInterface
list
End portStart
port
SubtypeIP
network:
IP
address
Prot.Destination
MAC
address.
DHCP
source
MAC:
Name
0.0.0.0PassWLAN-1-20000.0.0.00.0.0.00806000000000000irrelevantARP
0.0.0.0PassWLAN
1-2
6867170.0.0.00.0.0.00800000000000000irrelevantDHCP
192.168.11.5RedirectWLAN
1-2
232360.0.0.00.0.0.00800000000000000irrelevantTELNET
0.0.0.0PassWLAN
1-2
0010.0.0.00.0.0.00800000000000000irrelevantICMP
192.168.11.5RedirectWLAN
1-2
808060.0.0.00.0.0.00800000000000000irrelevantHTTP
ARP, DHCP, ICMP are allowed to pass, Telnet and HTTP are redirected to 192.168.11.5 and all other packets are rejected.
1
Procedure for filter test
If no filter rules are defined for an interface, all packets from and destined to it are transmitted without alteration. As
soon as a filter rule has been defined for an interface, all packets to be transferred via this interface are checked prior
to being processed.
1. As a first step, the information required for checking is read out of the packets:
1
DHCP source MAC:
1
Destination MAC address of the packet:
1
Protocol, e.g. IPv4, IPX, ARP
945
Reference Manual
13 Wireless LAN (WLAN)
1
Sub-protocol, e.g. TCP, UDP or ICMP for IPv4 packets, ARP Request or ARP Response for ARP packets
1
IP address and network mask (source and destination) for IPv4 packets
1
Source and destination port for IPv4 TCP or IPv4 UDP packets
2. As a second step, this information is checked against the information from the filter rules. All those rules in which
the source or destination interface is included in the interface list are considered. Checking of the rules for the
individual values is as follows:
1
For DHCP source MAC, protocol and sub-protocol, the values read out of the packets are checked for consistency
with the values defined in the rule.
1
With IP addresses, the source and destination address of the packet are checked to see whether they lie within
the range formed by the IP address and the network mask of the rule.
1
Source and destination ports are checked to see whether they lie in the range between start port and end port.
If none of the rule values specified (not filled by wildcards) agree with the values read out of the packet, the rule is
not considered applicable and is disregarded. If several rules apply, the most accurate rule action is carried out.
Parameters are more accurate the further down the list of parameters they are or the further right they appear in
the protocol table.
5
If rules are defined for an interface, but there is no match with one of the rules for a packet from/for this
interface, the default rule for this interface is used for the packet. The default rule is pre-configured for each
interface with the 'drop' action but this is not visible in the protocol table. To modify a default rule for an
interface, a rule with the name 'default-drop' is defined. Besides the interface naming, this rule can only
contain wildcats and the required action.
Checking of MAC addresses in packets sent over the respective interface takes on a different form to that with
in-coming packets.
1
With out-going packets, the source MAC address read out of the packet is checked against the destination MAC
address entered in the rule.
1
The destination MAC addresses read out of the packet are then checked to see whether they are listed as currently
active DHCP clients.
1
Rules with the 'Redirect' action are ignored if they apply for an interface over which the packet is to be sent.
3. In the third step, the action associated with the applicable rule is carried out.
1
Redirect function
With the Redirect action, IPv4 packets can not only be transferred and dropped, they can also be communicated
specifically to a particular destination. As a general rule, the destination IP address of the packet is replaced by the
Redirect IP address entered. The destination MAC address of the packet is replaced by the MAC address determined
by ARP and associated with the Redirect IP address.
In order for the redirected packets to find the correct sender on their "return trip", a dynamic table is compiled with
automatic filter rules that apply to packets leaving via this interface. This table can be viewed under Status >
LAN bridge > Connection table. Rules in this table have a higher priority than other matching rules
with the 'Transfer' or 'Drop' actions.
Clients within wireless networks often have one aspect in common: a high degree of mobility. Consequently, clients
are not necessarily always connected to the same access point, but frequently change between access points and
the related LANs.
The redirect function assists WLAN client applications to automatically find the correct target computer in the LAN.
If a WLAN client's HTTP request from a particular logical wireless network is to be always directed to a particular
946
Reference Manual
13 Wireless LAN (WLAN)
server in the LAN, a filter setting with the "Redirect" action is set up for the appropriate protocol for the desired
logical WLAN interface.
LAPTO P/ W-LAN
LAPTO P/ W-LAN
ACCESS POINT
PC
server
PC
DRUCKER
ANTENNA
10.0.0.99
Logical wireless
network on interface
WLAN-1-2
HTTP request to 192.168.2.25
Redirect: HTTP from
WLAN 1-2 to 10.0.0.99
All requests with this protocol from this logical wireless network are automatically redirected to the target server in
the LAN. The returning data packets are sent to the senders' addresses and ports according to the entries in the
connection statistics, ensuring trouble-free operation in both directions.
1
DHCP address tracking
DHCP address tracking keeps a record of which clients have received their IP addresses using DHCP. The relevant
information for an interface is automatically maintained in a table under Status > LAN Bridge
Statistics > DHCP Table. DHCP tracking is enabled on an interface if, for this interface, a minimum
of one rule is defined where 'DHCP Source MAC' is set to 'Yes'.
5
The number of clients which may be connected to an interface via DHCP can be configured in the Port table
under Setup > LAN Bridge > Port Data. Setting the entry to '0' means that any number of
clients can register at this interface via DHCP. If the maximum number of DHCP clients is exceeded by a
further attempt to register, the oldest entry in the list is deleted.
When checking data packets, IP addresses and the IP network mask defined in the rule are not used. Consequently
no check is made as to whether the destination IP address of the packet lies within the range specified. Instead, a
check is made as to whether the source IP address of the packet matches the IP address assigned to the client via
DHCP. The connection of the two IP addresses is made based on the source MAC address.
This check can be used to block clients which have received an IP address via DHCP, but which actually use a different
IP address (either intentionally or inadvertently). A rule in which the DHCP Source MAC parameter is set to 'Yes'
would not apply since the two addresses do not match. The packet would instead be processed either by other rules
or the default rule.
In order for DHCP tracking to work, at least two more rules must be set up for this interface, rules which are not
dependent on DHCP tracking. This is necessary since the required DHCP information is not exchanged until the end
of DHCP handshake. This is why packets due to be sent beforehand must be allowed by rules which do not use DHCP
tracking. These usually included TCP/UDP packets on port 67 and 68 and ARP packets.
5
If DHCP tracking is enabled on an interface, packets received on this interface from DHCP servers are
automatically dropped.
13.5.3 Selecting approved stations for the WLAN
Access-control list
With the Access Control List (ACL) you can permit or prevent the access to your wireless LAN by individual clients. The
decision is based on the MAC address that is permanently programmed into wireless LAN adapters.
5
When working with central management of LANCOM Wireless Routers and LANCOM Access Points by LANCOM
WLAN Controller, the table of stations is to be found in the area 'WLAN Controller' on the 'Stations' tab and
then with the Stations button.
947
Reference Manual
13 Wireless LAN (WLAN)
Check that the setting 'filter out data from the listed stations, transfer all other' is activated. New stations that are to
participate in your wireless network are added with the button 'Stations'.
LANconfig: Wireless LAN / Stations / Stations
WEBconfig: LCOS menu tree / Setup / WLAN / Access list
1
MAC address
MAC address of the WLAN client for this entry.
1
Name
WLAN client name for easy identification, e.g. employees.
1
Passphrase
Passphrase for the WLAN client in networks with 802.11i/WPA/AES-PSK.
1
TX bandwidth limit
Permitted bandwidth tor this WLAN client. Also see
1
RX bandwidth limit
Permitted bandwidth tor this WLAN client. Also see
1
VLAN ID
This VLAN ID is assigned to packets that are received from the client with the MAC address entered here. In case of
VLAN-ID 0, the station is not assigned a specific VLAN ID. Instead, the VLAN ID for the radio cell (SSID) applies.
13.5.4 Encryption settings
Access points of the LANCOM range support the most up-to-date methods of encryption and security for data that is
transferred via WLAN.
1
The IEEE standard 802.11i/WPA stands for the highest degree of security that is currently available for WLAN
connections. This standards uses a new encryption procedure (AES-CCM) which, in combination with other methods,
achieves levels of security equaled only by VPN connections until now. When using AES-capable hardware (such as
the 54-Mbit AirLancer clients and the 54-Mbit LANCOM access points) the transmissions are much faster than with
comparable VPN security.
1
WEP is also supported to ensure compatibility with older hardware. WEP (Wired Equivalent Privacy) is the encryption
method originally incorporated in the 802.11 standard for the encryption of data in wireless transmission. This method
uses keys of 40 (WEP64), 104 (WEP128) or 128 bits (WEP152) in length. A number of security loopholes in WEP have
come to light over time, and so the latest 802.11i/WPA methods should be used wherever possible.
5
Further information about the 802.11i and WPA standards are available under .
948
Reference Manual
13 Wireless LAN (WLAN)
WPA and private WEP settings
LANconfigWireless LAN / 802.11i/WEP / WPA or Private WEP settings
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Encryption
1
Method/key 1 length
Set the encryption method to be used here.
2
802.11i (WPA)-PSK – Encryption according to the 802.11i standard offers the highest security. The 128-bit AES
encryption used here offers security equivalent to that of a VPN connection. Select this setting if no RADIUS server
is available and authentication is based on a pre-shared key.
2
802.11i (WPA)-802.1x – If authentication is handled by a RADIUS server, select the option '802.11i (WPA)-802.1x'.
When using this setting, additionally ensure that the RADIUS server is configured in the 802.1x settings.
2
WEP 152, WEP 128, WEP 64 – encryption according to the WEP standard with key lengths of 128, 104 or 40
bits respectively. This setting is only to be recommended when the hardware used by the WLAN client does not
support the modern method.
2
WEP 152-802.1x, WEP 128-802.1x, WEP 64-802.1x – encryption according to the WEP standard with key lengths
of 128, 104 or 40 bits respectively, and with additional authentication via 802.1x/EAP. This setting is also only
to be recommended when the hardware used by the WLAN client does not support the 802.11i standard. The
802.1x/EAP authentication offers a higher level of security than WEP encryption alone.
1
Key 1/passphrase
In line with the encryption method activated, you can enter a special WEP key for the respective logical WLAN interface
or a passphrase when using WPA-PSK:
2
The passphrase, or the 'password' for the WPA-PSK method, is entered as a string of at least 8 and up to 63
ASCII characters.
5
Please be aware that the security of this encryption method depends on the confidential treatment of
this passphrase. Passphrases should not be made public to larger circles of users.
2
The WEP key 1, that applies only to its respective logical WLAN interface, can be entered in different ways
depending on the key length. Rules of the entry of the keys can be found in the description of the WEP group
key .
1
WPA version
WPA version for encryption offered by the access point to the WLAN clients.
2
WPA1: WPA1 only
2
WPA2: WPA2 only
2
WPA1/2: WPA1 and WPA2 in one SSID (radio cell)
1
WPA1 session key type
949
Reference Manual
13 Wireless LAN (WLAN)
If '802.11i (WPA)-PSK' has been entered as the encryption method, the procedure for generating a session or group
key for WPA 1 can be selected here:
2
AES – the AES method will be used.
2
TKIP – the TKIP method will be used.
2
AES/TKIP – the AES method will be used. If the client hardware does not support the AES method, TKIP will be
used.
1
WPA 2 session key type
Procedure for generating a session or group key for WPA 2.
1
WPA rekeying cycle
A 48-bit long initialization vector (IV) impedes attackers in their attempts to calculate the WPA key. The true key
consisting of the IV and WPA key only repeats every 16 million packets. In high-traffic WLANs, the key is repeated
only after several hours. To avoid repetition of the key, WPA automatically renegotiates the key at regular intervals.
This takes place before repetition of the key.
Enter a value in seconds after which the key is renegotiated.
The standard value is '0' and the key is not negotiated in advance.
1
Client EAP method
In WLAN client operating mode, LANCOM Access Points can authenticate themselves to another access point using
EAP/802.1X. To activate the EAP/802.1X authentication in client mode, the client EAP method is selected as the
encryption method for the first logical WLAN network.
Note that the selected client EAP method must match the settings of the access point that the LANCOM Access Point
is attempting to log onto.
5
In addition to setting the client EAP method, also be sure to observe the corresponding setting for the WLAN
client operation mode! The client EAP method setting has no function on logical WLAN networks other than
WLAN 1.
1
Authentication
If the encryption method was set as WEP encryption, two different methods for the authentication of the WLAN client
are available:
2
The 'Open system' method does not use any authentication. The data packets must be properly encrypted from
the start to be accepted by the access point.
2
With the 'Shared key' method, the first data packet is transmitted unencrypted and must be sent back by the
client correctly encrypted. This method presents potential attackers with at least one data packet that is
unencrypted.
1
Default key
If WEP encryption is selected, the access point can select from four different WEP keys for each logical WLAN interface:
2
Three WEP keys for the physical interface
2
An additional WEP key particular to each logical WLAN interface
The private WEP settings are used to set the additional key for each logical WLAN interface (see 'Key 1/passphrase').
You should also select which of the four keys is currently to be used for the encryption of the data (default key). This
setting can be used to change the key frequently, so increasing security.
Rules of the entry of the keys can be found in the description of the WEP group key .
WEP group keys
The WEP method uses keys of 40 (WEP64), 104 (WEP128) or 128 bits (WEP152) in length. Each WLAN interface has four
WEP keys: a special key for each logical WLAN interface and three common group WEP keys for each physical WLAN
interface.
950
Reference Manual
13 Wireless LAN (WLAN)
5
If 802.1x/EAP is in use and the 'dynamic key generation and transmission' is activated, the group keys from
802.1x/EAP will be used and are consequently no longer available for WEP encryption.
Rules of the entry of the keys can be found in the description of the WEP group key .
LANconfigWireless LAN / 802.11i/WEP / WEP group keys
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Group keys
Rules for entering WEP keys
WEP keys can be entered as ASCII characters or in hexadecimal form. The hexadecimal form begins with the characters
'0x'. The keys have a length depending on the WEP method:
HEXASCIIMethod
10 characters Example: '0x0A5C1B6D8E'5 characters Example: 'aR45Z'WEP 64
26 characters13 charactersWEP 128
32 characters16 charactersWEP 152
The ASCII character set includes the characters '0' to'9', 'a' to 'z', 'A' to 'Z' and the following special characters:
! ” # $ % & ´ () * + , - ./ : ; < = > ? @ [ \ ] ^ _ ‘ { | } ~
The HEX form uses the numbers '0' to '9' and the letters 'A' to 'F' to display each character as a character pair, which
is why twice the number of characters is required to display a HEX key.
Select the length and the format (ASCII or HEX) of the key depending on the best option available in the wireless network
cards that register with your WLAN. If the encryption in an access point is set to WEP 152, some clients may not be able
to log into the WLAN as their hardware does not support the key length.
13.5.5 The physical WLAN interfaces
In addition to the general WLAN parameters, a variety of settings apply specifically to each WLAN module in the access
point.
951
Reference Manual
13 Wireless LAN (WLAN)
K.
Operating settings
LANconfig: Wireless LAN / General / Physical WLAN settings / Operation
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Operational
1
WLAN operating modes
LANCOM Access Points can be operated in various operating modes:
2
As an access point, it forms the link between WLAN clients and the cabled LAN.
952
Reference Manual
13 Wireless LAN (WLAN)
2
In client mode, the device itself locates the connection to another access point and attempts to register with a
wireless network. In this case the device serves to link a cabled network device to an access point over a wireless
connection.
2
As a managed Access Point, the device searches for a central WLAN-Controller from which it can obtain a
configuration.
If the WLAN interface is not required, it can be completely deactivated.
1
Link LED function
When setting up point-to-point connections or operating the device as a WLAN client, the best possible positioning
of the antennas is facilitated if the signal strength can be recognized at different positions. The WLAN link LED can
be used for displaying the signal quality during the set-up phase. In the corresponding operation mode, the WLAN
link LED blinks faster the better the reception quality in the respective antenna position is.
2
Number of connections: In this operation mode, the LED uses "inverse flashing" in order to display the number
of WLAN clients that are logged on to this access point as clients. There is a short pause after the number of
flashes for each client. Select this operation mode when you are operating the LANCOM Wireless Router in access
point mode.
2
Client signal strength: In this operation mode, this LED displays the signal strength of the access point with which
the LANCOM Access Point has registered itself as a client. The faster the LED blinks, the better the signal. Select
this operation mode only if you are operating the LANCOM Access Point in client mode.
2
P2P1 to P2P6 signal strength: In this operation mode, the LED displays the signal strength of respective P2P
partner with which the LANCOM Access Point forms a P2P path. The faster the LED blinks, the better the signal.
Radio settings
LANconfig: Wireless LAN / General / Physical WLAN settings / Radio
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Radio settings
1
Frequency band, Subband
When selecting the frequency band on the 'Radio' tab under the physical interface settings, you decide whether the
WLAN module operates in the 2.4 GHz or in the 5 GHz band (also see ), and thus the available radio channels.
In the 5 GHz band, a subband can also be selected which is linked to certain radio channels and maximum transmission
powers.
953
Reference Manual
13 Wireless LAN (WLAN)
5
In some countries, the use of the DFS method for automatic channel selection is a legal requirement. Selecting
the subband also defines the radio channels that can be used for the automatic channel selection.
With the DFS method (Dynamic Frequency Selection) an unused frequency is automatically selected, for example, to
avoid interference from radar systems or to distribute WLAN devices as evenly as possible over the entire frequency
band. After switching on or booting, the device randomly selects one of the available channels (e.g. based on the
country settings). It checks whether radar signals exist on this channel, and whether it is already in use by another
WLAN. This scan procedure repeats until a channel is found that is free of radar signals and which has the lowest
possible number of other networks. The selected channel is then monitored for radar signals for a further 60 seconds.
For this reason, data traffic may be interrupted for a period of 60 seconds while the frequencies are scanned for a
free channel.
To avoid these pauses in data transmission every time the channel is changed, LANCOM devices carry out the scan
before a channel is chosen. Information about scanned channels is stored to an internal database.
2
Was a radar signal detected on the channel?
2
How many other networks were found on the channel?
This database helps the WLAN device to select a channel from the list that is free of radar signals and that has the
lowest number of other networks (the operating channel). After the channel has been selected, data transmission
can continue immediately without any waiting.
2
The "blacklist" in the database stores the channels to be blocked due to the detection of radar signals. This entries
are removed from the list every 30 minutes in order to keep the information up to date.
2
The "whitelist" in the database stores the channels where no radar was detected. These entries remain valid for
24 hours, although if radar signals be detected in the meantime, an entry is made to the blacklist.
The access point generally uses the operating channel selected after the first scan permanently. Connections can
now be operated for any length of time on the channel selected by the DFS algorithm until either a radar signal is
detected or the radio cell is restarted (e.g. by changing the device configuration, firmware upload, or restart).
When is it necessary to carry out a new 60-second scan?
2
The device is switched on or cold-started. Under these circumstances the database is empty. The device cannot
select a channel from the whitelist, and so a scan has to be carried out.
2
Within the first 24 hours of scanning, it becomes necessary to switch channels because a radar signal is detected
within range of the access point. In this case, the access point can refer to alternatives in the whitelist. It then
informs associated WLAN clients and/or P2P partners of the new operating channel and switches to this channel.
This process takes place within about a second, so the switch can be considered to be uninterrupted.
2
The device is in operation for 24 hours already, and then a channel switch becomes necessary. Entries in the
whitelist are out of date and thus discarded. The access point has no alternative channel to which it can switch
directly. In this case the database requires new information from a scan and WLAN operation is interrupted for
one minute.
5
To avoid having the 60 second pause at an inconvenient time, you can set the time of the scan and thus
the database update. Do this with WEBconfig or telnet in the menu
Setup/Interfaces/WLAN/Radio settings. To define the time you can use the options
provided by cron commands, e.g. '1,6,13' to force a DFS scan at 01:00h, 06:00h or 13:00h, or '0-23/4'
for a DFS scan between 0:00h and 23:00h every 4 hours. Forced DFS scans require that the device is set
with the correct system time.
The ETSI standard 301 893 version 1.4.1 is the latest set of regulations concerning the operation of 5-GHz wireless
LANs. In the context of the wireless LAN modules used in the LANCOM Wireless Routers and LANCOM Access Points,
this standard is also referred to as DFS 2.
This standard makes tougher demands on the radar detection patterns used when operating 5-GHz WLANs. The
standard applies to all devices brought into circulation after April 01, 2008. Devices brought into circulation before
this date do not have to meet this standard. In particular devices with older WLAN chips (two- or three-chip modules)
do not have to meet this standard and, as such, do not have to be upgraded.
954
Reference Manual
13 Wireless LAN (WLAN)
LANCOM Systems supplies LCOS firmware of the versions 7.30 (for the current Wireless Routers and Access Points)
and 7.52 (for LANCOM Wireless L-310agn and LANCOM Wireless L-305agn) with DFS 2 support. These firmware
versions have different threshold values for radar-pattern recognition than with the former DFS.
5
In principle the operator of the WLAN is responsible for maintaining the new ETSI standards. For this reason
LANCOM Systems recommends that you perform an update to a firmware version with DFS 2 support.
1
Channel number
The radio channel selects a portion of the conceivable frequency band for data transfer.
5
In the 2.4-GHz band, two separate wireless networks must be at least three channels apart to avoid
interference.
WLAN Controller
Access Point Access Point
LAN
Access Point
Access Point Access PointAccess Point
Channel 1 Channel 11
Channel 11
Channel 6
Channel 1Channel 6
1
2.4-GHz mode
Three different wireless standards are based on the 2.4-GHz band: IEEE 802.11b, IEEE 802.11g and IEEE 802.11n.
If 2.4 GHz is selected as the operating frequency, the compatibility mode can be selected in addition.
5
Please observe that clients supporting only the slower standards may not be able to register with the WLAN
if compatibility mode is set to a high value.
The 802.11gbn compatibility mode offers the highest possible speeds and yet also offers the 802.11b standard so
that slower clients are not excluded. In this mode, the WLAN module in the access point principally works with the
faster standard and falls back on the slower mode should a client of this type log into the WLAN.
In principle 802.11n is backwardly compatible to the previous IEEE 802.11b/g wireless LAN standards, although not
all 802.11n functions are supported in this mode.
In the 2.4 GHz band you can allow operation in accordance with 802.1b/g/n either exclusively or in various mixed
modes. When 802.11b is supported you can also select whether only 11 Mbps mode or the older 2 Mbps should be
supported.
5
Compatibility is always achieved at the expense of performance. It is therefore recommended to allow only
those modes of operation that are absolutely necessary for the wireless LAN clients in use.
1
5-GHz mode
Using two neighboring, vacant channels for wireless transmissions can increase the transfer speeds up to 108 Mbps.
With the base station in the 108Mbit/s Turbo mode, only those WLAN clients that also support the 108Mbit/s Turbo
mode can connect to this base station.
In the 5 GHz band you can choose to allow either greenfield mode (802.11n only) or mixed operation with 802.11a.
Greenfield mode should be chosen if there are only 802.11n devices in operation in a network, as these guarantee
the highest possible throughput rates.
1
Double bandwidth (20/40 MHz)
A wireless LAN module normally uses a frequency range of 20 MHz in which data to be transmitted is modulated to
the carrier signals. 802.11a/b/g use 48 carrier signals in a 20 MHz channel. The use of double the frequency range
of 40 MHz means that 96 carrier signals can be used, resulting in a doubling of the data throughput.
802.11n can use 52 carrier signals in one 20 MHz channel for modulation and up to 108 in a 40 MHz channel. The
use of the 40 MHz option for 802.11n therefore means a performance gain of more than double.
1
Antenna grouping
955
Reference Manual
13 Wireless LAN (WLAN)
LANCOM Access Points with 802.11 support can use up to three antennas for transmitting and receiving data. Using
several antennas with 802.11n can have different purposes:
2
Improved data throughput: Using "spatial multiplexing" allows parallel data streams to be implemented to
transmit double the amount of data.
2
Improving wireless coverage: Cyclic shift diversity (CSD) can be used to transmit a radio signal in different phases.
This reduces the risk of the signal being erased at certain points in the radio cell.
Depending on the application the use of the antennas can be set:
2
When using the device in access point mode to connect wireless LAN clients it is generally recommended to use
all three antennas in parallel in order to achieve good network coverage.
2
To work with 2 parallel data streams; for example for point-to-point links with an appropriate dual slant antenna,
the antenna ports 1 + 2 or 1 + 3 are used. The unused antenna port is deactivated.
2
For applications with only one antenna (for example an outdoor application with just one antenna) the antenna
is connected to port 1 and ports 2 and 3 are deactivated
2
The ''Auto' setting means that all available antennas are used
Please note the following when connecting antennas:
Antenna connector 1 must always be used. Depending on the mounting and cabling, the second antenna may be
connected either to connector 2 or connector 3.
The configuration of the device software must agree with the actual antenna connections.
1
Diversity settings
The diversity settings specify which antennas should be used for transmission and for reception:
2
'Transmit via the primary antenna only' (RX diversity): In this default setting, the antenna connected to the access
point's main connector is used for data transmission. For reception (RX), the antenna with the best signal is
selected (at Main or AUX).
2
'Automatically select the best antenna for transmission' (TX and RX diversity): If the diversity function is used for
transmission (TX) as well, the antenna with the strongest signal is taken.
2
'Send via the primary antenna and receive via the secondary antenna' (no diversity): The main antenna only is
used for transmission, and for reception the antenna at the AUX connector is preferred. Using this alternative,
high-performance antennas that are legally prohibited from transmitting can be used for reception.
1
Antenna gain, transmission power reduction
Where the transmission power of an antennae exceeds the levels permitted in the country of operation, the power
must be attenuated accordingly.
2
The field 'Antenna gain' is for the gain of the antenna minus the actual cable loss. For an AirLancer Extender
O-18a antenna with a gain of 18dBi and a 4m cable with a loss of 1dB/m, the 'Antenna gain' would be entered
as 18 - 4 = 14. This value for true antenna gain is dynamically used to calculate and emit the maximum permissible
power with regards to other parameters such as country, data rate and frequency band.
2
In contrast to this, the entry in the field 'Tx power reduction' causes a static reduction in the power by the value
entered, and ignores the other parameters. Also see .
5
The transmission power reduction simply reduces the emitted power. The reception sensitivity (reception
antenna gain) remains unaffected. This option is useful, for example, where large distances have to be bridged
by radio when using shorter cables. The reception antenna gain can be increased without exceeding the
legal limits on transmission power. This leads to an improvement in the maximum possible range and, in
particular, the highest possible data transfer rates.
1
Access point density
The more access points there are in a given area, the more the reception areas of the antennae intersect. Information
on 'access point density' is sent with the beacons for processing by older Agere clients.
1
Maximum distance
956
Reference Manual
13 Wireless LAN (WLAN)
Large distances between transmitter and receiver give rise to increasing delays for the data packets. If a certain limit
is exceeded, the responses to transmitted packets no longer arrive within an acceptable time limit. The entry for
maximum distance increases the wait time for the responses. This distance is converted into a delay which is acceptable
for wireless communications.
1
Background scan interval
If a value is entered here, the LANCOM Wireless Router searches the frequencies in the active band that are currently
not in use in cycles within this interval in order to find available access points.
2
The background scan function is usually deployed for rogue AP detection for the LANCOM Wireless Router in
access point mode. This scan interval should correspond to the time span within which unauthorized access
points should be recognized, e.g. 1 hour.
2
Conversely, for the LANCOM Wireless Router in client mode, the background scan function is generally used for
improved mobile WLAN client roaming. In order to achieve fast roaming, the scan time is limited here, for example,
to 260 seconds.
2
When the background scan time is '0' the background scanning function is deactivated.
1
Time unit for background scanning
The background scan interval sets the time period between searches by a Wireless Router or Access Point for third-party
WLAN networks within range.
The time interval allows the entered value to be defined in milliseconds, seconds, minutes, hours or days.
5
To avoid adverse effects on data transfer rates, the interval between channel scans in access-point mode
should be at least 20 seconds. Lesser values will be corrected to this minimum value automatically. For
example, with 13 channels to scan in the 2.4GHz band, one scan of the full spectrum takes at least 13 x 20s
= 260 seconds.
5
Background scanning can be limited to a lower number of channels when indoor mode is activated. This
allows roaming for the mobile LANCOM Wireless Router in client mode to be improved even further.
Performance
LANconfig: Wireless LAN / General / Physical WLAN settings / Performance
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Performance
1
TX burst
957
Reference Manual
13 Wireless LAN (WLAN)
Enables/prevents packet bursting for increasing throughput. Bursting leads to less fairness on the medium.
1
Hardware compression
Allows or prohibits the hardware packet compression.
1
QoS according to 802.11e
With the extension to the 802.11 standard, 802.11e, Quality of Service can be provided for transfers via WLAN.
Among others, 802.11e supports the prioritization of certain data-packet types. This extension is an important basis
for the use of voice applications in WLANs (Voice over WLAN, VoWLAN). The WiFi alliance certifies products that
support Quality of Service according to 802.11e, and refer to WMM (WiFi Multimedia, formerly known as WME or
Wireless Multimedia Extension). WMM defines four categories (voice, video, best effort and background) which make
up separate queues to be used for prioritization. The 802.11e standard sets priorities by referring to the VLAN tags
or, in the absence of these, by the DiffServ fields of IP packets. Delay times (jitter) are kept below 2 milliseconds, a
magnitude which is inaudible to the human ear. 802.11e controls access to the transfer medium with EDCF, the
Enhanced Distributed Coordination Function.
5
Priorities can only be set if the WLAN client and the access point both support 802.11e or WMM, and also
if the applications are able to mark the data packets with the corresponding priorities.
Point-to-point connections
Access points are not limited to communications with mobile clients; they can also transfer data from one access point
to another.
LANconfig: Wireless LAN / General / Physical WLAN settings / Point-to-point
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Interpoint settings
1
Point-to-point operation mode
2
'Off': The access point only communicates with mobile clients
2
'On': The access point can communicate with other access points and with mobile clients
958
Reference Manual
13 Wireless LAN (WLAN)
2
'Exclusive': The access point only communicates with other access points
1
Station name
For this physical WLAN interface, enter a name which is unique in the WLAN: This name can be used by other WLAN
devices to connect this base station over point-to-point.
You can leave this field empty if the device has only one WLAN interface and already has a device name which is
unique in the WLAN, or if the other base stations identify this interface by means of the WLAN adapter's MAC address.
1
Do not forward packets between P2P links on the same interface
Allows or prohibits the transmission of packets between P2P links on the same WLAN interface
1
Channel selection scheme
In the 5-GHz band, the automatic search for vacant WLAN channels can lead to several simultaneous test transmissions
from multiple access points, with the result that they do not find each other. This stalemate situation can be avoided
with the appropriate "Channel selection scheme".
Thus it is recommended for the 5GHz band that one central access point should be configured as 'Master' and all
other point-to-point partners should be configured as 'Slave'. In the 2.4GHz band, too, this setting simplifies the
establishment of point-to-point connections if the automatic channel search is activated.
2
Master: This access point takes over the leadership when selecting a free WLAN channel.
2
Slave: All other access points will search for a channel until they have found a transmitting Master.
5
The purpose of this area is to define general P2P parameters only—the actual connections to remote WLAN
stations themselves are defined under the following paths: LANconfigWireless LAN / General / Point to point
partners WEBconfig: Setup / Interfaces / WLAN Interpoint peers
Client mode
If the LANCOM Router device is operating as a client, the tab 'Client mode' can be used for further settings that affect
the behavior as a client.
LANconfig: Wireless LAN / General / Physical WLAN settings / Client mode
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Client modes
1
Keep client connection alive
959
Reference Manual
13 Wireless LAN (WLAN)
This option ensures that the client station keeps the connection to the access point alive even if the connected devices
are not exchanging any data packets. If this option is disabled, the client station is automatically logged off the
wireless network if no packets are transferred over the WLAN connection within a specified time.
1
Scan bands
This defines whether the client station scans just the 2.4 GHz, just the 5 GHz, or all of the available bands for access
points.
1
Preferred BSS ID
If the client station is to log onto one particular access point only, the MAC address of the WLAN module in this
access point can be entered here.
1
Address adaptation
In client mode, the client station normally replaces the MAC addresses in data packets from the devices connected
to it with its own MAC address. The access point at the other end of the connection only ever “sees” the MAC address
of the client station, not the MAC address of the computer(s) connected to it.
ACCESS POINT
PC
ACCESS POINT
PC
PC
PC
CLIENT STATIONACCESS POINT
server
HEADQUARTER
HEADQUARTER
ACCESS POINT
CLIENT STATION
server
MAC address
of client station
MAC address
of computer
MAC address
of computer
Without MAC address adaptation
MAC address
of computer
With MAC address adaptation
In some installations it may be desirable for the MAC address of a computer to be transmitted to the access point
and not the MAC address of the client station. The option ‘Address adaptation’ prevents the MAC address from being
replaced by the client station. Data packets are transferred with their original MAC addresses—in the WLAN, the
Access Point takes the client's MAC address.
5
Address adaptation only works when just one computer is connected to the client station.
1
Client-bridge support
Whereas address adaptation allows only the MAC address of a single attached device to be visible to the access
point, client-bridge support provides transparency in that all MAC addresses of the LAN stations behind the client
stations are transferred to the access point.
ACCESS POINT
server
HEADQUARTER
CLIENT STATION
STATION 2
STATION 1
MAC address
of station 1
MAC address
of station 2
Source: MAC address of
station 1 and client station
Target: MAC address of
access point and server
Source: MAC address of
station 2 and client station
Target: MAC address of
access point and server
Furthermore, the three MAC addresses usual in client mode are not used for this operating mode (in this example
for server, access point and client station), but rather four addresses as with point-to-point connections (the fourth
is the MAC address of the station in the LAN of the client station). The fully transparent connection of a LAN to the
client station allows targeted transmission of data packets in the WLAN and hence functions such as TFTP downloads,
initiated by a broadcast.
The client-bridge mode offers the following advantages:
2
Unlike the "normal" client mode, address translation (masking) in the client station is omitted.
960
Reference Manual
13 Wireless LAN (WLAN)
2
In relation to point-to-point connections, the occasionally undesirable entry of MAC addresses or station names
is omitted. Furthermore, the client-bridge mode allows more than six connections (limitation with P2P) to be set
up.
2
The client station can roam, which is not possible with point-to-point (this applies both to the client-bridge mode
and to the standard client mode).
5
Client-bridge mode can only be used between two LANCOM devices. Likewise, the use of the client-bridge
mode must be enabled in the settings for the logical network of the access point.
13.5.6 Point-to-point peers
Up to six point-to-point connections can be activated for each WLAN module.
LANconfigWireless LAN / General / Point to point partners
WEBconfig: Setup / Interfaces / WLAN Interpoint peers
1
Recognize by
Here you select the characteristics to be used to identify the P2P peer.
1
MAC address
MAC address of the P2P remote station.
1
Station name
Station name of the P2P remote station.
5
If you work with detection by MAC address, enter the MAC address of the WLAN adapter here and not that
of the device itself.
961
Reference Manual
13 Wireless LAN (WLAN)
13.5.7 The logical WLAN interfaces
Every physical WLAN interface can support up to eight different logical wireless networks (Multi-SSID). Parameters can
be defined specifically for each of these networks, without the need of additional access points.
Network settings
LANconfig: Wireless LAN / General / Logical WLAN settings / Network
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Network
1
Wireless LAN enabled/operating
This switch allows the logical WLAN to be activated/deactivated separately.
1
Network name (SSID)
Define a unique SSID (the network name) for each of the logical wireless LANs required. Only network cards that
have the same SSID can register with this wireless network.
1
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted
by any mobile station in the area without the SSID being named. By suppressing SSIDs in the broadcasts, you place
962
Reference Manual
13 Wireless LAN (WLAN)
your wireless LAN into a privacy mode. In this operation mode, mobile stations that do not know the network name
(SSID) are excluded from taking part in the wireless LAN.
Activate the suppression of SSID broadcasting if you wish to prevent WLAN clients from registering with your network
without naming the SSID.
1
MAC filter enabled
The MAC addresses of the clients that are allowed to associate with an access point are stored in the MAC filter list
(Wireless LAN / Stations / Stations). The 'MAC filter activated' switch can be used to switch off the use of the
MAC filter list for individual logical networks.
5
Use of the MAC filter list is required for logical networks in which the clients register via LEPS with an individual
passphrase. The passphrase used by LEPS is also entered into the MAC filter list. The MAC filter list is always
consulted for registrations with an individual passphrase, even if this option is deactivated.
1
Maximum number of clients
Here you set the maximum number of clients that may associate with this access point. Additional clients wanting
to associate will be rejected.
1
Client-bridge support
Enable this option for an access point if you have enabled the client-bridge support for a client station in WLAN
client mode.
5
Client-bridge mode can only be used between two LANCOM devices.
Transmission settings
Details for the data transfer over the logical interface are set on the 'Transmission' tab.
LANconfig: Wireless LAN / General / Logical WLAN settings / Transmission
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Transmission
1
Packet size
Smaller data packets cause fewer transmission errors than larger packets, although the proportion of header
information in the traffic increases, leading to a drop in the effective network load. Increase the factory value only
if your wireless network is largely free from interference and very few transmission errors occur. Reduce the value to
reduce the occurrence of transmission errors.
1
Minimum and maximum transmit rate
The access point normally negotiates the data transmission speeds with the connected WLAN clients continuously
and dynamically. The access point adjusts the transmission speeds to the reception conditions. As an alternative,
963
Reference Manual
13 Wireless LAN (WLAN)
you can set fixed values for the minimum and maximum transmission speeds if you wish to prevent the dynamic
speed adjustment.
1
Modulation Coding Scheme (MCS)
A specific MCS number denotes a unique combination from the modulation of the individual carriers (BPSK, QPSK,
16QAM, 64QAM), coding rate (i. e. proportion of error correction bits in the raw data and number of spatial streams.
802.11n uses this term instead of the term "data rate" used in older wireless LAN standards because data rate is no
longer an unequivocal description.
Data throughput (GI=0.4 µs,
40 MHz)
Coding rateModulationData streamsMCS index
151/2BPSK10
301/2QPSK11
453/4QPSK12
601/216QAM13
903/416QAM14
1201/264QAM15
1353/464QAM16
1505/664QAM17
301/2BPSK28
601/2QPSK29
903/4QPSK210
1201/216QAM211
1803/416QAM212
2401/264QAM213
2703/464QAM214
3005/664QAM215
The MCS selection therefore indicates the type and minimum or maximum number of modulation parameters that
should be used for one or two spatial data streams. Within these limits, the appropriate MCS is selected when the
connection is established depending on the current conditions and may be adapted during the connection if required.
This also defines the maximum attainable data throughput, indicated in the last column of the table (here for the
short guard interval GI = 0.4 µs using the 40 MHz channel).
1
Broadcast rate
The defined broadcast rate should allow the slowest clients to connect to the WLAN even under poor reception
conditions. A higher value should only be set here if all clients are able to connect "faster".
1
Number of spatial streams
The spatial multiplexing function allows several separate data streams to be transmitted over separate antennas in
order to increase data throughput. The use of this function is only recommended when the remote device can process
the data streams with corresponding antennas.
5
With the 'Auto' setting all spatial streams that are supported by the wireless LAN module in question are
used.
1
RTS threshold
964
Reference Manual
13 Wireless LAN (WLAN)
The RTS threshold prevents the occurrence of the "hidden station“ phenomenon.
ACCESS POINT ACCESS POINT ACCESS POINT
Network cove rage acces pointNetwork cove rage acces point
Here, the three access points , , and are positioned such that no direct wireless connection between the two outer
devices is possible. If sends a packet to , is not aware of this as it is outside of 's coverage area. may also try, during
the transmission from , to send a packet to as well, because has no knowledge of the medium (in this case the
wireless connection) being blocked. A collision results and neither of the transmissions from nor to will be successful.
The RTS/CTS protocol is used to prevent collisions.
ACCESS POINT ACCESS POINT ACCESS POINT
To this end, precedes the actual transmission by sending an RTS packet to , that answers with a CTS. The CTS sent
by is now within "listening distance" of , so that can wait with its packet for . The RTS and CTS signals each contain
information about the time required for the transmission that follows.
A collision between the very short RTS packets is improbable, although the use of RTS/CTS leads to an increase in
overhead. The use of this procedure is only worthwhile where long data packets are being used and the risk of
collision is higher. The RTS threshold is used to define the minimum packet length for the use of RTS/CTS. The best
value can be found using trial and error tests on location.
5
The RTS/CTS threshold value also has to be set in the WLAN client, as far as the driver and/or operating
system allow this.
1
Long preamble for 802.11b
Normally, the clients in 802.11b mode negotiate the length of the preamble with the access point. "Long preamble"
should only be set when the clients require this setting to be fixed.
1
Short guard interval
This option is used to reduce the transmission pause between two signals from 0.8 µs (default) to 0.4 µs (short guard
interval). This increases the effective time available for data transmission and thus the data throughput. However,
the wireless LAN system becomes more liable to disruption that can be caused by interference between two consecutive
signals.
The short guard interval is activated in automatic mode, provided that the remote station supports this. Alternatively
the short guard mode can be switched off.
1
Frame aggregation
Frame aggregation is used to combine several data packets (frames) into one large packet and transmit them together.
This method serves to reduce the packet overhead, and the data throughput increases.
Frame aggregation is not suitable when working with mobile receivers or time-critical data transmissions such as
voice over IP.
1
Hard retries
This value defines the number of times that the hardware should attempt to send packets before a Tx error message
is issued. Smaller values mean that a packet which cannot be sent blocks the sender for less time.
1
Soft retries
If the hardware was unable to send a packet, the number of soft retries defines how often the system repeats the
attempt to transmit.
The total number of attempts is thus (soft retries + 1) * hard retries.
The advantage of using soft retries at the expense of hard retries is that the rate-adaption algorithm immediately
begins the next series of hard retries with a lower datarate.
965
Reference Manual
13 Wireless LAN (WLAN)
Addition(s) to LCOS 8.62
New parameter for WLAN client signal strength
LCOS version 8.62 now optionally evaluates the signal strengths of wireless LAN clients when they logon.
Additions to LANconfig
Network settings
LANconfig:Wireless LAN > General > Logical WLAN settings > Network
1
WLAN network enabled
This switch enables or disenables the corresponding logical WLAN.
1
Network name (SSID)
Specify a unique SSID (the network name) for each of the required logical wireless LANs. Only network cards that
have the same SSID can register with this wireless network.
1
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted
by any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function.
In this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in
the wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented
from associating with your network.
The option Suppress SSID broadcast provides the following settings:
2
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or
incorrect SSID, the access point responds with the SSID of the radio cell (public WLAN).
2
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an
empty SSID, the access point similarly responds with an empty SSID.
2
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with
an empty or incorrect SSID, the access point does not respond.
966
Reference Manual
13 Wireless LAN (WLAN)
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients
in the WLAN network.
1
MAC filter enabled
The MAC addresses of the clients that are allowed to associate with an access point are stored in the MAC filter list
(Wireless LAN > Stations > Stations). The MAC filter enabled switch allows you to switch off the use of the MAC
filter list for individual logical networks.
5
Use of the MAC filter list is required for logical networks in which the clients register via LEPS with an individual
passphrase. The passphrase used by LEPS is also entered into the MAC filter list. The access point always
consults the MAC filter list for registrations with an individual passphrase, even if this option is deactivated
here.
1
Maximum number of clients
Here you set the maximum number of clients that may associate with this access point. Additional clients wanting
to associate will be rejected by the access point.
1
Minimum client signal strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on. If the
client's signal strength is below this value, the access point stops sending probe responses and discards the client's
requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, as those offering only a weak connection at the client's current
position are not listed.
1
Client-bridge support
Enable this option for an access point if you have enabled the client-bridge support for a client station in WLAN
client mode.
5
The client-bridge mode operates between two LANCOM devices only.
1
Allow traffic between stations of this SSID
Check this option if all stations logged on to this SSID are to be able to communicate with one another.
Additions to the menu system
2.23.20.1.16 Min-Client-Strength
This values defines the minimum signal strength of WLAN clients which the access point will accept, even if a matching
SSID or a wildcard SSID is provided. The access point will silently discard all probe requests below this threshold.
You can use this option to prevent large numbers of potential WLAN clients, e.g. mobile handsets, to decrease the WLAN
performance with probe requests looking for available WLAN networks.
The strength threshold is specified in percent, which can be translated into an SNR: a threshold of 100 percent means
a minimum SNR of 64 dBm, 50 percent means 32 dBm and so on.
Path Telnet: /Setup/Interfaces/WLAN/Network
Possible values:
1
0% to 100%
Default: 0
Special values: '0' deactivates the minimum signal strenght, the access point will answer all requests.
967
Reference Manual
13 Wireless LAN (WLAN)
Closed-network function: Suppress SSID broadcast
A WLAN client can only connect to a wireless network if it is informed of the corresponding SSID. The factory settings
for many wireless networks allow the use of a blank SSID or the SSID "any", and continuing to use this means that
potential intruders do not need to know the wireless LAN's SSID. The closed network function prevents unauthorized
WLAN clients from logging into the WLAN. The access point rejects any attempt to log on with a blank SSID or the SSID
"any". Any user wanting to logon to the WLAN must know the correct SSID.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
LANconfig:Wireless LAN > General > Interfaces > Logical WLAN settings > Network.
LANconfig:WLAN Controller > Profiles > Logical WLAN networks (SSIDs)
968
Reference Manual
13 Wireless LAN (WLAN)
The option Suppress SSID broadcast provides the following settings:
1
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with a blank or incorrect
SSID, the device responds with the SSID of the radio cell (publicly visible WLAN).
1
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the device similarly responds with an empty SSID. The client cannot log on to the radio cell.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with a
blank or incorrect SSID, the device does not respond. The client cannot log on to the radio cell. This setting also
reduces the network load if there is a large number of WLAN clients in the radio cell.
Additions to the menu system
Closed network
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted by
any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function. In
this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in the
wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented from
associating with your network.
The option Suppress SSID broadcast provides the following settings:
1
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or incorrect
SSID, the access point responds with the SSID of the radio cell (public WLAN).
1
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the access point similarly responds with an empty SSID.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an
empty or incorrect SSID, the access point does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
Telnet path:
Telnet path:Setup > Interfaces > WLAN > Network
Possible values:
No
Yes
Tightened
Default:
No
SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted by
any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function. In
this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in the
wireless LAN.
With the closed-network mode activated on the access point, WLAN clients that use an empty SSID or the SSID "ANY"
are prevented from associating with your network.
The option SSID broadcast provides the following settings:
969
Reference Manual
13 Wireless LAN (WLAN)
1
Yes: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or incorrect
SSID, the access point responds with the SSID of the radio cell (publicly visible WLAN).
1
No: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the access point similarly responds with an empty SSID.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an
empty or incorrect SSID, the access point does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
5
The "closed network" function for the access point is to be found under Setup > Interfaces > WLAN > Network.
Please note: If the WLAN controller has the option SSID broadcast set to "No" (device does not broadcast the
SSID), the access point sets its closed network option to "Yes", and vice versa. Only with the setting "Tightened"
do both devices retain identical settings.
Telnet path:
Telnet path:Setup > WLAN-Management > AP-Configuration > Networkprofiles
Possible values:
No
Yes
Tightened
Default:
Yes
13.5.8 IEEE 802.1x/EAP
The international industry standard IEEE 802.1x and the Extensible Authentication Protocol (EAP) enable access points
to carry out reliable and secure access checks. The access information can be managed centrally on a RADIUS server
and can be called up by the access point on demand.
This technology also enables the secure transmission and the regular automatic changing of WEP keys. In this way, IEEE
802.1x improves the security of WPA2.
The IEEE-802.1x technology has already been fully integrated since Windows XP. Client software exists for other operating
systems.
LANconfig: Wireless LAN / General / 802.1X
WEBconfig: LCOS menu tree / Setup / IEEE802.1x
1
Regularly update authentication
Here you activate regular re-authentication. If a new authentication starts, the user remains registered during the
negotiation. A typical value as a re-authentication interval is 3,600 seconds.
1
Re-authentication interval
The interval for regular re-authentication.
970
Reference Manual
13 Wireless LAN (WLAN)
1
Activate dynamic re-keying and key transmission
Here you activate the regular generation and transmission of a dynamic WEP key.
1
Re-keying interval
Interval for the regular generation of the key.
13.5.9 Expert WLAN settings
The beaconing table
Settings in the beaconing table influence the transmission of beacons by the access point in AP mode. In part this can
influence the roaming behavior of clients, and in part this serves to optimize the MultiSSID mode for older WLAN clients.
LANconfig: Wireless LAN / Expert WLAN settings / Beaconing
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Beaconing
1
Beacon period
This value defines the time interval in Kµs between beacon transmission (1 Kµs corresponds to 1024 microseconds
and is a measurement unit of the 802.11 standard. 1 Kµs is also known as a Timer Unit (TU)). Smaller values result
in a shorter beacon timeout period for the client and enable quicker roaming in case of failure of an access point,
but they also increase the WLAN overhead.
1
DTIM period
This value defines the number of beacons which are collected before multicasts are broadcast. Higher values enable
longer client sleep intervals, but worsen the latency times.
1
Beacon order
Beacon order refers to the order in which beacons are sent to the various WLAN networks. For example, if three
logical WLAN networks are active and the beacon period is 100 Kµs, then the beacons will be sent to the three
WLANs every 100 Kµs. Depending on the beacon order, the beacons are transmitted at times as follows:
2
Cyclic: In this mode the access point transmits the first beacon transmission at 0 Kµs to WLAN-1, followed by
WLAN-2 and WLAN-3. For the second beacon transmission (100 Kµs) WLAN-2 is the first recipient, followed by
WLAN-3 and then WLAN-1. For the third beacon transmission (200 Kµs) the order is WLAN-3, WLAN-1, WLAN-2.
Thereafter the order starts at the beginning again.
2
Staggered: In this mode, the beacons are not sent together at a particular time, rather they are divided across
the available beacon periods. Beginning at 0 Kµs, WLAN-1 only is sent; after 33.3 Kµs WLAN-2, after 66.6 Kµs
WLAN-3. At the start of a new beacon period, transmission starts again with WLAN-1.
971
Reference Manual
13 Wireless LAN (WLAN)
2
Simple burst: In this mode the access point always transmits the beacons for the WLAN networks in the same
order. The first beacon transmission (0 Kµs) is WLAN-1, WLAN-2 and WLAN-3; the second transmission is in the
same order, and so on.
2
Default: Cyclic
Some older WLANs are unable to process the quick succession of beacons which occur with simple burst. Consequently
these clients often recognize the first beacons only and can only associate with this network.
Staggered transmission of beacons produces better results but increases load on the access point's processor. Cyclic
transmission proves to be a good compromise as all networks are transmitted first in turn.
The roaming table
The roaming table contains various threshold values which influence the precise control over the LANCOM Wireless
Router's behavior when roaming in the 'Client' operating mode.
LANconfig: Wireless LAN / Expert WLAN settings / Roaming
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Roaming
1
Soft roaming
This option enables a client to use scan information to roam to the strongest access point (soft roaming). Roaming
due to connection loss (hard roaming) is unaffected by this. The roaming threshold values only take effect when soft
roaming is activated.
1
Beacon miss threshold
This defines how many access-point beacons can be missed before an associated client starts searching again.
Higher values will delay the recognition of an interrupted connection, so a longer time period will pass before the
connection is re-established.
The smaller the value set here, the sooner a potential interruption to the connection will be recognized; the client
can start searching for an alternative access point sooner.
5
Values which are too small may cause the client to detect lost connections more often than necessary.
1
Roaming threshold
This value is the percentage difference in signal strength between access points above which the client will switch
to the stronger access point.
5
Other contexts require the value of signal strengths in dB. The following conversion applies: 64dB - 100%
32dB - 50% 0dB - 0%
972
Reference Manual
13 Wireless LAN (WLAN)
1
No roaming threshold
This threshold refers to the field strength in percent. Field strengths exceeding the value set here are considered to
be so good that no switching to another access point will take place.
1
Forced roaming threshold
This threshold refers to the field strength in percent. Field strengths below the value set here are considered to be
so poor that a switch to another access point is required.
1
Connect threshold
This value defines field strength in percent defining the minimum that an access point has to show for a client to
attempt to associate with it.
1
Connect hold threshold
This threshold defines field strength in percent. A connection to an access point with field strength below this value
is considered as lost.
13.5.10 WLAN routing (isolated mode)
The standard setting allows data traffic to be "bridged" between LAN and WLAN, i.e. layer-2 transparent transmission.
Data traffic between the cabled network and the wireless LAN is not directed via the IP router. Consequently, the firewall
and Quality of Service functions integrated into the firewall are not available for traffic between LAN and WLAN. In order
to be able to use these functions, the WLAN interfaces are set to "isolated mode"and the data traffic is intentionally
routed via the IP router.
5
To ensure that the IP router can correctly transmit the data between the LAN and WLAN, the two areas must
have different IP address ranges. Further information is available in the Advanced Routing and Forwarding (ARF)
area.
LANconfig: Interfaces / LAN
WEBconfig: LCOS menu tree / Setup / LAN bridge / Isolated mode
973
Reference Manual
13 Wireless LAN (WLAN)
13.5.11 Addition(s) to LCOS 8.80
Closed-network function: Suppress SSID broadcast
A WLAN client can only connect to a wireless network if it is informed of the corresponding SSID. The factory settings
for many wireless networks allow the use of a blank SSID or the SSID "any", and continuing to use this means that
potential intruders do not need to know the wireless LAN's SSID. The closed network function prevents unauthorized
WLAN clients from logging into the WLAN. The access point rejects any attempt to log on with a blank SSID or the SSID
"any". Any user wanting to logon to the WLAN must know the correct SSID.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
LANconfig:Wireless LAN > General > Interfaces > Logical WLAN settings > Network.
974
Reference Manual
13 Wireless LAN (WLAN)
LANconfig:WLAN Controller > Profiles > Logical WLAN networks (SSIDs)
The option Suppress SSID broadcast provides the following settings:
1
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with a blank or incorrect
SSID, the device responds with the SSID of the radio cell (publicly visible WLAN).
1
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the device similarly responds with an empty SSID. The client cannot log on to the radio cell.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with a
blank or incorrect SSID, the device does not respond. The client cannot log on to the radio cell. This setting also
reduces the network load if there is a large number of WLAN clients in the radio cell.
Additions to the menu system
Closed network
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted by
any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function. In
this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in the
wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented from
associating with your network.
The option Suppress SSID broadcast provides the following settings:
1
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or incorrect
SSID, the access point responds with the SSID of the radio cell (public WLAN).
1
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the device similarly responds with an empty SSID.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with a
blank or incorrect SSID, the device does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
975
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Telnet path:Setup > Interfaces > WLAN > Network
Possible values:
No
Yes
Tightened
Default:
No
SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted by
any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function. In
this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in the
wireless LAN.
With the closed-network mode activated on the access point, WLAN clients that use an empty SSID or the SSID "ANY"
are prevented from associating with your network.
The option SSID broadcast provides the following settings:
1
Yes: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or incorrect
SSID, the access point responds with the SSID of the radio cell (publicly visible WLAN).
1
No: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an empty
SSID, the device similarly responds with an empty SSID.
1
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with a
blank or incorrect SSID, the device does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients in the
WLAN network.
5
The "closed network" function for the access point is to be found under Setup > Interfaces > WLAN > Network.
Please note: If the WLAN controller has the option SSID broadcast set to "No" (device does not broadcast the
SSID), the access point sets its closed network option to "Yes", and vice versa. Only with the setting "Tightened"
do both devices retain identical settings.
Telnet path:
Telnet path:Setup > WLAN-Management > AP-Configuration > Networkprofiles
Possible values:
No
Yes
Tightened
Default:
Yes
976
Reference Manual
13 Wireless LAN (WLAN)
Enhancements to LANconfig
Network settings
LANconfig:Wireless LAN > General > Logical WLAN settings > Network
1
WLAN network enabled
This switch enables or disenables the corresponding logical WLAN.
1
Network name (SSID)
Specify a unique SSID (the network name) for each of the required logical wireless LANs. Only network cards that
have the same SSID can register with this wireless network.
1
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted
by any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function.
In this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in
the wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented
from associating with your network.
The option Suppress SSID broadcast provides the following settings:
2
No: The access point broadcasts the radio cell's SSID. When a client sends a probe request with an empty or
incorrect SSID, the access point responds with the SSID of the radio cell (public WLAN).
2
Yes: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with an
empty SSID, the device similarly responds with an empty SSID.
2
Tightened: The access point does not broadcast the radio cell's SSID. When a client sends a probe request with
a blank or incorrect SSID, the device does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients
in the WLAN network.
1
MAC filter enabled
977
Reference Manual
13 Wireless LAN (WLAN)
The MAC addresses of the clients that are allowed to associate with an access point are stored in the MAC filter list
(Wireless LAN > Stations > Stations). The MAC filter enabled switch allows you to switch off the use of the MAC
filter list for individual logical networks.
5
Use of the MAC filter list is required for logical networks in which the clients register via LEPS with an individual
passphrase. The passphrase used by LEPS is also entered into the MAC filter list. The access point always
consults the MAC filter list for registrations with an individual passphrase, even if this option is deactivated
here.
1
Maximum number of clients
Here you set the maximum number of clients that may associate with this access point. Additional clients wanting
to associate will be rejected by the access point.
1
Minimum client signal strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on. If the
client's signal strength is below this value, the access point stops sending probe responses and discards the client's
requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, as those offering only a weak connection at the client's current
position are not listed.
1
Client-bridge support
Enable this option for an access point if you have enabled the client-bridge support for a client station in WLAN
client mode ().
5
The client-bridge mode operates between two LANCOM devices only.
1
Allow traffic between stations of this SSID
Check this option if all stations logged on to this SSID are to be able to communicate with one another.
New parameter for WLAN client signal strength
LCOS version 8.62 now optionally evaluates the signal strengths of wireless LAN clients when they logon.
Additions to the menu system
Minimum client strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on. If the client's
signal strength is below this value, the access point stops sending probe responses and discards the client's requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, as those offering only a weak connection at the client's current
position are not listed.
Telnet path:
Telnet path:Setup > Interfaces > WLAN > Network
Possible values:
0-100
Default:
0
978
Reference Manual
13 Wireless LAN (WLAN)
13.6 Configuring the client mode
To connect individual devices with an Ethernet interface into a wireless LAN, LANCOM devices with a WLAN module can
be switched to "client mode", whereupon they act as conventional wireless LAN adapters and not as access points (AP).
The use of client mode therefore allows devices fitted with only an Ethernet interface, such as PCs and printers, to be
integrated into a wireless LAN.
ACCESS POINT
LAPTO P/ W-LAN
DRUCKER
server
LAN
ACCESS POINT
ACCESS POINT PC
WLAN device
in client mode
WLAN device
in AP mode
WLAN device
in client mode
5
Multiple WLAN clients can register with a WLAN device in AP mode, which is not the case for a WLAN device in
client mode.
WLAN Router ANTENNA
INDUSTRy
FORK LIFT
FORK LIFT
FORK LIFT
FORK LIFT
13.6.1 Client settings
For LANCOM Access Points and LANCOM Wireless Routers in client mode, further settings/client behavior can be
configured from the 'Client mode' tab under the settings for the physical interfaces.
979
Reference Manual
13 Wireless LAN (WLAN)
5
The configuration of the client settings can also be carried out with the WLAN Wizards in LANconfig.
1. To edit the settings for client mode in LANconfig, go to the 'Client mode' tab under the physical WLAN settings for
the desired WLAN interface.
2. In 'Scan bands', define whether the client station scans just the 2.4 GHz, just the 5 GHz, or all of the available bands
to locate an access point.
13.6.2 Set the SSID of the available networks
In the WLAN clients, the SSIDs of the networks to which the client stations are to connect must be entered.
1. To enter the SSIDs, change to the 'General' tab under LANconfig in the 'Wireless LAN' configuration area. In the
'Interfaces' section, select the first WLAN interface from the list of logical WLAN settings.
1. Enable the WLAN network and enter the SSID of the network the client station should log onto.
13.6.3 Encryption settings
For access to a WLAN, the appropriate encryption methods and key must be set in the client station.
980
Reference Manual
13 Wireless LAN (WLAN)
1. To enter the key, change to the '802.11i/WEP' tab under LANconfig in the 'Wireless LAN' configuration area. From
'WPA / private WEP settings', select the first WLAN interface from the list of logical WLAN settings.
1. Enable encryption and match the encryption method to the settings for the access point.
2. In WLAN client operating mode, the LANCOM Access Points and LANCOM Wireless Routers can authenticate
themselves to another access point using EAP/802.1X. For this, select the desired client EAP method here. Note that
the selected client EAP method must match the settings of the access point that the device is attempting to log onto.
5
Depending on the EAP method, the appropriate certificates must be stored in the device:
3. For TTLS and PEAP – the EAP/TLS root certificate only; the key is entered as a combination username:password.
1
For TLS in addition; the EAP/TLS device certificate including the private key.
5
When working with WPA or 802.1X, settings may need to be made in the RADIUS server.
13.6.4 Roaming
Roaming is defined as the transfer of a WLAN client to another access point once the connection to the access point
used so far can no longer be kept alive. To allow roaming, at least one additional access point must be within range of
the client, it must provide a network with an identical SSID and matching radio and encryption settings.
Under normal circumstances the WLAN client would only log onto another access point if the connection to the access
point used up to that point was lost completely (hard roaming). Soft roaming on the other hand enables the client to
use scan information to roam to the strongest access point. With the background scanning function, the LANCOM
Wireless Router in client mode can gather information on other available access points prior to the connection being
lost. In this case the client is not switched to another access point once the existing connection has been lost completely,
but rather when another access point within its range has a stronger signal.
1. To enable soft roaming in WEBconfig or telnet, change to Setup > Interfaces > WLAN > Roaming and select the
physical WLAN interface.
2. Enable soft roaming and, if required, set the other parameters (such as threshold levels and signal level).
981
Reference Manual
13 Wireless LAN (WLAN)
3. To configure background scanning in LANconfig, go to the 'Radio' tab under the physical WLAN settings for the
desired WLAN interface.
1. Enter the background scan interval as the time in which the LANCOM Wireless Router cyclically searches the currently
unused frequencies of the active band for available access points. To achieve fast roaming the scan time is set, for
example, to 260 seconds (2.4 GHz) or 720 seconds (5 GHz).
13.6.5 Addition(s) to LCOS 7.80
Multiple WLAN profiles in client mode
Introduction
If a device equipped with an Ethernet interface is to be connected to a wireless LAN, a LANCOM access point can be
switched into client mode, causing it to act as conventional wireless LAN client and not as an access point.
WLAN clients such as notebooks are generally able to save and manage various profiles which allow different access
points to be selected depending on the environment (e.g. for a company WLAN or for another WLAN at home). These
profiles store various information such as the WLAN SSID and the associated key. The WLAN client automatically selects
the profile fitting to the strongest available or preferred WLAN.
LANCOM access points can store up to eight different WLAN profiles for use in client mode. The profile in client mode
activates the networking and transmission parameters, and also the encryption settings for the logical WLAN.
5
Please observe that a WLAN module in client mode only connects to one access point at a time, even if multiple
WLAN profiles have been defined.
982
Reference Manual
13 Wireless LAN (WLAN)
Configuration
Not only can networking, transmission and encryption parameters be defined separately for each WLAN module, but
also which criteria are to be used to select the client profile.
LANconfig: Wireless LAN / General / Physical WLAN settings / Client mode
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Client modes / WLAN-1
1
AP selection preference
Here you select how this interface is to be used.
Possible values:
2
Signal strength: Selects the profile for the WLAN offering the strongest signal. This setting causes the WLAN
module in client mode to automatically switch to a different WLAN as soon as it offers a stronger signal.
2
Profile: Selects the profile for available WLANs in the order that they have been defined (WLAN index, e.g.
WLAN-1, WLAN-2, etc.), even if another WLAN offers a stronger signal. In this setting, the WLAN module in client
mode automatically switches to a different WLAN as soon as a WLAN with a lower WLAN index is detected
(irrespective of signal strengths).
Default:
2
Signal strength.
983
Reference Manual
13 Wireless LAN (WLAN)
13.7 Configuring point-to-point connections
LANCOM Access Points can serve not only as central stations in a wireless network, they can also operate in point-to-point
mode to bridge longer distances. For example, they can provide a secure connection between two networks that are
several kilometers apart — without direct cabling or expensive leased lines.
WLAN Router ANTENNA
BUILDING
ACCESS POINT
ANTENNA
BUILDING
ACCESS POINTANTENNA
BUILDING
When using Access Points and appropriately polarized antennas in accordance with IEEE 802.11n two wireless links can
be established simultaneously between the end points of a point-to-point connection. This allows higher data throughput
to be achieved or greater distances to be covered than when using other standards.
MIMO AP 802.11n
POLARIZATION
DIVERSITY
BUILDING
MIMO AP 802.11n
POLARISATION
DIVERSITY
BUILDING
Depending on the WLAN standard and WLAN antenna being used, the following data-throughput rates can be achieved:
RangeData throughputantennaAccess Point
1km240Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 10m cable
802.11n indoor AP
8,9km15Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 10m cable
802.11n indoor AP
2,1km240Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 2m cable
802.11n outdoor AP
18km15Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 2m cable
802.11n outdoor AP
0,4km54Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 10m cable
802.11a indoor AP
6km6Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 10m cable
802.11a indoor AP
1,3km54Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 2m cable
802.11a outdoor AP
13km6Mbps grossDirectional antenna with 9° beam spread,
lightning protection, 2m cable
802.11a outdoor AP
0,08km54Mbps grossDirectional antenna with 30° beam
spread, lightning protection, 10m cable
802.11g indoor AP
1km6Mbps grossDirectional antenna with 30° beam
spread, lightning protection, 10m cable
802.11g indoor AP
0,28km54Mbps grossDirectional antenna with 30° beam
spread, lightning protection, 2m cable
802.11g outdoor AP
2,5km6Mbps grossDirectional antenna with 30° beam
spread, lightning protection, 2m cable
802.11g outdoor AP
984
Reference Manual
13 Wireless LAN (WLAN)
Highly optimized wireless bridges based on IEEE 802.11n are capable of high data transfer rates even over long distances.
This chapter introduces the basic principles involved in designing point-to-point links and provides tips on aligning the
antennas.
13.7.1 Geometric dimensioning of outdoor wireless network links
The following basic questions must be answered when designing wireless links:
1
Which antennas are necessary for the desired application?
1
How do the antennas have to be positioned to ensure problem-free connections?
1
What performance characteristics do the antennas need to ensure sufficient data throughput within the legal limits?
Selection of antennas using the LANCOM Antenna Calculator
You can use the LANCOM Antenna Calculator to calculate the output power of the access points as well as the achievable
distances and data rates. The program can be downloaded from our Web site at www.lancom.de.
After selecting your components (access points, antennas, lightning protection and cable) the calculator works out the
data rates, ranges, and the antenna gain settings that have to be entered into the access point.
5
Please note that when using 5 GHz antennas additional technologies such as dynamic frequency selection (DFS)
may be stipulated depending on the country of use. The operator of the wireless LAN system is responsible for
ensuring that local regulations are met.
985
Reference Manual
13 Wireless LAN (WLAN)
Positioning the antennas
Antennas do not broadcast their signals linearly, but within an angle that depends on the model in question. The spherical
expansion of the signal waves produces amplification or interference of the effective power output at certain distances
along the connection between the transmitter and receiver. The areas where the waves amplify or cancel themselves
out are known as Fresnel zones.
Protecting the components employed from the consequences of lightning strikes and other electrostatic influences is
one of the most important aspects to be considered when designing and installing wireless LAN systems for outdoor
use. Please refer to the appropriate notes on 'Lightning and surge protection' as otherwise LANCOM Systems cannot
provide any guarantee for damage to LANCOM and AirLancer components.
Information on the installation of WLAN systems for outdoor deployment is available in the 'LANCOM Outdoor Wireless
Guide'.
WLAN Router
ANTENNA
ADMINISTRATION ACCESS POINT
ANTENNA
PRODUCTIONOBSTRUCTION
Distance d
Radius R
Fresnel zone 3
Fresnel zone 2
Fresnel zone 1
The Fresnel zone 1 must remain free from obstruction in order to ensure that the maximum level of output from the
transmitting antenna reaches the receiving antenna. Any obstructing element protruding into this zone will significantly
impair the effective signal power. The object not only screens off a portion of the Fresnel zone, but the resulting reflections
also lead to a significant reduction in signal reception.
The radius (R) of Fresnel zone 1 is calculated with the following formula assuming that the signal wavelength () and the
distance between transmitter and receiver (d) are known.
R = 0.5 * √ ( * d)
The wavelength in the 2.4 GHz band is approx. 0.125 m, in the 5 GHz band approx. 0.05 m.
Example: With a separating distance of 4 km between the two antennae, the radius of Fresnel zone 1 in the 2.4-GHz
band is 11 m, in the 5-GHz band 7 m.
To ensure that the Fresnel zone 1 remains unobstructed, the height of the antennas must exceed that of the highest
obstruction by this radius. The full height of the antenna mast (M) should be as depicted:
WLAN Router
ANTENNA
ADMINISTRATION
WLAN Router
ANTENNA
PRODUCTION
OBSTRUCTION
Fresnel zone 1
Radius R
Security:
Obstruction height H
Earth’s curvature E
M = R + 1m + H + E (earth's curvature)
The allowance for the curvature of the earth (E) can be calculated at a distance (d) as E = d² * 0.0147 – i.e. at a distance
of 8 km this is almost 1m
Example: With a distance of 8 km between the antennae, the result in the 2.4-GHz band is a mast height above the
level of the highest obstruction of approx. 13 m, in the 5-GHz band 9 m.
Antenna power
The power of the antennas must be high enough to ensure acceptable data transfer rates. On the other hand, the
country-specific legal regulations regarding maximum transmission power should not be exceeded.
986
Reference Manual
13 Wireless LAN (WLAN)
The calculation of effective power considers everything from the radio module in the transmitting access point to the
radio module in the receiving access point. In between there are attenuating elements such as the cable, plug connections
or simply the air transmitting the signals and amplifying elements such as the external antennas.
WLAN Router
ANTENNA
ADMINISTRATION
ACCESS POINT
ANTENNA
PRODuCTION
SA-5L SA-5L
Amplification with
antenna gain
Amplification with
antenna gain
Free-space loss
Output power of
the radio module
Input signal at the
radio module
Loss through cable,
plugs and lightning
protection
Loss through cable,
plugs and lightning
protection
13.7.2 Antenna alignment for P2P operations
The precise alignment of the antennas is of considerable importance in establishing P2P connections. The more central
the receiving antenna is located in the "ideal line" of the transmitting antenna, the better are the actual performance
and the effective bandwidth. If the receiving antenna is outside of this ideal area, however, significant losses in performance
will be the result.
WLAN Router
ANTENNA
MANAGEMENT
ACCESS POINT
ANTENNA
PRODUcTION
ANTENNA
5
You can find further information on the geometrical design of wireless paths and the alignment of antennas with
the help of LANCOM software in the LCOSreference manual.
The current signal quality over a P2P connection can be displayed on the device's LEDs or in the LANmonitor in order to
help find the best possible alignment for the antennas.
The display of signal quality on the LEDs must be activated for the wireless LAN interface (LANconfig: Wireless LAN /
General / Physical WLAN settings / Operation). The faster the LED blinks the better the connection (a blinking
987
Reference Manual
13 Wireless LAN (WLAN)
frequency of 1 Hz represents a signal quality of 10 dB, double the frequency indicates that the signal strength is twice
as high).
In LANmonitor the connection quality display is opened with the context menu. Right-clicking with the mouse on
'Point-to-point' activates the option 'Adjusting Point-to-Point WLAN Antennas...'
5
The 'Point-to-point' entry is only visible in the LANmonitor if the monitored device has at least one base station
defined as a remote site for a P2P connection (LANconfig: Wireless LAN / General / Physical WLAN settings
/ Point-to-Point).
In the dialog for setting up point-to-point connections, LANmonitor prompts for the information required to establish
the P2P connection:
1
Is the P2P connection configured at both ends (remote base station defined with MAC address or station name)?
1
Is the point-to-point mode of operation activated?
1
Which access point is to be monitored? All of the base stations defined as P2P remote sites in the device concerned
can be selected here.
1
Are both antennas approximately aligned? The basic P2P connection has to be working before fine-tuning can be
performed with the aid of LANmonitor.
988
Reference Manual
13 Wireless LAN (WLAN)
Once signal monitoring has commenced, the P2P dialog displays the absolute values for the current signal strength and
the maximum value since starting the measurement. The development of the signal strength over time and the maximum
value are displayed in a diagram, too.
Initially only one of the two antennas should be adjusted until a maximum value is achieved. This first antenna is then
fixed and the second antenna is then adjusted to attain the best signal quality.
13.7.3 Measuring wireless bridges
After planning and installation, the wireless bridge can be analyzed to determine the actual data throughput. Further
information about the available tools and taking measurements can be found in the LANCOM Techpaper "The performance
of outdoor P2P connections", available as a download from www.lancom.de.
13.7.4 Activating point-to-point operation mode
The behavior of an access point when exchanging data with other access points is defined in the "Point-to-point operation
mode".
1
Off: The access point only communicates with mobile clients
1
On: The access point can communicate with other access points and with mobile clients
1
Exclusive: The access point only communicates with other base stations
In the 5 -GHz band, the automatic search for vacant WLAN channels can lead to several simultaneous test transmissions
from multiple access points, with the result that they do not find each other. This stalemate situation can be avoided
with the appropriate "Channel selection scheme":
1
Master: This access point takes over the leadership when selecting a free WLAN channel.
1
Slave: All other access points will search for a channel until they have found a transmitting Master.
MASTER ANTENNE
SLAVEANTENNE
SLAVEANTENNE
989
Reference Manual
13 Wireless LAN (WLAN)
Thus it is recommended for the 5 GHz band that one central access point should be configured as 'Master' and all other
point-to-point partners should be configured as 'Slave'. In the 2.4 GHz band, too, this setting simplifies the establishment
of point-to-point connections if the automatic channel search is activated.
5
It is imperative that the channel selection scheme is configured correctly if the point-to-point connections are to
be encrypted with 802.11i/WPA (a master as authentication server and a slave as client).
13.7.5 Configuration of P2P connections
In the configuration of point-to-point connections, entries have to be made for the point-to-point operation mode and
the channel selection scheme, along with the MAC addresses or station names of the remote sites.
5
The configuration of the P2P connections can also be carried out with the WLAN Wizards in LANconfig.
1. Click on the button Physical WLAN settings to open the corresponding WLAN interface and select the tab for
'Point-to-Point'.
2. Activate the suitable point-to-point operation mode here and set the channel selection scheme to either 'Master' or
'Slave'. If the peers of the P2P connections are to be identified via their station names, then enter a unique name
for this WLAN station.
5
For models with multiple WLAN modules, the station name can be entered separately for each physical WLAN
interface.
990
Reference Manual
13 Wireless LAN (WLAN)
1. Close the physical WLAN settings and open the list of Point-to-point partners. For each of the maximum of six
P2P connections, enter either the MAC address of the WLAN card at the remote station or enter the WLAN station's
name (depending on the chosen method of identification).
5
Please observe that only the MAC addresses of the WLAN cards at the other end of the connections are to be
entered here! Not the access point's own MAC address, and not the MAC addresses from any other interfaces
that may be present in the access points.
You will find the WLAN MAC address on a sticker located under each of the antenna connectors. Only use the string
that is marked as the "WLAN MAC" or "MAC-ID". The other addresses that may be found are not the WLAN MAC address
but the LAN MAC address.
Connecting point-to-point remote stations by station name
When configuring point-to-point connections, an alternative to the MAC addresses is to use the station names of the
remote stations.
First of all the station name is entered into the point-to-point settings in the Wireless Routers or Access Points.
1
LANconfig: Wireless LAN / General / Physical WLAN settings / Point to point
1
WEBconfig: Setup / Interfaces / WLAN interpoint settings
991
Reference Manual
13 Wireless LAN (WLAN)
5
For models with multiple WLAN modules, the station name can be entered separately for each physical WLAN
interface.
In the point-to-point configuration, select the identification by station name and enter the name of the corresponding
station.
1
LANconfig: Wireless LAN / General / Point to point partners
1
WEBconfig: Setup / Interfaces / WLAN interpoint peers
992
Reference Manual
13 Wireless LAN (WLAN)
13.7.6 Access points in relay mode
Access points equipped with two wireless modules can be used to establish wireless bridges across multiple stations.
Each wireless module is configured as a 'Master' and then 'Slave' in turn.
DUAL RADIO AP ANTENNA
BUILDING
ANTENNA
DUAL RADIO AP ANTENNA
BUILDING
ANTENNA
WLAN Router ANTENNE
BUILDING
LAPTO P/ W-LAN
Master Slave SlaveMaster
5
Employing relay stations with two WLAN modules each also cuts down on the problems from "hidden stations".
13.7.7 Security for point-to-point connections
IEEE 802.11i can be used to attain a significant increase in the security of WLAN point-to-point connections. All of the
advantages of 802.11i such as the simple configuration and the powerful encryption with AES are thus available for P2P
mode, as are the improved security of the passphrase from the LANCOM Enhance Passphrase Security (LEPS).
Encryption with 802.11i/WPA
To activate the 802.11i encryption for a correctly configured P2P connection, adjust the settings for the first logical WLAN
network in the appropriate WLAN interface (i.e. WLAN-1 if you are using the first WLAN module for the P2P connection,
WLAN-2 if you are using the second module, e.g. as with an access point with two WLAN modules).
1
Activate the 802.11i encryption.
1
Select the method '802.11i (WPA)-PSK'.
1
Enter the passphrase to be used.
5
The passphrases should consist of a random string at least 32 characters long.
When set as P2P Master, the passphrase entered here will be used to check the Slave's authorization to access. When
set as P2P Slave, the access point transfers this information to register with the remote site.
For configuration with LANconfig you will find the encryption settings under the configuration area 'Wireless LAN' on
the '802.11i/WEP' tab.
993
Reference Manual
13 Wireless LAN (WLAN)
LEPS for P2P connections
A further gain in security can be attained by additionally using LANCOM Enhanced Passphrase Security (LEPS) which
involves the matching of MAC address and passphrase.
LEPS can be used to secure single point-to-point (P2P) connections with an individual passphrase. Even if an access point
in a P2P installation is stolen and the passphrase and MAC address become known, all other WLAN connections secured
by LEPS remain secure.
When using LANconfig for the configuration, you enter the passphrases of the stations approved for the WLAN in the
configuration area 'Wireless LAN' on the 'Stations' tab under the button Stations.
13.7.8 Addition(s) to LCOS 8.50
Auto-configuration of WLAN P2P links over serial connections
When configuring wireless P2P links, the remote sites usually recognize one another by a particular feature of the P2P
partner; either the station name or the MAC address as entered into the access point's configuration.
However, when changing P2P partners, it is not possible to enter a fixed parameter into the configuration. For example,
if you want to set up a P2P link between two train carriages to offer IP services on the whole train, the P2P partners
could change according to the combination of carriages.
In these cases, the access points can exchange their MAC addresses via the serial interface. To do this, interconnect the
devices via two wires of the serial interface. You can then set the P2P peer recognition to the value 'Serial autoconfig'.
You then configure the P2P links as if for a fixed installation of the access points.
In the default state, the WLAN modules are disabled. When the devices are turned on, they first exchange their MAC
addresses, the WLAN modules are activated and the P2P link is established automatically.
Additions to the menu system
Serial configuration
This menu contains the settings for the auto configuration of WLAN point-to-point links over a serial connection.
Telnet path: /Setup/COM-Ports
English description: WAN
994
Reference Manual
13 Wireless LAN (WLAN)
Telnet path, English: LCOS Menu Tree/Setup/COM-Ports
Bit rate
This item sets the bit rate for communications between the devices when a serial connection is used for the automatic
configuration of WLAN point-to-point links.
Telnet path: /Setup/COM-Ports
English description: WAN
Telnet path, English: LCOS Menu Tree/Setup/COM-Ports
Possible values:
1
1200
1
2400
1
4800
1
9600
1
19200
1
38400
1
57600
1
115200
Default: 9600
5
It is imperative that the same bit rate is set in all devices communicating over serial connections to be used for
the automatic configuration of WLAN point-to-point links.
13.7.9 Addition(s) to LCOS 8.60
Point-to-point partners
Up to 16 point-to-point connections can be activated for each WLAN module. In LANconfig you find these settings under
Wireless LAN > General > Interfaces > Point-to-point partners
Proceed as follows to set up a point-to-point link:
1. Select the option Enable this point-2-point channel.
2. Select whether the P2P peer is to be identified by its MAC address or its Station name.
3. The corresponding text box is activated. Enter the MAC address or station name.
995
Reference Manual
13 Wireless LAN (WLAN)
5
If you work with detection by MAC address, enter the MAC address of the WLAN module here and not that of
the device itself.
On the Alarm tab, you can set threshold values for signal strength, total repetitions and Tx errors for the point-to-point
connection. If the value exceeds or falls below this value, the access point sets off alarms or traps.
Conclude your entries by clicking on OK.
Additions to the menu system
Interpoint peers
Here you enter the wireless base stations that are to be networked via the point-to-point connection.
SNMP ID: 223.20.12
Telnet path: /Setup/Interfaces/WLAN
13.8 Central firmware and script management
LANCOM WLAN Controllers allow the configurations of multiple LANCOM Wireless Routers and LANCOM Access Points
to be managed from a central location in a consistent and convenient manner. With central firmware and script
management, uploads of firmware and scripts can be automated for all of the WLAN devices.
To achieve this, the firmware and script files are stored on a Web server (firmware as *.upx files, scripts and *.lcs files).
The WLAN-Controller checks once daily, or on user request, to compare the available files with those on the devices.
Alternatively, this procedure can be handled by a cron job—overnight, for example. If an update can be carried out, or
if the Access Point is not running the desired firmware version, then the WLAN-Controller downloads the file from the
Web server and uploads it to the appropriate Wireless Routers and Access Points.
The configuration of firmware and script management provides precise control over the distribution of the files. It is
possible, for example, to limit certain firmware versions to certain device types or MAC addresses.
An update can be carried out in two possible states:
1
When a connection is established; the Access Point subsequently restarts automatically.
1
If the Access Point is already connected, the device does not restart automatically. In this case the Access Point is
manually restarted with the menu action
"/Setup/WLAN-Management/Central-Firmware-Management/Reboot-updated-APs" or by a timed cron job.
996
Reference Manual
13 Wireless LAN (WLAN)
1
The action "/Setup/WLAN-Management/Central-Firmware-Management/Update-Firmware-and-Script-Information"
updates the script and firmware directories.
The parameters for configuration can be found under the following paths:
LANconfig: WAN Controller / AP Update
WEBconfig: Setup / WLAN Management / Central Firmware Management
13.8.1 General settings for firmware management
1
Firmware URL
The path to the directory with the firmware files.
2
Possible values: URL in the form Server/Directory or http://Server/Directory
2
Default: Blank
1
Simultaneously loaded FW
The number of firmware versions loaded simultaneously into the main memory of the WLAN-Controller.
5
The firmware versions stored here are downloaded from the server just once and then used for all update
processes.
2
Possible values: 1 to 10
2
Default: 5
1
Firmware sender IP address
This is where you can configure an optional sender address for use instead of the one automatically selected for the
destination address.
Possible values:
997
Reference Manual
13 Wireless LAN (WLAN)
2
Name of a defined IP network.
2
'INT' for the IP address in the first network with the setting 'Intranet'.
2
'DMZ' for the IP address in the first network with the setting 'DMZ'.
2
Name of a loopback address.
2
Any other IP address.
Default:
2
Blank
5
If the list of IP networks or loopback addresses contains an entry named 'INT' or 'DMZ', the associated IP
address of the IP network or the loopback address named 'INT' or 'DMZ' is used.
13.8.2 Firmware management table
Table with device type, MAC address and firmware version for the precise control of the firmware files in use.
1
Device types
Select here the type of device that the firmware version specified here is to be used for.
2
Possible values: All, or a selection from the list of available devices.
2
Default: All
1
MAC address
Select here the device (identified by its MAC address) that the firmware version specified here is to be used for.
2
Possible values: Valid MAC address
2
Default: Blank
1
Version
Firmware version that is to be used for the devices or device types specified here.
2
Possible values: Firmware version in the form X.XX
2
Default: Blank
13.8.3 General settings for script management
1
Script URL
The path to the directory with the script files.
2
Possible values: URL in the form Server/Directory or http://Server/Directory
2
Default: Blank
1
Script sender IP address
This is where you can configure an optional sender address for use instead of the one automatically selected for the
destination address.
Possible values:
2
Name of a defined IP network.
2
'INT' for the IP address in the first network with the setting 'Intranet'.
2
'DMZ' for the IP address in the first network with the setting 'DMZ'.
2
Name of a loopback address.
2
Any other IP address.
Default:
2
Blank
998
Reference Manual
13 Wireless LAN (WLAN)
5
If the list of IP networks or loopback addresses contains an entry named 'INT' or 'DMZ', the associated IP
address of the IP network or the loopback address named 'INT' or 'DMZ' is used.
13.8.4 Script management table
Table with the name of the script file and a WLAN profile for allocating the script to a WLAN profile.
Configuring a Wireless Router and Access Point in the "Managed" mode is handled via WLAN profiles. A script can be
used for setting those detailed parameters in managed devices that are not handled by the pre-defined parameters in
a WLAN profile. Distribution is also handled by WLAN profiles to ensure that the Wireless Routers and Access Points
with the same WLC configuration also use the same script.
As only one script file can be defined per WLAN profile, versioning is not possible here. However, when distributing a
script to a Wireless Router or Access Point, an MD5 checksum of the script file is saved. This checksum allows the
WLAN-Controller to determine whether the script file has to be transmitted again in case a new or altered script has the
same file name.
1
Script file name
Name of the script file to be used.
2
Possible values: File name in the form *.lcs
2
Default: Blank
1
WLAN profile
Select here the WLAN profile that the script file specified here should be used for.
2
Possible values: Selection from the list of defined WLAN profiles.
2
Default: Blank
13.8.5 Internal script storage (script management without an HTTP server)
In contrast to firmware files, scripts involve only small volumes of data. The WLAN-Controller's internal script storage
allows three scripts of up to 64KB each to be stored. If script requirements do not exceed this volume, an HTTP server
does not need to be configured for this purpose.
Script files are simply loaded from the designated storage location using WEBconfig. After upload the list of available
scripts must be updated with Configure/Wireless LAN/Central Firmware /Update Firmware and Script Information.
The internal scripts can be referenced from the script management table using the relevant names (WLC_Script_1.lcs,
WLC_Script_2.lcs or WLC_Script_3.lcs).
999
Reference Manual
13 Wireless LAN (WLAN)
5
Please be careful with upper and lower case letters when entering script names.
13.9 DFS 2: Non-use of channels for weather radar
With the DFS method (Dynamic Frequency Selection) as required for 5 GHz WLANs, an unused frequency is automatically
selected, for example, to avoid interference from radar systems or to distribute WLAN devices as evenly as possible over
the entire frequency band. Occasionally, however, signals from weather radar stations cannot be identified reliably.
For this reason the European Commission is extending the demands of standards ETSI EN 301 893 V1.3.1 and ETSI EN
310 893 V1.4.1 to additionally avoid the use of three channels (120, 124 and 128) in subband 2 of the 5 GHz band.
These are not to be used for automatic channel selection. Methods for detecting weather radar signatures are currently
under development.
13.10 Bandwidth limits in the WLAN
The bandwidths that are available can be limited so that they can be better distributed among several participants in
the WLAN. This bandwidth limit is available for wireless ISPs, for example, who want to provide their customers with a
defined bandwidth.
5
Unlike bandwidth management using QoS (Quality of Service), this procedure does not allow a minimum
bandwidth, but an exactly defined maximum bandwidth instead. Even if more bandwidth were actually available
due to low traffic from other network stations, only the bandwidth specified here is provided to the user.
The settings differentiate between operating a device as an access point or in client mode.
13.10.1 Operating as an access point
In the access point operating mode, the maximum permitted bandwidths can be specified in Tx and Rx direction for the
WLAN clients that register with the access point. The values of the maximum Tx and Rx bandwidths are entered in kbps
in the MAC access list. A value of '0' indicates that there is no intention to restrict the bandwidth in this transmission
direction. The bandwidth that is actually provided is determined from the value that is entered here and the value that
is transmitted by the client.
1000
Reference Manual
13 Wireless LAN (WLAN)
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as an access
point, Rx stands for "Send data" and Tx stands for "Receive data".
LANconfig: Wireless LAN / Stations
WEBconfig: LCOS menu tree / Setup / WLAN E Access list
13.10.2 Operating as a Client
If the device is operated as a WLAN client, the device can transmit its maximum bandwidth when it registers with the
access point. The access point then provides the actual maximum bandwidths with proprietary limits for this client where
necessary.
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as a client, Tx
stands for "Send data" and Rx stands for "Receive data".
LANconfig: Interfaces / Wireless LAN / Physical WLAN Settings / Client Mode
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN/ Client modes
1
Comment
Comment on this entry.
1
VLAN ID
VLAN-ID for the WLAN client.
2
Possible values: 0 to 4094
2
Special values: 0: Switches the use of VLAN off.
1001
Reference Manual
13 Wireless LAN (WLAN)
13.11 Addition(s) to LCOS 7.70
13.11.1 APSD – Automatic Power Save Delivery
Introduction
Automatic Power Save Delivery (APSD) is an extension to the IEEE 802.11e standard. APSD is available in two versions:
1
Unscheduled APSD (U-APSD)
1
Scheduled APSD (S-APSD)
These two methods differ in the way that they use the transmission channels, among others. LANCOM access points and
wireless routers support U-APSD, which forms the basis for the WiFi-certified WMM Power Save (WMMPS).
U-APSD allows WLAN devices to save considerable amounts of energy. This function has come into demand due to the
increasing use of WLAN-capable telephones (Voice over WLAN – VoWLAN). Activating U-APSD for a wireless LAN enables
WLAN devices making calls to switch into "doze mode" while they wait for the next data packet. Transmission of VoIP
data takes place in a fixed time pattern—WLAN devices synchronize their phases of activity with this cycle, so that they
are ready in good time to receive the next packet. This significantly reduces power consumption and the batteries provide
a considerably longer call time.
The precise behavior of the power-saving mode is negotiated between the access point and WLAN client under
consideration of the actual application at hand. This makes APSD much more flexible than former power saving methods,
referred to in this context as "legacy power save".
Configuration
WEBconfig: LCOS menu tree / Setup / Interfaces / WLAN / Network
1
APSD
Activates APSD power saving for this logical WLAN network.
Possible values:
2
On, off
Default:
2
Off
5
Please note that in order for the APSD function to work in a logical WLAN, QoS must be activated on the
device. APSD uses mechanisms in QoS to optimize power consumption for the application.
Statistics
WEBconfig: LCOS menu tree / Status / WLAN E Networks
1
APSD
Indicates whether APSD is activated or deactivated for the respective WLAN (SSID). APSD is only indicated as active
if it is activated in the settings for the logical WLAN and also if the general QoS module is activated.
1
WEBconfig: LCOS menu tree / Status / WLAN / Station table
Displays the access categories for which associated WLAN clients are using APSD:
2
Voice (highest priority)
2
Video
2
Best effort (including data traffic from legacy power-save clients)
1002
Reference Manual
13 Wireless LAN (WLAN)
2
Background (lowest priority).
13.11.2 BFWA – higher transmission power for longer ranges
BFWA stands for Broadband Fixed Wireless Access. A typical application would be to support a network node that
provides Internet to subscribers connected to it. In Germany, the frequencies were provided as part of a general frequency
allocation by the German Federal Network Agency. BFWA transmits at a frequency of 5.8 GHz. The maximum permitted
transmission power for the operation of BFWA wireless bridges is 4000 mW EIRP (Equivalent Isotropic Radiated Power).
These high transmission powers are the advantage from BFWA. Without BFWA, the maximum permissible transmission
power for outdoor WLAN directional radio systems in the 5-GHz band is limited to 1000 mW. This increases the legal
transmission power to allow the same directional radio systems to function over significantly longer distances.
LANCOM access points based on 802.11n and all of the current LANCOM 54 Mbps access points support BFWA as of
LCOS version 7.70. For older access points, support depends on the chipset (AR-5414 chipset). LANCOM Support can
inform you whether these models are able to support BFWA.
For further information see the tech-paper "Broadband Fixed Wireless Access (BFWA)", available for download from
www.lancom.eu.
13.12 Addition(s) to LCOS 7.80
13.12.1 ARF network for IAPP
Access points use the IAPP protocol to communicate and pass information about the handovers of associated WLAN
clients which are roaming. Access points regularly send out multicast announcements to inform the devices about the
BSSIDs and IP addresses of the other access points. A roaming WLAN client initiates a handover by informing a new
access point about its former AP. The access point uses the information supplied by the IAPP protocol to inform the
former access point to remove the WLAN client from its list of associated clients.
Where an access point supports multiple ARF networks, the IAPP announcements are transmitted on all ARF networks.
To limit these multicasts to one particular ARF network, it is possible to define an IAPP IP network.
WEBconfig: LCOS menu tree / Setup / WLAN
1
IAPP-IP network
Here you select the ARF network which is to be used as the IAPP-IP network.
Possible values:
2
Selection from the list of ARF networks defined in the device; max. 16 alphanumerical characters
1003
Reference Manual
13 Wireless LAN (WLAN)
Default:
2
Blank
Special values:
2
Blank: If no IAPP-IP network is defined, IAPP announcements are transmitted on all of the defined ARF networks.
13.13 Addition(s) to LCOS 8.50
13.13.1 Alarm limits for WLAN devices
Typical situations that cause problems in the wireless LAN environment include a decrease in signal strength below a
certain threshold, the percentage of lost packets exceeding a certain threshold, or packets frequently having to be
resent—all of which can greatly reduce the available bandwidth.
In order to recognize and react to these situations, LANCOM Wireless devices now feature alarms to provide information
on the over- or undershooting of threshold values.
5
A connection is not absolutely rated as poor. The assessment always depends on the parameters that are specified.
It should be noted that threshold limits that are too high or too low can lead to incorrect evaluation, and that
a very large number of false alarms could be the result. A certain amount of packet loss and fluctuating signal
strengths are to be expected even for stable wireless connections.
Threshold limits can be set for each individual SSID and point-to-point link supported by an access point. These limits
are used to evaluate a client's connection to the SSID and the connection to a P2P remote.
Additions to the menu system
Network alarm limits
This table contains the settings for the network alarm limits for the device's logical WLAN networks (SSIDs).
Telnet path: /Setup/Interfaces/WLAN
Interface
Select the logical WLAN network (SSID) for which you want to edit the network alarm limits.
Telnet path: /Setup/Interfaces/WLAN/Network-Alarm-Limits
Possible values:
1
Choose from the SSIDs available in the device, e.g. WLAN-1, WLAN-2, etc.
Phy signal
The negative threshold value for the signal level of the corresponding SSID. If the value falls below this threshold, an
alarm is issued. Setting this value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Network-Alarm-Limits
Possible values:
1
3 numerical characters
Default: 0
1004
Reference Manual
13 Wireless LAN (WLAN)
Total retries
The threshold value for the total number of transmission retries for the corresponding SSID. Once the value is reached,
an alarm is issued. Setting this value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Network-Alarm-Limits
Possible values:
1
4 numeric characters to specify the repetitions in per mille
Default: 0 per mille
TX errors
The total number of lost packets for the corresponding SSID. Once the value is reached, an alarm is issued. Setting this
value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Network-Alarm-Limits
Possible values:
1
4 numeric characters to specify the repetitions in per mille
Default: 0 per mille
13.13.2 Interpoint alarm limits
Additions to the menu system
Interpoint alarm limits
This table contains the settings for the interpoint alarm limits for the device's P2P connections (SSIDs).
Telnet path: /Setup/Interfaces/WLAN
Interface
Select the P2P connection here for which you wish to set the interpoint alarm limits.
Telnet path: /Setup/Interfaces/WLAN/Interpoint-Alarm-Limits
Possible values:
1
Choose from the P2P connections available in the device, e.g. P2P-1, P2P-2, etc.
Phy signal
The negative threshold value for the signal level of the corresponding P2P connection. If the value falls below this
threshold, an alarm is issued. Setting this value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Interpoint-Alarm-Limits
Possible values:
1
3 numerical characters
Default: 0
Total retries
The threshold value for the total number of transmission retries for the corresponding P2P connection. Once the value
is reached, an alarm is issued. Setting this value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Interpoint-Alarm-Limits
1005
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
1
4 numeric characters to specify the repetitions in per mille
Default: 0 per mille
TX errors
The total number of lost packets for the corresponding P2P connection. Once the value is reached, an alarm is issued.
Setting this value to 0 deactivates the check.
Telnet path: /Setup/Interfaces/WLAN/Interpoint-Alarm-Limits
Possible values:
1
4 numeric characters to specify the repetitions in per mille
Default: 0 per mille
13.13.3 IEEE 802.11e user priority converted into VLAN tags
IEEE 802.11e is an extension to the WLAN standards that incorporates quality-of-service (QoS) functions. An access point
operating this standard can assign a user priority to each wireless client associated with it. By prioritizing wireless data
packets, the access point can provide preferred handling for voice over IP clients, for example. On the LAN side, access
points are commonly connected with a switch, and different LAN segments are often separated by VLANs. The wired
LAN uses other mechanisms for the prioritization of data packets.
The following example application illustrates this:
1
A wireless client (e.g. VoIP phone) is connected to an access point, QoS is enabled on the WLAN, the data between
the phone and access point is not VLAN tagged.
1
On the Ethernet side, the access point is connected to a VLAN-capable switch, and the data between AP and switch
is VLAN tagged.
The access point is the interface between wired LAN and wireless LAN, and it converts the different prioritization
information accordingly:
1
When an access point receives data for transfer to a WLAN client, it determines the priority of each data packet either
from the VLAN tag or the ToS/DSCP field in the IP header. The access point sends the packets to the client with this
priority.
1
However, data packets transferred from the WLAN client to the access point do not have a VLAN tag. What's more,
in this direction the access point does not inspect the IP header. Instead, the access point takes the user priority of
the WLAN packet and translates this into the appropriate VLAN tag to be attached to outgoing data packets on their
way to the switch.
13.14 Addition(s) to LCOS 8.60
13.14.1 Adjustable rate adaption algorithm
Unlike an Ethernet connection, a wireless connection uses variable bit rates. Higher bit rates provide a better throughput,
but they require a high signal quality at the receiver end. This is essential for error-free decoding. WLAN devices adapt
their bit rate the first time a connection is made or if there is a change to the properties of the medium. This ensures
that the device uses the best available bit rate.
Unlike the standard algorithm, the well-known Minstrel algorithm checks not only the neighboring bit rates, but all
available bit rates. This is a quicker way of determining the optimal bit rate.
1006
Reference Manual
13 Wireless LAN (WLAN)
Additions to the menu system
Method
You have the option to set the desired rate adaptation algorithm.
Telnet path:
Setup > WLAN > Rate-Adaptation
Possible values:
standards
Minstrel
Default:
Minstrel
Initial rate
The initial rate determines the starting bit rate that the algorithm uses to determine the optimal bit rate.
Telnet path:
Setup > WLAN > Rate-Adaptation
Possible values:
Minimum
RSSI-derived
Default:
Minimum
Minstrel averaging factor
The averaging factor used for recalculating the net rates for each bit rate according to the Minstrel method.
Telnet path:
Setup > WLAN > Rate-Adaptation
Possible values:
0 to 99
Default:
75
Standard averaging factor
The averaging factor used for recalculating the net rates for each bit rate according to the standard method.
Telnet path:
Setup > WLAN > Rate-Adaptation
Possible values:
0 to 99
1007
Reference Manual
13 Wireless LAN (WLAN)
Default:
0
13.15 Addition(s) to LCOS 8.80
13.15.1 Spectral scan
In addition to connecting computers to the Internet, professional users are increasingly using wireless local area networks
(WLAN) for business-critical applications. Examples include accessing of patient files, online monitoring of production
facilities, and the transmission of video and audio data (ideally without any time lags). The reliability and performance
of WLAN systems are thus increasingly important.
The rising significance and usage of WLAN for data transmission is resulting in more and more scenarios where the
equipment and systems of various users are crowding the WLAN frequency ranges. These may include, for example ,
microwave ovens, cordless telephones, Bluetooth devices and video transmitters, with their signals occurring on a
continual or intermittent basis. The simultaneous usage of a frequency band or frequency range gives rise to interference
that can disrupt or negatively impact the reliability and performance of a WLAN. This type of interference can result in
data packets or connections being lost. If the interference is too strong, the complete failure of the WLAN may result.
It is therefore becoming increasingly important to use targeted analysis to check the frequency ranges. These checks
should identify the interference or other interference factors, and introduce countermeasures as required. It can also be
used to ensure that the WLAN is working properly and operating interference free.
Targeted analysis can also clarify or identify the following:
1
Proper, fault-free operation of the WLAN
1
Existence of interference or noise
1
Display or identify the bands with interference
1
Strength of the interference signal
1
Regularity or frequency of the interference signal
1
Type, and possibly source, of the interference signal
The WLAN-related frequency ranges are subject to spectral analysis. Results are displayed graphically, i. e. in the form
of real-time diagrams or real-time overviews of frequencies and interference. However, graphical analyses of a spectral
range are open to some freedom of interpretation. Therefore, the following scenario should be fairly commonplace: You
ascertain that the frequency currently being used is being subjected to interference that is continual and of constant
signal strength. However, you are not able to ascertain unequivocally which room or building the signal is coming from,
nor the type of equipment which is transmitting the interfering signal.
Functions of the software module
The "Spectral Scan" software module enables you to run a spectral analysis directly on the access point. There is not
need to purchase any additional software or hardware as the integrated functionality can be used to analyze the frequency
ranges and bands in question. This gives you a graphical overview of the frequency response characteristics within your
WLAN at all times so that you can detect interference and safeguard against it.
1008
Reference Manual
13 Wireless LAN (WLAN)
Clicking on the menu optionExtras > Spectral scan in WEBconfig opens the window shown below:
5
When the WLAN module is disabled (Setup > Interfaces > WLAN > Operational), a message is displayed and
the spectral scan cannot be started. Configure the access point for "Base station" operation or ensure that a
WLAN controller configures the access point.
The following entries, buttons and selection menus are available here:
1
Interfaces: Shows the selected WLAN module for analysis.
1
Radio bands: Use this selection menu to set which frequency band(s) you wish to analyze. The relevant field is
grayed out once the spectral scan has started on this module.
1
Sub-bands: This selection menu is only enabled if '5GHz' or '2.4GHz/5Ghz' is selected in Radio bands. You are then
able to specify which sub-bands of the 5GHz band are included in the analysis.
1
Start: Clicking this button starts the spectral scan on the relevant WLAN module. A separate window opens for each
of the selected frequency bands.
1
Stop: This buttons ends the analysis. The WLAN module then returns to the previous mode and is available again
with its usual functionality.
5
This button is only shown once the module has been started.
1
Show: Once the spectral scan has started, click this button to open a window for each selected frequency band.
Click the button repeatedly to open multiple windows.
1009
Reference Manual
13 Wireless LAN (WLAN)
The spectral scan can also be started from the LANmonitor. To do this, right-click the relevant device in the list and select
Show spectral scan in the context dialog.
A browser window opens showing you the same entries, buttons and selection menus as those in WEBconfig.
5
During the analysis, the WLAN module being analyzed does not send any data or transmit any SSID.
5
The "Spectral Scan" function is supported by LANCOM access points of the L-4xx series, L-32x series, and the
models 1781AW, 1781EW and 1780EW-3G only.
1010
Reference Manual
13 Wireless LAN (WLAN)
Spectral scan analysis window
5
The spectral scan is displayed in a browser application. For this to work properly, your browser must support the
latest version of WebSockets, and the HTML5 element <canvas>. The browser in LANmonitor meets all of
these requirements.
In the separate analysis window of the spectral scan, there are different ways to show the frequencies and frequency
ranges together with the potential interference. The following buttons are available at the top of the window:
1
Current: Shows or hides the curve of the values being measured.
1
Maximum: Shows or hides the maximum values of the ongoing spectrum scan in relation to the currently set history
range.
1
Average: Shows or hides the average values of the ongoing spectrum scan in relation to the currently set history
range.
1
History: Shows or hides the values last measured.
1
Number of history values: Determines the number of results last measured that are displayed. You are able to
show at least the last 5 and at most the last 50 measuring points for every frequency.
1
Last channel: Shows or hides the channel last used.
1
Frequency: Switches the display on the X-axis between WLAN channel and frequency.
The window contains two graphical views showing the readings in a different manner. The top diagram shows the signal
strength in dBm on the Y-axis, and either the WLAN channel or the relevant frequency on the X-axis. The lower diagram
contains the analysis progression over time in the form of a waterfall diagram, with the Y-axis showing the time and the
X-axis again showing the WLAN channel or the relevant frequency. These view formats depict both continuous and
occasional interference on the frequencies, so helping you to take appropriate action to improve the connection (e. g.
by changing the channel or identifying and eliminating the interference source). For example , certain interference sources
such as microwave devices, DECT telephones (working in the 2.4GHz frequency range) and audio-video transmitters
exhibit very typical transmit patterns that occur prominently in both diagrams.
On the lower border of the window is a slider denoted Time slider. This enables you to extend or limit the time period
analyzed in the waterfall diagram. Alternatively, you can use the input box to the right of the slider to select how many
readings you would like to display in the waterfall diagram. The web application can display up to 300 readings in the
waterfall diagram using the time slider. The readings from a maximum of 24 hours can be cached.
1011
Reference Manual
13 Wireless LAN (WLAN)
Below are some example analysis results showing graphically other settings in a different way:
Figure 1: Spectral scan, frequency display of the last 10 history values
Figure 2: Spectral scan, channel display of Current, Maximum and Average, interference from radio camera
1012
Reference Manual
13 Wireless LAN (WLAN)
Figure 3: Spectral scan, channel display of Current, last 10 history values and "Time Slider", interference from
baby phone
Enhancements to LANmonitor
LANmonitor application concepts
This section outlines different application concepts for LANmonitor, such as using SNMP to query CPU and memory
utilization, or performing spectral scans.
1013
Reference Manual
13 Wireless LAN (WLAN)
Spectral scan
Right-click the relevant device in the list and select Show spectrum analyzer in the context dialog.
The following entries, buttons and selection menus are available here:
1
Interfaces: Shows the selected WLAN module for analysis.
1
Radio bands: Use this selection menu to set which frequency band(s) you wish to analyze. The relevant field is
grayed out once the spectral scan has started on this module.
1
Sub-bands: This selection menu is only enabled if '5GHz' or '2.4GHz/5Ghz' is selected in Radio bands. You are then
able to specify which sub-bands of the 5GHz band are included in the analysis.
1
Start: Clicking this button starts the spectral scan on the relevant WLAN module. A separate window opens for each
of the selected frequency bands.
1
Stop: This buttons ends the analysis. The WLAN module then returns to the previous mode and is available again
with its usual functionality.
5
This button is only shown once the module has been started.
1
Show: Once the spectral scan has started, click this button to open a window for each selected frequency band.
Click the button repeatedly to open multiple windows.
1014
Reference Manual
13 Wireless LAN (WLAN)
5
Please refer to Section
Spectral scan analysis window
for further information on the diagrams displayed.
5
During the analysis, the WLAN module being analyzed does not send any data or transmit any SSID.
5
The "Spectral Scan" function is supported by LANCOM access points of the L-4xx series, L-32x series, and the
models 1781AW, 1781EW and 1780EW-3G only.
Additions to the Setup menu
Operation mode
All LANCOM wireless devices can be operated in various modes.
Telnet path:
Setup > Interfaces > WLAN > Operational
Possible values:
Access Point: As a base station (access point), the device establishes the link to a wired LAN for the WLAN
clients.
Station: As a station (client), the device itself locates the connection to another access point and attempts
to register with a wireless network. In this case the device serves to connect a wired device to a base station
over a point-to-point link.
Managed AP: As a managed access point, the device searches for a central WLAN controller from which it
can obtain a configuration.
Probe: In 'Probe' mode, the spectral scan uses the radio module of the access point. The device cannot
transmit or receive data in this mode. On startup of the spectral scan, the device automatically switches to
'Probe' mode so that this setting need not be configured manually.
Default:
LANCOM Wireless Router: Access Point
1015
Reference Manual
13 Wireless LAN (WLAN)
LANCOM Access Points: Managed AP
Probe settings
This table contains the settings for the spectral scan.
5
The device cannot transmit or receive data in this mode.
Telnet path:
Setup > Interfaces > WLAN
Ifc
Opens the settings for the physical WLAN interface.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Selection from the available physical WLAN interfaces.
Radio bands
Here you can select which frequency bands should be analyzed by spectral scanning.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
2.4GHz
5GHz
2.4GHz/5GHz
Default:
2.4GHz
Subbands 2.4GHz
This setting determines which subbands of the 2.4GHz frequency are to be analyzed.
5
The spectral scan only takes this field into account when either '2.4GHz' or '2.4GHz/5GHz' is set in Radio bands.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Band-1
Band-2
Band-1+2
1016
Reference Manual
13 Wireless LAN (WLAN)
Default:
Band-1
Channel list 2.4GHz
Specify in this field the list of channels for the spectral scan in the 2.4GHz frequency band. Individual channels are
separated with commas.
There is no need to change the default values of the spectral scan for its operation. The spectral scan examines 20MHz-wide
frequency bands at a time. Due to the 5MHz gaps between the individual 20MHz-wide channels in the 2.4GHz radio
band, the channels specified result in a continuous scan of the entire 2.4GHz radio band. In the 5GHz band, the channel
bandwidth is also 20MHz, and the individual channels lie next to each other with no overlapping. When no channels
are specified, all channels are scanned which results in a complete scan in the 5GHz band.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Max. 48 characters
from ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
1, 5, 9, 13
Subbands 5GHz
This setting specifies which subbands of the 5GHz frequency are to be analyzed.
5
The spectral scan only takes this field into account when either '5GHz' or '2.4GHz/5GHz' is set in Radio bands.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Band-1
Band-2
Band-1+2
Default:
Band-1
Channel list 5GHz
In this field, specify the list of channels for the spectral scan in the 5GHz frequency band. Individual channels are separated
with commas.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Max. 48 characters
1017
Reference Manual
13 Wireless LAN (WLAN)
from ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
Channel dwell time
Determine here the number of milliseconds the spectral scan dwells on a channel.
The web application can display up to 300 readings in the waterfall diagram using the time slider. The readings from a
maximum of 24 hours can be cached. The default value is generally adequate. Only lower the value when you need a
more accurate resolution, and when the performance of your browser and PC is high enough to process the faster display
of the readings.
Telnet path:
Setup > Interfaces > WLAN > Probe-Settings
Possible values:
Max. 10 characters
from 0 to 9
Default:
250
13.15.2 WLAN band steering
The IEEE 802.11 standard contains virtually no criteria by which a WLAN client should select the access point for a
connection. While there are general guidelines according to which preference is given to an access point with a higher
RSSI value (i. e. the received signal strength), for example, WLAN clients do not, in practice, adhere strictly to these
definitions or the general guidelines. If both 2.4GHz and 5GHz are used to broadcast an SSID, there is normally no way
of influencing the client as regards the preferred frequency band.
The steering of WLAN clients is based on the principle that many clients determine the available access points by means
of an active scan. Active scanning here means that a client sends probe requests containing the network ID to which
the client is to connect. Access points with this ID then send a test response, enabling the client to create a list of available
access points. The vast majority of WLAN clients only connect to access points from which they have received a probe
response, and this can be used to steer their selection process.
There are multiple, sometimes very advanced, criteria for steering. One of these criteria relates to the wireless frequency
ranges used for client communication. Modern dual-band WLAN clients are expected to prefer the 5GHz frequency band
over the (now) overcrowded 2.4GHz band. Band steering is the term given to purposefully assigning a WLAN client a
particular frequency band or range.
The list of detected or "seen" clients contains all clients from which the access point has received a test request packet.
In combination with the radio frequency on which the WLAN client sends the test request, this list is one of the bases
on which the access point decides whether to respond to the request or not.
Other criteria depend on the reported client IDs and the configuration of the devices. It may be the case, for example,
that fewer SSIDs are reported on the preferred frequency band than are on the one with the lower preference. Similarly,
too low a transmit strength when SSIDs are reported can result in the client not receiving any probe responses at all on
the preferred frequency band. For the latter scenario, it is important to ensure that the access point does not suppress
probe responses on the less favored frequency band. The minimum signal strength responsible here can be set in the
following ways :
1
LANconfig: Wireless LAN > General > Logical WLAN settings > Network > Minimum client signal strength
1
WEBconfig: Setup > Interfaces > WLAN > Network > Minimum station strength
1018
Reference Manual
13 Wireless LAN (WLAN)
In LANconfig you can use Wireless LAN > Band steering to enable and manage the access point's band steering
function.
Enhancements to LANconfig
Band steering
This dialog enables you to configure the settings for band steering in LANconfig.
The following functions are available in Wireless LAN > Band steering:
1
Band steering enabled: Enables or disables this function.
1
Preferred frequency band: Specifies the frequency band to which the device steers WLAN clients. Possible values:
2
2.4GHz: The device routes clients to frequency band 2.4GHz.
2
5GHz: The device routes clients to frequency band 5GHz.
1
Block time: The time for which the access point steers the WLAN client to the preferred frequency band. The default
value is 120 seconds.
Additions to the Setup menu
Client steering
This is where you determine the 'WLAN band steering' settings of the WLAN clients registered at the access point.
Telnet path:
Setup > WLAN
1019
Reference Manual
13 Wireless LAN (WLAN)
Operating
This option enables 'client steering' in the access point.
Telnet path:
Setup > WLAN > Client-Steering
Possible values:
Yes
No
Default:
No
Criterion
Determine here the criteria by which the access point controls the WLAN client.
Telnet path:
Setup > WLAN > Client-Steering
Possible values:
Radio-Band
Default:
Radio-Band
Preferred band
Set here the preferred frequency band to which the access point steers the WLAN client.
Telnet path:
Setup > WLAN > Client-Steering
Possible values:
5GHz
2.4GHz
Default:
5GHz
Probe request ageout seconds
Set the time (in seconds) that the WLAN client connection should be stored in the access point. When this time expires,
the access point deletes the entry from the table.
5
This value should be set low if you are using clients in the WLAN that, for example , often switch from dual-band
to single-band mode.
Telnet path:
Setup > WLAN > Client-Steering
1020
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Max. 10 characters
From 0 to 9
Special values:
0: The visible probe requests are deemed invalid immediately.
Default:
120
Additions to the Status menu
Seen clients
Telnet path:
Status > WLAN > Client
This table contains the following status values:
Num-ProbeRsp-OK
Number of probe responses sent to and received by this client.
Num-ProbeRsp-Bad
Number of probe responses sent to and not received by this client (Tx errors).
Num-ProbeRsp-suppressed
Number of probe responses, which were sent to this client either because its signal strength was below the
threshold or because band steering suppressed the response.
Band
Displays the WLAN band on which the client last communicated.
13.15.3 STBC / LDPC
Basics
Data transfers according to the IEEE-802.11n standard are performed using MIMO technology (multiple input, multiple
output). The sender transmits data packets concurrently over multiple, spatially separated antennas, meaning that
reflections and the resulting interference have little effect on the signal. However, the gain in throughput is less with
each additional antenna, and the performance requirements for signal processing are increased.
Low Density Parity Check (LDPC)
Before the sender transmits the data packets, it expands the data stream with checksum bits depending on the modulation
rate. These checksum bits allow the receiver to correct transmission errors. By default the 802.11n standard uses
'Convolution Coding' (CC) for error correction, which is well-known from 802.11a and 802.11g; however, the 11n
standard also provides for error correction according to the LDPC method (Low Density Parity Check).
In contrast to CC encoding, LDPC encoding uses larger packets to calculate checksums and can also recognize more bit
errors. The improved ratio of payload to checksum data enables LDPC encoding to provide a higher data transfer rate.
1021
Reference Manual
13 Wireless LAN (WLAN)
Space Time Block Coding (STBC)
The function 'STBC' (Space Time Block coding) additionally varies the transmission of data packets over time to minimize
time-related effects on the data. Due to the time offset of the packets the recipient has an even better chance of receiving
error-free data packets, regardless of the number of antennas.
Additions to the Setup menu
Use STBC
Here you activate the use of STBC for data transfer per logical network (SSID).
5
If the WLAN chipset does not support STBC, you cannot set this value to Yes.
Telnet path:
Setup > Interfaces > WLAN > Transmission
Possible values:
Yes
No
Default:
Yes (If the WLAN chipset supports STBC)
No (If the WLAN chipset does not support STBC)
Use LDPC
Here you activate the use of LDPC for data transfer per logical network (SSID).
5
If the WLAN chipset does not support STBC, you cannot set this value to Yes.
Telnet path:
Setup > Interfaces > WLAN > Transmission
Possible values:
Yes
No
Default:
Yes (If the WLAN chipset supports STBC)
No (If the WLAN chipset does not support STBC)
Additions to the Status menu
Rx-STBC
This parameter indicates whether the detected remote station can receive data streams in STBC mode, and how many.
Telnet path:
Status > WLAN > Station-table
1022
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the selected WLAN interface supports LDPC encoding.
Telnet path:
Status > WLAN > Station-table
Possible values:
Yes
No
Tx-STBC
This parameter indicates whether the detected remote station is capable of transmitting with STBC.
Telnet path:
Status > WLAN > Scan-Results
Possible values:
Yes
No
Rx-STBC
This parameter indicates whether the detected remote station can receive data streams in STBC mode, and how many.
Telnet path:
Status > WLAN > Scan-Results
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the detected remote station can interpret LDPC-encoded data packets.
Telnet path:
Status > WLAN > Scan-Results
1023
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Yes
No
Rx-STBC
This parameter indicates whether the detected remote station can receive data streams in STBC mode, and how many.
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the selected WLAN interface supports LDPC encoding.
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
Yes
No
Rx-STBC
This parameter indicates whether the detected remote station can receive data streams in STBC mode, and how many.
Telnet path:
Status > WLAN > Client > Interfaces
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the selected WLAN interface supports LDPC encoding.
Telnet path:
Status > WLAN > Client > Interfaces
1024
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Yes
No
Tx-STBC
This parameter indicates whether the detected remote station is capable of transmitting with STBC.
Telnet path:
Status > WLAN > Competing-networks
Possible values:
Yes
No
Rx-STBC
This parameter indicates whether the detected remote station can receive data streams in STBC mode, and how many.
Telnet path:
Status > WLAN > Competing-networks
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the detected remote station can interpret LDPC-encoded data packets.
Telnet path:
Status > WLAN > Competing-networks
Possible values:
Yes
No
Rx-STBC
This parameter indicates how many data streams the selected WLAN interface can receive when the STBC option is
enabled.
If 0 is displayed, the WLAN interface does not support STBC.
Telnet path:
Status > WLAN > WLAN-Parameter
1025
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
none
One
Two
Three
LDPC
This parameter indicates whether the selected WLAN interface supports LDPC encoding.
Telnet path:
Status > WLAN > WLAN-Parameter
Possible values:
Yes
No
13.15.4 LANCOM-specific UUID information element for access points
As of LCOS version 8.80, LANCOM access points transmit a LANCOM-specific UUID device identifier.
UUID info element for LANCOM WLAN access points
All current LANCOM access points have multi-SSID capability. This means that they can simultaneously present different
'virtual' access points to their WLAN clients.
For devices with two radio modules (dual radio), the BSSIDs relate to the logical networks on the corresponding radio
module. However, the MAC addresses of the two radio modules are completely independent of one another. Consequently,
logical networks with different BSSIDs cannot be unequivocally related to a single device.
However, for the planning and monitoring of networks, it is often desirable to be able to relate logical networks to their
respective devices (or radio modules).
LANCOM access points support an Aironet-compatible information element that contains the name of the device as
assigned to it by the administrator. The transmission of this information is optional and many operators disable it for
security reasons because they want to publish as little information as possible about the access point on the network.
Thus, this information either does not appear for network monitoring at all or, depending on the setting, the information
may not identify the device as a LANCOM access point.
Besides this, LANCOM access points possess a UUID (universally unique identifier), which is calculated from the device
type and serial number and can identify the device uniquely on the network. By using encryption when generating the
UUID, the device type or serial number can only be inferred with considerable effort (brute-force attack for all types of
devices and serial numbers).
Transmission of the UUID can be switched on or off independent of the radio module and logical network.
Additions to the Setup menu
Include UUID
Here you can determine whether the corresponding radio module should transfer its UUID.
1026
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > Interfaces > WLAN > Network
Possible values:
Yes
No
Default:
Yes
13.15.5 DFS
This section contains information about DFS (Dynamic Frequency Selection).
DFS4
As of LCOS version 8.80 all devices transmitting on the 5GHz WLAN frequencies support the standard ETSI EN 301 893
V1. 6. 1 ("DFS4").
Function and the history of development
For the DFS method (Dynamic Frequency Selection) required for 5 GHz WLANs, an unused frequency is automatically
selected, for example, to avoid interference from radar systems. Occasionally, however, signals from weather radar
stations cannot be identified reliably.
For this reason the European Commission is extending the requirements of the standards ETSI EN 301 893 V1.3.1 and
ETSI EN 301 893 V1.4.1 to additionally avoid the use of three channels (120, 124 and 128) in subband 2 of the 5 GHz
band, and not to allow use of these bands for automatic channel selection until a process to auto-detect weather radar
station signals is made available. The versions EN 301 893 V1.3 and EN 301 893 V1.4 are referred to as "DFS2"
In the middle of 2010 the new version ETSI EN 301 893 V1.5.1 came into force, which was accompanied by changes in
the usage of WLAN frequencies in the ranges 5.25 to 5.35 GHz and 5.47 to 5.725 GHz. The new Version 1.5.1 regulates
the DFS (Dynamic Frequency Selection) method for the protection of radar stations from WLAN systems working in this
frequency range. By using DFS to detect certain patterns in the radio signals received, it is now possible to detect active
radar stations, and WLAN systems can automatically switch their operating channel. To differentiate from previous
regulations, the new standard EN 301 893-V1.5 for the updated DFS is referred to as "DFS3".
A pulse pattern can generally be described in terms of its pulse rate, pulse width and the number of pulses. Former DFS
technology was only able to detect fixed radar patterns as defined by the various combinations of pulse rates and pulse
widths which were stored in the WLAN device. According to DFS3, the device is now able to recognize changing pulse
rates and pulse widths as radar patterns. Furthermore, two or three different pulse rates may be used within a radar
signal.
The version ETSI EN 301 893 V1.5.1 (DFS-3) expires on 01/01/2013. The new version ETSI EN 301 893 v1.6.1 (known as
"DFS4"), which also detects shorter radar pulses, applies thereafter.
5
The recognition of weather radar stations (channels 120, 124 and 128 in the 5.6 to 5.65 MHz frequency range)
is subject to special conditions. The DFS implementation in LCOS does not support the more stringent recognition
conditions. Therefore, these three channels will be omitted from newer versions of LCOS.
Additions to the Setup menu
Preferred DFS scheme
All WLAN systems that have been put into operation since EN 301 893-V1.6 came into effect are required to use DFS4
in the 5GHz band.
1027
Reference Manual
13 Wireless LAN (WLAN)
Here you can select DFS2 (EN 301 893-V1.3), DFS3 (EN 301 893-V1.5) or DFS4 (EN 301 893-V1.6).
Telnet path:
Setup > Interfaces > WLAN > Radio-settings > Preferred-DFS-Scheme
Possible values:
EN 301 893-V1.3
EN 301 893-V1.5
EN 301 893-V1.6
Default:
EN 301 893-V1.6
5
When upgrading from a firmware version older than LCOS version 8.80 to an LCOS version 8.80 or higher, the
existing setting of DFS3 (EN 301 893-V1.5) remains in effect.
13.15.6 PMK caching in the WLAN client mode
When establishing a connection from a WLAN client to an access point operating with 802.1x-authentication, the two
stations negotiate a shared key, known as the Pairwise Master Key (PMK), for the subsequent encryption. In applications
with mobile WLAN clients (laptops in large offices, moving objects with WLAN connections in the industrial sector), the
WLAN clients often change the access points via which they are logged in to the WLAN network. And although WLAN
clients roam back and forth between different access points, in most cases these tend to be the same ones.
Access points typically save a negotiated PMK for a certain period of time. WLAN devices in WLAN client mode also store
PMKs. As soon as a WLAN client starts a login procedure for which a connection already existed, the WLAN client can
directly transfer the existing PMK to the access point. In this way, the two remote stations skip the PMK negotiation
phase while establishing the connection, and the WLAN client and access point establish the connection much faster.
The WLAN client stores the negotiated PMK for the duration set under
Default lifetime
.
Additions to the Setup menu
PMK caching
Enables PMK caching in WLAN client mode
Telnet path:
Setup > Interfaces > WLAN > Encryption
Possible values:
Yes
No
Default:
No
PMK-Caching
Manage PMK-caching here.
Telnet path:
Setup > WLAN > PMK-Caching
1028
Reference Manual
13 Wireless LAN (WLAN)
Default lifetime
Specifies the duration in seconds that the WLAN client stores the negotiated PMK.
5
Make sure that the time set here matches the session timeout in the accept message that the access point or
RADIUS server sends to the WLAN client. Once this time has expired, the access point or RADIUS server requires
a re-authentication.
Telnet path:
Setup > WLAN > PMK-Caching
Possible values:
0 to 4294967295
Default:
0
Special values:
0: The negotiated PMK expires immediately.
Additions to the Status menu
PMK caching
This directory contains the status of the PMK caches.
Telnet path:
Status > WLAN > PMK-Caching
Contents
This table contains all entries of the PMK caches.
Telnet path:
Status > WLAN > PMK-Caching > Content
Authenticator
This entry contains the MAC address of the authenticating access points.
Telnet path:
Status > WLAN > PMK-Caching > Content
Supplicant
This entry contains the MAC address of the authenticating WLAN client.
Telnet path:
Status > WLAN > PMK-Caching > Content
User name
This entry contains the user name, which the RADIUS server sends to the access point for access permission.
1029
Reference Manual
13 Wireless LAN (WLAN)
5
If the RADIUS server does not transmit a user name, this field is left blank.
Telnet path:
Status > WLAN > PMK-Caching > Content
VLAN-ID
This entry contains the VLAN-ID, which the RADIUS server sends to the access point for access permission.
5
If the RADIUS server does not transmit a VLAN-ID, this field is left blank.
Telnet path:
Status > WLAN > PMK-Caching > Content
Lifetime
This entry contains the lifetime of the PMKs in seconds. It is calculated from the validity of the session, which the RADIUS
server transmitted with the access permission.
The value is 0 seconds if the RADIUS server did not transmit a duration or the PMK does not have a validity period.
Telnet path:
Status > WLAN > PMK-Caching > Content
Lifetime
This entry shows whether a PMK has expired. If this is the case, the access point no longer accepts PMK-caching or
authentication attempts with this PMK. Instead, it will launch a new 802.1x authentication.
Telnet path:
Status > WLAN > PMK-Caching > Content
Source
This entry indicates how the WLAN client obtained the PMK:
1
Unknown: The source is unknown. This entry should not occur in normal operation.
1
Authentication: PMK is the result of a normal 802.1x-authentication between WLAN-client and access point.
1
Pre-Authentication: PMK is the result of a normal 802.1x-pre-authentication between the WLAN client and another
access point.
Telnet path:
Status > WLAN > PMK-Caching > Content
13.15.7 Pre-authentication in WLAN-client mode
Fast authentication by means of the Pairwise Master Key (PMK) only works if the WLAN client was logged on to the
access point previously. The WLAN client uses pre-authentication to reduce the time to logon to the access point at the
first logon attempt.
1030
Reference Manual
13 Wireless LAN (WLAN)
Usually, a WLAN client carries out a background scan of the environment to find existing access points that it could
connect to. Access points that support WPA2/802.1x can communicate their pre-authentication capability to any WLAN
clients that issue requests. A WPA2 pre-authentication differs from a normal 802.1x authentication as follows:
1
The WLAN client logs on to the new access point via the infrastructure network, which interconnects the access
points. This can be an Ethernet connection or a WDS link (wireless distribution system), or a combination of both
connection types.
1
A pre-authentication is distinguished from a normal 802.1x authentication by the differing Ethernet protocol
(EtherType). This allows the current access point and all other network partners to treat the pre-authentication as a
normal data transmission from the WLAN client.
1
After successful pre-authentication, the negotiated PMK is stored to the new access point and the WLAN client.
5
The use of PMKs is a prerequisite for pre-authentication. Otherwise, pre-authentication is not possible.
1
When the client wants to connect to the new access point, the stored PMK significantly accelerates the logon
procedure. The further procedure is equivalent to the
PMK caching
.
5
On the client side, the number of concurrent pre-authentications is limited to four. This minimizes the network
load on the central RADIUS server in network environments with large numbers of access points.
Additions to the Setup menu
Pre-authentication
Enables pre-authentication support for the corresponding WLAN.
5
In order to be able to use pre-authentication, PMK caching must be enabled.
Telnet path:
Setup > Interfaces > WLAN > Encryption
Possible values:
Yes
No
Default:
No
13.15.8 Greenfield mode for access points with IEEE 802.11n
For access points that comply with the IEEE 802.11n standard, the physical WLAN settings provide the option to allow
or restrict data transmission according to the IEEE 802.11n standard.
Along with the selection of the individual a/b/g/n standards and a selection of mixed operating modes, the access points
provide the option of using the Greenfield mode. Once activated in the physical WLAN settings for a WLAN interface,
the Greenfield mode only allows WLAN clients that support the IEEE 802.11n standard to associate with the corresponding
logical WLANs (SSIDs). Other WLAN clients that only work with the standards IEEE 802.11a/b/g cannot associate with
these WLANs.
The IEEE 802.11n standard only allows connections that are either encrypted with WPA2/AES or unencrypted. WEP- and
TKIP-based encryptions are not allowed in IEEE 802 11n. Please be aware of the following restrictions depending on the
actual physical and logical WLAN settings:
1
If, in the Physical settings, you activate support of a mixed-mode which includes the IEEE 802.11n standard and
individual WLAN clients on a logical network only support WEP encryption, then the access point will reduce the
1031
Reference Manual
13 Wireless LAN (WLAN)
transmission rate to the 802.11a/b/g standard, because the higher transfer rates available with IEEE 802.11n are
not supported in combination with WEP.
1
If, in the Encryption settings for a logical WLAN network, you enable not only AES session keys but also TKIP session
keys, then the access point will use only the AES session key for this WLAN, because TKIP is not supported by IEEE
802.11n.
1
If, in the Encryption settings for a logical WLAN network, you enable only TKIP session keys, then the access point
will reduce the transmission rate to the 802.11a/b/g standard, because the higher transfer rates available with IEEE
802.11n are not supported in combination with TKIP.
13.15.9 Separate RADIUS server for each SSID
If you operate RADIUS for the central administration of accounts and access credentials in your wireless network, then
the access point forwards requests for the authorization and accounting to the RADIUS server by default. If you are using
a WLAN controller for access point management, then the controller can forward RADIUS requests from all of these
access points to the RADIUS server.
In some cases, the operator of access points or WLAN controllers may wish to use a different RADIUS server for each
logical wireless network (SSID). This may be the case, for example, when multiple customers share the same technical
WLAN infrastructure but use their own authentication systems (e.g. with Wireless as a Service – WaaS).
In these cases, you have the option to choose a separate RADIUS profile for each logical WLAN (i.e. each SSID). The
RADIUS profile contains all of the necessary information to use the appropriate RADIUS server, including the optional
backup solution.
Additions to the menu system
RADIUS server profiles
By default, the WLAN controller forwards requests for account and access administration to the RADIUS server. In order
for the access points to contact the RADIUS server directly, you define the necessary RADIUS profiles in this table. When
setting up logical wireless networks (SSIDs), you have the option of choosing a separate RADIUS profile for each SSID.
SNMP ID: 2.37.35
Telnet path: /Setup/WLAN-Management
Name
Name of the RADIUS profile. This name is used to reference the RADIUS profile in the logical WLAN settings.
SNMP ID: 2.30.3.1
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 16 characters
Default: Blank
Access IP
IP address of the RADIUS server that authenticates user data. In the default setting with the IP address of 0.0.0.0, the
access point sends RADIUS requests to the WLAN controller.
SNMP ID: 2.37.35.7
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Valid IP address.
1032
Reference Manual
13 Wireless LAN (WLAN)
Default: 0.0.0.0
Access port
Port of the RADIUS server that authenticates user data.
SNMP ID: 2.37.35.8
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 5 numbers
Default: 1812
Access secret
Password for the RADIUS server that authenticates user data.
SNMP ID: 2.37.35.9
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 32 characters
Default: Blank
Access loopback
Here, you can optionally configure a sender address for the RADIUS server that authenticates user data. This is used
instead of the sender address otherwise selected automatically for the destination address. If you have configured
loopback addresses, you can specify them here as sender address.
SNMP ID: 2.37.35.10
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Various forms of entry are accepted:
1
Name of the IP networks whose addresses are to be used.
1
"INT" for the address of the first intranet.
1
"DMZ" for the address of the first DMZ
5
If there is an interface called "DMZ", its address will be taken in this case.
1
LBO... LBF for the 16 loopback addresses.
1
Furthermore, any IP address can be entered in the form x.x.x.x.
Default: Blank
Access protocol
Protocol for communication between the access point and the RADIUS server that authenticates the user data.
SNMP ID: 2.37.35.11
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
RADSEC
1033
Reference Manual
13 Wireless LAN (WLAN)
1
RADIUS
Default: RADIUS
Account IP
IP address of the RADIUS server that carries out the accounting of user activities. In the default setting with the IP address
of 0.0.0.0, the access point sends RADIUS requests to the WLAN controller.
SNMP ID: 2.37.35.2
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Valid IP address.
Default: 0.0.0.0
Account port
Port of the RADIUS server that carries out the accounting of user activities.
SNMP ID: 2.37.35.3
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 5 numbers
Default: 1813
Account secret
Password for the RADIUS server that carries out the accounting of user activities.
SNMP ID: 2.37.35.4
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 32 characters
Default: Blank
Account loopback
Here, you can optionally configure a sender address for the RADIUS server that carries out the accounting of user activities.
This is used instead of the sender address otherwise selected automatically for the destination address. If you have
configured loopback addresses, you can specify them here as sender address.
SNMP ID: 2.37.35.5
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Various forms of entry are accepted:
1
Name of the IP networks whose addresses are to be used.
1
"INT" for the address of the first intranet.
1
"DMZ" for the address of the first DMZ
5
If there is an interface called "DMZ", its address will be taken in this case.
1034
Reference Manual
13 Wireless LAN (WLAN)
1
LBO... LBF for the 16 loopback addresses.
1
Furthermore, any IP address can be entered in the form x.x.x.x.
Default: Blank
Account protocol
Protocol for communication between the access point and the RADIUS server that carries out the accounting of user
activities.
SNMP ID: 2.37.35.6
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
RADSEC
1
RADIUS
Default: RADIUS
Backup
Name of the backup RADIUS profile. This name is used to reference the backup RADIUS profile in the logical WLAN
settings. The WLAN controller uses the settings from the backup RADIUS profile when the primary RADIUS server for
authentication or accounting does not respond to queries.
SNMP ID: 2.30.3.12
Telnet path: /Setup/WLAN-Management/RADIUS-Server-Profiles
Possible values:
1
Max. 16 characters
Default: Blank
Network profiles
Here you define the logical WLAN networks for activation and operation via the associated access points (APs).
SNMP ID: 2.37.1.1
Telnet path: /Setup/WLAN-management/AP-configuration
RADIUS profile
Here you enter the name of the RADIUS profile containing the information about the RADIUS server used for the
authentication of the user data and the accounting of user activity.
SNMP ID: 2.37.1.1.35
Telnet path:/Setup/WLAN-Management/AP-Configuration/Networkprofiles
Possible values:
1
Max. 16 characters
Default: Blank
1035
Reference Manual
13 Wireless LAN (WLAN)
Enhancements to LANconfig
Setting up the RADIUS profiles
In LANconfig, the settings for the RADIUS profiles in the WLAN controller are to be found under WLAN Controller >
Profiles > RADIUS profiles.
Selecting a RADIUS profile for a logical WLAN
In LANconfig, selecting the RADIUS profile for a logical WLAN in the WLAN Controller is done with the menu item WLAN
Controller > Profiles > Logical WLAN networks.
1036
Reference Manual
13 Wireless LAN (WLAN)
13.16 Addition(s) to LCOS 8.82
13.16.1 Advanced ARP handling
As of LCOS version 8.82, access points can store more than one IP address per WLAN client.
Additions to the Status menu
ARP handling
This menu displays both IPv4 and IPv6 information about the WLAN clients detected in the WLAN cell.
5
The access point can store multiple IP addresses per WLAN client in these tables, especially in IPv6 networks. If
there are several IP addresses for each WLAN client, the entry in the WLAN station table (Setup > WLAN >
Station-Table) points to the most recently identified IP address.
Telnet path:
Status > WLAN
ARP Table
This table contains IPv4 information about the WLAN clients detected in the WLAN cell.
Telnet path:
Status > WLAN > ARP-Handling
Address
Contains the stored IPv4 address of the WLAN client.
MAC address
Contains the associated MAC address of the WLAN client.
Interface
Contains the SSID with which the WLAN client is connected.
VLAN ID
Contains the VLAN ID on which the WLAN client is connected.
Age
Contains the time, in seconds, since the access point last identified the WLAN client.
5
The access point only deletes entries in this table if it no longer detects the corresponding WLAN client in the
WLAN cell.
5
In this table, it is possible that the access point stores multiple IP addresses for a WLAN client (or several WLAN
clients with the same IP address), in order to identify, for example, address conflicts.
ND table
This table contains IPv6 information about the WLAN clients detected in the WLAN cell.
1037
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Status > WLAN > ARP-Handling
Address
Contains the stored IPv6 address of the WLAN client.
MAC address
Contains the associated MAC address of the WLAN client.
Interface
Contains the SSID with which the WLAN client is connected.
VLAN ID
Contains the VLAN ID on which the WLAN client is connected.
Age
Contains the time, in seconds, since the access point last identified the WLAN client.
5
The access point only deletes entries in this table if it no longer detects the corresponding WLAN client in the
WLAN cell.
5
In this table, it is possible that the access point stores multiple IP addresses for a WLAN client (or several WLAN
clients with the same IP address), in order to identify, for example, address conflicts.
ARP requests answered
This entry shows the number of ARP requests that the access point successfully and directly answered without the request
having been previously sent to the WLAN cell.
Telnet path:
Status > WLAN > ARP-Handling
ARP requests not answered
This entry indicates the number of ARP requests not directly answered by the access point. Instead, the access point had
to forward this request to the WLAN cell first.
Telnet path:
Status > WLAN > ARP-Handling
ARP requests rejected
This entry shows the number of ARP requests rejected by the access point. Reasons for this may include:
1
The access point has already answered this request over a different interface.
1
The access point has classified this request as an unnecessary ARP check.
1
The request does not match the VLAN override of the WLAN client.
Telnet path:
Status > WLAN > ARP-Handling
1038
Reference Manual
13 Wireless LAN (WLAN)
ND searches answered
This entry shows the number of ND requests that the access point successfully and directly answered without the request
having been previously sent to the WLAN cell.
Telnet path:
Status > WLAN > ARP-Handling
ND searches not answered
This entry indicates the number of ND requests not directly answered by the access point. Instead, the access point had
to forward this request to the WLAN cell first.
Telnet path:
Status > WLAN > ARP-Handling
ND searches rejected
This entry shows the number of ND requests rejected by the access point. Reasons for this may include:
1
The access point has already answered this request over a different interface.
1
The access point has classified this request as a DAD query (Duplicate Address Detection).
1
The request does not match the VLAN override of the WLAN client.
Telnet path:
Status > WLAN > ARP-Handling
Delete values
This action deletes all stored valuesin the ARP or ND tables.
Telnet path:
Status > WLAN > ARP-Handling
13.16.2 Multicast and broadcasts in cells can be switched off
According to the HotSpot 2.0 specification, as of LCOS version 8.82 it is possible to switch off multicasts and broadcasts
in cells.
Additions to the Setup menu
Transmit only unicasts
Multicast and broadcast transmissions within a WLAN cell cause a load on the bandwidth of the cell, especially since
the WLAN clients often do not know how to handle these transmissions. The access point already intercepts a large part
of the multicast and broadcast transmissions in the cell with ARP spoofing. With the restriction to unicast transmissions
it filters out unnecessary IPv4 broadcasts from the requests, such as Bonjour or NetBIOS.
The suppression of multicast and broadcast transmissions is also a requirement from the HotSpot 2.0 specification.
Telnet path:
Telnet path:Setup > Interfaces > WLAN > Network
1039
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Yes
No
Default:
No
Enhancements to LANconfig
Configuration of WLAN parameters
The settings for the cellular networks are made at various points in the configuration:
1
Some parameters concern the physical WLAN interfaces. Some LANCOM models have just one WLAN interface (single
radio access point), and others have a second WLAN module integrated (dual radio access point). The settings for
the physical WLAN interfaces apply to all of the logical cellular networks supported by this module. These parameters
include, for example, the transmission power of the antenna and the operating mode of the WLAN module (access
point or client).
1
Other parameters are only related to the Logical cellular networks, which are supported by a physical interface. These
include, for example, the SSID or the activation of encryption, such as 802.11i with AES.
1
A third group of parameters affect the wireless network operation, but are not significant only to WLANs. These
include, for example, the protocol filter in the LAN bridge.
The logical WLAN interfaces
Every physical WLAN interface can support up to eight different logical cellular networks (Multi-SSID). Parameters can
be defined specifically for each of these networks, without the need of additional access points.
1040
Reference Manual
13 Wireless LAN (WLAN)
Network settings
LANconfig:Wireless LAN > General > Logical WLAN settings > Network
1
WLAN network enabled
This switch enables or disenables the corresponding logical WLAN.
1
Network name (SSID)
Specify a unique SSID (the network name) for each of the required logical wireless LANs. Only network cards that
have the same SSID can register with this wireless network.
1
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be contacted
by any mobile station in the area. Your wireless LAN is put into private mode by activating the closed network function.
In this operation mode, mobile stations that do not know the network name (SSID) are excluded from taking part in
the wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented
from associating with your network.
The option Suppress SSID broadcast provides the following settings:
2
No: The access point publishes the SSID of the cell. When a client sends a probe request with an empty or incorrect
SSID, the access point responds with the SSID of the radio cell (public WLAN).
2
Yes: The access point does not publish the SSID of the cell. When a client sends a probe request with an empty
SSID, the device similarly responds with an empty SSID.
2
Tightened: The access point does not publish the SSID of the cell. When a client sends a probe request with a
blank or incorrect SSID, the device does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN clients
associate with the access point, this transmits the SSID in plain text so that it is briefly visible to all clients
in the WLAN network.
1
MAC filter enabled
The MAC addresses of the clients that are allowed to associate with an access point are stored in the MAC filter list
(Wireless LAN > Stations > Stations). The MAC filter enabled switch allows you to switch off the use of the MAC
filter list for individual logical networks.
5
Use of the MAC filter list is required for logical networks in which the clients register via LEPS with an individual
passphrase. The passphrase used by LEPS is also entered into the MAC filter list. The access point always
1041
Reference Manual
13 Wireless LAN (WLAN)
consults the MAC filter list for registrations with an individual passphrase, even if this option is deactivated
here.
1
Maximum number of clients
Here you set the maximum number of clients that may associate with this access point. Additional clients wanting
to associate will be rejected by the access point.
1
Minimum client signal strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on. If the
client's signal strength is below this value, the access point stops sending probe responses and discards the client's
requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, as those offering only a weak connection at the client's current
position are not listed.
1
Client-bridge support
Enable this option for an access point if you have enabled the client-bridge support for a client station in WLAN
client mode ().
5
The client-bridge mode operates between two LANCOM devices only.
1
Allow traffic between stations of this SSID
Check this option if all stations logged on to this SSID are to be able to communicate with one another.
1
(U)APSD / WMM Power Save activated
Enable this option to signal stations that the power saving function (U)APSD ([Unscheduled] Automatic Power Save
Delivery) is supported.
(U)APSD is established in the 802.11e standard, and helps VoWLAN devices to increase their battery life. The related
devices switch to power saving mode after login on a (U)APSD-capable access point. If the access point receives data
packets for the related devices thereafter, it temporarily stores the data and waits until the VoWLAN device is available
again. It then forwards the data. Afterwards, (U)APSD increases the latency time of the radio module, whereby it
ultimately consumes less power. The individual rest periods may be so short that a VoWLAN device can still use the
power saving function in the call state itself. However, the relevant devices must also support (U)APSD.
WWM (Wi-Fi Multimedia) Power Save is a power saving function of the Wi-Fi Alliance and is based on U-APSD.
Certain LANCOM access points are WMM® Power Save CERTIFIED by the Wi-Fi Alliance.
1
Only transmit unicasts, suppress broadcast and multicasts
Multicast and broadcast transmissions within a WLAN cell cause a load on the bandwidth of the cell, especially since
the WLAN clients often do not know how to handle these transmissions. The access point already intercepts a large
part of the multicast and broadcast transmissions in the cell with ARP spoofing. With the restriction to unicast
transmissions it filters out unnecessary IPv4 broadcasts from the requests, such as Bonjour or NetBIOS.
The suppression of multicast and broadcast transmissions is also a requirement from the HotSpot 2.0 specification.
13.17 Addition(s) to LCOS 8.84
13.17.1 LANCOM Active Radio Control (ARC)
The intelligent WLAN optimization concept behind LANCOM Active Radio Control (ARC) helps you to sustainably
optimize your radio field and proactively avoid sources of interference on the WLAN. Active Radio Control consists of
numerous complementary functions in the LANCOM operating system LCOS, which combine to significantly improve the
1042
Reference Manual
13 Wireless LAN (WLAN)
performance of your WLAN. All of the features in Active Radio Control are included for free in the LANCOM operating
system LCOS and they are easy to operate with the appropriate management tools.
RF optimization
Automatic selection of optimum WLAN channels: WLAN clients benefit from improved throughput thanks to
reduced channel overlap. In controller-based WLAN installations, the optimal channels are selected
automatically for managed access points.
For more information about RF optimization, see the relevant section of the Reference Manual.
Band steering
Make optimal use of your WLAN's bandwidth: Automatically controlled by the access point, clients steered
to the 5-GHz frequency band can effectively double the WLAN performance because only here are sufficient
channels available for channel bundling.
For more information about band steering, see the relevant section of the Reference Manual.
Adaptive noise immunity
Better WLAN throughput thanks to immunity to interfering signals: WLAN clients benefit from significantly
improved data throughput thanks to interference-free signal coverage. Enabling the adaptive noice immunity
allows an access point to block out interfering signals and to focus exclusively on WLAN clients with sufficient
signal strength.
For more information about adaptive noise immunity,
see the relevant section
of the Reference Manual.
Spectral scan
Check your WLAN radio spectrum for sources of interference: With LANCOM Spectral Scan, you have a
professional tool for efficient WLAN troubleshooting. A scan of the entire radio spectrum identifies sources
of interference from outside the WLAN and allows a graphical representation.
For more information about spectral scanning, see the relevant section of the Reference Manual.
13.17.2 Maximum EIRP value depends on the transmission standard
In order to comply with the maximum transmission power density defined by the 802.11b transmission standard, the
maximum available EIRP value is 18dBm. For the 802.11gn transmission standard, the EIRP value may not exceed 20dBm.
As of LCOS 8.84, the maximum EIRP value for any WLAN-enabled device from LANCOM automatically concurs with the
applicable transmission standard.
13.17.3 Adjusting the maximum transmit rate for multicasts and broadcasts
As of LCOS 8.84, the LANCOM can automatically adjust the broadcast and multicast transmission rates to that of the
access point with the lowest transmission rate.
Automatic adjustment of multicast and broadcast transmission rates
Whereas with unicast broadcasts the access point and client can negotiate the optimum transfer rate between them,
multicast and broadcast transmissions communicate in just one direction: From the access point to the client. The clients
cannot report back the access point with their actual maximum transmission speeds.
The access point has two options for setting the transmission rate for multicast and broadcast transmissions:
1
Fixed bit rate: The transfer rate is set so that the slowest client in the WLAN can receive error-free transmissions
even under unfavorable conditions. This can lead to the situation that the LANCOM transmits at a lower rate sends
than environmental conditions and the clients would actually allow. As a result, the access point slows down the
communications in the WLAN unnecessarily.
1
Automatic bit rate: By setting the transmission rate to auto, the access point collects information about the
transmission rates of the various WLAN clients. Clients automatically notify the access point of this rate with each
1043
Reference Manual
13 Wireless LAN (WLAN)
unicast communication. The access point takes the lowest transmission rate from the list of associated clients and
applies this to all multicast and broadcast transmissions.
Additions to the Setup menu
Basic rate
The basic rate is the transmission rate used by the LANCOM to send multicast and broadcast packets.
The rate defined here should allow the slowest clients to connect to the WLAN even under poor reception conditions. A
higher value should only be set here if all clients in this logical WLAN can be reached at this speed.
If you choose "Auto", the device automatically matches the transmission rate to the slowest WLAN client on your network.
Telnet path:
Setup > Interfaces > WLAN > Transmission
Possible values:
Auto
Select from the available speeds between 1Mbps and 54Mbps
Default:
2Mbps
Additions to the Status menu
Networks
Displays information about the WLAN interfaces of the device.
Telnet path:
Status > WLAN
Ifc
The name of the interface
Operating
Indicates whether the interface is enabled.
Network name
Displays the name of the network (SSID)
BSSID
MAC address of the access point for this WLAN
Radio mode
Displays the data transfer standard being used by the access point.
VLAN ID
Displays the VLAN ID of the interface.
Num. stations
Indicates how many stations are currently logged on to the access point.
1044
Reference Manual
13 Wireless LAN (WLAN)
MCast-Pwr-Save
Indicates whether the power-save mode is enabled.
APSD
Indicates whether APSD is activated or deactivated for the respective WLAN (SSID). APSD is only indicated
as active if it is activated in the settings for the logical WLAN and also if the general QoS module is activated.
Alarm state
Displays the alarm state of the interface.
Basic rate
Indicates the transmission rate for multicast and broadcast transmissions.
MAC filter
Indicates whether the MAC filter is enabled.
Access mode
Indicates whether the access point blocks or approves the stations entered in the access list.
13.17.4 IGMP snooping in auto mode
As of LCOS version 8.84, the bridge can automatically detect whether there is at least one querier in the network. Only
then can it learn the multicast-group memberships and forward the multicasts accordingly.
General settings
The configuration of the IGMP snooping in LANconfig is located under Interfaces > IGMP snooping
IGMP snooping module activated
Activates or deactivates IGMP snooping in the device and all of the defined querier instances. Without IGMP
snooping the bridge functions like a simple switch and forwards all multicasts to all ports.
Possible values:
1
Yes
1
No
1
Automatic
Default:
1
Automatic
With the setting Auto, the bridge only activates the IGMP snooping when there are also queriers in the
network.
1045
Reference Manual
13 Wireless LAN (WLAN)
5
If this function is deactivated, the bridge sends all IP multicast packets on all ports. If there is a change
of operating state, the bridge completely resets the IGMP snooping function, i.e. it clears all dynamically
learned values (memberships, router port properties).
Unregistered data packets
This setting defines the handling of multicast data packets with a destination address outside the 224.0.0.x
range and for which neither static memberships were defined nor were dynamic memberships learned.
Possible values:
1
Flood to router ports only: Sends these packets to all router ports.
1
Flood to all ports: Sends these packets to all ports.
1
Drop: Drops these packets.
Default:
1
Router ports only
Advertise interval
The interval in seconds in which devices send packets advertising themselves as multicast routers. This
information makes it quicker for other IGMP-snooping devices to find which of their ports are to operate as
router ports. When activating its ports, a switch (for example) can query for multicast routers, and the router
can respond to this query with an advertisement of this type. Under some circumstances this method can be
much quicker than the alternative IGMP queries.
Possible values:
1
4 to 180 seconds
Default:
1
20
Query interval
Interval in seconds in which a multicast-capable router (or a simulated querier) sends IGMP queries to the
multicast address 224.0.0.1, so prompting the stations to transmit return messages about multicast
group memberships. These regular queries influence the time in which the bridge ages, expires, and are
deletes the multicast group memberships.
1
After the startup phase, the querier sends IGMP queries in this interval.
1
A querier returns to the querier status after a time equal to
"Robustness*Query-Interval+(Query-Response-Interval/2)".
1
A port loses its router-port status after a time equal to
"Robustness*Query-Interval+(Query-Response-Interval/2)".
Possible values:
1
10-figure number greater than 0.
Default:
1
125
5
The query interval must be greater than the query response interval.
Query response interval
Interval in seconds influencing the timing between IGMP queries and router-port aging and/or memberships.
1046
Reference Manual
13 Wireless LAN (WLAN)
Interval in seconds in which a multicast-capable router (or a simulated querier) expects to receive responses
to its IGMP queries. These regular queries influence the time in which multicast group memberships are "aged"
and then deleted.
Possible values:
1
10-figure number greater than 0.
Default:
1
10
5
The query response interval must be less than the query interval.
Robustness
This value defined the robustness of the IGMP protocol. This option tolerates packet losses of IGMP queries
with respect to Join messages.
Possible values:
1
10-figure number greater than 0.
Default:
1
2
Port settings
This table is used to define the port-related settings for IGMP snooping.
Port
The port for which the settings apply.
Possible values:
1
Selects a port from the list of those available in the device.
Default:
1
N/A
Router port
This option defines the port's behavior.
Possible values:
1
Yes: This port will always work as a router port, irrespective of IGMP queries or router messages that the
bridge receives at this port.
1
No: This port will never work as a router port, irrespective of IGMP queries or router messages that the
bridge receives at this port.
1
Automatic: This port will work as a router port if IGMP queries or router messages are received. The port
loses this status if the bridge receives no packets for the duration of
"Robustness*Query-Interval+(Query-Response-Interval/2)".
1047
Reference Manual
13 Wireless LAN (WLAN)
Default:
1
Automatic
Static members
This table enables members to be defined manually, for example if they cannot or should not be learned automatically.
IP address
The IP address of the manually defined multicast group.
Possible values:
1
Valid IP multicast address.
Default:
1
0.0.0.0
VLAN-ID
The VLAN ID to which the bridge applies this static membership. You can enter multiple entries with different
VLAN IDs for each IP multicast address.
Possible values:
1
0 to 4096.
Default:
1
0
Special values:
1
If "0" is selected as VLAN, the IGMP queries are sent without a VLAN tag. For this reason, this value only
makes sense when VLAN is deactivated in general.
Learning allowed
This option activates the automatic learning of memberships in this multicast group. If automatic learning is
deactivated, the bridge only sends packets via the ports which have been manually defined for the multicast
group.
Possible values:
1
Activated
1
Deactivated
Default:
1
Activated
1048
Reference Manual
13 Wireless LAN (WLAN)
Static members
The bridge will always send packets with the corresponding IP multicast address to these ports, irrespective
of any Join messages received.
Possible values:
1
Comma-separated list of the desired ports, max. 215 alphanumerical characters.
Default:
1
Blank
Simulated queriers
This table contains all of the simulated queriers defined in the device. These units are employed if IGMP snooping
functions are required but there is no multicast router in the network. The querier can be limited to certain bridge groups
or VLANs if you define multiple independent queriers to support the corresponding VLAN IDs.
Entry active
Activates or deactivates the querier instance
Possible values:
1
Activated
1
Deactivated
Default:
1
Activated
Name
Name of the querier instance
Possible values:
1
8 alphanumerical characters.
Default:
1
Blank
Bridge group
Limits the querier instance to a certain bridge group.
Possible values:
1
Select from the list of available bridge groups.
1
None
Default:
1
BRG-1
1049
Reference Manual
13 Wireless LAN (WLAN)
Special values:
1
If bridge group is set to "none", the bridge sends all IGMP queries via all bridge groups.
VLAN-ID
Limits the querier instance to a certain VLAN.
Possible values:
1
0 to 4096
Default:
1
0
Special values:
1
If the VLAN ID is set to "0", the bridge sends the IGMP requests without a VLAN tag. For this reason, this
value only makes sense when VLAN is deactivated in general.
Additions to the Setup menu
Operating
Activates or deactivates IGMP snooping in the device and all of the defined querier instances. Without IGMP snooping
the bridge functions like a simple switch and forwards all multicasts to all ports.
5
If this function is deactivated, the bridge sends all IP multicast packets on all ports. If there is a change of
operating state, the device completely resets the IGMP snooping function, i.e. it clears all dynamically learned
values (memberships, router port properties).
Telnet path:
Setup > LAN-Bridge > IGMP-Snooping
Possible values:
No
Yes
Auto
Default:
No
13.17.5 Converting DHCP responses from broadcast to unicast
To improve the reliability of the delivery of DHCP responses on the WLAN, LCOS versions 8.84 and later give you the
option to convert data packets which were sent as a broadcast (and which have no specific addressee, do not use
optimized transmission techniques such as ARP spoofing or IGMP/MLD snooping, and have a low data rate) into unicast
data packets.
To achieve this in LANconfig, use the setting Convert broadcast DHCP responses to unicast in the dialog Wireless
LAN > General > Logical WLAN settings > WLAN network [...] > Transmission.
4
This function is already an integral part of the setting Only transmit unicasts, suppress broadcast and
multicasts and does not need to be activated explicitly.
1050
Reference Manual
13 Wireless LAN (WLAN)
Additions to the Setup menu
Convert to unicast
Using this parameter you specify which type of data packets, which have been sent as a broadcast, are automatically
converted into unicast by the device within a WLAN network.
Telnet path:
Setup > Interfaces > WLAN > Transmission
Possible values:
1
No selection
1
DHCP: Response messages sent from the DHCP server as a broadcast are converted into unicasts. This
form of message delivery is more reliable because data packets sent as a broadcast have no specific
addressee, they do not use optimized transmission techniques such as ARP spoofing or IGMP/MLD snooping,
and they have a low data rate.
Default:
DHCP
13.17.6 Adaptive noise immunity to reduce interference on the WLAN
As of LCOS version 8.84, LANCOM access points are equipped with adaptive noise immunity (ANI), which compensates
for various types of interference on the wireless network.
Enhancements to LANconfig
Adaptive noise immunity for reducing interference on the WLAN
A wireless LAN can be subjected to interference from various sources. Devices such as microwave ovens or cordless
phones interfere with data transmission, and even the network devices themselves can emit interference and hinder
communications. Each type of interference has its own characteristics. Adaptive noise immunity (ANI) enables the access
point to use different error conditions to determine the best way to compensate for the interference. By automatically
increasing noise immunity, the size of the radio cell can be reduced to mitigate the impact of interference on the data
transfer.
The current values and any previous actions are to be found in WEBconfig under Status > WLAN > Noise-Immunity.
1051
Reference Manual
13 Wireless LAN (WLAN)
You can enable adaptive noise immunity in LANconfig under Wireless LAN > General > Interfaces > Physical WLAN
settings.
To enable the adaptive noise immunity function, go to the Radio tab and set the value in the selection field Adaptive
noise immunity to "On".
5
Adaptive noise immunity is a component of
LANCOM Active Radio Control (ARC)
Additions to the Setup menu
Adaptive noise immunity
A wireless LAN can be subjected to interference from various sources. Devices such as microwave ovens or cordless
phones interfere with data transmission, and even the network devices themselves can emit interference and hinder
communications. Each type of interference has its own characteristics. Adaptive noise immunity (ANI) enables the access
point to use different error conditions to determine the best way to compensate for the interference. By automatically
increasing noise immunity, the size of the radio cell can be reduced to mitigate the impact of interference on the data
transfer.
The current values and any previous actions are to be found under Status > WLAN > Noise-Immunity.
Telnet path:
Setup > Interfaces > WLAN > Radio-settings
Possible values:
No
Yes
Default:
Yes
1052
Reference Manual
13 Wireless LAN (WLAN)
Additions to the Status menu
Noise immunity
This directory contains current measurements of the WLAN values and the records of past events.
Telnet path:
Status > WLAN
Current parameters
This table shows the current ANI parameters for all bands and radio channels.
5
If adaptive noise immunity is disabled, the table contains either the default values after the initialization of the
WLAN interface or the manually preset values.
Telnet path:
Status > WLAN > Noise-immunity
Band
Indicates the radio band on which the access point is measuring the current parameters. Possible values are:
1
2.4 GHz
1
5 GHz
Radio channel
Displays the radio channels available in the corresponding band.
Interface
Indicates the WLAN interface on which the access point is measuring the current parameters.
Age
Indicates the age of the measurement.
Noise immunity level
Shows the level of noise immunity. The higher the value, the more "immune" the access point is to interference.
The range of values depends on the radio module being used.
Spurious immunity level
Parameter for internal use by the WLAN module.
Fir step level
Parameter for internal use by the WLAN module.
OFDM weak signal detection
Parameter for internal use by the WLAN module.
CCK weak signal detection threshold
Parameter for internal use by the WLAN module.
MRC-CCK
Parameter for internal use by the WLAN module.
The range of values for the individual measurements depends on the radio module being used. Information about which
radio module is installed in your device is displayed in the status menu WLAN > Interfaces > Card ID.
1053
Reference Manual
13 Wireless LAN (WLAN)
MRC-CCKSpurious
immunity
Fir step
level
CCK weak signal
detection threshold
OFDM weak signal
detection
Noise
immunity
Radio module chipset
Blank0 to 70 to 30, 10, 10 to 4AR5212/5213/2414/5414
Blank0 to 70 to 30, 10, 10 to 4AR9160/9280
0, 10 to 70 to 80, 10, 1BlankAR9380/9382/9390
Log table
This table shows the recorded ANI events per band, channel and WLAN interface.
Under extreme conditions (very strong or very weak interference) the parameters can reach their maximum values. Even
if the interference levels change within these extremes, the access point writes this maximum value to the table just
once.
Telnet path:
Status > WLAN > Noise-immunity
Index
Contains the sequential number of the entry
Time
The time of the log entry.
Interface
Displays the WLAN interface where the event or action occurred.
Band
Shows the band that the event applied to.
Radio channel
Shows the radio channel that the event applied to.
Event
Displays the changes to the ANI parameters. Possible values are:
1
Min. immunity:
1
Value change:
Parameters
Parameter for internal use by the WLAN module.
Value
Parameter for internal use by the WLAN module.
13.17.7 Opportunistic key caching
As of version 8.84, LCOS uses opportunistic key caching to facilitate WPA2-Enterprise encryption and speed up WLAN
roaming.
Opportunistic key caching (OKC)
Authentication of wireless clients using EAP and 802.11X has become standard in corporate networks, and these methods
are becoming even more widespread with the integration of the Hotspot 2.0 specification for public Internet access. The
disadvantage of 802.11X authentication is the significantly longer time between login and connection, because up to
twelve data packets have to be exchanged between the WLAN client and the access point. For most applications, which
1054
Reference Manual
13 Wireless LAN (WLAN)
are all about data exchange, this may not be particularly important. However, for time-critical applications such as Voice
over IP, it is important that the authentication at neighboring WLAN radio cells does not affect communication.
To counteract this, authentication strategies such as PMK caching and pre-authentication have become established,
although pre-authentication does not fix all of the problems. On the one hand, there is no guarantee that the WLAN
client can recognize whether the access point can perform pre-authentication. On the other hand, pre-authentication
causes considerable load on the RADIUS server, which needs to handle the authentication of all clients and all access
points in the WLAN.
Opportunistic key caching delegates the key management to a WLAN controller, or to a central switch, which manages
all of the access points in the network. If a client logs on to an access point, the WLAN controller behind it works as an
authenticator to manage the keys and send the PMK to the access point, which is ultimately received by the client. If
the client moves to another cell, it uses this PMK and the MAC address of the new access point to calculate a PMKID.
It then send this to the new access point in the hope that OKC is enabled there (therefore "opportunistic"). If the access
point cannot handle the PMKID, then it negotiates an 802.11X authentication with the client in the usual manner.
A LANCOM access point can even perform OKC if the WLAN controller is temporarily unavailable. In this case, it stores
the PMK and sends this to the WLAN controller when it becomes available again. Ultimately it sends the PMK to all of
the access points in the network, which allows clients to use OKC to login after a change of radio cell.
Enhancements to LANconfig
Logical WLAN networks
Under WLAN Controller > Profiles > Logical WLAN networks you can set the logical WLAN network parameters,
which the WLAN controller is to assign to the access points. The following parameters can be defined for each logical
WLAN network:
Logical WLAN network activated
Enable the logical WLAN network by clicking on this option.
Name
Here, specify a name which uniquely identifies the logical WLAN network.
1055
Reference Manual
13 Wireless LAN (WLAN)
Inheritance
If you wish to create entries that differ only slightly from existing ones, you can choose a "parent" entry here
and select the parameters which are to be applied each time it is used.
5
A "parent" entry itself can contain inherited entries. Try to ensure that the structure of inherited entries
is not too complex, otherwise they may be difficult to understand and configure.
Network name (SSID)
Enter the SSID of the WLAN network here. All stations that belong to this WLAN network must use the same
SSID.
SSID connect to
Here you select which of the access point's logical interfaces is to be associated with the SSID, i.e. where the
access point sends the data packets for this SSID.
1
"LAN": The access point forwards the data packets locally into the LAN (LAN-1) by default. It must be
configured appropriately to do this.
1
"WLC-Tunnel-x": The SSID is connected to a WLC bridge layer-3 tunnel. The access point sends all data
packets to this tunnel and thus to the WLC. This tunnel must be configured on the WLC.
5
Note that although forwarding all data packets to the WLC allows you to define routes and filters
centrally, this creates a heavy load on the WLAN controller This model demands a correspondingly
high bandwidth in order to transfer all of the data traffic of this and any other SSIDs that are connected
to this WLAN controller via WLC tunnel.
VLAN mode
This item sets the access point VLAN mode for packets belonging to this WLAN network (SSID). VLAN IDs are
used if the VLAN module is enabled in the physical WLAN parameters of the access point. Otherwise the
access point ignores all VLAN settings in the logical networks. Even with VLAN activated, it is possible to
operate the network untagged.
1
"Untagged": The access point does not tag data packets from this SSID with a VLAN ID.
5
Even with VLAN activated, it is possible to operate a WLAN network untagged. The VLAN ID '1'
is reserved internally for this.
1
"Tagged": The access point marks the data packets with the VLAN ID specified as follows.
VLAN-ID
VLAN ID for this logical WLAN network
5
Please note that to use VLAN IDs in a logical WLAN network, you must set up a management VLAN
ID (see physical WLAN parameters).
Encryption
This item sets the encryption method or, in the case of WEP, the key length for packet encryption in this
WLAN.
Key 1/passphrase
You can enter the key or passphrase as an ASCII character string. An option for WEP is to enter a hexadecimal
number by adding a leading "0x". The following character string lengths result for the formats used:
1
WPA-PSK: 8 to 63 ASCII characters
1
WEP128 (104 bit): 13 ASCII or 26 hex characters
1
WEP64 (40 bit): 5 ASCII or 10 hex characters
1056
Reference Manual
13 Wireless LAN (WLAN)
RADIUS profile
Specify which RADIUS profile the access point should receive for this network, so that it can connect directly
to the RADIUS server if necessary. Leave this field blank if the WLAN controller is to handle RADIUS requests.
5
You configure the RADIUS profiles in the corresponding table.
Allowed frequency bands
Here you set the frequency band used by network participants for transmitting data on the wireless network.
You can select the 2.4-GHz band, the 5-GHz band, or both bands.
AP standalone time
The time in minutes that a managed-mode access point continues to operate in its current configuration.
The configuration is provided to the access point by the WLAN controller and is optionally stored in flash
memory (in an area that is not accessible to LANconfig or other tools). Should the connection to the WLAN
controller be interrupted, the access point will continue to operate with the configuration stored in flash for
the time period entered here. The access point can also continue to work with this flash configuration after
a local power outage.
If there is no connection to the WLAN controller after this time period has expired then the flash configuration
is deleted and the access point goes out of operation. As soon as the WLAN controller is available, the WLAN
controller transmits the configuration to the access point again.
This represents an effective measure against theft as the access point deletes all security-related configuration
parameters after this time has expired.
5
If the access point establishes a backup connection to a secondary WLAN controller, then the
countdown to the expiry of standalone operation is halted. The access point and its WLAN networks
remain active as long as it has a connection to a WLAN controller.
5
Please note that the access point only deletes the configuration in flash memory after the time for
standalone operation has expired, and not when the power is lost!
802.11u network profile
Select the Hotspot 2.0 profile from the list.
OKC activated
This option enables the opportunistic key caching. OKC makes it easy for WLAN clients to quickly and
conveniently roam between WLAN cells in wireless environments with WPA2-Enterprise encryption.
MAC check activated
The MAC addresses of the clients that are allowed to associate with an access point are stored in the MAC
filter list (Wireless LAN > Stations > Stations). The MAC filter enabled switch allows you to switch off
the use of the MAC filter list for individual logical networks.
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be
contacted by any mobile station in the area. Your wireless LAN is put into private mode by activating the
closed network function. In this operation mode, mobile stations that do not know the network name (SSID)
are excluded from taking part in the wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented
from associating with your network.
The option Suppress SSID broadcast provides the following settings:
1
No: The access point publishes the SSID of the cell. When a client sends a probe request with an empty
or incorrect SSID, the access point responds with the SSID of the radio cell (public WLAN).
1057
Reference Manual
13 Wireless LAN (WLAN)
1
Yes: The access point does not publish the SSID of the cell. When a client sends a probe request with an
empty SSID, the device similarly responds with an empty SSID.
1
Tightened: The access point does not publish the SSID of the cell. When a client sends a probe request
with a blank or incorrect SSID, the device does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN
clients associate with the access point, this transmits the SSID in plain text so that it is briefly visible
to all clients in the WLAN network.
RADIUS accounting activated
Select this option if you want to enable the RADIUS accounting in this logical WLAN network.
Allow traffic between stations of this SSID
Check this option if all stations logged on to this SSID are to be able to communicate with one another.
WPA version
Here you select which WPA version the access point is to offer to the WLAN clients for encryption.
1
WPA1: WPA2 only
1
WPA2: WPA2 only
1
WPA1/2: WPA1 and WPA2 in one SSID (radio cell)
WPA1 session key type
If you use "802.11i (WPA)-PSK" for encryption, the method for generating a WPA1 session or group key can
be selected here:
1
AES: The access point uses the AES method.
1
TKIP: The access point uses the TKIP method.
1
AES/TKIP: The access point uses the AES method. If the client hardware does not support the AES method,
the access point will change to the TKIP method.
WPA2 session key type
The method for generating a WPA2 session or group key can be selected here.
Basis rate
The defined basis rate should allow the slowest clients to connect to the WLAN even under poor reception
conditions. A higher value should only be set here if all clients in this logical WLAN can be reached "faster".
By setting the transmission rate to auto, the access point collects information about the transmission rates
of the various WLAN clients. Clients automatically notify the access point of this rate with each unicast
communication. The access point takes the lowest transmission rate from the list of associated clients and
applies this to all multicast and broadcast transmissions.
Client-bridge support.
Enable this option for an access point if you have enabled the client-bridge support for a client station in
WLAN client mode ().
5
The client-bridge mode operates between two LANCOM devices only.
Maximum count of clients
Here you set the maximum number of clients that may associate with this access point. Additional clients
wanting to associate will be rejected by the access point.
1058
Reference Manual
13 Wireless LAN (WLAN)
Minimum client signal strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on.
If the client's signal strength is below this value, the access point stops sending probe responses and discards
the client's requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures
that the client has an optimized list of available access points, as those offering only a weak connection at
the client's current position are not listed.
Use long preamble for 802.11b
Normally, the clients in 802.11b mode negotiate the length of the preamble with the access point. "Long
preamble" should only be set when the clients require this setting to be fixed.
Max. spatial streams
The spatial multiplexing function allows the access point to transmit multiple data streams over separate
antennas in order to increase the data throughput. The use of this function is only recommended when the
remote device can process the data streams with corresponding antennas.
5
In the 'Auto' setting, the access point uses all of the spatial streams supported by this WLAN module.
Allow short guard interval
This option is used to reduce the transmission pause between two signals from 0.8 µs (default) to 0.4 µs
(short guard interval). This increases the effective time available for data transmission and thus the data
throughput. However, the wireless LAN system becomes more liable to disruption that can be caused by
interference between two consecutive signals.
The short guard interval is activated in automatic mode, provided that the remote station supports this.
Alternatively the short guard mode can be switched off.
Use frame aggregation
Frame aggregation is used to combine several data packets (frames) into one large packet and transmit them
together. This procedure reduces the overhead of the packets to increase the throughput.
Frame aggregation is not suitable when working with mobile receivers or time-critical data transmissions
such as voice over IP.
STBC (space time block coding) activated
Activate the space time block coding here.
The function 'STBC' additionally varies the transmission of data packets over time to minimize time-related
effects on the data. Due to the time offset of the packets the recipient has an even better chance of receiving
error-free data packets, regardless of the number of antennas.
LDPC (low density parity check) activated
Activate the low density parity check here.
Before the sender transmits the data packets, it expands the data stream with checksum bits depending on
the modulation rate. These checksum bits allow the receiver to correct transmission errors. By default the
802.11n standard uses 'Convolution Coding' (CC) for error correction, which is well-known from 802.11a and
802.11g; however, the 11n standard also provides for error correction according to the LDPC method (Low
Density Parity Check).
In contrast to CC encoding, LDPC encoding uses larger packets to calculate checksums and can also recognize
more bit errors. The improved ratio of payload to checksum data enables LDPC encoding to provide a higher
data transfer rate.
1059
Reference Manual
13 Wireless LAN (WLAN)
Additions to the Setup menu
OKC
Opportunistic key caching delegates the management of the WLAN client keys to a WLAN controller, or to a central
switch, which manages all of the access points in the network. If a client logs on to an access point, the WLAN controller
behind it works as an authenticator to manage the keys and send the PMK to the access point, which is ultimately
received by the client. If the client moves to another cell, it uses this PMK and the MAC address of the new access point
to calculate a PMKID. It then send this to the new access point in the hope that OKC is enabled there (therefore
"opportunistic"). If the access point cannot handle the PMKID, then it negotiates an 802.11X authentication with the
client in the usual manner.
A LANCOM access point can even perform OKC if the WLAN controller is temporarily unavailable. In this case, it stores
the PMK and sends this to the WLAN controller when it becomes available again. Ultimately it sends the PMK to all of
the access points in the network, which allows clients to use OKC to login after a change of radio cell.
This setting enables OKC on the access point that is being managed by the WLAN controller.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
Yes
No
Default:
Yes
Additions to the Status menu
Contents
This table contains all entries of the PMK caches.
Telnet path:
Status > WLAN > PMK-Caching > Content
Authenticator
This entry contains the MAC address of the authenticating access points.
Supplicant
This entry contains the MAC address of the authenticating WLAN client.
Source
This entry indicates how the WLAN client obtained the PMK:
1
Unknown: The source is unknown. This entry should not occur in normal operation.
1
Authentication: PMK is the result of a normal 802.1x-authentication between WLAN client and access
point.
1
Pre-authentication: PMK is the result of a normal 802.1x-pre-authentication between the WLAN client
and another access point.
OKC: The PMK results from opportunistic key caching.
User name
This entry contains the user name, which the RADIUS server sends to the access point for access permission.
1060
Reference Manual
13 Wireless LAN (WLAN)
5
If the RADIUS server does not transmit a user name, this field is left blank.
VLAN ID
This entry contains the VLAN-ID, which the RADIUS server sends to the access point for access permission.
5
If the RADIUS server does not transmit a VLAN-ID, this field is left blank.
Lifetime
This entry contains the lifetime of the PMKs in seconds. It is calculated from the validity of the session, which
the RADIUS server transmitted with the access permission.
The value is 0 seconds if the RADIUS server did not transmit a duration or the PMK does not have a validity
period.
Expired
This entry shows whether a PMK has expired. If this is the case, the access point no longer accepts PMK-caching
or authentication attempts with this PMK. Instead, it will launch a new 802.1x authentication.
Encryption
This table contains information about the encryption on each interface.
Telnet path:
Status > WLAN
Interface
Name of interface
Encryption
Displays whether encryption is enabled for this interface.
Method
Displays the encryption method. If encryption is not enabled, this column contains the value "None"
WPA version
Displays the WPA encryption version.
WPA1 session key types
Displays the log for the WPA1 session key.
WPA2 session key types
Displays the log for the WPA2 session key.
PMK caching
Indicates whether the PMK caching (pairwise master key storage) is enabled on the interface.
Pre-authentication
Indicates whether pre-authentication is enabled on this interface.
OKC
Indicates whether the opportunistic key caching is enabled on this interface.
1061
Reference Manual
13 Wireless LAN (WLAN)
13.17.8 Feature enhancement of the WLC tunnel interface
WLC tunnel interfaces provide "virtual" Ethernet interfaces, which so far had some limitations in comparison with physical
Ethernet interfaces. As of LCOS version 8.84, WLC tunnel interfaces additionally support the following features:
1
You can set a bandwidth limit per user.
1
VRRP works (entry of additional MAC addresses)
1
You can set a VLAN-ID for each user.
13.17.9 Support for 802.11u/HotSpot 2.0 on WLAN controllers
With LCOS 8.84, WLAN controllers gain the IEEE 802.11u/Hotspot 2.0 functions that were introduced for access points
with LCOS 8.82. Controllers use profiles to configure and assign these functions to the access points managed by them.
The options in the settings correspond to those of the access points.
Additions to the Status menu
IEEE802.11u
This menu shows the full range of IEEE802.11u or Hotspot-2.0 settings assigned to the device by the WLC.
Telnet path:
Setup > WLAN-Management
Network profiles
This table shows the network profile or 802.11u profile that has been assigned to the device by the WLC.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the network profile or 802.11u profile
Operating
Indicates whether support for IEEE 802.11u connections is enabled for this profile
Hotspot2.0
Indicates whether support for Hotspot2.0 connections is enabled for this profile
Internet
Indicates whether the Internet bit is set for this profile
Network type
The type of network that the logical WLAN network most closely characterizes (e.g. private, public, access
with or without authorization, etc.)
Asra
Indicates whether the Asra bit is set for this profile
HESSID type
Indicates the source of the MAC address for the HESSID. Possible values are:
1
Auto: Automatic calculation of the HESSID by the WLC
1
User: Manual allocation of HESSID by the network administrator
1
None: No HESSID available
1062
Reference Manual
13 Wireless LAN (WLAN)
HESSID-MAC
MAC address of the HESSID
ANQP profile
ANQP profile used on the WLC for the 802.11u profile
HS20 profile
Hotspot2.0 or SH20 profile used on the WLC for the 802.11u profile
ANQP profiles
This table shows the ANQP profile assigned to the device by the WLC.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the ANQP profile
Include in beacon OUI
Organizationally unique identifier (abbreviated as OUI and simplified to OI) broadcast by an access point in
its beacons
Additional OUI
OI(s) additionally broadcast by an access point after a GAS request from a station
Domain list
List of domains which a hotspot belongs to
NAI realm list
Allocated NAI realm profile
Cellular list
Assigned cellular network profile
Network auth type list
Assigned authentication parameters
Hotspot2.0 profiles
This table shows the Hotspot-2.0 profile assigned to the device by the WLC.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the Hotspot2.0 profile
Operator name
Assigned profile list for hotspot operators
Connection capabilities
Assigned connection capabilities
1063
Reference Manual
13 Wireless LAN (WLAN)
Operating class
Code for the global operating class of the managed access points
Network authentication type
This table shows the network authentication type profile assigned to the device by the WLC for the ANQP profile.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the network authentication type profile
Network auth type
Context to which the redirect applies
Redirect URL
Address to which the device redirects stations for an additional authentication step after the station has been
successfully authenticated by the hotspot operator or any of its roaming partners.
Cellular network information list
This table shows the cellular network profile assigned to the device by the WLC for the ANQP profile.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the cellular network profile
Country code
Assigned mobile country code (MCC) of the hotspot operator or its roaming partners
Network code
Assigned mobile network code (MNC) of the hotspot operator or its roaming partners
Venue name
This table shows the venue name profile (used to manage information about the location of the access point) assigned
to the device by the WLC.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the venue name profile
Language
Language in which the site information is stored
Venue name
Description of the location of the device
1064
Reference Manual
13 Wireless LAN (WLAN)
NAI realms
This table shows the NAI realm profile assigned to the device by the WLC for the ANQP profile.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the NAI realm profile
NAI realm
Assigned realm for the WLAN network
EAP method
Assigned authentication method for the NAI realm
Auth parameter list
Assigned authentication parameters for the EAP method
Operator list
This table shows the operator profile assigned to the device by the WLC for the Hotspot2.0 profile.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the operator profile
Language
Assigned language for hotspot operators
Operator name
Assigned plain text name of the hotspot operator
General
This table shows the location profile assigned to the device by the WLC.
Telnet path:
Setup > WLAN-Management > IEEE802.11u
Name
Name of the location profile
Link status
Internet connectivity status of the managed access point
Downlink speed
Nominal value of the downlink bandwidth
Uplink speed
Nominal value of the uplink bandwidth
1065
Reference Manual
13 Wireless LAN (WLAN)
IPv4 addr type
Information for an IEEE 802.11u-capable station about the availability of IPv4 address space
IPv6 addr type
Information for an IEEE 802.11u-capable station about the availability of IPv6 address space
Venue group
Assigned venue group
Venue type
Assigned venue type code
Venue name
Assigned venue name profile (used to manage information about the location of the access point)
IEEE802.11u
This menu shows the IEEE802.11u or Hotspot-2.0 settings that are currently assigned by the device to the managed
access points.
Telnet path:
Setup > WLAN-Management > AP-Configuration
Network profiles
This table shows the different network profiles currently assigned by the device to the managed access points for the
logical WLAN networks, by means of the 802.11u profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the network or 802.11u profile
Operating
Indicates whether IEEE 802.11u connection support is enabled for this profile
Hotspot2.0
Indicates whether Hotspot-2.0 connection support is enabled for this profile
Internet
Indicates whether the Internet bit is set for this profile
Network type
Type that most closely characterizes the logical WLAN network (e.g. private, public, access with or without
authorization, etc.)
Asra
Indicates whether the Asra bit is set for this profile
HESSID type
Indicates the source of the MAC address for the HESSID. Possible values are:
1
Auto: Automatic calculation of the HESSID by the WLC
1
User: Manual allocation of HESSID by the network administrator
1
None: No HESSID available
1066
Reference Manual
13 Wireless LAN (WLAN)
HESSID-MAC
MAC address of the HESSID
ANQP profile
ANQP profile used for the 802.11u profile
HS20 profile
Hotspot-2.0 or HS20 profile used for the 802.11u profile
ANQP profiles
This table shows the different ANQP profiles currently assigned by the device to the managed access points for the logical
WLAN networks, by means of the network- or 802.11u profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the ANQP profile
Include in beacon OUI
Organizationally unique identifier (abbreviated as OUI and simplified to OI) broadcast by an access point in
its beacons
Additional OUI
OI(s) additionally broadcast by an access point after a GAS request from a station
Domain list
List of domains which a hotspot belongs to
NAI realm list
Allocated NAI realm profile
Cellular list
Assigned cellular network profile
Network auth type list
Assigned authentication parameters
Hotspot2.0 profiles
This table shows the different Hotspot2.0 profiles currently assigned by the device to the managed access points for the
logical WLAN networks, by means of the network- or 802.11u profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the Hotspot2.0 profile
Operator name
Assigned profile list for hotspot operators
Connection capabilities
Assigned connection capabilities
1067
Reference Manual
13 Wireless LAN (WLAN)
Operating class
Code for the global operating class of the managed access points
Network authentication type
This table shows the individual network authentication type profiles that are currently used by the device for one or more
ANQP profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the network authentication type profile
Network auth type
Context to which the redirect applies
Redirect URL
Address to which the device redirects stations for an additional authentication step after the station has been
successfully authenticated by the hotspot operator or any of its roaming partners.
Cellular network information list
This table shows the cellular network profiles that are currently used by the device for one or more ANQP profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the cellular network profile
Country code
Assigned mobile country code (MCC) of the hotspot operator or its roaming partners
Network code
Assigned mobile network code (MNC) of the hotspot operator or its roaming partners
Venue-Name
This table shows the venue name profiles (used to manage information about the location of the access point) used by
the device for one or more venue profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the venue name profile
Language
Language in which the site information is stored
1068
Reference Manual
13 Wireless LAN (WLAN)
Venue name
Description of the location of the device
NAI-Realms
This table shows the individual NAI profiles that are currently used by the device for one or more ANQP profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the NAI realm profile
NAI realm
Assigned realm for the WLAN network
EAP method
Assigned authentication method for the NAI realm
Auth parameter list
Assigned authentication parameters for the EAP method
Operator-List
This table shows the individual operator profiles that are currently used by the device for one or more Hotspot2.0 profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the operator profile
Language
Assigned language for hotspot operators
Operator name
Assigned plain text name of the hotspot operator
General
This table shows the individual venue profiles that are currently used by the device for one or more WLAN profiles.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Name of the location profile
Link status
Internet connectivity status of the managed access point
Downlink speed
Nominal value of the downlink bandwidth
1069
Reference Manual
13 Wireless LAN (WLAN)
Uplink speed
Nominal value of the uplink bandwidth
IPv4 addr type
Information for an IEEE 802.11u-capable station about the availability of IPv4 address space
IPv6 addr type
Information for an IEEE 802.11u-capable station about the availability of IPv6 address space
Venue group
Assigned venue group
Venue type
Assigned venue type code
Venue name
Assigned venue name profile (used to manage information about the location of the access point)
Additions to the Setup menu
IEEE802.11u
The tables and parameters in this menu are used to make all settings for connections according to IEEE 802.11u and
Hotspot 2.0. With the use of profiles, these settings can be be assigned the access points connected to the WLAN
controller.
Telnet path:
Setup > WLAN-Management > AP-Configuration
ANQP profiles
Using this table you manage the profile lists for IEEE802.11u and ANQP. IEEE802.11u profiles offers you the ability to
group certain ANQP elements and to independently assign logical WLAN interfaces in the table Network profiles. These
elements include, for example, information about your OIs, domains, roaming partners and their authentication methods.
Some of the elements are located in other profile lists.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the ANQP 2.0 profile here. You specify this name later in the table Network profiles under ANQP
profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
String, max. 32 characters
1070
Reference Manual
13 Wireless LAN (WLAN)
Default:
Include-in-Beacon-OUI
Organizationally Unique Identifier, abbreviated as OUI, simplified as OI. As the hotspot operator, you enter the OI of the
roaming partner with whom you have agreed a contract. If you are the hotspot operator as well as the service provider,
enter the OI of your roaming consortium or your own OI. A roaming consortium consists of a group of service providers
which have entered into mutual agreements regarding roaming. In order to get an OI, this type of consortium – as well
as an individual service provider – must register with IEEE.
It is possible to specify up to 3 parallel OIs, in case you, as the operator, have roaming agreements with several partners.
Multiple OIs can be provided in a comma-separated list, such as 00105E,00017D,00501A.
5
This device transmits the specified OI(s) in its beacons. If a device should transmit more than 3 OIs, these can
be configured under Additional-OUI. However, additional OIs are not transferred to a station until after the
GAS request. They are not immediately visible to the stations!
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
OI, max. 65 characters. Multiple OIs can be provided in a comma-separated list.
Default:
Additional-OUI
Enter the OI(s) that the device also sends to a station after a GAS request. Multiple OIs can be provided in a
comma-separated list, such as 00105E,00017D,00501A.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
OI, max. 65 characters. Multiple OIs can be provided in a comma-separated list.
Default:
Domain-List
Enter one or more domains that are available to you as a hotspot operator. Multiple domain names are separated by a
comma separated list, such as providerX.org,provx-mobile.com,wifi.mnc410.provX.com.
For subdomains it is sufficient to specify only the highest qualified domain name. If a user configured a home provider
on his device, e.g., providerX.org, this domain is also assigned to access points with the domain name wi-fi.providerX.org.
When searching for suitable hotspots, a station always prefers a hotspot from his home provider in order to avoid possible
roaming costs.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
OI, max. 65 characters. Multiple OIs can be provided in a comma-separated list.
1071
Reference Manual
13 Wireless LAN (WLAN)
Default:
NAI-Realm-List
Enter a valid NAI realm profile in this field.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > NIA-Realms,
max. 65 characters Multiple names can be provided in a comma-separated list.
Default:
Cellular-List
Enter a valid cellular network profile in this field.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
Cellular-Network-Information-List, max. 65 characters Multiple names can be provided in a
comma-separated list.
Default:
Network-Auth-Type-List
Enter one or more valid authentication parameters in this field.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
Network-Authentication-Type, max. 65 characters Multiple names can be provided in a comma-separated
list.
Default:
Auth-Parameter
This table contains a set list of possible authentication parameters for the NAI realms, as referenced by a comma-separated
list in the table NAI realms in the input field Auth parameter.
Table 8: Overview of possible authentication parameters
CommentSub-parametersParameters
Identifies the protocol that the realm requires for phase 2
authentication:
NonEAPAuth.
Password Authentication ProtocolPAP
1072
Reference Manual
13 Wireless LAN (WLAN)
CommentSub-parametersParameters
Challenge Handshake Authentication Protocol, original CHAP
implementation, specified in RFC 1994
CHAP
Implementation of Microsoft CHAP V1, specified in RFC 2433MSCHAP
Implementation of Microsoft CHAP V2, specified in RFC 2759MSCHAPV2
Describes the type of authentication that the realm accepts:Credentials.
SIM cardSIM
USIM cardUSIM
NFC chipNFCSecure
Hardware tokenHWToken*
Software tokenSoftToken*
Digital certificateCertificate
Username and passwordUserPass
No credentials requiredNone
TunnelEAPCredentials.*
SIM cardSIM*
USIM cardUSIM*
NFC chipNFCSecure*
Hardware tokenHWToken*
Software tokenSoftToken*
Digital certificateCertificate*
Username and passwordUserPass*
Anonymous loginAnonymous*
*) The specific parameter or sub-parameter is reserved for future uses within the framework of Passpoint™ certification,
but currently is not in use.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
This entry displays the name of the authentication parameters that you referenced as a comma-separated list in the table
NAI-Realms in the input field Auth-Parameter.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Auth-Parameter
Cellular network information list
Using this table, you manage the profile lists for the cellular networks. With these lists you have the ability to group
certain ANQP elements. These include the network and country codes of the hotspot operator and its roaming partners.
Based on the information stored here, stations with SIM or USIM cards use this list to determine if the hotspot operator
belongs to their cellular network company or has a roaming agreement with their cellular network company.
In the setup menu you use the ANQP-Profiles table to assign this list to an ANQP profile.
1073
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the cellular network profile, such as an abbreviation of the network operator in combination with the
cellular network standard used. You specify this name later in the table ANQP profiles under Cellular-List.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Cellular-Network-Information-List
Possible values:
String, max. 32 characters
Default:
Country-Code
Enter the Mobile Country Code (MCC) of the hotspot operator or its roaming partners, consisting of 2 or 3 characters,
e.g., 262 for Germany.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Cellular-Network-Information-List
Possible values:
Valid MCC, max. 3 characters
Default:
Network-Code
Enter the Mobile Network Code (MNC) of the hotspot operator or its roaming partners, consisting of 2 or 3 characters.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Cellular-Network-Information-List
Possible values:
Valid MNC, max. 32 characters
Default:
Connection capability
This table contains a set list of possible connection capabilities, as referenced by a comma-separated list in the table
Hotspot2.0 profiles in the input field Connection-Capabilities. Possible status values for each of these services are
'closed' (-C), 'Open' (-O) or 'unknown' (-U):
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
This entry displays the name of the connection capability that you referenced as a comma-separated list in the table
Hotspot2.0-Profiles in the input field Connection-Capabilities.
1074
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Connection-Capability
General
This table is used to manage the general settings for IEEE 802.11u/Hotspot 2.0.
On a standalone access point, there settings exist in the form of separate parameters. On a WLAN controller, these
parameters are summarized into tables, which are subsequently assigned to the managed access points by means of
the WLAN profile (the Common profiles table).
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the general settings profile here. You specify this name later in the table Setup >
WLAN-Management > AP-Configuration > Common-Profiles under Hotspot2.0-General an.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
String, max. 32 characters
Default:
Link-Status
Using this entry, you specify the connectivity status of your device to the Internet.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
1
Auto: The device determines the status value for this parameter automatically
1
Link-Up: The connection to the Internet is established.
1
Link-Down: The connection to the Internet is interrupted.
1
Link-Test: The connection to the Internet is being established or is being checked.
Default:
Auto
Downlink-Speed
Using this entry, you enter the nominal value for the maximum receiving bandwidth (downlink) that is available to a
client logged in to your hotspot. The bandwidth itself can be defined using the Public Spot module.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
0 to 4294967295, in Kbit/s
1075
Reference Manual
13 Wireless LAN (WLAN)
Default:
0
Uplink-Speed
Using this entry you can enter the nominal value for the maximum transmission bandwidth (uplink) that is available to
a client logged in to your hotspot. The bandwidth itself can be defined using the Public Spot module.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
0 to 4294967295, in Kbit/s
Default:
0
IPv4-Addr-Type
Using this entry you inform an IEEE802.11u-capable station whether the address it receives after successful authentication
on the operator's Hotspot is of type IPv4.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
Not-Available
IPv4 address type is not available.
Public-Addr-Available
Public IPv4 address is available.
Port-Restr-Addr-Avail
Port-restricted IPv4 address is available.
Single-Nat-Priv-Addr-Avail
Private, single NAT-masked IPv4 address is available.
Double-Nat-Priv-Addr-Avail
Private, double NAT-masked IPv4 address is available.
Port-Restr-Single-Nat-Addr-Avail
Port-restricted IPv4 address and single NAT-masked IPv4 address is available.
Port-Restr-Double-Nat-Addr-Avail
Port-restricted IPv4 address and double NAT-masked IPv4 address is available.
Availability-not-known
The availability of an IPv4 address type is unknown.
Default:
Single-Nat-Priv-Addr-Avail
1076
Reference Manual
13 Wireless LAN (WLAN)
IPv6-Addr-Type
Using this entry you inform an IEEE802.11u-capable station whether the address it receives after successful authentication
on the operator's Hotspot is of type IPv6.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
Not-Available
IPv6 address type is not available.
Available
IPv6 address type is available.
Availability-not-known
The availability of an IPv6 address type is unknown.
Default:
Not-Available
Venue-Group
The venue group describes the environment where you set up the access point. You define them globally for all languages.
The possible values, which are set by the venue group code, are specified in the 802.11u standard.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
1
Unspecified: Unspecified
1
Assembly: Assembly
1
Business: Business
1
Educational: Educational:
1
Factory-and-Industry: Factory and industry
1
Institutional: Institutional
1
Mercantile: Commerce
1
Residential: Residence hall
1
Storage: Warehouse
1
Utility-and-Miscellaneous: Utility and miscellaneous
1
Vehicular: Vehicular
1
Outdoor: Outdoor
Default:
Unspecified
Venue-Type
Using the location type code (venue type), you have the option to specify details for the location group. These values
are also specified by the standard. The possible type codes can be found in the following table.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
1077
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Table 9: Overview of possible values for venue groups and types
Code = Venue type codeVenue group
Unspecified
Assembly
1
0 = unspecified assembly
1
1 = stage
1
2 = stadium
1
3 = passenger terminal (e.g., airport, bus station, ferry terminal, train station)
1
4 = amphitheater
1
5 = amusement park
1
6 = place of worship
1
7 = convention center
1
8 = library
1
9 = museum
1
10 = restaurant
1
11 = theater
1
12 = bar
1
13 = café
1
14 = zoo, aquarium
1
15 = emergency control center
Business
1
0 = unspecified business
1
1 = doctor's office
1
2 = bank
1
3 = fire station
1
4 = police station
1
6 = post office
1
7 = office
1
8 = research facility
1
9 = law firm
Educational:
1
0 = unspecified education
1
1 = primary school
1
2 = secondary school
1
3 = college
Factory and industry
1
0 = unspecified factory and industry
1
1 = factory
Institutional
1
0 = unspecified institution
1
1 = hospital
1
2 = long-term care facility (e.g., nursing home, hospice)
1
3 = rehabilitation clinic
1
4 = organizational association
1
5 = prison
Commerce
1
0 = unspecified commerce
1
1 = retail store
1
2 = food store
1
3 = auto repair shop
1
4 = shopping center
1
5 = gas station
1078
Reference Manual
13 Wireless LAN (WLAN)
Code = Venue type codeVenue group
Halls of residence
1
0 = unspecified residence hall
1
1 = private residence
1
2 = hotel or motel
1
3 = student housing
1
4 = guesthouse
Warehouse
1
0 = unspecified warehouse
Utility and miscellaneous
1
0 = unspecified service and miscellaneous
Vehicular
1
0 = unspecified vehicle
1
1 = passenger or transport vehicles
1
2 = aircraft
1
3 = bus
1
4 = ferry
1
5 = ship or boat
1
6 = train
1
7 = motorcycle
Outdoor
1
0 = unspecified outdoor
1
1 = municipal Wi-Fi network (wireless mesh network)
1
2 = city park
1
3 = rest area
1
4 = traffic control
1
5 = bus stop
1
6 = kiosk
Default:
0
Venue-Name
Use this field to specify one or more valid list entries from the table Venue Name in order to identify the location of the
device. The parameter considers all list entries that match the venue name specified here.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Venue-Name,
max. 32 characters Multiple names can be provided in a hash-separated (#) list.
Default:
Hotspot2.0 profiles
Using this table you manage the profile lists for the Hotspot 2.0. Hotspot 2.0 profiles enable you to group certain ANQP
elements (from the Hotspot 2.0 specification) and to independently assign these to logical WLAN interfaces in the table
Network-Profiles under HS20-Profile. These include, for example, the operator-friendly name, the connection capabilities,
operating class and WAN metrics. Some of the elements are located in other profile lists.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
1079
Reference Manual
13 Wireless LAN (WLAN)
Name
Assign a name for the Hotspot 2.0 profile here. You specify this name later in the table Setup > WLAN-Management >
AP-Configuration > IEEE802.11u > Network-Profiles under HS20-Profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Hotspot2.0-Profiles
Possible values:
String, max. 32 characters
Default:
Operator name
Enter a valid profile for hotspot operators in this field.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Hotspot2.0-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Operator-List,
max. 65 characters
Default:
Connection capabilities
Enter one or more valid entries for the connection capabilities in this field. Before joining a network, stations use the
information stored in this list to determine whether your hotspot even allows the required services (e.g., Internet access,
SSH, VPN). For this reason, the fewest possible entries should be entered with the status "unknown".
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Hotspot2.0-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
Connection-Capability, max. 250 characters Multiple names can be provided in a comma-separated list.
Default:
Operating class
Enter the code for the global operating class of the managed access point. Using the operating class, you inform a station
on which frequency bands and channels an access point is available. Example:
1
81: Operation at 2.4 GHz with channels 1-13
1
116: Operation at 40 MHz with channels 36 and 44
Please refer to the IEEE standard 802.11-2012, Appendix E, Table E-4, for the operating class that corresponds to an
access point: Global operating classes, available at
standards.ieee.org
.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Hotspot2.0-Profiles
Possible values:
Operating class code, max. 32 characters
1080
Reference Manual
13 Wireless LAN (WLAN)
Default:
NAI-Realms
Using this table you manage the profile lists for the NAI realms. With these lists you have the ability to group certain
ANQP elements. These include the realms of the hotspot operator and its roaming partners, as well as the associated
authentication methods and parameters. Stations use the information stored in this list to determine whether they have
the hotspot operator or one of its roaming partners have valid credentials.
In the setup menu you use the ANQP-Profiles table to assign this list to an ANQP profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the NAI realm profile, such as the name of the service provider or service to which the NAI realm
belongs. You specify this name later in the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
ANQP-Profiles under NAI-Realm-List.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > NAI-Realms
Possible values:
String, max. 32 characters
Default:
NAI-Realm
Enter the realm for the Wi-Fi network. The identification of the NAI realm consists of the username and a domain, which
can be extended using regular expressions. The syntax for an NAI realm is defined in IETF RFC 2486 and, in the simplest
case, is <username>@<realm>, for user746@providerX.org, and therefore the corresponding realm
is providerX.org.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > NAI-Realms
Possible values:
String, max. 32 characters
Default:
EAP-Method
Select a language for the NAI realm from the list. EAP stands for the authentication profile (Extensible Authentication
Protocol), followed by the corresponding authentication procedure
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > NAI-Realms
Possible values:
1
None: Select this setting when the relevant NAI realm does not require authentication.
1
EAP-TLS: Authentication using Transport Layer Security (TLS). Select this setting when authentication
via the relevant NAI realm is performed by a digital certificate installed by the user.
1081
Reference Manual
13 Wireless LAN (WLAN)
1
EAP-SIM: Authentication via the Subscriber Identity Module (SIM). Select this setting when authentication
via the relevant NAI realm is performed by the GSM Subscriber Identity Module (SIM card) of the station.
1
EAP-TTLS: Authentication via Tunneled Transport Layer Security (TTLS). Select this setting when
authentication via the relevant NAI real is performed using a username and password. For security reasons,
the connection is tunneled for this method.
1
EAP-AKA: Authentication using Authentication and Key Agreement (AKA). Select this setting when
authentication via the relevant NAI realm is performed by the UMTS Subscriber Identity Module (USIM
card) of the station.
Default:
None
Auth-Parameter-List
In this field, enter the appropriate authentication parameters for the EAP method using a comma-separated list, e.g.,
for EAP-TTLS NonEAPAuth.MSCHAPV2,Credential.UserPass or for EAP-TLS
Credentials.Certificate.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > NAI-Realms
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Auth-Parameter,
max. 65 characters Multiple names can be provided in a comma-separated list.
Default:
Network authentication type
Using this table, you manage addresses to which the device forwards stations for an additional authentication step after
the station has been successfully authenticated by the hotspot operator or any of its roaming partners. Only one forwarding
entry is allowed for each authentication type.
You specify the name for the Network Authentication Type Profile later in the table ANQP profiles under
Network-Auth-Type-List.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the table entry, e.g., Accept Terms and Conditions.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Authentication-Type
Possible values:
String, max. 32 characters
Default:
Network-Auth-Type
Choose the context from the list, which applies before forwarding.
1082
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Authentication-Type
Possible values:
1
Accept-Terms-Cond: An additional authentication step is set up that requires the user to accept
the terms of use.
1
Online-Enrollment: An additional authentication step is set up that requires the user to register
online first.
1
Http-Redirection: An additional authentication step is set up to which the user is forwarded via
HTTP.
1
DNS-Redirection: An additional authentication step is set up to which the user is forwarded via
DNS.
Default:
Accept-Terms-Cond
Redirect-URL
Enter the address to which the device forwards stations for additional authentication.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Authentication-Type
Possible values:
URL, max. 65 characters
Default:
Network profiles
The table Network profiles is the highest administrative level for 802.11u and Hotspot 2.0. It gives you the option of
turning the functions for every profile on or off, to assign child profile lists (such as those for ANQP or HS20), or to make
general settings.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
This parameter specifies the name of the 802.11u profile. You will subsequently assign this profile to a logical wireless
network in the table Setup > WLAN-Management > AP-Configuration > Network-profiles under 802.11u network
profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
String, max. 32 characters
Default:
Operating
Enable or disable support for connections according to IEEE 802.11u at the appropriate interface. If you enable support,
the device sends the interworking element in beacons/probes for the interface or for the associated SSID, respectively.
1083
Reference Manual
13 Wireless LAN (WLAN)
This element is used as an identifying feature for IEEE 802.11u-enabled connections: It includes, for example, the Internet
bit, the ASRA bit, the HESSID, and the location group code and the location type code. These individual elements use
802.11u-enabled devices as the first filtering criteria for network detection.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-profiles
Possible values:
Yes
No
Default:
No
Hotspot2.0
Enable or disable the support for Hotspot 2.0 according to the Wi-Fi Alliance® at the appropriate interface. Hotspot 2.0
extends the IEEE standard 802.11u with additional network information, which stations can request using an ANQP
request. These include, for example, the operator-friendly name, the connection capabilities, operating class and WAN
metrics. Using this additional information, stations are in a position to make an even more selective choice of Wi-Fi
network.
5
The prerequisite for this function is that support for connections according to IEEE 802.11u is enabled.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
Yes
No
Default:
No
Internet
Select whether the Internet bit is set. Over the Internet-bit, all stations are explicitly informed that the Wi-Fi network
allows Internet access. Enable this setting if services other than internal services are accessible via your device.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
Yes
No
Default:
No
Network type
Select a network type from the available list which most closely describes the Wi-Fi network behind the selected interface.
1084
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
1
Private: Describes networks which are blocked to unauthorized users. Select this type, for example,
for home networks or corporate networks where access is limited to employees.
1
Private-GuestAcc: Similar to Private, but with guest access for unauthorized users. Select
this type, for example, for corporate networks where visitors may use the Wi-Fi network in addition to
employees.
1
Public-Charge: Describes public networks that are accessible to everyone and can be used for a
fee. Information about fees may be available through other channels (e.g.: IEEE 802.21, HTTP/HTTPS or
DNS forwarding). Select this type, for example, for hotspots in shops or hotels that offer fee-based Internet
access.
1
Public-Free: Describes public networks that are accessible to everyone and for which no fee is
payable. Select this type, for example, for hotspots in public, local and long-distance transport, or for
community networks where Wi-Fi access is an included service.
1
Personal-Dev: In general, it describes networks that connect wireless devices. Select this type, for
example, for digital cameras that are connected to a printer via WLAN.
1
Emergency: Describes networks that are intended for, and limited to, emergency services. Select this
type, for example, for connected ESS or EBR systems.
1
Experimental: Describes networks that are set up for testing purposes or are still in the setup stage.
1
Wildcard: Placeholder for previously undefined network types.
Default:
Private
Asra
Select whether the ASRA bit (Additional Step Required for Access) is set. Using the ASRA bit explicitly informs all stations
that further authentication steps are needed to access the Wi-Fi network. Enable this setting if you have, for example,
set up online registration, additional authentication, or a consent form for your terms of use on your web site.
5
Please remember to specify a forwarding address in the Network authentication types table for the additional
authentication and/or WISPr for the Public Spot module if you set the ASRA bit.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
Yes
No
Default:
No
HESSID type
Specify which HESSID is provided by the device to the access points for the homogeneous ESS.
A homogeneous ESS is defined as a group of a specific number of access points, which all belong to the same network.
The MAC address of a connected access point (its BSSID), or the MAC address of the WLC, serves as a globally unique
identifier (HESSID). The SSID can not be used as an identifier in this case, because different network service providers
can have the same SSID assigned in a hotspot zone, e.g., by common names such as "HOTSPOT".
1085
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
1
Auto: Based on its own MAC address, the device generates a common HESSID for all access points that
belong to the network profile.
1
User: Manually assign an HESSID for all access points that belong to the network profile.
1
None: The connected access points are not assigned an HESSID.
Default:
Auto
HESSID MAC
If you selected the setting user for the HESSID-type, enter the HESSID of your homogeneous ESS as a 6-octet MAC
address. For the HESSID, select the BSSID for any access point in your homogeneous ESS, or the MAC address of your
WLC, in capital letters and without separators, e.g., 008041AEFD7E for the MAC address 00:80:41:ae:fd:7e.
5
If an access point is not present in multiple homogeneous ESS's, the HESSID is identical for all of its interfaces.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
MAC address in capital letters and without separators
Default:
000000000000
ANQP profile
Using this parameter, you specify a valid ANQP profile that you want to use for the 802.11u profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > ANQP-Profiles,
max. 32 characters
Default:
HS20 profile
Using this parameter, you specify a valid Hotspot 2.0 or HS20 profile that you want to use for the 802.11u profile.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Network-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
Hotspot2.0-Profiles, max. 32 characters
1086
Reference Manual
13 Wireless LAN (WLAN)
Default:
Operator-List
Using this table you manage the plain text name of the hotspot operator. An entry in this table offers you the ability to
send a user-friendly operator name to the stations, which they can then display instead of the realms. However, whether
they actually do that depends on their implementation.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Assign a name for the entry, such as an index number or combination of operator-name and language.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Operator-List
Possible values:
String, max. 32 characters
Default:
Language
Select a language for the hotspot operator from the list.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Operator-List
Possible values:
None
English
Deutsch
Chinese
Spanish
French
Italian
Russian
Dutch
Turkish
Portuguese
Polish
Czech
Arabian
Default:
None
1087
Reference Manual
13 Wireless LAN (WLAN)
Operator name
Enter the plain text name of the hotspot operator.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Operator-List
Possible values:
String, max. 65 characters
Default:
Venue-Name
In this table, enter general information about the location of an access point.
In the event of a manual search, additional details on the Venue information help a user to select the correct hotspot.
If more than one operator (e.g., multiple cafés) in a single hotspot zone uses the same SSID, the user can clearly identify
the appropriate location using the venue information.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u
Name
Enter a name for the list entry in the table. This name will be used to reference the site information from other tables.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Venue-Name
Possible values:
String, max. 65 characters
Default:
Language
Select the language in which you store information about the location.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Venue-Name
Possible values:
None
English
Deutsch
Chinese
Spanish
French
Italian
Russian
Dutch
Turkish
1088
Reference Manual
13 Wireless LAN (WLAN)
Portuguese
Polish
Czech
Arabian
Default:
None
Venue-Name
Enter a short description of the location of your device for the selected language.
Telnet path:
Setup > WLAN-Management > AP-Configuration > IEEE802.11u > Venue-Name
Possible values:
String, max. 65 characters
Default:
IEEE802.11u network profile
This parameter specifies the name of 802.11u network profile which is to be assigned to the logical WLAN network.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u >
Network-Profiles, max. 32 characters
Default:
IEEE802.11u-General
These parameters specify the name of the location profile that you want to apply for the WLAN profile (i.e. this common
profile).
Telnet path:
Setup > WLAN-Management > AP-Configuration > Commonprofiles
Possible values:
Name from the table Setup > WLAN-Management > AP-Configuration > IEEE802.11u > General, max.
32 characters
1089
Reference Manual
13 Wireless LAN (WLAN)
Default:
13.18 Addition(s) to LCOS 9.00
13.18.1 Support of 802.11ac WLAN interfaces
As of version 9.00, LCOS provides support of the 802.11ac standard for devices with the appropriate hardware.
Additions to the Status menu
Rx-STBC-HT
Indicates whether and how many streams the corresponding WLAN client can receive using the STBC technique when
data transmission is in the 802.11n (HT) mode.
SNMP ID:
1.3.32.68
Telnet path:
Status > WLAN > Station-table
Possible values:
None
One
Two
Three
Rx-STBC-VHT
Indicates whether and how many streams the corresponding WLAN client can receive using the STBC technique with
data transmission in the 802.11ac-(VHT) mode.
SNMP ID:
1.3.32.69
Telnet path:
Status > WLAN > Station-table
1090
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the corresponding WLAN client supports the use of the low density parity check (LDPC) in relation to
802.11n/802.11ac bit rates.
SNMP ID:
1.3.32.70
Telnet path:
Status > WLAN > Station-table
Possible values:
None
The WLAN client does not support LDPC or it does not provide information about it.
HT
The WLAN client supports LDPC in the 802.11n (HT) mode. HT = high throughput.
VHT
The WLAN client supports LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
Tx-STBC
Indicates whether and in which mode the detected network is capable of transmitting with STBC (space time block
coding).
SNMP ID:
1.3.34.49
Telnet path:
Status > WLAN > Scan-Results
Possible values:
None
The detected WLAN does not support STBC or provides no information about the mode.
1091
Reference Manual
13 Wireless LAN (WLAN)
HT
The detected WLAN permits data packets to be sent with STBC in the 802.11n (HT) mode. HT = high
throughput.
VT
The detected WLAN permits data packets to be sent with STBC in the 802.11ac (VHT) mode. VHT = very
high throughput.
Rx-STBC-HT
Indicates whether and how many streams the detected WLAN can receive using the STBC technique with data transmission
in the 802.11n (HT) mode.
SNMP ID:
1.3.34.50
Telnet path:
Status > WLAN > Scan-Results
Possible values:
None
One
Two
Three
Rx-STBC-VHT
Indicates whether and how many streams the detected WLAN can receive using the STBC technique with data transmission
in the 802.11ac (VHT) mode.
SNMP ID:
1.3.34.51
Telnet path:
Status > WLAN > Scan-Results
1092
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the detected WLAN supports the use of the low density parity check (LDPC) in relation to
802.11n/802.11ac bit rates.
SNMP ID:
1.3.34.52
Telnet path:
Status > WLAN > Scan-Results
Possible values:
None
The detected WLAN does not support LDPC or it does not provide information about it.
HT
The detected WLAN supports LDPC in the 802.11n (HT) mode. HT = high throughput.
VHT
The detected WLAN supports LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
Rx-STBC-HT
Indicates whether and how many streams the P2P partner can receive using the STBC technique when data transmission
is in the 802.11n (HT) mode.
SNMP ID:
1.3.36.1.48
Telnet path:
Status > WLAN > Interpoints > Access-point-list
1093
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
None
One
Two
Three
Rx-STBC-VHT
Indicates whether and how many streams the P2P partner can receive using the STBC technique when data transmission
is in the 802.11ac (VHT) mode.
SNMP ID:
1.3.36.1.49
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the AP for the P2P connection uses the low density parity check (LDPC) in relation to 802.11n/802.11ac
bit rates.
SNMP ID:
1.3.36.1.50
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
None
The AP is not using LDPC either because the P2P partner does not support LDPC or it does not provide
information about the mode.
HT
The AP uses LDPC in the 802.11n (HT) mode. HT = high throughput.
VHT
The AP uses LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
1094
Reference Manual
13 Wireless LAN (WLAN)
Rx-STBC-HT
Indicates whether and how many streams the physical WLAN interface can receive using the STBC technique with data
transmission in the 802.11n (HT) mode.
SNMP ID:
1.3.43.51.42
Telnet path:
Status > WLAN > Client > Interfaces
Possible values:
None
One
Two
Three
Rx-STBC-VHT
Indicates whether and how many streams the physical WLAN interface can receive using the STBC technique with data
transmission in the 802.11ac (VHT) mode.
SNMP ID:
1.3.43.51.43
Telnet path:
Status > WLAN > Client > Interfaces
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the physical WLAN interface uses the low density parity check (LDPC) in relation to 802.11n/802.11ac
bit rates.
SNMP ID:
1.3.43.51.44
1095
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Status > WLAN > Client > Interfaces
Possible values:
None
The physical WLAN interface does not use LDPC.
HT
The physical WLAN interface uses LDPC in the 802.11n (HT) mode. HT = high throughput.
VHT
The physical WLAN interface uses LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
Channel bandwidths
Indicates which channel bandwidths are supported by the corresponding network.
SNMP ID:
1.3.44.44
Telnet path:
Status > WLAN > Competing-networks
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidth
Indicates which channel bandwidths are currently being used by the corresponding network.
SNMP ID:
1.3.44.45
Telnet path:
Status > WLAN > Competing-networks
1096
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Tx-STBC
Indicates whether and in which mode the detected remote station is capable of transmitting with STBC (space time block
coding).
SNMP ID:
1.3.44.49
Telnet path:
Status > WLAN > Competing-networks
Possible values:
None
The detected remote station does not support STBC or provides no information about the mode.
HT
The detected remote station permits data packets to be sent with STBC in the 802.11n (HT) mode. HT
= high throughput.
VT
The detected remote station permits data packets to be sent with STBC in the 802.11ac (VHT) mode.
VHT = very high throughput.
TX STBC HT
Indicates whether and how many streams the detected remote station can receive using the STBC technique with data
transmission in the 802.11n (HT) mode.
SNMP ID:
1.3.44.50
1097
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Status > WLAN > Competing-networks
Possible values:
None
One
Two
Three
TX STBC VHT
Indicates whether and how many streams the detected remote station can receive using the STBC technique with data
transmission in the 802.11ac (VHT) mode.
SNMP ID:
1.3.44.51
Telnet path:
Status > WLAN > Competing-networks
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the detected remote station supports the use of the low density parity check (LDPC) in relation to
802.11n/802.11ac bit rates.
SNMP ID:
1.3.44.52
Telnet path:
Status > WLAN > Competing-networks
Possible values:
None
The corresponding remote station does not support LDPC or it does not provide information about it.
HT
The remote station supports LDPC in the 802.11n (HT) mode. HT = high throughput.
1098
Reference Manual
13 Wireless LAN (WLAN)
VHT
The remote station supports LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
Channel bandwidths
Shows which channel bandwidth the WLAN supports.
SNMP ID:
1.3.55.39
Telnet path:
Status > WLAN > WLAN-Parameter
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidth
Shows which channel bandwidth the WLAN is using.
SNMP ID:
1.3.55.40
Telnet path:
Status > WLAN > WLAN-Parameter
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
1099
Reference Manual
13 Wireless LAN (WLAN)
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Rx-STBC-HT
Indicates whether and how many streams an AP on the WLAN can receive using the STBC technique when data
transmission is in the 802.11n (HT) mode.
SNMP ID:
1.3.55.42
Telnet path:
Status > WLAN > WLAN-Parameter
Possible values:
None
One
Two
Three
Rx-STBC-VHT
Indicates whether and how many streams an AP on the WLAN can receive using the STBC technique when data
transmission is in the 802.11ac (VHT) mode.
SNMP ID:
1.3.55.43
Telnet path:
Status > WLAN > WLAN-Parameter
1100
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
None
One
Two
Three
Four
Five
Six
Seven
LDPC
Indicates whether the corresponding WLAN supports the use of the low density parity check (LDPC) in relation to
802.11n/802.11ac bit rates.
SNMP ID:
1.3.55.44
Telnet path:
Status > WLAN > WLAN-Parameter
Possible values:
None
The corresponding WLAN does not support LDPC or it does not provide information about it.
HT
The WLAN supports LDPC in the 802.11n (HT) mode. HT = high throughput.
VHT
The WLAN supports LDPC in the 802.11ac (VHT) mode. VHT = very high throughput.
Channel bandwidth
Shows which channel bandwidth is configured for the physical WLAN interface.
SNMP ID:
1.3.57.19
Telnet path:
Status > WLAN > Radios
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
1101
Reference Manual
13 Wireless LAN (WLAN)
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidth
Shows which channel bandwidth is configured for the corresponding frequency band.
SNMP ID:
1.3.63.1.18
Telnet path:
Status > WLAN > Noise-immunity > Current-parameters
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
13.18.2 Specifying client-bridge mode and bandwidth limit for each SSID
As of LCOS 9.00 you have the option of specifying the client-bridge mode and bandwidth limits for individual SSIDs.
1102
Reference Manual
13 Wireless LAN (WLAN)
Changes to stand-alone APs
The following settings are made in LANconfig in Wireless LAN > General > Logical WLAN settings > Network.
1
Client-bridge support
Enable this option for an access point if you have enabled the client-bridge support for a client station in WLAN
client mode ().
5
The client-bridge mode only operates between two LANCOM devices.
1
TX bandwidth limit
With this setting, you define the overall bandwidth that is available for transmission within this SSID (limit in kbps).
A value of 0 disables the limit.
1
RX bandwidth limit
With this setting, you define the overall bandwidth that is available in the reception direction within this SSID (limit
in kbps). A value of 0 disables the limit.
The settings of this name are thus removed from LANconfig under Wireless LAN > General > Physical WLAN settings. >
Client modean also from the following menu items in WEBconfig:
1
Setup > Interfaces > WLAN > Client-Modes > Cl.-Brg.-Support
1
Setup > Interfaces > WLAN > Client-Modes > Tx-Limit
1
Setup > Interfaces > WLAN > Client-Modes > Rx-Limit
1103
Reference Manual
13 Wireless LAN (WLAN)
Changes to WLCs
The explanations added for a stand-alone AP to the changes in LANconfig also apply in the same manner to a WLC
under WLAN Controller > Profiles > Logical WLAN networks.
Additions to the Setup menu
Cl.-Brg.-Support
While the address adaption can only make the MAC address of just one connected device visible for the access point,
client-bridge support enables all MAC addresses of the stations in the LAN behind the client stations to be transmitted
transparently to the access point.
In this operation mode, not three MAC addresses are taken (in this example for server, access point and client station)
as is normal for client mode, but four addresses as with point-to-point connections (additionally the MAC address of the
station in the client station's LAN). The fully transparent connection of a LAN to the client station allows targeted
transmission of data packets in the WLAN and hence functions such as TFTP downloads, which are initiated via broadcast.
5
The client-bridge mode can only be used between two LANCOM devices.
SNMP ID:
2.23.20.1.11
Telnet path:
Setup > Interfaces > WLAN > Network
1104
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Yes
Activates client-bridge support for this logical WLAN.
No
Deactivates client-bridge support for this logical WLAN.
Exclusive
Only accepts clients that also support the client-bridge mode.
Default:
No
Tx limit
With this setting, you define the overall bandwidth that is available for transmission within this SSID.
SNMP ID:
2.23.20.1.20
Telnet path:
Setup > Interfaces > WLAN
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the limit.
Default:
0
Rx limit
With this setting, you define the overall bandwidth that is available for reception within this SSID.
SNMP ID:
2.23.20.1.21
Telnet path:
Setup > Interfaces > WLAN
Possible values:
0 … 4294967295 kbps
1105
Reference Manual
13 Wireless LAN (WLAN)
Special values:
0
This value disables the limit.
Default:
0
Tx limit
With this setting, you define the overall bandwidth that is available for transmission within this SSID.
SNMP ID:
2.37.1.1.44
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the limit.
Default:
0
Rx limit
With this setting, you define the overall bandwidth that is available for reception within this SSID.
SNMP ID:
2.37.1.1.45
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the limit.
Default:
0
1106
Reference Manual
13 Wireless LAN (WLAN)
13.18.3 Separation of P2P and WLAN/SSID configuration
As of LCOS 9.00, the transmission and encryption settings for P2P connections can be configured separately from the
settings for the first logical WLAN network of the corresponding physical WLAN interface. P2P devices no longer use a
configured SSID as an administrative network for connection establishment and for availability checks ("Alive") of a
point-to-point partner. Instead, they now use the fixed SSID *** P2P INFO ***.
This feature, among others, forms the basis for the structure of
AutoWDS networks
.
Configuration of P2P connections
In the configuration of point-to-point (P2P) connections, enter the point-to-point operation mode and the channel
selection scheme, along with the MAC addresses or station names of the remote sites. The configuration can be done
in LANconfig either by using the Setup wizard Configure WLAN or manually using the configuration dialog.
The following steps show you how you create an encrypted or unencrypted P2P basic configuration.
4
Along with a P2P connection, each of the APs automatically operates an SSID *** P2P INFO ***. This SSID works
purely as an administrative network for establishing the connection and for the availability check ("Alive") of a
point-to-point partner. It is not possible for the WLAN clients to connect to this network.
1. Open the configuration dialog for the device that is to operate as the P2P master or P2P slave, and navigate to the
page Wireless LAN > General > Physical WLAN settings.
2. Select the WLAN interface which you want to use explicitly for the P2P connection and move to the tab Point-to-Point.
3. Enable the desired Point-to-point operation mode, such as On.
4. Set the Channel selection scheme to Master or Slave.
5. Optional: If the remote site should identify the physical interface by an alias and not the MAC address, then enter a
corresponding descriptor into the field Station name, for example P2P_MASTER or P2P_SLAVE.
6. Optional: Adjust the settings on the tab P2P encryption for the IEEE 802.11i encryption of the P2P connection, if
necessary.
IEEE 802.11i can attain a significant increase in the security of WLAN point-to-point connections. All of the advantages
of 802.11i such as the simple configuration and the powerful encryption with AES are thus available for P2P mode,
as are the improved security of the passphrase from the LANCOM Enhance Passphrase Security (LEPS).
The setting options are practically identical with those of the physical WLAN interfaces, see
WPA and private WEP
settings
. By default, P2P encryption is enabled and filled-out with meaningful values.
1107
Reference Manual
13 Wireless LAN (WLAN)
4
In LCOS versions prior to 9.00, the settings for encryption are tied to the settings for the first logical WLAN
network on the corresponding physical WLAN interface (i.e. WLAN-1 if you are using the first WLAN module
for the P2P connection, WLAN-2 if you are using the second WLAN module for an access point with two
WLAN modules). In this case, you find the settings under Wireless LAN > 802.11i/WEP > WPA or private
WEP settings.
7. Close the dialog with OK and under Point-to-Point partners on the same page of the configuration dialog select
a logical P2P connection, such as P2P-1-1.
8. Enable the selected P2P channel on the Point-to-Point tab and specify whether the device identifies the remote
station using a MAC address or a Station name. Here you then enter either the MAC address of the physical WLAN
interface which the remote station uses for the P2P connection, or its station name accordingly.
You will find the WLAN MAC address on a sticker located under each of the antenna connectors on the housing of
the device. Only use the string that is marked as the "WLAN-MAC" or "MAC-ID". The other addresses that may be
found are not the WLAN MAC address but the LAN MAC address.
Alternatively, you will also find the MAC address in the status menu under WLAN > Interfaces > MAC-Address.
9. In Passphrase, enter a shared secret of at least 8 characters (recommended: 32 characters), which is used to
additionally encrypt the P2P connection. The P2P encryption must be enabled for this (see above).
When set as P2P Master, the passphrase entered here will be used to check the Slave's authorization to access.
When set as P2P Slave, the access point transfers this information to register with the remote site.
10. Optional: Move to the Transmission tab to enter the limits and settings for packet transmission.
The setting options are practically identical with those of the logical WLAN networks (see
Transmission settings
). By
default, all parameters are adjusted for optimization and automatic operation.
11. Close the dialog with OK and save the configuration to your device.
12. You continue by performing the corresponding configuration steps for the remote station (slave or master).
Additions to the Setup menu
Interpoint transmission
This table contains the transmission settings for the individual P2P links.
SNMP ID:
2.23.20.19
Telnet path:
Setup > Interfaces > WLAN
1108
Reference Manual
13 Wireless LAN (WLAN)
Ifc
Name of the logical P2P interface which you selected.
SNMP ID:
2.23.20.19.1
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Select from the available P2P links.
Packet size
Select the maximum size of data packets on a P2P link.
Smaller data packets cause fewer transmission errors than larger packets, although the proportion of header information
in the traffic increases, leading to a drop in the effective network load. Increase the factory value only if your wireless
network is largely free from interference and very few transmission errors occur. Reduce the value to reduce the occurrence
of transmission errors.
SNMP ID:
2.23.20.19.2
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
600 … 2347
Default:
1600
Min-Tx-Rate
Specify the minimum transmission rate in the direction of transmission.
Normally the access point negotiates the data transmission speeds continuously and dynamically with the connected
WLAN clients (Auto). The access point adjusts the transmission speeds to the reception conditions. You also have the
option of preventing dynamic speed adjustment by entering a fixed transmission speed.
SNMP ID:
2.23.20.19.3
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
1109
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Auto
1M
2M
5.5M
11M
6M
9M
12M
18M
24M
36M
48M
54M
Default:
Auto
Max-Tx-Rate
Specify the maximum transmission rate in the direction of transmission.
Normally the access point negotiates the data transmission speeds continuously and dynamically with the connected
WLAN clients (Auto). The access point adjusts the transmission speeds to the reception conditions. You also have the
option of preventing dynamic speed adjustment by entering a fixed transmission speed.
SNMP ID:
2.23.20.19.9
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
1M
2M
5.5M
11M
6M
9M
12M
18M
24M
36M
48M
54M
Default:
Auto
1110
Reference Manual
13 Wireless LAN (WLAN)
EAPOL-Rate
Set the data rate for EAPOL transmission.
WLAN clients use EAP over LAN (EAPOL) to login to the access point by WPA and/or 802.1x. With this method, the EAP
packets used for exchanging authentication information are encapsulated within Ethernet frames, which in turn facilitates
EAP communication over a Layer-2 connection.
In some cases, it makes sense to select a lower data rate for the transmission of the EAPOL packets than for payload
data. For example, in the case of mobile WLAN clients, high data rates can cause the loss of EAPOL packets, which in
turn leads to considerable delays in client association. This procedure can be stabilized by selecting specific data rates
for EAPOL.
SNMP ID:
2.23.20.19.19
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Like-Data
In this setting, the device transmits the EAPOL data at the same rate as payload data.
1M
2M
5.5M
11M
6M
9M
12M
18M
24M
36M
48M
54M
HT-1-6.5M
HT-1-13M
HT-1-19.5M
HT-1-26M
HT-1-39M
HT-1-52M
HT-1-58.5M
HT-1-65M
HT-2-13M
HT-2-26M
HT-2-39M
HT-2-52M
HT-2-78M
HT-2-104M
HT-2-117M
HT-2-130M
Default:
Like-Data
1111
Reference Manual
13 Wireless LAN (WLAN)
Soft retries
Enter the number of transmission attempts that the device tries if the hardware cannot send a data packet. The total
number of transmission attempts results from the calculation (Soft-Retries + 1) * Hard-Retries.
The advantage of soft retries over hard retries is that, owing to the rate adaptation algorithm, the next set of hard retries
immediately starts at a lower rate.
SNMP ID:
2.23.20.19.11
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
0 … 255
Default:
10
Hard retries
Enter the number of transmission attempts that the device attempts before the hardware reports a Tx error. The smaller
the value you choose, the shorter is the time that an unsendable packet will block the transmitter. If the hardware cannot
send a data packet, you have the option to continue the attempts on the software side. For more information, see the
parameter Soft-Retries.
SNMP ID:
2.23.20.19.12
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
0 … 255
Default:
10
11b-Preamble
Specify whether your device uses a long preamble in 802.11b mode.
Normally every WLAN client (in this case the P2P slave) independently negotiates the necessary length of the preamble
for communication with the base station (in this case the P2P master). However, in some rare cases it is necessary to
ignore this handshake process and use the long WLAN preamble, although this is less advantageous.
Only enable the long WLAN preamble if it precisely resolves your wireless problems.
SNMP ID:
2.23.20.19.7
1112
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
The P2P slave automatically negotiates the length of the preamble (short/long) required to communicate
with the P2P-master.
Long
The P2P slave does not negotiate and always uses a long preamble.
Default:
Auto
Min. HT MCS
MCS (Modulation Coding Scheme) is used for automatic speed adjustment and defines a series of variables in the 802.11n
standard, which, for example, specifies the number of spatial streams, the modulation, and data transfer rate of each
data stream.
In the factory settings, the station automatically selects the optimal MCS for the corresponding stream according to the
current channel conditions. If interference arises during operation and the channel conditions change, for example due
to movement of the transmitter or signal deterioration, the MCS is dynamically adjusted to suit the new conditions.
You still have the option of setting the MCS to a constant value. This may facilitate testing, or it may be useful in particularly
dynamic environments to avoid unnecessary parameterizing where an optimal value simply cannot be expected.
SNMP ID:
2.23.20.19.16
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
MCS-0/8
MCS-1/9
MCS-2/10
MCS-3/11
MCS-4/12
MCS-5/13
MCS-6/14
MCS-7/15
Default:
Auto
1113
Reference Manual
13 Wireless LAN (WLAN)
Max. HT MCS
MCS (Modulation Coding Scheme) is used for automatic speed adjustment and defines a series of variables in the 802.11n
standard, which, for example, specifies the number of spatial streams, the modulation, and data transfer rate of each
data stream.
In the factory settings, the station automatically selects the optimal MCS for the corresponding stream according to the
current channel conditions. If interference arises during operation and the channel conditions change, for example due
to movement of the transmitter or signal deterioration, the MCS is dynamically adjusted to suit the new conditions.
You still have the option of setting the MCS to a constant value. This may facilitate testing, or it may be useful in particularly
dynamic environments to avoid unnecessary parameterizing where an optimal value simply cannot be expected.
SNMP ID:
2.23.20.19.17
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
MCS-0/8
MCS-1/9
MCS-2/10
MCS-3/11
MCS-4/12
MCS-5/13
MCS-6/14
MCS-7/15
Default:
Auto
Use STBC
Here you enable Space Time Block Coding (STBC).
STBC is a method to improve reception. The function additionally varies the transmission of data packets over time to
minimize time-related effects on the data. Due to the time offset of the transmissions, the recipient has an even better
chance of receiving error-free data packets, regardless of the number of antennas.
4
This parameter cannot be set to Yes if the WLAN chipset does not support STBC.
SNMP ID:
2.23.20.19.23
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
1114
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
No
Yes
Default:
Yes
Use LDPC
Enable Low Density Parity Check (LDPC) here.
LDPC is a method of error correction. Before the sender transmits the data packets, it expands the data stream with
checksum bits depending on the modulation rate. These checksum bits allow the receiver to correct transmission errors.
By default the 802.11n standard uses 'Convolution Coding' (CC) for error correction, which is well-known from 802.11a
and 802.11g; however, it also provides error correction according to the LDPC-method (Low Density Parity Check).
In contrast to CC encoding, LDPC encoding uses larger packets to calculate checksums and can also recognize more bit
errors. Therefore, LDPC encoding already provides a higher data rate due to having a better ratio of usage to checksum
data.
4
If the WLAN chipset does not support STBC, you cannot set this value to Yes.
SNMP ID:
2.23.20.19.24
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
No
Yes
Default:
Yes
Short guard interval
Enable or disable the short guard interval.
In rough terms, the guard interval is used to minimize the disturbance from intersymbol interference (ISI) when operating
with multiplexing (OFDM). The option reduces the transmission pause between two signals from 0.8 µs (default) to 0.4 µs
(short guard interval). This increases the effective time available for data transmission and thus the data throughput.
However, the wireless LAN system becomes more liable to disruption that can be caused by interference between two
consecutive signals.
1115
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.23.20.19.13
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
The device activates the short guard interval in automatic mode, provided that the remote station
supports this.
No
Disables the short guard interval.
Default:
Auto
Min.-Spatial-Streams
Enter the minimum number of allowed spatial streams.
In principle, the spatial streams add a 3rd dimension—space—to the existing frequency-time matrix. An array of multiple
antennas provides the receiver with spatial information that the device can use for spatial multiplexing, a technique that
increases transmission rates. This allows parallel transmission of multiple data streams over a single radio channel.
Multiple transmitter and receiver antennas can be operated at the same time. This improves the performance of the
entire radio system.
In the factory settings, the device automatically has the spatial streams turned on in order to optimize use of the radio
system. Alternatively you have the option of limiting the spatial streams to one or two to reduce the load on the radio
system.
SNMP ID:
2.23.20.19.18
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
One
Two
Three
Default:
Auto
1116
Reference Manual
13 Wireless LAN (WLAN)
Max. spatial streams
Enter the maximum number of allowed spatial streams.
In principle, the spatial streams add a 3rd dimension—space—to the existing frequency-time matrix. An array of multiple
antennas provides the receiver with spatial information that the device can use for spatial multiplexing, a technique that
increases transmission rates. This allows parallel transmission of multiple data streams over a single radio channel.
Multiple transmitter and receiver antennas can be operated at the same time. This improves the performance of the
entire radio system.
In the factory settings, the device automatically has the spatial streams turned on in order to optimize use of the radio
system. Alternatively you have the option of limiting the spatial streams to one or two to reduce the load on the radio
system.
SNMP ID:
2.23.20.19.14
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
Auto
One
Two
Three
Default:
Auto
Send aggregates
With this setting you configure the transmission of aggregated data packets. Frame aggregation is an official standard
and, according to the 802.11n standard, it is intended to be vendor-independent. This is similar to the well-known burst
mode.
For frame aggregation, the device combines multiple data packets (frames) to a larger packet—by increasing the length
of the WLAN frame—and sends them together. The method shortens the waiting time between data packets and also
reduces the overhead, so increasing the data throughput.
However, with increased frame length, the probability increases that the device must resend the packets, for example,
due to radio interference. Other stations must also wait for a free channel and collect their data packets until they have
multiple packets that they can send at one time.
Frame aggregation is enabled in the factory settings. This option makes sense if you want to increase the throughput
for your device and others on this medium are not important. Frame aggregation is not suitable when working with
mobile receivers or real-time data transmissions such as voice over IP.
SNMP ID:
2.23.20.19.15
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
1117
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
No
Yes
Default:
Yes
Receive-Aggregates
With this setting you configure the reception of aggregated data packets. Frame aggregation is an official standard and,
according to the 802.11n standard, it is intended to be vendor-independent. This is similar to the well-known burst
mode.
For frame aggregation, the device combines multiple data packets (frames) to a larger packet—by increasing the length
of the WLAN frame—and sends them together. The method shortens the waiting time between data packets and also
reduces the overhead, so increasing the data throughput.
However, with increased frame length, the probability increases that the device must resend the packets, for example,
due to radio interference. Other stations must also wait for a free channel and collect their data packets until they have
multiple packets that they can send at one time.
Frame aggregation is enabled in the factory settings. This option makes sense if you want to increase the throughput
for your device and others on this medium are not important. Frame aggregation is not suitable when working with
mobile receivers or real-time data transmissions such as voice over IP.
SNMP ID:
2.23.20.19.22
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
No
Yes
Default:
Yes
Max.-Aggr.-Packet-Count
Using this parameter, you define the maximum number of packets the device may combine into one aggregate. Aggregation
in IEEE 802.11n WLAN transmissions combines multiple data packets into one large packet, so reducing the overhead
and speeding up the transmission.
SNMP ID:
2.23.20.19.20
1118
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
0 … 11/16/24 (device dependent)
Special values:
0
The device automatically uses the highest value allowed on the hardware side.
Default:
0
RTS threshold
Use this field to define the RTS threshold. If the size of the RTS packets for transmission exceeds this value, the device
uses the RTS/CTS protocol in order to prevent the increased probability of collisions and the associated "hidden station"
phenomena. Further information about this phenomena can be found in the Reference Manual under the same keyword.
Since the RTS packets are generally very short and the use of RTS/CTS increases the overhead, using this method only
pays off if you are using longer data packets where collisions are likely. This value has to be determined in a trial in the
respective environment.
5
The RTS/CTS threshold should also be set in the WLAN clients, in as far as the driver or the operating system
allow this.
SNMP ID:
2.23.20.19.6
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
Possible values:
60 … 2347
Default:
2347
Min.-Frag.-Length
Using this input field you define the minimum length of packet fragments, below which the device rejects data packet
fragments.
SNMP ID:
2.23.20.19.10
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Transmission
1119
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
0 … 65535
Special values:
0, 1
The device allows for packet fragments of any length.
Default:
16
Interpoint-Encryption
This table contains the encryption settings of the physical WLAN interface for P2P links.
SNMP ID:
2.23.20.20
Telnet path:
Setup > Interfaces > WLAN
Ifc
Name of the physical WLAN interface
SNMP ID:
2.23.20.20.1
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Encryption
Enables or disables the WPA/WEP encryption for P2P connections over the respective interface.
SNMP ID:
2.23.20.20.2
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
1120
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
No
Yes
Default:
Yes
Default-Key
WEP keys with which the device encrypts the packets sent over this interface.
SNMP ID:
2.23.20.20.3
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
0 … 9
Default:
1
Method
Selects the encryption method or, for WEP, the key length which the device uses for the encryption of P2P data packets.
5
Please note that not every client (or their hardware) supports every encryption method.
SNMP ID:
2.23.20.20.4
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
802.11i-WPA-PSK
WEP-128-bit
WEP-104-bit
WEP 40-bit
Default:
802.11i-WPA-PSK
1121
Reference Manual
13 Wireless LAN (WLAN)
WPA version
WPA version that the device offers a client for WPA encryption.
SNMP ID:
2.23.20.20.9
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
WPA1
WPA2
WPA1/2
Default:
WPA1/2
WPA1 session key types
Select the method or methods that the device offers the remote station for generating the WPA session or group key for
WPA1. The device can provide the Temporal Key Integrity Protocol (TKIP) method, the Advanced Encryption Standard
(AES) method, or both.
SNMP ID:
2.23.20.20.12
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
TKIP
AES
TKIP/AES
Default:
TKIP
WPA2-Session-Key
Select the method or methods that the device offers the remote station for generating the WPA session or group key for
WPA2. The device can provide the Temporal Key Integrity Protocol (TKIP) method, the Advanced Encryption Standard
(AES) method, or both.
1122
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.23.20.20.13
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
TKIP
AES
TKIP/AES
Default:
AES
WPA-Rekeying-Cycle
Specify the intervals at which the device repeats the WPA key handshake.
For WPA1/2, authentication on a network is performed with a pre-shared key (PSK), which is part of a 128-bit individual
key. The device (as authenticator) generates this key with a 48-bit initial vector (IV), which makes it difficult for attackers
to calculate the WPA key. The repetition of the key that consists of the IV and WPA keys only occurs after 2
48
data
packets, which no WLAN will reach within a foreseeable time.
To prevent the (theoretical) repetition of the real key, the WPA allows for an automatic renegotiation of the key with the
WLAN client (the supplicant) in regular intervals (rekeying). This prevents the repetition of the real key. By setting an
individual cycle, you have the option of shortening the rekeying intervals.
SNMP ID:
2.23.20.20.11
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
0 … 4294967295 Seconds
Special values:
0
This value disables the preliminary negotiation of a new WPA key at the device. Rekeying can still be
triggered by the supplicant.
Default:
0
WPA2-Key-Management
You can configure the WPA2 key management with this option.
1123
Reference Manual
13 Wireless LAN (WLAN)
5
Although it is possible to make multiple selections, this is advisable only if you are sure that the clients attempting
to login to the access point are compatible. Unsuitable clients deny the connection if an option other than
Standard is enabled.
SNMP ID:
2.23.20.20.19
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
SHA256
Enables key management according to the IEEE 802.11w standard with keys based on SHA-256.
Standard
Enables key management according to the IEEE 802.11i standard without Fast Roaming and with keys
based on SHA-1. Depending on the configuration, the WLAN clients in this case must use opportunistic
key caching, PMK caching or pre-authentication.
Default:
Standard
13.18.4 Flexible WLAN capture format
As of LCOS 9.00, different formats are available for storing WLAN packet-capture data.
Additions to the Setup menu
Packet-Capture
This menu contains the settings for packet capturing.
SNMP ID:
2.12.86
Telnet path:
Setup > WLAN
WLAN-Capture-Format
With this setting you specify the format used by the packet capture function to store the WLAN-specific information in
the capture file.
The selection of the appropriate capture format depends on the transmission standard in your WLAN network and the
scope of the information that you would like to capture. The IEEE 802.11 standard with its numerous extensions has
grown over many years. However, the capture formats that were developed in parallel are not flexible enough to cater
optimally for every extension (particularly 802.11n). For this reason there is no universal capture format which is equally
suitable for all standards. However, there are recommendations that cover a wide spectrum of standards:
Radiotap
and
PPI
.
1124
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.12.86.1
Telnet path:
Setup > WLAN > Packet-Capture
Possible values:
Radiotap
Uses the radiotap header. Radiotap is a widely accepted format on Linux and BSD WLAN drivers which
enables the creation of compact captures due to its flexible structure. With radiotap you can record a
large amount of WLAN-specific information with a high compression rate. This also applies to data
packets from 802.11n compliant connections. Limitations only arise when recording antenna-specific
RSSI and signal strength as well as aggregations (A-MPDU). If you do not require detailed WLAN-specific
information for this, choose the PPI format instead.
AVS
Uses the AVS header. The AVS header is a newer development of the PRISM header, and is used by
LCOS as the standard header up to version 8.60. However, since AVS is also unable to process information
from 802.11n compliant connections, you should choose the more powerful radiotap header.
PPI
Uses the proprietary Wireshark PPI header. Use this setting if you want to analyze the capture file with
Wireshark. PPI offers similar functions as radiotap but can also bypass its limitations on the recording
of information about 802.11n compliant connections. A disadvantage to radiotap is, however, the
weaker compression and less detailed header structure.
PRISM
Uses the classic PRISM header. Only use this setting if you want to analyze the capture file with a
program which does not support any of the other formats. PRISM is not suitable for recording information
from 802.11n compliant connections. In the meantime this is considered obsolete and should no longer
be used.
Plain
Disables all headers. Use this setting if you are only interested in the packet data itself.
Default:
Radiotap
13.18.5 Band steering with delayed scan at 2.4 GHz
With an AP as of LCOS version 9.00, you can delay the band steering to the 2.4-GHz band under Wireless LAN > Band
steering.
Initial block time
If an access point with a 5-GHz DFS radio module is put into operation for the first time, and also following
a restart, it cannot detect any dual-band capable WLAN clients during the DFS scan. As a result, the access
point cannot direct a WLAN client to a preferred 5-GHz band. Instead, the 2.4-GHz radio module would
answer the client request and forward it to the 2.4-GHz band.
1125
Reference Manual
13 Wireless LAN (WLAN)
By setting an initial block time, the radio module that is configured to 2.4-GHz only responds to client requests
after the specified delay. The default value is 10 seconds.
The delayed response to the 2.4GHz probes causes WLAN clients, which would otherwise expect to find an
access point in the 2.4GHz band, to scan again in the 5GHz band.
4
Registration of a purely 2.4-GHz WLAN client also occurs after this delay time. If no 5-GHz WLAN
clients are present in the network, the delay time should be set to 0 seconds.
On the WLC you activate client steering for an AP under WLAN controller > Profiles > Physical WLAN parameters
using the selection list Client steering. Refer to section
Client steering by WLC
on page 1387 for further information on
this.
Additions to the Setup menu
Initial block time
If an access point with a 5-GHz DFS radio module is put into operation for the first time, and also following a restart, it
cannot detect any dual-band capable WLAN clients during the DFS scan. As a result, the access point cannot direct a
WLAN client to a preferred 5-GHz band. Instead, the 2.4-GHz radio module would respond to the client request and
direct it to the 2.4-GHz band.
By entering an initial block time, the access point's 2.4-GHz radio module only starts after the delay set here.
4
Registration of a purely 2.4-GHz WLAN client also occurs after this delay time. If no 5-GHz WLAN clients are
present in the network, the delay time should be set to 0 seconds.
SNMP ID:
2.12.87.5
Telnet path:
Setup > WLAN > Client-Steering
Possible values:
Max. 10 characters from 0123456789
Special values:
0
This value disables the delay.
Default:
10
13.18.6 Advanced wireless LAN traces
As of LCOS version 9.00, management frame classes can be separately selected for a WLAN data trace. The settings can
be found in WEBconfig under Setup > WLAN. The menu item Setup > WLAN > Trace-Beacons is no longer available
as of LCOS 9.00.
Trace-Mgmt-Packets
With this selection it is possible to set which type of management frames should automatically appear in the
WLAN-DATA trace
1126
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Association: (Re)Association Request/Response, Disassociate
Authentication: Authentication, Deauthentication
Probes: Probe Request, Probe Response
Action
Beacon
Other: all other management frame types
Default:
Association
Authentication
Probes
Action
Other
Additions to the Setup menu
Trace-Mgmt-Packets
With this selection it is possible to set which type of management frames should automatically appear in the WLAN-DATA
trace
SNMP ID:
2.12.124
Telnet path:
Setup > WLAN
Possible values:
Association
(Re)association request/response
Disassociate
Authentication
Authentication
Deauthentication
Probes
Probe request
Probe response
Action
Beacon
Other
All other management frame types
1127
Reference Manual
13 Wireless LAN (WLAN)
Default:
Association
Authentication
Probes
Action
Other
Trace-Data-Packets
With this selection it is possible to set which type of data frames should automatically appear in the WLAN-DATA trace
SNMP ID:
2.12.125
Telnet path:
Setup > WLAN
Possible values:
Normal
All normal data packets
NULL
All empty data packets
Other
All other data packets
13.18.7 Fast roaming as per IEEE 802.11r
As of LCOS 9.00, access points support fast roaming according to the standard IEEE 802.11r.
Fast roaming
By operating authentication according to the IEEE 802.1X standard and key management according to the IEEE 802.11i
standard, modern WLAN installations offer a high degree of security and confidentiality for the transmitted data. However,
these standards require transmission of additional data packets during the connection negotiation as well as additional
computing power on the client and server.
Currently, WLAN devices have hardware accelerators, which perform the real-time encryption and decryption of payload
data during a connection without noticeable delays or conspicuous network loading. In the meantime, because sufficient
computing power is available, the creation of keys on the client side no longer causes any noticeable delays.
The delays when connecting via EAP/802.1X or WPA are therefore mostly related to the time that the client and server
require to negotiate the security protocol during login.
The original IEEE 802.11 only required up to six data packets to establish a data connection between a WLAN client and
an access point. The standard extension IEEE 802.11i improved on weak points of WEP encryption; however, depending
on the authentication method, it substantially increased the length of the login process.
1128
Reference Manual
13 Wireless LAN (WLAN)
This extra time for the WLAN client to login to the access point is not a problem for non-time-critical applications.
However, for smooth, loss-free roaming of a WLAN client from one access point to the next (as required, for example,
for Voice-over-IP applications or in industrial, real-time environments), a delay of more than 50 ms is not acceptable.
Methods such as pair-wise master key caching (PMK caching), pre-authentication, opportunistic key caching (OKC) and
the use of central WLAN controllers for key management improve the time for the key negotiation between the WLAN
client and access point during login. Despite this, the comparatively long time required for key negotiation between the
WLAN client and the access point has still not been reduced to a viable extent.
Along with the improved encryption protocols, IEEE 802.11e makes it possible to reserve additional bandwidth with the
access point. This allows the WLAN client to prevent interruptions, for example for VoIP connections at times of high
network loads at the access point. For roaming from one access point to the next, the WLAN client must again reserve
this additional bandwidth on the new access point. However, the additional management frames required for this
considerably increase the login time.
The IEEE 802.11r standard provides a simplified authentication process for mobile WLAN clients to roam trouble-free
from one access point to the next. The goal is to once again reduce the number of data packets for the login on the
access point to the four to six packets known from 802.11.
Similar to opportunistic key caching (OKC), a centralized key management (preferably by a WLAN controller) supplies
the access points connected to it with the credentials of the WLAN clients. In contrast to OKC, the WLAN client performing
fast roaming can detect whether the access point supports 802.11r
Access points managed by the WLAN controller transmit the mobility domain information element (MDIE) to inform the
WLAN clients about which "mobility group" the access point belongs to, among other things. Based on this information,
the WLAN client detects whether it belongs to the same domain and can therefore authenticate without delay. This
mobility domain is announced to a WLAN client the first time it authenticates at an access point.
The domain identifier and other special keys generated during the initial authentication and transmitted to all managed
access points now reduce the stages of negotiation to the desired four to six steps when authenticating at a new access
point.
To avoid futile and thus time-wasting login attempts with expired PMKs, IEEE 802.11r provides additional information
about the validity periods of keys. In this manner, the client negotiates a new PMK while connected to the current access
point. This is also valid on the access point that the WLAN client wants to connect to next.
Additionally, IEEE 802.11r uses "resource requests" to reserve additional bandwidth on the new access point, so that
there is no need to cause added delay by transferring unnecessary data packets during the IEEE 802.11e authentication.
4
Older WLAN clients may have trouble establishing a connection to an SSID with enabled 802.11r. Therefore, it
is advisable to use two SSIDs here: One SSID for older clients without 802.11r support and another SSID with
enabled 802.11r for clients that support 802.11r.
Fast roaming is setup in LANconfig under Wireless LAN > 802.11i/WEP > WPA or private WEP settings.
1129
Reference Manual
13 Wireless LAN (WLAN)
Configuration
WPA2 key management
Here you specify which standard the WPA2 key management should follow. Possible values are:
1
Standard: Enables key management according to the IEEE 802.11i standard without Fast Roaming and
with keys based on SHA-1. Depending on the configuration, the WLAN clients in this case must use
opportunistic key caching, PMK caching or pre-authentication.
1
SHA256: Enables key management according to the IEEE 802.11w standard with keys based on SHA-256.
1
Fast roaming: Enables fast roaming as per 802.11r
1
Combinations of the three settings
5
Although it is possible to make multiple selections, this is advisable only if you are sure that the clients
attempting to login to the access point are compatible. Unsuitable clients may refuse a connection if
an option other than Standard is enabled.
Additions to the Status menu
Fast roaming
Indicates whether the wireless client uses fast roaming.
SNMP ID:
1.3.32.63
Telnet path:
Status > WLAN > Station-table
WPA2-Key-Management
Indicates which WPA2 key management the wireless client is using.
1130
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
1.3.32.64
Telnet path:
Status > WLAN > Station-table
WPA2-Key-Management
Indicates which WPA2 key management is used by the P2P access point.
SNMP ID:
1.3.36.1.44
Telnet path:
Status > WLAN > Interpoints > Access-point-list
WPA2-Key-Management
Indicates which WPA2 key management is used by the access point in client mode.
SNMP ID:
1.3.43.51.40
Telnet path:
Status > WLAN > Client > Interfaces
Additions to the Setup menu
WPA2-Key-Management
You configure the WPA2 key management with this option.
5
Although it is possible to make multiple selections, this is advisable only if you are sure that the clients attempting
to login to the access point are compatible. Unsuitable clients deny the connection if an option other than
Standard is enabled.
SNMP ID:
2.23.20.3.19
Telnet path:
Setup > Interfaces > WLAN > Encryption
Possible values:
Fast roaming
Enables Fast Roaming via 802.11r
SHA256
Enables key management according to the IEEE 802.11w standard with keys based on SHA-256.
1131
Reference Manual
13 Wireless LAN (WLAN)
Standard
Enables key management according to the IEEE 802.11i standard without Fast Roaming and with keys
based on SHA-1. Depending on the configuration, the WLAN clients in this case must use opportunistic
key caching, PMK caching or pre-authentication.
Default:
Standard
WPA2-Key-Management
You can configure the WPA2 key management with this option.
5
Although it is possible to make multiple selections, this is advisable only if you are sure that the clients attempting
to login to the access point are compatible. Unsuitable clients deny the connection if an option other than
Standard is enabled.
SNMP ID:
2.23.20.20.19
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
SHA256
Enables key management according to the IEEE 802.11w standard with keys based on SHA-256.
Standard
Enables key management according to the IEEE 802.11i standard without Fast Roaming and with keys
based on SHA-1. Depending on the configuration, the WLAN clients in this case must use opportunistic
key caching, PMK caching or pre-authentication.
Default:
Standard
WPA2-Key-Management
You configure the WPA2 key management with this option.
5
Although it is possible to make multiple selections, this is advisable only if you are sure that the clients attempting
to login to the access point are compatible. Unsuitable clients deny the connection if an option other than
Standard is enabled.
SNMP ID:
2.37.1.1.41
1132
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
Fast roaming
Enables Fast Roaming via 802.11r
SHA256
Enables key management according to the IEEE 802.11w standard with keys based on SHA-256.
Standard
Enables key management according to the IEEE 802.11i standard without Fast Roaming and with keys
based on SHA-1. Depending on the configuration, the WLAN clients in this case must use opportunistic
key caching, PMK caching or pre-authentication.
Default:
Standard
13.18.8 WPA2 with AES as factory setting
As of LCOS 9.00, WPA2 encryption in LANconfig and LCOS uses the session key type AES by default.
13.18.9 WLAN protected management frames (PMF)
By default, the management information transmitted on a WLAN for establishing and operating data connections
is unencrypted. Anybody within a WLAN cell can receive this information, even those who are not associated with an
access point. Although this does not entail any risk for encrypted data connections, the injection of fake management
information could severely disturb the communications within a WLAN cell.
The IEEE 802.11w standard encrypts this management information, meaning that potential attackers can no longer
interfere with the communications without the corresponding key.
1133
Reference Manual
13 Wireless LAN (WLAN)
To enable protected management frames for a logical WLAN interface, in LANconfig you navigate to Wireless LAN >
802.11i/WEPWPA or Private WEP settings, open the configuration of the appropriate WLAN interface and click the
appropriate option in the selection list Encrypt mgmt. frames.
To encrypt the management frames for P2P connections between base stations, in LANconfig you navigate to Wireless
LAN > General, click on Physical WLAN settings and click the appropriate option in the selection list Encrypt mgmt.
frames.
1134
Reference Manual
13 Wireless LAN (WLAN)
To manage the encryption of management frames for a WLAN controller, in LANconfig you navigate to WLAN Controller >
Profiles, click on Logical WLAN networks (SSIDs) and click the appropriate option in the selection list Encrypt mgmt.
frames.
The following options are available in each of these configurations:
No
The WLAN interface does not support PMF. The WLAN management frames are not encrypted.
Mandatory
The WLAN interface supports PMF. The WLAN management frames are always encrypted. It is not possible
to connect with WLAN clients that do not support PMF.
Optional
The WLAN interface supports PMF. Depending on the WLAN client's PMF support, the WLAN management
frames are either encrypted or unencrypted.
1135
Reference Manual
13 Wireless LAN (WLAN)
LANmonitor displays information about WLAN management frame encryption below each client.
Additions to the Status menu
Prot.-Mgmt-Frames
Indicates whether the WLAN client has established a PMF-protected connection.
SNMP ID:
1.3.32.67
Telnet path:
Status > WLAN > Station-table
Possible values:
No
Yes
Prot.-Mgmt-Frames
Indicates whether the corresponding network supports PMF.
SNMP ID:
1.3.34.47
Telnet path:
Status > WLAN > Scan-Results
1136
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
No
Yes
Optional
Prot.-Mgmt-Frames
Indicates whether PMF is enabled on the corresponding P2P link.
SNMP ID:
1.3.36.1.47
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
No
Yes
Key type
Shows the session key type for the P2P connection.
SNMP ID:
1.3.36.3.3
Telnet path:
Status > WLAN > Interpoints > Key-list
Possible values:
None
Unknown
WEP 40-bit
WEP-104-bit
WEP-128-bit
TKIP
AES-OCB
AES-CCM
BIP
The type "Broadcast Integrity Protection" indicates that the AP secures the management frames that
are sent as broadcasts or multicasts to several clients.
1137
Reference Manual
13 Wireless LAN (WLAN)
RSC-MGMT
Shows the sequence counter of the last received encrypted management frame. This value is use for protection from
replay.
SNMP ID:
1.3.36.3.24
Telnet path:
Status > WLAN > Interpoints > Key-list
Key type
Shows the session key type for the P2P connection.
SNMP ID:
1.3.41.3
Telnet path:
Status > WLAN > Group-encryption-keys
Possible values:
None
Unknown
WEP 40-bit
WEP-104-bit
WEP-128-bit
TKIP
AES-OCB
AES-CCM
BIP
The type "Broadcast Integrity Protection" indicates that the AP secures the management frames that
are sent as broadcasts or multicasts to several clients.
RSC-MGMT
Shows the sequence counter of the last received encrypted management frame. This value is use for protection from
replay.
SNMP ID:
1.3.41.24
Telnet path:
Status > WLAN > Group-encryption-keys
1138
Reference Manual
13 Wireless LAN (WLAN)
RSC-MGMT
Shows the sequence counter of the last received encrypted management frame. This value is use for protection from
replay.
SNMP ID:
1.3.42.23
Telnet path:
Status > WLAN > Channel-scan-results
Prot.-Mgmt-Frames
Indicates whether the corresponding WLAN interface in client mode has established a PMF-protected connection.
SNMP ID:
1.3.43.51.41
Telnet path:
Status > WLAN > Client > Interfaces
Possible values:
No
Yes
Prot.-Mgmt-Frames
Indicates whether the corresponding network supports PMF.
SNMP ID:
1.3.44.47
Telnet path:
Status > WLAN > Competing-networks
Possible values:
No
Yes
Optional
Key type
Shows the session key type for the P2P connection.
1139
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
1.3.47.3
Telnet path:
Status > WLAN > Pairwise-keys
Possible values:
None
Unknown
WEP 40-bit
WEP-104-bit
WEP-128-bit
TKIP
AES-OCB
AES-CCM
BIP
The type "Broadcast Integrity Protection" indicates that the AP secures the management frames that
are sent as broadcasts or multicasts to several clients.
RSC-MGMT
Shows the sequence counter of the last received encrypted management frame. This value is use for protection from
replay.
SNMP ID:
1.3.47.24
Telnet path:
Status > WLAN > Pairwise-keys
Prot.-Mgmt-Frames
Indicates whether the corresponding WLAN interface supports PMF.
SNMP ID:
1.3.55.41
Telnet path:
Status > WLAN > Competing-networks
1140
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
No
Yes
Additions to the Setup menu
Prot.-Mgmt-Frames
By default, the management information transmitted on a WLAN for establishing and operating data connections
is unencrypted. Anybody within a WLAN cell can receive this information, even those who are not associated with an
access point. Although this does not entail any risk for encrypted data connections, the injection of fake management
information could severely disturb the communications within a WLAN cell.
The IEEE 802.11w standard encrypts this management information, meaning that potential attackers can no longer
interfere with the communications without the corresponding key.
Here you can specify whether the corresponding WLAN interface supports protected management frames (PMF) as per
IEEE 802.11w.
SNMP ID:
2.23.20.3.14
Telnet path:
Setup > Interfaces > WLAN > Encryption
Possible values:
No
The WLAN interface does not support PMF. The WLAN management frames are not encrypted.
Mandatory
The WLAN interface supports PMF. The WLAN management frames are always encrypted. It is not
possible to connect with WLAN clients that do not support PMF.
Optional
The WLAN interface supports PMF. Depending on the WLAN client's PMF support, the WLAN management
frames are either encrypted or unencrypted.
Default:
No
Prot.-Mgmt-Frames
By default, the management information transmitted on a WLAN for establishing and operating data connections
is unencrypted. Anybody within a WLAN cell can receive this information, even those who are not associated with an
access point. Although this does not entail any risk for encrypted data connections, the injection of fake management
information could severely disturb the communications within a WLAN cell.
The IEEE 802.11w standard encrypts this management information, meaning that potential attackers can no longer
interfere with the communications without the corresponding key.
Here you can specify whether the corresponding WLAN interface supports protected management frames (PMF) as per
IEEE 802.11w.
1141
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.23.20.20.14
Telnet path:
Setup > Interfaces > WLAN > Interpoint-Encryption
Possible values:
No
The WLAN interface does not support PMF. The WLAN management frames are not encrypted.
Mandatory
The WLAN interface supports PMF. The WLAN management frames are always encrypted. It is not
possible to connect with WLAN clients that do not support PMF.
Optional
The WLAN interface supports PMF. Depending on the WLAN client's PMF support, the WLAN management
frames are either encrypted or unencrypted.
Default:
No
Prot.-Mgmt-Frames
By default, the management information transmitted on a WLAN for establishing and operating data connections
is unencrypted. Anybody within a WLAN cell can receive this information, even those who are not associated with an
access point. Although this does not entail any risk for encrypted data connections, the injection of fake management
information could severely disturb the communications within a WLAN cell.
The IEEE 802.11w standard encrypts this management information, meaning that potential attackers can no longer
interfere with the communications without the corresponding key.
Here you can specify whether the corresponding WLAN interface supports protected management frames (PMF) as per
IEEE 802.11w.
SNMP ID:
2.37.1.1.43
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
No
The WLAN interface does not support PMF. The WLAN management frames are not encrypted.
Mandatory
The WLAN interface supports PMF. The WLAN management frames are always encrypted. It is not
possible to connect with WLAN clients that do not support PMF.
Optional
The WLAN interface supports PMF. Depending on the WLAN client's PMF support, the WLAN management
frames are either encrypted or unencrypted.
1142
Reference Manual
13 Wireless LAN (WLAN)
Default:
No
13.18.10 Redundant connections using PRP
Applications that are sensitive to connection failures require uninterrupted communications. Examples are to be found
in automation, transport and mobile applications.
As of LCOS 9.00, you have the option of operating redundant connections in your WLAN by means of the parallel
redundancy protocol (PRP). Redundant point-to-point links offer you a high level of failover reliability.
PRP achieves high failover reliability by sending twin packets over 2 independent WLANs. While 1 WLAN is active, PRP
transports data packets.
Basic function
PRP devices act as the sender and receiver of PRP packets, whereby PRP devices are capable of assuming both roles.
The sender operates as follows:
1. It duplicates packets to produce twin pakets, and sends them over 2 independent (W)LANs.
2. Each packet is given a redundancy control trailer (RCT).
The RCT provides the following information for the recipient:
1
It identifies the packet as a PRP packet.
1
It contains a sequence ID.
1
It shows which (W)LAN the packet arrived from.
1
It contains the packet size.
The sequence ID is a consecutive incremented number. The sequence ID together with the the source MAC address allow
the receiver to detect duplicate packets. Duplicate detection causes the packet arriving later to be discarded.
The receiver operates as follows:
1
It reads the RCT.
1
It forwards the first of the duplicated packets without its RCT.
1
Through duplicate detection, the receiver discards the packet that arrives later.
Advantages of WLAN PRP
The functions of PRP offer you significant advantages for your WLAN. In practice, PRP improves the 3 most important
quality indicators for a network: Jitter, latency and packet loss.
With PRP, the receivers will accept and forward the first copy of the PRP packets and discard those that arrive later.
Because the devices always forward the first incoming packet, latency is reduced. In practice, significant improvements
were seen to average and maximum jitter.
Like Ethernet, WLAN is designed to be a shared medium. Within a single WLAN connection, the devices hold back packets
if the medium is busy. Because the devices with PRP transport the data via 2 different WLANs, in effect 2 media are
available thanks to frequency division.
1143
Reference Manual
13 Wireless LAN (WLAN)
Because the devices send each packet twice, PRP can to some extent compensate for unsystematic packet loss. As long
as the receiver receives one of the packets, then communication was successful. Under certain circumstances there is
no need to retransmit lost packets, which also positively affects jitter.
Implementation of PRP in the access points
Any access point (AP) with at least 3 interfaces can be used to setup a PRP network. The AP handles all of the functions
necessary for establishing a PRP network.
The devices offer the following options:
1. PRP networks can be implemented via wireless interfaces
2. Each device can implement up to 2 PRP networks
3. In addition to a PRP network, connect additional clients to an AP
4. Activate dual roaming so that the 2 WLAN modules can roam asynchronously with PRP.
5. Comprehensive diagnostic options
Dual roaming
A device with just 1 WLAN module will lose its connection to the infrastructure in a handover scenario.
However, a device with 2 WLAN modules can use PRP to reduce interruptions if the corresponding LANconfig setting
prevents both WLAN modules from roaming at the same time. This mode is called dual roaming.
1144
Reference Manual
13 Wireless LAN (WLAN)
A practical example is a client moving past an access point. Due to the design of the network, one WLAN module stays
connected and receives PRP packets, while the other WLAN module can already associate with the next AP.
A concrete example would be for materials management, and for the real-time monitoring of inventory flow in particular.
Another example is the railway. An AP in a train connects to the trackside APs throughout the journey.
In addition, you can specify the block time in LANconfig. The block time specifies the minimum time that passes before
the different WLAN modules of the same device can perform roaming operations.
Diagnostic options
Recipients of PRP packets discard duplicates during normal operation and remove the RCT from packets that they pass
on to their bundled output port.
LCOS provides you the following options to assist you in network diagnostics:
1. Forwarding packet duplicates without RCT
2. Forwarding single packets with RCT
3. Forwarding packet duplicates with RCT
LCOS also features the following trace options:
1. trace # PRP-DATA
2. trace # PRP-NODES
PRP-DATA contains information about packets that are sent and received. Information included: Name of the interface
group transporting the packet: Direction of transport of the packet (RX|TX): Trailer sequence number: MAC address of
the partner device: Interface within the PRP group (A|B) transporting the packet: Treatment of the packet (accept|discard)
PRP-NODES contain the following information: Removed new address (proxy) node table address from the table (proxy)
node, node type an address has changed.
1145
Reference Manual
13 Wireless LAN (WLAN)
Tutorial: Setting up a PRP connection over a point-to-point network (P2P)
4
The following steps must be conducted for both P2P partners.
Proceed as follows to set up a P2P connection between two PRP-enabled APs:
1. Under Wireless LAN > General > Physical WLAN settings, go to the Operation tab for each physical WLAN
interface (WLAN interface 1, WLAN interface 2) and, on the Point-to-point tab, enable the Point-2-Point operation
mode.
2. In the field Station name, give each of the physical WLAN interfaces a name that is unique on the WLAN. If the
P2P partner can or should identify this interface using the MAC address, leave this field blank.
5
In order for PRP to operate smoothly, the two instances of PRP must be operating on separate physical
interfaces. If you are operating PRP on two logical interfaces of a single physical interface (e.g. "P2P-1-1"
and "P2P-1-2"), then the device transmits the data sequentially. Apart from causing a loss of redundancy,
this can also lead to delays in data transmission and a reduction in the bandwidth.
3. Under Wireless LAN > General > Point-to-point partners, enable the point-to-point channels "P2P-1-1" and
"P2P-2-1" and specify the interface identifier for each point-to-point partner (MAC address or Station name).
Specify either the MAC address or the station name of the corresponding WLAN interface of the P2P partner. You
set these station names in the previous step.
1146
Reference Manual
13 Wireless LAN (WLAN)
4. Open the PRP configuration under Interfaces > LAN with a click on PRP interfaces.
5. Enable the PRP interfaces and set the interfaces that the AP uses for bundling.
Here you select the previously activated point-to-point interfaces "P2P-1-1" and "P2P-2-1".
5
In order for PRP to operate smoothly, the two instances of PRP must be operating on separate physical
interfaces. If you are operating PRP on two logical interfaces of a single physical interface (e.g. "P2P-1-1"
and "P2P-1-2"), then the device transmits the data sequentially. Apart from causing a loss of redundancy,
this can also lead to delays in data transmission and a reduction in the bandwidth.
1147
Reference Manual
13 Wireless LAN (WLAN)
6. You can accept the advanced settings from the default configuration by clicking on OK.
This completes the setup of a PRP connection over a point-to-point network.
Tutorial: Roaming with a dual-radio client and PRP
A common way to increase the resilience of a WLAN infrastructure is to operate the various APs in different frequency
bands. One way to implement this is for the physical WLAN interfaces of the APs to operate SSID-1 on the 2.4-GHz band
and SSID-2 on the 5-GHz band, for example. A PRP-capable dual-radio client moving from the radio cell of one physical
WLAN interface to a neighboring cell of the same infrastructure can experience uninterrupted cell switching thanks to
PRP.
To do this, the dual-radio client using PRP initially connects its physical WLAN interface WLAN-1 to SSID-1 and WLAN-2
to SSID-2. If the reception for SSID-1 deteriorates and another radio cell with better reception is within range, the
dual-radio client will perform a cell change. During the cell change the dual-radio client continues to send the data via
WLAN-2 on SSID-2, while WLAN-1 already starts sending the same data with better reception on SSID-1. A PRP-enabled
switch filters out the duplicate PRP packets before forwarding the data to the LAN.
4
In this scenario, the APs in the WLAN infrastructure do not have to be configured to operate PRP.
In order for the receiver to detect duplicate data packets, the APs in the WLAN infrastructure must be operating in
client-bridge mode. The MAC address of the dual-radio client together with the RCT ensure that the receiver detects the
duplicate packets. Without client-bridge support, an AP in the WLAN infrastructure would replace the MAC address of
the dual-radio client with its own MAC address, so preventing the detection of duplicates.
1148
Reference Manual
13 Wireless LAN (WLAN)
Client-bridge support is enabled with LANconfig under Wireless LAN > General > Logical WLAN settings on the
Network tab.
The PRP configuration of the dual-radio clients involves the following steps:
1. Under Wireless LAN > General > Physical WLAN settings, go to the Operation tab for each WLAN interface
(WLAN interface 1, WLAN interface 2) and set the WLAN operation mode for each one to Client.
Specify the remaining WLAN parameters under Radio, Performance, Encryption and Client mode according to
the requirements of the WLAN radio cells.
5
In order for PRP to operate smoothly, the two instances of PRP must be operating on separate physical
interfaces. If you are operating PRP on two logical interfaces of a single physical interface (e.g. "P2P-1-1"
and "P2P-1-2"), then the device transmits the data sequentially. Apart from causing a loss of redundancy,
this can also lead to delays in data transmission and a reduction in the bandwidth.
1149
Reference Manual
13 Wireless LAN (WLAN)
2. To enter the SSID, switch to the view Wireless LAN > General, click Logical WLAN settings and, for each WLAN
interface, select network 1.
3. In the field Network name (SSID), enter the name of the WLAN which the WLAN interface is to be connected to.
4. Under Wireless LAN > General in the section Extended settings, disable the option Allow simultaneous roaming
for both WLAN interfaces.
By deactivating the parallel roaming, you prevent the two physical WLAN interfaces from roaming at the same time
or performing background scans. The result could be that both could lose connectivity to their radio cell.
When configured in this way, the dual-radio client can move past a line of APs and roam between the individual APs .
Additions to the Setup menu
Interface bundling
This table contains the settings for bundling the physical and logical interfaces.
By bundling interfaces, it is possible to transmit data packets on two paired interfaces. To do this, the device duplicates
outgoing data packets and transmits them on each of the two interfaces simultaneously. When receiving packets, the
device accepts the incoming packets; duplicates are detected and discarded by the device.
Using interface bundling makes it possible to reduce packet failure rates and latency times for data transmissions,
although this does reduce the maximum bandwidth of the corresponding interface.
SNMP ID:
2.4.13.11.1
1150
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > LAN
Interfaces
This menu contains the settings for interface bundling.
SNMP ID:
2.4.13.1
Telnet path:
Setup > LAN > Interface-Bundling
Interface
This parameter indicates shows the logical cluster interface used for bundling the selected logical and physical interfaces
of the devices.
SNMP ID:
2.4.13.1.1
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
Possible values:
BUNDLE-1
BUNDLE-2
Operating
Using this parameter, you enable or disable interface bundling.
With bundling enabled, the device groups the selected device interfaces together under one shared logical bundle
interface. In the disabled state the interfaces A and B that are selected in the corresponding table can still be used as
individual interfaces.
SNMP ID:
2.4.13.1.2
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
1151
Reference Manual
13 Wireless LAN (WLAN)
Possible values:
Yes
No
Default:
No
Protocol
Set the protocol that is used for interface bundling using these parameters.
SNMP ID:
2.4.13.1.3
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
Possible values:
PRP
Sets the Parallel Redundancy Protocol (PRP).
MAC address
Using this parameter you can set an alternative MAC address for use by the corresponding bundle interface.
SNMP ID:
2.4.13.1.4
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
Possible values:
Max. 12 characters from [a-f][0-9]
Special values:
empty
If you leave this field empty, the device uses the system-wide MAC address.
Default:
Depends on the MAC address of your device
1152
Reference Manual
13 Wireless LAN (WLAN)
Interface-A
Using this parameter you select the 1st physical or logical link that this device bundles.
SNMP ID:
2.4.13.1.5
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
Possible values:
Select from the available interfaces.
Default:
WLAN-1
Interface-B
Using this parameter you select the 2nd physical or logical link that this device bundles.
SNMP ID:
2.4.13.1.6
Telnet path:
Setup > LAN > Interface-bundling > Interfaces
Possible values:
Select from the available interfaces.
Default:
WLAN-2
Interfaces
This menu contains the settings for PRP as the bundling protocol.
SNMP ID:
2.4.13.11
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Interfaces
This table contains the interfaces with all PRP-relevant settings.
1153
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.4.13.11.1
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Interface
The parallel redundancy protocol (PRP) makes redundant transmissions on two (bundled) interfaces. To use this, you
select two interfaces which the device internally combines into one interface. The device duplicates outgoing packets so
that the packets are transmitted on each of the two interfaces. On the receiving side, the device recognizes the duplicates
and discards them. This leads to a reduced packet error rate and to lower latency on the bundled interface in comparison
to transmission on a single interface. Enter the name for this interface here.
SNMP-ID:
2.4.13.11.1.1
Pfad Telnet:
Setup > LAN > Interface-bundling > PRP > Interfaces
Mögliche Werte:
Max. 18 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Duplicate-accept
Switches the forwarding of packet duplicates on or off.
SNMP ID:
2.4.13.11.1.2
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
Special values:
Yes
No
Transparent-mode
Switches the transparent operation mode on/off. If the transparent operation mode is enabled, the recipient of the PRP
packets forwards the packets with a redundancy control trailer.
SNMP ID:
2.4.13.11.1.3
1154
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
Yes
No
Default:
No
Life-Check-Interval
Specifies how often the device sends control packets.
SNMP ID:
2.4.13.11.1.4
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
100 … 60000 Milliseconds
Default:
2000
Node-forget-time
Enters the time until the device deletes a node from its node table or proxy node table.
SNMP ID:
2.4.13.11.1.5
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
1000 … 3600000 Milliseconds
Default:
60000
Entry-forget-time
Specifies as of when the device deletes the entry from the duplicate-detection buffer.
1155
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.4.13.11.1.6
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
10 … 60000 Milliseconds
Default:
400
Node-Reboot-Interval
Specifies the time that a PRP device passively monitors a link until the device sends packets over the link.
SNMP ID:
2.4.13.11.1.7
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
0 … 60000 Milliseconds
Default:
500
Dup-Elimination-Buffer-Size
Limits the number of entries in the duplicate-detection memory.
SNMP ID:
2.4.11.1.8
Telnet path:
Setup > LAN > Interface-bundling > PRP > Interfaces
Possible values:
16 … 65536 Entries/Nodes
Default:
8192
Send supervision packets
Specifies the settings for sending supervision packets.
1156
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.4.13.11.1.9
Telnet path:
LAN > Interface-bundling > PRP > Interfaces
Possible values:
0
None
1
Own-MAC-only
2
All-nodes
Default:
2
Node-Name
The node name is the identifier for the node. You can specify any name.
SNMP-ID:
2.4.13.11.1.10
Pfad Telnet:
Setup > LAN > Interface-bundling > PRP > Interfaces
Mögliche Werte:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Evaluate-Sup.-Frames
Switches the monitoring of control packages on or off.
SNMP-ID:
2.4.13.11.1.11
Pfad Telnet:
Setup > LAN > Interface-bundling > PRP > Interfaces
1157
Reference Manual
13 Wireless LAN (WLAN)
Mögliche Werte:
Yes
No
Default-Wert:
Yes
13.19 Addition(s) to LCOS 9.10
13.19.1 Upgrade to 16 SSIDs per WLAN module
As of LCOS version 9.10 IEEE 802.11n WLAN modules support up to 16 SSIDs and IEEE 802.11ac WLAN modules support
15 SSIDs.
WLCs with the LCOS version 9.10 manage up to 16 SSIDs per AP profile.
For each WLAN profile you can specify the following parameters under WLAN controller > Profiles > WLAN profiles:
13.19.2 WLAN disabled by default
As of LCOS version 9.10, all of the WLAN interfaces of the WLAN routers are disabled by default.
13.19.3 Wildcards for MAC address and SSID filters
As of LCOS version 9.10 wildcards (* and ?) can be used to specify MAC addresses. You can also restrict access by WLAN
clients to specific SSIDs.
4
In WEBconfig, the new station list replaces the previous station list under Setup > WLAN > Access-list (APs)
or Setup > WLAN-management > Access-list (WLCs).
When updating to the new version, LCOS takes the available values from the existing station list.
1158
Reference Manual
13 Wireless LAN (WLAN)
Table 10: Overview of all possible traces
...causes the following message in the trace:This parameter ...
Status messages about MAC filtering rules.
WLAN-ACL
4
The display depends on how the WLAN data trace is configured. If a MAC
address is specified there, the trace shows only the filter results relating
to that specific MAC address.
Access-control list
With the Access Control List (ACL) you can permit or prevent individual WLAN clients accessing your WLAN. The decision
is based on the MAC address that is permanently programmed into WLAN adapters.
5
If you are centrally managing your LANCOM WLAN routers and LANCOM APs with a WLC, you will find the
station table under WLAN controller > Stations under the button Stations.
Check under Wireless LAN > Stations to see if the setting Filter out data from the listed stations, transfer all
other is activated. New stations to be included in your wireless network are added with the button Stations.
MAC address pattern
MAC address of the WLAN client for this entry. The following entries are possible:
Individual MAC address
A MAC address in the format 00a057112233, 00-a0-57-11-22-33 or 00:a0:57:11:22:33.
Wildcards
The wildcards '*' and '?' uses to specify MAC address ranges, e.g. 00a057*, 00-a0-57-11-??-??
or 00:a0:??:11:*.
Vendor ID
The device contains a list of the major manufacturer OUIs (organizationally unique identifier). The MAC address
range is valid if this entry matches the first three bytes of the MAC address of the WLAN client.
4
It is possible to use wildcards.
SSID pattern
WLAN clients with the corresponding MAC addresses have access that is limited to this SSID.
4
The use of wildcards makes it possible to allow access to multiple SSIDs.
1159
Reference Manual
13 Wireless LAN (WLAN)
Name
You can enter any name you wish and a comment for any WLAN client. This enables you to assign MAC
addresses more easily to specific stations or users.
Passphrase
Here you may enter a separate passphrase for each physical address (MAC address) that is used in a
802.11i/WPA/AES-PSK-secured network. If no separate passphrase is specified for this MAC address, the
passphrases stored in the 802.11i/WEP area will be used for each logical wireless LAN network.
TX bandwidth limit
Transmission-bandwidth restriction for WLAN clients currently authenticating themselves. A WLAN device in
client mode communicates its setting to the AP when logging on. This then uses uses these two values to set
the minimum bandwidth.
RX bandwidth limit
Reception-bandwidth restriction for WLAN clients currently authenticating themselves. A WLAN device in
client mode communicates its setting to the AP when logging on. This then uses uses these two values to set
the minimum bandwidth.
5
The RX bandwidth restriction is only active for WLAN devices in client mode. For value is not used by
normal WLAN clients.
VLAN-ID
This VLAN ID is assigned to packets that are received from the client with the MAC address entered here. In
case of VLAN-ID '0', the station is not assigned a specific VLAN ID. Instead, the VLAN ID of the radio cell
(SSID) applies.
If filter rules contradict, the individual rule has a higher priority: A rule without wildcards in the MAC address or SSID
takes precedence over a rule with wildcards. When creating these entries, the user should ensure that filter rules do not
contradict. The definitions in the filters can be checked in a Telnet session with the trace command trace WLAN-ACL.
5
The filter criteria in the station list either allow or deny WLAN clients to access your wireless network. The entries
Name, Bandwidth limit, VLAN ID and Passphrase are meaningless if the device uses valid filter criteria to
deny access to the WLAN.
Additions to the Setup menu
Access rules
You can limit the data traffic between the wireless LAN and its local network by excluding certain stations from transferring
data, or you can approve specific stations only.
SNMP ID:
2.12.89
Telnet path:
Setup > WLAN
MAC address pattern
Enter the MAC address of a station.
1160
Reference Manual
13 Wireless LAN (WLAN)
4
It is possible to use wildcards.
SNMP ID:
2.12.89.1
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 20 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Possible arguments:
MAC address
MAC address of the WLAN client for this entry. The following entries are possible:
Individual MAC address
A MAC address in the format 00a057112233, 00-a0-57-11-22-33 or 00:a0:57:11:22:33.
Wildcards
The wildcards '*' and '?' uses to specify MAC address ranges, e.g. 00a057*, 00-a0-57-11-??-??
or 00:a0:??:11:*.
Vendor ID
The device contains a list of the major manufacturer OUIs (organizationally unique identifier). The MAC
address range is valid if this entry matches the first three bytes of the MAC address of the WLAN client.
4
It is possible to use wildcards.
Name
You can enter any name you wish for any station. This enables you to assign MAC addresses more easily to specific
stations or users.
SNMP ID:
2.12.89.2
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 32 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Comment
You can enter any comment you wish for any station. This enables you to assign MAC addresses more easily to specific
stations or users.
1161
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.12.89.3
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 30 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
WPA passphrase
Here you may enter a separate passphrase for each entry that is used in a 802.11i/WPA/AES-PSK-secured network. If no
separate passphrase is specified for this MAC address, the passphrases stored in the 802.11i/WEP area will be used for
each logical wireless LAN network.
5
The passphrases should consist of a random string at least 22 characters long, corresponding to a cryptographic
strength of 128 bits.
4
This field has no significance for networks secured by WEP.
SNMP ID:
2.12.89.4
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Tx-Limit
Bandwidth restriction for registering WLAN clients. A client communicates its setting to the AP when logging on. This
then uses uses these two values to set the minimum bandwidth.
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as an AP Rx stands
for "Send data" and Tx stands for "Receive data".
SNMP ID:
2.12.89.5
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 9 characters from 0123456789
0 … 999999999
1162
Reference Manual
13 Wireless LAN (WLAN)
Default:
0
Special values:
0
No limit
Rx-Limit
Bandwidth restriction for registering WLAN clients. A client communicates its setting to the AP when logging on. This
then uses uses these two values to set the minimum bandwidth.
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as an AP Rx stands
for "Send data" and Tx stands for "Receive data".
SNMP ID:
2.12.89.6
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 9 characters from 0123456789
0 … 999999999
Default:
0
Special values:
0
No limit
VLAN-ID
The device assigns this VLAN ID to packets received by the WLAN client and containing the MAC address entered here.
SNMP ID:
2.12.89.7
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 4 characters from 0123456789
0 … 4096
Default:
0
1163
Reference Manual
13 Wireless LAN (WLAN)
Special values:
0
No limit
SSID pattern
For WLAN clients with the appropriate MAC addresses, this entry allows them to access this SSID or it restricts them to
it.
4
The use of wildcards makes it possible to allow access to multiple SSIDs.
SNMP ID:
2.12.89.9
Telnet path:
Setup > WLAN > Access rules
Possible values:
Max. 40 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Special values:
*
Placeholder for any number of characters
?
Placeholder for exactly one character
Default:
empty
Access rules
You can limit the data traffic between the wireless LAN and its local network by excluding certain stations from transferring
data, or you can approve specific stations only.
SNMP ID:
2.37.21
Telnet path:
Setup > WLAN-Management
MAC address pattern
Enter the MAC address of a station.
4
It is possible to use wildcards.
1164
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.37.21.1
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 20 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Possible arguments:
MAC address
MAC address of the WLAN client for this entry. The following entries are possible:
Individual MAC address
A MAC address in the format 00a057112233, 00-a0-57-11-22-33 or 00:a0:57:11:22:33.
Wildcards
The wildcards '*' and '?' uses to specify MAC address ranges, e.g. 00a057*, 00-a0-57-11-??-??
or 00:a0:??:11:*.
Vendor ID
The device contains a list of the major manufacturer OUIs (organizationally unique identifier). The MAC
address range is valid if this entry matches the first three bytes of the MAC address of the WLAN client.
4
It is possible to use wildcards.
Name
You can enter any name you wish for any station. This enables you to assign MAC addresses more easily to specific
stations or users.
SNMP ID:
2.37.21.2
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 32 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Comment
You can enter any comment you wish for any station. This enables you to assign MAC addresses more easily to specific
stations or users.
SNMP ID:
2.37.21.3
1165
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 30 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
WPA passphrase
Here you may enter a separate passphrase for each entry that is used in a 802.11i/WPA/AES-PSK-secured network. If no
separate passphrase is specified for this MAC address, the passphrases stored in the 802.11i/WEP area will be used for
each logical wireless LAN network.
5
The passphrases should consist of a random string at least 22 characters long, corresponding to a cryptographic
strength of 128 bits.
4
This field has no significance for networks secured by WEP.
SNMP ID:
2.37.21.4
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Tx-Limit
Bandwidth restriction for registering WLAN clients. A client communicates its setting to the AP when logging on. This
then uses uses these two values to set the minimum bandwidth.
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as an AP Rx stands
for "Send data" and Tx stands for "Receive data".
SNMP ID:
2.37.21.5
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 9 characters from 0123456789
0 … 999999999
Default:
0
1166
Reference Manual
13 Wireless LAN (WLAN)
Special values:
0
No limit
Rx-Limit
Bandwidth restriction for registering WLAN clients. A client communicates its setting to the AP when logging on. This
then uses uses these two values to set the minimum bandwidth.
5
The significance of the Rx and Tx values depends on the device's operating mode. In this case, as an AP Rx stands
for "Send data" and Tx stands for "Receive data".
SNMP ID:
2.37.21.6
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 9 characters from 0123456789
0 … 999999999
Default:
0
Special values:
0
No limit
VLAN-ID
The device assigns this VLAN ID to packets received by the WLAN client and containing the MAC address entered here.
SNMP ID:
2.37.21.7
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 4 characters from 0123456789
0 … 4096
Default:
0
1167
Reference Manual
13 Wireless LAN (WLAN)
Special values:
0
No limit
SSID pattern
For WLAN clients with the appropriate MAC addresses, this entry allows them to access this SSID or it restricts them to
it.
4
The use of wildcards makes it possible to allow access to multiple SSIDs.
SNMP ID:
2.37.21.9
Telnet path:
Setup > WLAN-Management > Access rules
Possible values:
Max. 40 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Special values:
*
Placeholder for any number of characters
?
Placeholder for exactly one character
Default:
empty
13.19.4 Conformity with current ETSI radio standards in the 2.4GHz/5GHz bands
As of LCOS version 9.10, the AP additionally supports the radio standards ETSI EN 300328-V1.7.1, ETSI EN 300328-V1.8.1
and ETSI EN 301893-V1.7.1.
DFS configuration
In LANconfig you access the DFS settings under Wireless LAN > General, then click Physical WLAN settings and
select the Radio tab.
1168
Reference Manual
13 Wireless LAN (WLAN)
Time of DFS rescan
This entry determines at what time (0 - 24h) the device deletes the DFS database and performs a DFS rescan.
If this item is left empty, the device only performs a DFS rescan when no further free channel is available. This
is the case when the number of channels determined during the initial DFS scan falls below the minimum
number of free channels.
4
The cron command options can be used to define the time: The entry '1,6,13' starts the rescan at
01:00h, 06:00h and 13:00h. The entry ' 0-23/4 ' starts a rescan every four hours between 00:00h and
23:00h.
Number of channels to scan
This entry determines the minimum number of free channels that a DFS scan has to achieve. The default value
of '2' means that the device performs a DFS scan for as long as it takes to detect 2 free channels. If the device
has to switch channels, for example if it detects an active radar pattern, the second channel is immediately
available for the change.
A value of '0' disables the restriction. The physical WLAN interface performs a DFS scan on all available
channels.
Rescan free channels
With this item you select whether, following the completion of a DFS rescan, the physical WLAN interface
deletes occupied channels or saves them for subsequent DFS rescans.
1
Yes: The physical WLAN interface deletes occupied channels after completing a DFS rescan so that they
are available again for a new DFS rescan.
1
No: The device saves occupied channels after completing a DFS rescan and so that the device immediately
skips them during a new DFS rescan.
1169
Reference Manual
13 Wireless LAN (WLAN)
Additions to the Setup menu
Preferred DFS scheme
In order to operate the WLAN device in accordance with current ETSI radio standards, select the corresponding standard
here.
5
When upgrading a LCOS version to a current radio standard, the previous setting is retained.
SNMP ID:
2.23.20.8.20
Telnet path:
Setup > Interfaces > WLAN > Radio settings > Preferred DFS scheme
Possible values:
EN 301 893-V1.3
EN 301 893-V1.5
EN 301 893-V1.6
EN 301 893-V1.7
Default:
EN 301 893-V1.7
Preferred 2.4 scheme
This parameter sets the version of the EN 300 328 standard operated by the device in the 2.4-GHz band.
5
Should you carry out a firmware update, the current version is retained. New devices and devices subject to a
configuration reset operate version 1.8 by default.
SNMP ID:
2.23.20.8.28
Telnet path:
Setup > Interfaces > WLAN > Radio-settings
Possible values:
EN300328-V1.7
EN300328-V1.8
Default:
EN300328-V1.8
13.19.5 Time of the DFS rescan configurable via LANconfig
As of LCOS version 9.10, the time for a DFS rescan can be configured in LANconfig.
1170
Reference Manual
13 Wireless LAN (WLAN)
13.19.6 P2P support for 802.11ac
As of LCOS version 9.10, 802.11ac modules are also able to establish P2P connections. The distance between two access
points can be up to one kilometer (1 km).
5
The maximum range depends on the antenna system used.
13.19.7 Client mode for 802.11ac
As of LCOS version 9.10, 802.11ac modules are also able to operate in client mode.
13.19.8 Bandwidth limit for each WLAN client per SSID
As of LCOS version 9.10, a general bandwidth limit can be applied to all WLAN clients in each SSID.
Client TX bandwidth limit
Here, you set the transmit-direction bandwidth limit (in kbps) available to each wireless client on this SSID.
A value of 0 disables the limit.
Client RX bandwidth limit
Here, you set the receive-direction bandwidth limit (in kbps) available to each wireless client on this SSID. A
value of 0 disables the limit.
Additions to the Setup menu
Per-Client-Tx-Limit
Here, you set the transmit-direction bandwidth limit (in kbps) available to each wireless client on this SSID. A value of
0 disables the limit.
SNMP ID:
2.23.20.1.23
Telnet path:
Setup > Interfaces > WLAN > Network
Possible values:
Max. 10 characters from 0123456789
Default:
0
Special values:
0
Disables the limit.
Per-Client-Rx-Limit
Here, you set the receive-direction bandwidth limit (in kbps) available to each wireless client on this SSID. A value of 0
disables the limit.
1171
Reference Manual
13 Wireless LAN (WLAN)
SNMP ID:
2.23.20.1.24
Telnet path:
Setup > Interfaces > WLAN > Network
Possible values:
Max. 10 characters from 0123456789
Default:
0
Special values:
0
Disables the limit.
13.19.9 Opportunistic key caching (OKC) adjustable on the client side
As of LCOS version 9.10, the OKC can also be adjusted for devices in client mode.
Additions to the Setup menu
OKC
This option enables or disables the opportunistic key caching (OKC).
The device uses this value only if the interface works in client mode. The interface is in AP mode, the enabling or disabling
of OKC is only possible by means of profile management with a WLC.
In the PMK caching status under Status > WLAN > PMK-Caching > Contents, OKC PMKs can be identified by the
authenticator address ff:ff:ff:ff:ff:n, where n is the assigned profile number (e.g. 0 for “WLAN-1”, 1 for
“WLAN1-2”, etc.).
SNMP ID:
2.23.20.3.17
Telnet path:
Setup > Interfaces > WLAN > Encryption
Possible values:
Yes
No
Default:
Yes
13.19.10 Counter for WPA login attempts
As of LCOS version 9.10, the device stores the number of successful and failed WPA login attempts on each interface.
1172
Reference Manual
13 Wireless LAN (WLAN)
Additions to the Status menu
Ports
This table provides an overview of the accepted or rejected connection requests for each logical interface.
SNMP ID:
1.46.3
Telnet path:
Status > IEEE802.1x
Port
Displays the name of the interface.
SNMP ID:
1.46.3.1
Telnet path:
Status > IEEE802.1x > Ports
Num-accept
Displays the number of successful WPA requests on this interface.
SNMP ID:
1.46.3.2
Telnet path:
Status > IEEE802.1x > Ports
Num-reject
Displays the number of failed WPA requests on this interface.
SNMP ID:
1.46.3.3
Telnet path:
Status > IEEE802.1x > Ports
1173
Reference Manual
13 Wireless LAN (WLAN)
WPA-PSK-Num-Wrong-Passphrase
Displays the number of WPA requests on this interface that were rejected due to an incorrect passphrase.
SNMP ID:
1.3.64.20
Telnet path:
Status > WLAN > Encryption
WPA-PSK-Num-Success
Displays the number of successful WPA requests on this interface.
SNMP ID:
1.3.64.21
Telnet path:
Status > WLAN > Encryption
WPA-PSK-Num-Failures
Displays the number of failed WPA requests on this interface.
SNMP ID:
1.3.64.22
Telnet path:
Status > WLAN > Encryption
13.19.11 Point-to-point links via 802.11ac
As of LCOS version 9.10, point-to point links can be established using 802.11ac WLAN modules.
5
This extension only works if all of the P2P APs involved have LCOS version 9.10. When updating from LCOS to
LCOS version 9.10 you should first update the APs that are connected via WLAN (starting with the farthest away
and finishing with the update of the nearest) and only then should you update the devices connected by cable.
13.19.12 Additions to the Setup menu
Channel change delay
Here you specify how long an access point, which has detected a radar, waits until it changes to a different channel.
SNMP ID:
2.12.130.9
1174
Reference Manual
13 Wireless LAN (WLAN)
Telnet path:
Setup > WLAN > DFS
Possible values:
Max. 3 characters from [0-9]
Default:
0
Special values:
0
The value 0 disables this function.
13.19.13 Additions to the Status menu
Delete values
SNMP ID:
1.46.99
Telnet path:
Status > IEEE802.1x
1175
Reference Manual
13 Wireless LAN (WLAN)
14 WLAN Management
LANCOM WLAN controllers and LANCOM routers with WLC option provide a centrally controlled WLAN management
for larger-scale WLAN infrastructures. The WLAN controller centrally stores the configurations of individual access points
as profiles and distributes these to the appropriate devices.
5
This documentation will use "WLAN Controller" as a generic term for LANCOM WLAN controllers and LANCOM
routers with WLC option.
14.1 Starting position
The widespread use of wireless access points and wireless routers provides great convenience and flexibility in network
access for businesses, universities and other organizations.
Yet in spite of the numerous advantages WLAN infrastructures offer, there are still a number of unsettled issues:
1
All wireless access points must be configured and require appropriate monitoring in order to recognize unwelcome
WLAN clients, etc. The administration of the access points, especially for larger WLAN infrastructures with the
appropriate security mechanisms, requires advanced qualifications and experience on the part of those responsible,
and it ties up considerable resources in the IT departments.
1
The manual customization of the configurations in the access points when changes are made to the WLAN infrastructure
can be time-consuming, with the result that different configurations can be present in the WLAN at the same time.
1
Combined utilization of the shared communications medium (air) requires effective coordination of the access points
to avoid frequency interference and optimize network performance.
1
In public places, access points are a potential security risk because the devices themselves, including the security-related
data in them such as passwords, etc., are susceptible to theft. In addition, rogue access points may be able to connect
to the LAN unnoticed, bypassing the security policies that are in place.
14.2 Technical concepts
Centralized WLAN management is the solution to these problems. The configuration of the access points is then no
longer carried out in the devices themselves but by a central authority instead, the WLAN controller. The WLAN controller
authenticates the access points and transmits the correct configuration to the approved devices. This allows for convenient
configuration of the WLAN from a central point and the changes to the configuration affect all of the access points
simultaneously. Optionally the configuration provided by the WLAN controller is not stored in the access point's flash
memory but in RAM, so security-related data cannot fall into the hands of unauthorized persons in the event of theft of
a device. Only in "standalone" operation is the configuration optionally saved for a defined period to flash memory (in
an area that cannot be read out with LANconfig or other tools).
14.2.1 The CAPWAP standard
The CAPWAP protocol (Control And Provisioning of Wireless Access Points) introduced by the IETF (Internet Engineering
Task Force) is a draft standard for the centralized management of large WLAN infrastructures.
CAPWAP uses two channels for data transfer:
1
Control channel, encrypted with Datagram Transport Layer Security (DTLS). This channel is used to exchange
administration information between the WLAN controller and the access point.
1176
Reference Manual
14 WLAN Management
5
DTLS is an encryption protocol is based on TLS but, in contrast to TLS itself, it can be used for transfers over
connectionless, unsecured transport protocols such as UDP. DTLS therefore combines the advantages of the
high security provided by TLS with the fast transfer via UDP. This also makes DTLS suitable for the transfer
of VoIP packets (unlike TLS) because, even after the loss of a packet, the subsequent packets can be
authenticated again.
1
Data channel, optionally also encrypted with DTLS. The payload data from the WLAN is transferred through this
channel from the access point via the WLAN controller into the LAN—encapsulated in the CAPWAP protocol.
14.2.2 Smart controller technology
In a decentralized WLAN structure with stand-alone access points (operating as so-called "rich access points") all functions
for data transfer take place in the PHY layer, the control functions in the MAC layer, and the management functions are
integrated in the access points. Centralized WLAN management divides these tasks among two different devices:
1
The central WLAN controller assumes the administration tasks.
1
The decentralized access points handle the data transfer at thePHY layer and theMAC functions.
1
A RADIUS or EAP server can be added as a third component RADIUS or for authentication of WLAN clients (which
can also be the case in stand-alone WLANs).
CAPWAP describes three different scenarios for the relocation of WLAN functions to the central WLAN controller.
1
Remote MAC: In this case, all of the WLAN functions are transferred from the access point to the WLAN controller.
Here, the access points only serve as "extended antennas" without independent intelligence.
1
Split MAC: With this variant, only a portion of the WLAN functions are transferred to the WLAN controller. Normally,
real-time applications will continue to be processed in the access point; the non-real-time applications are processed
via the central WLAN controller.
1177
Reference Manual
14 WLAN Management
1
Local MAC: The third possibility provides for complete management and monitoring of the WLAN data traffic directly
in the access points. The only information exchanged between the access point and the WLAN controller is for network
management and ensures that the access points have a uniform configuration.
The technology from LANCOM Systems uses the local MAC procedure. Thanks to the reduction of centralized tasks, these
WLAN infrastructures offer optimum scalability. At the same time, infrastructure of this type prevents the WLAN controller
from becoming a central bottleneck that has to process large portions of the overall data traffic. In remote MAC and
split MAC architectures, all payload data is forced to run centrally via the WLAN controller. In local MAC architectures
the data can alternatively be broken out from the access points directly to the LAN to provide high-performance data
transfer. WLAN controllers from LANCOM are also suitable for WLANs that work with the draft IEEE 802.11n standard,
so offering much higher bandwidths than previous WLAN technologies. With break-out into the LAN, data can also be
directly routed into special VLANs. This makes it very easy to set up closed networks, such as for guest access accounts.
5
Layer-3 tunneling and layer-3 roaming
LANCOM WLAN controllers also support the transfer of payload data through a CAPWAP tunnel.
1
This allows selected applications such as VoIP to be routed via the central WLAN controller, for example. If
WLAN clients change to a different radio cell, the underlying IP connection will not be interrupted because
it continues to be managed by the central WLAN controller (layer-3 roaming). In this way, mobile SIP telephones
can easily roam between Ethernet subnets, even during a call.
1
Managing data streams centrally can also make configuring VLANs at the switch ports unnecessary in
environments with numerous VLANs because all CAPWAP tunnels are centrally managed on the WLAN
controller.
14.2.3 Communication between access point and WLAN controller
5
As of firmware version LCOS 7.20 there is a difference between LANCOM access points (e. g. the LANCOM
L-54ag) and LANCOM wireless routers (e.g. the LANCOM 1811 Wireless) with regard to the ex-factory default
settings in the WLAN modules. In the following specifications, the general term access point will be used for the
most part.
Communication between an access point and the WLAN controller is always initiated by the access point. In the following
cases, the devices search for a WLAN controller that can assign a configuration to them:
1
When shipped, the WLAN modules in LANCOM access points are set to the 'Managed' operating mode. In this mode,
LANCOM access points search for a central WLAN controller that can provide them with a configuration, and they
remain in "search mode" until they discover a suitable WLAN controller or until the operating mode of the WLAN
module is changed manually.
1
While searching for a WLAN controller, LANCOM access points switch off their WLAN module(s).
1
Ex-factory, the WLAN modules in LANCOM wireless routers are set to the 'access point' operating mode. In this
mode, LANCOM wireless routers function as standalone access points with a configuration that is stored locally in
1178
Reference Manual
14 WLAN Management
the device. For integration into a WLAN infrastructure that is centrally managed by WLAN controllers, the operating
mode of the WLAN modules in LANCOM wireless routers has to be switched into the 'managed' mode.
The access point sends a "discovery request message" at the beginning of communication to find the available WLAN
controllers. This request is sent as a broadcast. However, because in some structures a potential WLAN controller cannot
be reached by a broadcast, special addresses from additional WLAN controllers can also be entered into the configuration
of the access points.
5
The DNS names of WLAN controllers can also be resolved. All access points with LCOS 7.22 or higher have the
default name 'WLC-Address' pre-configured so that a DNS server can resolve this name to a LANCOM WLAN
controller. The same applies to the DHCP suffixes learned via DHCP. This also makes it possible to reach WLAN
controllers that are not located in the same network, without having to configure the access points.
From the available WLAN controllers, the access point selects the best one and requests it to establish the DTLS connection.
The "best" WLAN controller for the access point is the one with the least load, i.e. the lowest ratio of managed access
points compared to the maximum possible number of access points. In case of two or more equally "good" WLAN
controllers, the access point selects the nearest one in the network, i.e. that with the fastest response time.
The WLAN controller then uses an internal random number to determine a unique and secure session key, which it uses
to secure the connection to the access point. The CA in the WLAN controller issues a certificate to the access point by
means of SCEP. The certificate is protected by a one-time-only "challenge" (password). The access point uses this certificate
for authentication at the WLAN controller to collect the certificate.
The access point is provided with the configuration for the integrated SCEP client via the secure DTLS connection – the
access point uses the SCEP to retrieve its certificate from the SCEP CA. Once this is done, the assigned configuration is
transferred to the access point.
5
SCEP stands for Simple Certificate Encryption Protocol, CA forCertification Authority.
Authentication and configuration can both be carried out either automatically or only with a corresponding entry of the
access point's MAC address in the AP table of the WLAN controller. If the access point's WLAN modules were deactivated
at the beginning of the DTLS communication, these will be activated after successful transfer of the certificate and
configuration (provided they are not explicitly deactivated in the configuration).
1179
Reference Manual
14 WLAN Management
The management and configuration data will then be transferred via the CAPWAP tunnel. The payload data from the
WLAN client is then released in the access point directly into the LAN and transferred, for example, to the server.
14.2.4 Zero-touch management
With their ability to automatically assign a certificate and configurations to the requesting access points, LANCOM WLAN
controllers implement true "zero-touch management". Simply connect new access points to the LAN—no further
configuration is necessary. This simplification to only having to install devices reduces the workload for IT departments,
especially in decentralized structures, because no special IT or WLAN expertise is required for the setup at the remote
locations.
14.2.5 Split management
LANCOM access points can search for their WLAN controller in remote networks—a simple IP connection, such as via
a VPN path, is all you need. As the WLAN controllers only influence the WLAN part of the configuration in the access
point, all of the other functions can be managed separately. This division of the configuration tasks makes LANCOM
WLAN controllers perfect for establishing a company-wide WLAN infrastructure that is based at the headquarters and
includes all of the branch and home offices connected to it.
14.3 Basic configuration of the WLAN controller function
To get started, a WLC requires the following two pieces of information to carry out the mainly automated configuration
of the APs:
1
Current time information (data and time) for checking the validity of the necessary certificates.
1
A WLAN profile that the WLC can assign to the APs.
Further optional examples for configuration include setting up redundant WLC, the manual disconnection and connection
of APs, and backing up any necessary certificates.
4
By default the WLC listens for connections on port 1027 (configurable). The certificates are distributed by SCEP,
which uses port 80 (HTTP).
14.3.1 Setting the time information for the WLAN controller
The management of APs in a WLAN infrastructure is based upon the automatic distribution of certificates via the Simple
Certificate Enrollment Protocol (SCEP).
The WLC can only check the temporal validity of these certificates if it is set with the current time. If the time is not set
in the WLC, the WLAN LED illuminates in red and the device is not operational.
1180
Reference Manual
14 WLAN Management
5
Routers with the WLC option do not have a WLAN LED.
To set the time in the device start LANconfig, click on the entry for the WLC with the right-hand mouse key and select
Set date/time from the context menu. Alternatively in WEBconfig you can click on Extras and then Set date and time.
5
Alternatively, WLCs can automatically retrieve the current time from a time server by means of the Network Time
Protocol (NTP). Information on NTP and its configuration can be found in the LCOS reference manual.
For LANCOM WLC-4006 models the time information must be obtained from a time server or entered manually,
as these devices do not have a battery-fed real-time clock.
As soon as the WLC has valid time information it begins with the generation of the certificates (root and device certificate)
and it determines a random number. Once the necessary certificates have been generated, the WLC indicates that it is
operational and the WLAN LED blinks red.
5
Once operational, you should make a backup copy of the certificates (
Backing up the certificates
)
14.3.2 Example: Default configuration
1. Open up the configuration of the WLC by double-clicking on its entry in LANconfig.
2. Activate the options for the automatic acceptance of new APs and the provision of a default configuration under
WLAN controller > General.
1
Automatically accept new APs (Auto-accept) Enables the WLC to provide a certificate to all new APs without
a valid certificate. To this end, either a configuration for the AP has to be entered into the AP table, or
'Automatically provide APs with a default configuration' has to be activated.
1
Automatically provide APs with a default configuration: This enables the WLC to assign a default
configuration to any new AP, even if no explicit configuration has been stored for it.
By combining these two options, the WLC can automatically integrate any managed-mode AP found in the LAN into
its WLAN infrastructure. This may, for example, be a temporary measure during the rollout phase of a WLAN
installation.
3. On the Profiles page, move to the logical WLAN networks. Add a new entry with the following values:
1
Name: Give the WLAN a name. This name is used only for administrative purposes in the WLC.
1
SSID: This SSID is used for the WLAN clients to connect.
1
Encryption: Select the encryption method suitable for the WLAN clients being used, and enter a key or passphrase,
as applicable.
1
Deactivate the MAC check. Instructions on the use of MAC filter lists in managed WLAN infrastructures can be
found under
Checking WLAN clients with RADIUS (MAC filter)
.
4. A new entry also has to be added to the physical WLAN parameters. In most cases involving the default configuration,
just entering a name is sufficient. Adjust the other settings to meet your needs, if necessary.
5
For normal AP applications you should use only the 5-GHz subbands 1 and 2. Subband 3 is for special
applications only (e.g. BFWA, Broadband Fixed Wireless Access).
1181
Reference Manual
14 WLAN Management
5. Create a new WLAN profile, give it an unique name, and assign the above logical WLAN network and physical WLAN
parameters to it.
6. Change to the AP configuration view, open the Access point table and add a new entry by clicking on the Default
button. Assign the WLAN profile to it as defined above. Leave AP name and Location empty.
5
The MAC address is set to 'ffffffffffff' for the default configuration and it cannot be edited. This entry is thus
a standard for any AP that is not explicitly listed in this table with its MAC address.
14.3.3 Assigning the default configuration to the new access points
With these settings you have defined all of the necessary values for the WLC to provide the APs with the required WLAN
parameters. Upon assignment of the configuration, the APs change their status in the WLC management from "New
access point" to "Expected access point", and they are listed in the device display under Exp. APs. Once the default
configuration has been assigned to all new APs, the New APs LED switches off.
5
After the initial start-up phase, the option Automatically provide APs with the default configuration can
be deactivated again so that no further APs are automatically accepted into the network. The option
Automatically accept new APs can remain active so that, after a reset, the WLC automatically provides expected
APs—as entered into the AP table—with valid certificates.
14.3.4 Configuring the access points
As of firmware version LCOS 7.20 there is a difference between LANCOM access points (e.g. the LANCOM L-54ag) and
LANCOM wireless routers (e.g. the LANCOM 1811 Wireless) with regard to the ex-factory default settings in the WLAN
modules.
1
When shipped, the WLAN modules in APs are set to the 'Managed' operating mode. In this mode, APs search for a
central WLC that can provide them with a configuration, and they remain in "search mode" until they discover a
suitable WLC or until the operating mode of the WLAN module is changed manually.
1
Ex-factory, the WLAN modules in wireless routers are set to the 'access point' operating mode. In this mode, wireless
routers function as standalone APs with a configuration that is stored locally in the device. For integration into a
WLAN infrastructure that is centrally managed by WLCs, the operating mode of the WLAN modules in wireless routers
has to be switched into the 'managed' mode.
5
The operating mode can be set separately for every WLAN module. For models with two WLAN modules, one
module can work with a local configuration and the second module can be centrally managed with a WLC.
For individual devices, the operating mode of the WLAN modules can be found in LANconfig under Wireless LAN >
General > Physical WLAN settings > Operation mode:
If you need to change the operating mode for multiple devices, you can use a simple script on the devices with the
following lines:
# Script
lang English
flash 0
cd Setup/Interfaces/WLAN/Operational
set WLAN-1 0 managed-AP 0
# done
exit
1182
Reference Manual
14 WLAN Management
14.4 Configuration
Most of the parameters for configuring the WLAN controller correspond with those of the access points. For this reason,
this section does not explicitly describe all of the WLAN parameters, but only those aspects necessary for operating the
WLAN controller.
14.4.1 General settings
This area is for the basic settings of your WLC.
1
Automatically accept new APs (auto accept)
Enables the WLC to provide all new APs with a configuration, even those not in possession of a valid certificate.
Enables the WLC to provide a certificate to all new APs without a valid certificate. a valid certificate. One of two
conditions must be fulfilled for this:
2
A configuration for the AP is entered into the AP table under its MAC address.
2
The option 'Automatically provide APs with the default configuration' is enabled.
1
Automatic provision of the default configuration
This enables the WLC to assign a default configuration to every new AP (even those without a valid certificate), even
if no explicit configuration has been stored for it. In combination with auto-accept, the WLC can accept all
managed-mode APs which are found in the WLAN infrastructure managed by it (up to the maximum number of APs
that can be managed by one WLC). Any APs accepted by default are also entered into the MAC list.
5
This option can also lead to the acceptance of unintended APs into the WLAN infrastructure. For this reason
this option should only be activated during the start-up phase when setting up a centrally managed WLAN
infrastructure
Combining the settings for auto-accept and default configuration can cater for a variety of different situations for the
setup and operation of APs:
Suitable forDefault
configuration
Auto accept
Rollout phase: Use this combination only if you can be sure that no APs can unintentionally
connect with the LAN and thus be accepted into the WLAN infrastructure.
OnOn
Controlled rollout phase: Use this combination if you have entered all of the approved APs
into the AP table along with their MAC addresses, assuming that these are to be automatically
accepted into the WLAN infrastructure.
OffOn
Normal operation: No new APs will be accepted into the WLAN infrastructure without the
administrator's approval.
OffOff
14.4.2 Profiles
The profiles area is used to define the logical WLAN networks, physical WLAN parameters, and the WLAN profiles which
combine these two elements.
WLAN profiles
The WLAN profiles are collections of the various settings that are to be assigned to the APs. The allocation of WLAN
profiles to the APs is set in the AP table.
1183
Reference Manual
14 WLAN Management
For each WLAN profile you can specify the following parameters under WLAN controller > Profiles > WLAN profiles:
Profile name
Name of the profile under which the settings are saved.
Log. WLAN network list
List of the logical WLAN networks that are assigned via this profile.
4
From this list, APs use only the first 816 entries that are compatible with their own hardware. This
means that 816 WLAN networks for purely 2.4-GHz operations and 816 for purely 5-GHz operations
can be defined in a profile. Consequently, each AP—be it a model offering 2.4 GHz or 5 GHz
support—can choose from a maximum of 816 logical WLAN networks.
Physic. WLAN parameters
A set of physical parameters that the AP WLAN modules are supposed to work with.
IP address of alternative WLCs
A list of WLCs that the APs should attempt to connect with. The AP starts searching for a WLC with a broadcast.
Defining alternative WLCs is worthwhile when a broadcast cannot reach all WLCs (e.g.if the WLC is located
in another network).
802.11u venue profile
Select the Hotspot 2.0 profile from the list. You create the Hotspot 2.0 profiles in the configuration menu
using the button of the same name.
Configuration delay
Here you specify a time delay before an AP managed by the WLAN controller activates the configuration
transmitted to it.
This is especially useful in AutoWDS scenarios where multiple managed APs are connected in a chain of
point-to-point links. A premature change in configuration on an AP that connects to a more distant AP would
otherwise cause this connection to be cut.
A rule of thumb for calculating the delay is (regardless of the topology): One second per managed AP, e.g.
200 seconds for 200 APs.
4
The delay does not apply to transmitted scripts.
1184
Reference Manual
14 WLAN Management
Device LED profile
The device LED profile selected here applies to the WLAN profile. To manage the devices LED profiles, see
WLAN controller > Profiles > Device LED profiles.
LBS general profile
The general LBS profile selected here applies to the WLAN profile. You select the general LBS profile under
WLAN Controller > Profiles > Advanced profiles with the button LBS - General.
Wireless ePaper profile
The Wireless ePaper profile selected here applies to the WLAN profile. You manage the Wireless ePaper profiles
under WLAN Controller > AP configuration > Extended settings with the button Wireless ePaper
profiles.
General LBS profile and device location profile
In order to conveniently manage the settings for location-based services servers (LBS) and the AP locations by means of
a WLC, you create the appropriate profiles for LBS servers and AP device locations via the menu WLAN Controller >
Profiles and the button Advanced profiles.
The button LBS - General opens the dialog for creating a general LBS server profile.
Name
Enter a descriptive name for the profile.
LBS enabled
Enable or disable LBS.
LBS server address
Enter the address of the LBS server.
1185
Reference Manual
14 WLAN Management
LBS server port
Enter the port used by the LBS server (default: 9091).
The button LBS - AP locations opens the dialog for creating a location profile for the LBS APs.
Name
Enter a descriptive name for the profile.
Floor (0-based)
Here you enter the floor on which the device is located. This allows you to differentiate between the top floor
and bottom floor, for example.
Height
Here you enter the height of the device installation. It is possible to specify a negative value so that you can
differentiate between a location above and below sea level.
Degrees (latitude)
This field specifies the angle in degrees of the geographic coordinate system.
Minutes (latitude)
This field specifies the minutes of the geographic coordinate system.
Seconds (latitude)
This field specifies the seconds of the geographic coordinate system.
Hemisphere (latitude)
This field specifies the orientation of the geographic coordinate system. The following values are possible for
geographical latitude:
1
North: Northerly latitude
1
South: Southerly latitude
Degrees (longitude)
This field specifies the angle in degrees of the geographic coordinate system.
1186
Reference Manual
14 WLAN Management
Minutes (longitude)
This field specifies the minutes of the geographic coordinate system.
Seconds (longitude)
This field specifies the seconds of the geographic coordinate system.
Hemisphere (longitude)
This field specifies the orientation of the geographic coordinate system. The following values are possible for
geographical longitude:
1
East: Easterly longitude
1
West: Westerly longitude
Description
Enter a description of the device.
Device LED profiles
The LEDs on the device are configurable so that you can, for instance, operate an AP while drawing a minimum of
attention to it. In order to perform this configuration by WLC, you need to create the corresponding profile under WLAN
Controller > Profiles > Device LED profiles and assign this to a WLAN profile.
Name
Give a name to the device LED profile here.
LED mode
The following options are available:
1
Normal: The LEDs are always enabled, also after rebooting the device.
1
Timed off: After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This
is useful for the LEDs to indicate critical errors during the restart process.
1
All off: The LEDs are all off. Even after restarting the device, the LEDs remain off.
LED switch-off delay
The Timed off option uses the setting in the field LED switch-off delay in seconds to control the time before
the LEDs are disabled after a restart.
1187
Reference Manual
14 WLAN Management
ESL- and iBeacon profiles
In order to use a WLC to manage the settings of the Wireless ePaper information and iBeacon information of the individual
APs, you create the corresponding profiles for Wireless ePaper and iBeacon via WLAN-Controller > AP-Configuration
with the button Extended settings.
The button iBeacon profiles is used to create iBeacon profiles for the assignment groups and the AP table, which specify
the iBeacon information to be broadcast by the individual APs.
Name
Name of the profile
Entry active
Activates or deactivates this profile.
UUID
Unique identification of the transmitter
Major
Specifies the Major value of the iBeacon.
1188
Reference Manual
14 WLAN Management
The button Wireless ePaper profiles is used to create Wireless ePaper profiles for the WLAN-profiles table, which
specify the Wireless ePaper information to be broadcast by the individual APs.
Name
Name of the profile
Entry active
Activates or deactivates this profile.
Port
Specifies the port.
Inheritance of parameters
A WLC is capable of managing a wide range of different APs at different locations. However, WLAN profiles include
settings that are not equally suitable for every type of AP that can be managed. For example, there are differences
between the country settings and the device properties.
In order to avoid having to maintain multiple redundant WLAN profiles to cater for countries or device types, it is possible
to "inherit" selected properties from the logical WLAN networks and the physical WLAN parameters.
1. You should initially generate the basic settings that are valid for the majority of the managed APs.
1189
Reference Manual
14 WLAN Management
2. You can then start to generate entries for the more specific values, e.g. physical settings for a certain country, or a
logical WLAN network for public access by mobile clients.
3. Select the entry from which the values are to be inherited and mark the values for inheritance. Parameters inherited
in this way are displayed in the configuration dialog in gray and they cannot be edited.
4. Depending on the application, the WLAN settings collected in this way are then grouped into separate profiles, and
these are then assigned to their respective access points.
5
Inheritance fundamentally allows chains over multiple stages (cascading). This means, for example, that country
and device-specific parameters can be grouped for convenience.
Recursion is also possible—profile A inherits from profile B, and at the same time B inherits from A. However, the
parameters available for inheritance are limited to one "inheritance direction" per parameter.
1190
Reference Manual
14 WLAN Management
Logical WLAN networks
Under WLAN Controller > Profiles > Logical WLAN networks you can set the logical WLAN network parameters,
which the WLC is to assign to the APs. The following parameters can be defined for each logical WLAN network:
Logical WLAN network activated
Enable the logical WLAN network by clicking on this option.
Name
Here, specify a name which uniquely identifies the logical WLAN network.
Inheritance
If you wish to create entries that differ only slightly from existing ones, you can choose a "parent" entry here
and select the parameters which are to be applied each time it is used.
5
A "parent" entry itself can contain inherited entries. Try to ensure that the structure of inherited entries
is not too complex, otherwise they may be difficult to understand and configure.
Network name (SSID)
Enter the SSID of the WLAN network here. All stations that belong to this WLAN network must use the same
SSID.
SSID connect to
Here you select which of the AP's logical interfaces is to be associated with the SSID, i.e. where the AP sends
the data packets for this SSID.
1
"LAN": The AP forwards the data packets locally into the LAN (LAN-1) by default. It must be configured
appropriately to do this.
1
"WLC-Tunnel-x": The SSID is connected to a WLC bridge layer-3 tunnel. The AP sends all data packets to
this tunnel and thus to the WLC. This tunnel must be configured on the WLC.
5
Note that although forwarding all data packets to the WLC allows you to define routes and filters
centrally, this creates a heavy load on the WLC. This model demands a correspondingly high bandwidth
1191
Reference Manual
14 WLAN Management
in order to transfer all of the data traffic of this and any other SSIDs that are connected to this WLC
via WLC tunnel.
VLAN mode
This item sets the AP VLAN mode for packets belonging to this WLAN network (SSID). VLAN IDs are used if
the VLAN module is enabled in the physical WLAN parameters of the AP. Otherwise the AP ignores all VLAN
settings in the logical networks. Even with VLAN activated, it is possible to operate the network untagged.
1
"Untagged": The AP does not tag data packets from this SSID with a VLAN ID.
5
Even with VLAN activated, it is possible to operate a WLAN network untagged. The VLAN ID '1'
is reserved internally for this.
1
"Tagged": The AP marks the data packets with the VLAN ID specified as follows.
VLAN-ID
VLAN ID for this logical WLAN network
5
Please note that to use VLAN IDs in a logical WLAN network, you must set up a management VLAN
ID (see physical WLAN parameters).
Encryption
This item sets the encryption method or, in the case of WEP, the key length for packet encryption in this
WLAN.
Key 1/passphrase
You can enter the key or passphrase as an ASCII character string. An option for WEP is to enter a hexadecimal
number by adding a leading "0x". The following character string lengths result for the formats used:
1
WPA-PSK: 8 to 63 ASCII characters
1
WEP128 (104 bit): 13 ASCII or 26 hex characters
1
WEP64 (40 bit): 5 ASCII or 10 hex characters
RADIUS profile
Specify which RADIUS profile the AP should receive for this network, so that it can connect directly to the
RADIUS server if necessary. Leave this field blank if the WLC is to handle RADIUS requests.
5
You configure the RADIUS profiles in the corresponding table.
Allowed frequency bands
Here you set the frequency band used by network participants for transmitting data on the wireless network.
You can select the 2.4-GHz band, the 5-GHz band, or both bands.
AP standalone time
The time in minutes that a managed-mode AP continues to operate in its current configuration.
The configuration is provided to the AP by the WLC and is optionally stored in flash memory (in an area that
is not accessible to LANconfig or other tools). Should the connection to the WLC be interrupted, the AP will
continue to operate with the configuration stored in flash for the time period entered here. The AP can also
continue to work with this flash configuration after a local power outage.
If there is no connection to the WLC after this time period has expired then the flash configuration is deleted
and the AP goes out of operation. As soon as the WLC can be reached again, the WLC transmits the
configuration to the AP again.
This represents an effective measure against theft as the AP deletes all security-related configuration parameters
after this time has expired.
1192
Reference Manual
14 WLAN Management
5
If the AP establishes a backup connection to a secondary WLC then the countdown to the expiry of
standalone operation stops. The AP and its WLAN networks remain active as long as there is a
connection to a WLC.
5
Please note that the AP only deletes the configuration in flash memory after the time for standalone
operation has expired, and not when the power is lost!
802.11u network profile
Select the Hotspot 2.0 profile from the list.
OKC activated
This option enables the opportunistic key caching. OKC makes it easy for WLAN clients to quickly and
conveniently roam between WLAN cells in wireless environments with WPA2-Enterprise encryption.
MAC check activated
The MAC addresses of the clients that are allowed to associate with an AP are stored in the MAC filter list
(Wireless LAN > Stations > Stations). The MAC filter enabled switch allows you to switch off the use of
the MAC filter list for individual logical networks.
Suppress SSID broadcast
You can operate your wireless LAN either in public or private mode. A wireless LAN in public mode can be
contacted by any mobile station in the area. Your wireless LAN is put into private mode by activating the
closed network function. In this operation mode, mobile stations that do not know the network name (SSID)
are excluded from taking part in the wireless LAN.
With the closed-network mode activated, WLAN clients that use an empty SSID or the SSID "ANY" are prevented
from associating with your network.
The option Suppress SSID broadcast provides the following settings:
1
No: The AP publishes the SSID of the cell. When a client sends a probe request with an empty or incorrect
SSID, the AP responds with the SSID of the radio cell (public WLAN).
1
Yes: The AP does not publish the SSID of the cell. When a client sends a probe request with an empty
SSID, the AP similarly responds with an empty SSID.
1
Tightened: The AP does not publish the SSID of the cell. When a client sends a probe request with a
blank or incorrect SSID, the AP does not respond.
5
Simply suppressing the SSID broadcast does not provide adequate protection: When legitimate WLAN
clients associate with the AP, this transmits the SSID in cleartext so that it is briefly visible to all clients
in the WLAN network.
RADIUS accounting activated
Select this option if you want to enable the RADIUS accounting in this logical WLAN network.
Allow traffic between stations of this SSID
Check this option if all stations logged on to this SSID may communicate with one another.
WPA-Version
Here you select which WPA version the AP is to offer to the WLAN clients for encryption.
1
WPA1: WPA2 only
1
WPA2: WPA2 only
1
WPA1/2: WPA1 and WPA2 in one SSID (radio cell)
1193
Reference Manual
14 WLAN Management
WPA1 session key type
If you use "802.11i (WPA)-PSK" for encryption, the method for generating a WPA1 session or group key can
be selected here:
1
AES: The AP uses the AES method.
1
TKIP: The AP uses the TKIP method.
1
AES/TKIP: The AP uses the AES method. If the client hardware does not support the AES method, the AP
will change to the TKIP method.
WPA2 session key type
The method for generating a WPA2 session or group key can be selected here.
Basis rate
The defined basis rate should allow the slowest clients to connect to the WLAN even under poor reception
conditions. A higher value should only be set here if all clients in this logical WLAN can be reached "faster".
By setting the transmission rate to auto, the AP collects information about the transmission rates of the various
WLAN clients. Clients automatically notify the AP of this rate with each unicast communication. The AP takes
the lowest transmission rate from the list of associated clients and applies this to all multicast and broadcast
transmissions.
Client bridge support
Enable this option for an AP if you have enabled the client-bridge support for a client station in WLAN client
mode.
5
Client-bridge mode is only available between two LANCOM devices.
TX bandwidth limit
With this setting, you define the overall bandwidth that is available for transmission within this SSID. A value
of 0 disables the limit.
RX bandwidth limit
With this setting, you define the overall bandwidth that is available for reception within this SSID. A value of
0 disables the limit.
Maximum count of clients
Here you set the maximum number of clients that may associate with this AP. Additional clients wanting to
associate will be rejected by the AP.
Min. client signal strength
This value sets the threshold value in percent for the minimum signal strength for clients when logging on.
If the client's signal strength is below this value, the AP stops sending probe responses and discards the
client's requests.
A client with poor signal strength will not detect the AP and cannot associate with it. This ensures that the
client has an optimized list of available APs, as those offering only a weak connection at the client's current
position are not listed.
Use long preamble for 802.11b
Normally, the clients in 802.11b mode negotiate the length of the preamble with the AP. "Long preamble"
should only be set when the clients require this setting to be fixed.
(U)APSD / WMM Power Save activated
Enable this option to signal stations that the power saving function (U)APSD ([Unscheduled] Automatic Power
Save Delivery) is supported.
1194
Reference Manual
14 WLAN Management
(U)APSD is established in the 802.11e standard, and helps VoWLAN devices to increase their battery life. The
related devices switch to power saving mode after login on a (U)APSD-capable AP. If the AP receives data
packets for the related devices thereafter, it temporarily stores the data and waits until the VoWLAN device
is available again. It then forwards the data. Afterwards, (U)APSD increases the latency time of the radio
module, whereby it ultimately consumes less power. The individual rest periods may be so short that a VoWLAN
device can still use the power saving function in the call state itself. However, the relevant devices must also
support (U)APSD.
WWM (Wi-Fi Multimedia) Power Save is a power saving function of the Wi-Fi Alliance and is based on U-APSD.
Certain LANCOM APs are WMM® Power Save CERTIFIED by the Wi-Fi Alliance.
Max. spatial streams
The spatial multiplexing function allows the AP to transmit multiple data streams over separate antennas in
order to increase the data throughput. The use of this function is only recommended when the remote device
can process the data streams with corresponding antennas.
5
In the 'Auto' setting, the AP uses all of the spatial streams supported by this WLAN module.
Allow short guard interval
This option is used to reduce the transmission pause between two signals from 0.8 µs (default) to 0.4 µs
(short guard interval). This increases the effective time available for data transmission and thus the data
throughput. However, the wireless LAN system becomes more liable to disruption that can be caused by
interference between two consecutive signals.
The short guard interval is activated in automatic mode, provided that the remote station supports this.
Alternatively the short guard mode can be switched off.
Use frame aggregation
Frame aggregation is used to combine several data packets (frames) into one large packet and transmit them
together. This procedure reduces the overhead of the packets to increase the throughput.
Frame aggregation is not suitable when working with mobile receivers or time-critical data transmissions
such as voice over IP.
STBC (space time block coding) activated
Activate the space time block coding here.
The function 'STBC' additionally varies the transmission of data packets over time to minimize time-related
effects on the data. Due to the time offset of the packets the recipient has an even better chance of receiving
error-free data packets, regardless of the number of antennas.
LDPC (low density parity check) activated
Activate the low density parity check here.
Before the sender transmits the data packets, it expands the data stream with checksum bits depending on
the modulation rate. These checksum bits allow the receiver to correct transmission errors. By default the
802.11n standard uses 'Convolution Coding' (CC) for error correction, which is well-known from 802.11a and
802.11g; however, the 11n standard also provides for error correction according to the LDPC method (Low
Density Parity Check).
In contrast to CC encoding, LDPC encoding uses larger packets to calculate checksums and can also recognize
more bit errors. The improved ratio of payload to checksum data enables LDPC encoding to provide a higher
data transfer rate.
1195
Reference Manual
14 WLAN Management
Physical WLAN parameters
Here the physical WLAN parameters are set for assignment to the APs. The following parameters can be defined for each
set of physical WLAN parameters:
LANconfig: WLAN Controller > Profiles > Physical WLAN parameters
WEBconfig: LCOS menu tree > Setup > WLAN-Management > AP-Configuration > Radioprofiles
1
Name
Unique name for this combination of physical WLAN parameters.
1
Inheritance
Selection of a physical WLAN parameter set defined earlier and from which the settings are to be inherited.
1
Country
The country in which the APs are to be operated. This information is used to define country-specific settings such as
the permitted channels, etc.
1
Automatic channel selection
As standard the APs can use all of the channels permitted in the country of operation. To restrict the selection to
certain channels, these can be entered here as a comma-separated list. It is also possible to specify ranges or lists
(e.g.'1,6,11').
1
Management VLAN-ID
The VLAN ID of the management network used to manage the APs.
5
The Management VLAN ID must be set to a value not equal to zero in order for VLANs to be used over the
WLAN networks. This also applies when the management network itself is not to be tagged with VLAN IDs
(Mgmt-VLANID=1).
5
VLAN activation only applies to WLAN networks which are connected by means of these physical WLAN
parameters.
1
Band steering activated
This entry determines whether the AP should enable band steering. In this case, a dual-port access point can forward
a WLAN client to a preferred frequency band.
5
All other physical WLAN parameters correspond to those for the standard configuration of APs.
1196
Reference Manual
14 WLAN Management
5
To successfully acquire a profile, HTTP access to the WLC from the local network must be allowed.
14.4.3 Access point configuration
IP parameter profiles
This table is used to configure specific network profiles that are assigned with APs that must not be automatically
configured by the WLC by means of DHCP. In this way you set which specific IP parameters are used by an AP.
Name
Name of the IP parameter profiles.
Inheritance
Selection of an IP parameter profile defined earlier and from which the settings are to be inherited (see
Inheritance of parameters
auf Seite 1189).
Domain name
Name of the domain (DNS suffix) which is to use this profile.
Netmask
Netmask of the profile
Default gateway
The gateway used by the profile as standard.
DNS default
The DNS (Domain Name System) to be used by the profile.
DNS backup
Second, alternative DNS if the first is unavailable.
Start address
The start of the IPv4 address range from which a new AP receives an IP address if the WLC can allocate an
assignment group to the AP and you have not defined a specific IP address for the AP in the AP table.
1197
Reference Manual
14 WLAN Management
End address
The end of the IPv4 address range from which a new AP receives an IP address if the WLC can allocate an
assignment group to the AP and you have not defined a specific IP address for the AP in the AP table.
For further information on assignment groups, please refer to the section
IP-dependent auto configuration and tagging
of APs
auf Seite 1229.
List of access points
The AP table is a central element of the configuration for WLCs. Here, the WLC assigns WLAN profiles (i.e. the combinations
of logical and physical WLAN parameters) to the APs via their MAC addresses. Furthermore, the existence of an entry in
the AP table for a specific AP affects its ability to connect to a WLC. Under WLAN Controller > AP Configuration >
Access Point Table you can define the following parameters for each AP:
1198
Reference Manual
14 WLAN Management
Entry active
Activates or deactivates this entry.
Update management active
Activating update management for this AP enables it to download the latest firmware and script versions
automatically. All other settings are adjusted under AP update (
Central firmware and script management
).
MAC address
MAC address of the AP.
AP name
Name of the AP in managed mode.
Location
Location of the AP in managed mode.
Groups
Assigns the AP to one or more groups
WLAN profile
WLAN profile from the list of defined profiles.
Client steering profile
Client-steering profiles control how the WLC decides which APs are to accept a client at the next login attempt.
LBS AP location profile
LBS location profile from the list of defined profiles.
Control channel encryption
Encryption of communications over the control channel. Without encryption, the AP and WLC exchange the
control data as cleartext. In both cases authentication is by certificate.
Antenna grouping
Antenna grouping can be configured in order to optimize the gain from spacial multiplexing.
IP address
Here you specify a fixed IP address of the AP.
IP parameter profile
Here you specify the profile name used by the WLC to reference the IP settings for the AP. If you retain the
default setting DHCP, the WLC ignores the setting for the fixed IP address and the AP is forced to obtain its
IP address via DHCP.
Channel (Wireless ePaper interface)
Here you specify how the channel is selected for the Wireless ePaper interface.
Mode WLAN ifc.1 1
This setting allows you to configure the frequency band in which the AP operates the 1st physical WLAN
interface. When set to Default, the AP independently selects the frequency band for the physical WLAN
interface. The AP prefers the 2.4GHz band, if available.
Mode WLAN ifc.1 2
This setting allows you to configure the frequency band in which the AP operates the 2nd physical WLAN
interface. When set to Default, the AP independently selects the frequency band for the physical WLAN
interface. The AP prefers the 5GHz band, if available.
1199
Reference Manual
14 WLAN Management
4
If a managed AP only has one physical WLAN interface, the AP ignores the settings for the 2nd physical
WLAN interface.
Auto Channel selection
If no entry is made here, APs automatically carry out the channel selection for the frequency band available
in the set country of operation.
Enter the channels to be available for automatic selection by the first WLAN module. If you enter just one
channel here, the AP uses this channel only and no automatic selection takes place. For this reason you should
ensure that the channels entered here are legal for use in the defined country of operation. The AP ignores
channels that are invalid for the frequency band.
Max. channel bandwidth
Enter how and to what extent the AP specifies the channel bandwidth for the physical WLAN interface(s).
The following values are possible:
1
Automatic: The AP automatically detects the maximum channel bandwidth (default).
1
20MHz: The AP uses channels bundled at 20 MHz.
1
40MHz: The AP uses channels bundled at 40MHz.
1
80MHz: The AP uses channels bundled at 80MHz.
By default, the physical WLAN interface automatically determines the frequency range used to modulate the
data onto the carrier signals. 802.11a/b/g use 48 carrier signals in one 20-MHz channel. The use of double
the frequency range of 40 MHz means that 96 carrier signals can be used, resulting in a doubling of the data
throughput.
802.11n can use 52 carrier signals in a 20-MHz channel for modulation, and even up to 108 carrier signals
in a 40-MHz channel. The use of the 40 MHz option for 802.11n therefore means a performance gain of more
than double.
Antenna gain
This item allows you to specify the antenna gain factor (in dBi) minus attenuation of the cable and (if applicable)
lightning protection. Based on this, as well as depending on the country where the system is operated and
the frequency band, the AP calculates the maximum permitted transmission power.
If you leave the field blank, the AP uses the default setting from the configuration group in the relevant WLAN
profile.
You can reduce the transmission power to a minimum of 0.5 dBm in the 2.4-GHz band or 6.5 dBm in the
5-GHz band. This limits the maximum value that can be added to 17.5 dBi in the 2.4-GHz band and 11.5 dBi
in the 5-GHz band.
5
Be sure that your combination of antenna, cable and lightning-protection complies with the legal
requirements of the country where the system is operated.
The receiver's sensitivity is unaffected by this.
4
The current transmission power is displayed by WEBconfig or telnet under Status > WLAN-statistics >
WLAN-parameters > Transmission-power or with LANmonitor under System information >
WLAN card > Transmission power.
TX power reduction
If you use an antenna with a high amplification factor, you can use this entry to attenuate the transmission
power of your AP to the level permitted on the frequency band in the country of operation.
If you leave the field blank, the AP uses the default setting from the configuration group in the relevant WLAN
profile.
1200
Reference Manual
14 WLAN Management
The same values and constraints apply as for the field Antenna gain.
iBeacon profile (iBeacon interface)
Select an iBeacon profile from the list of profiles created.
5
You create iBeacon profiles under WLAN Controller > AP configuration > Extended settings >
iBeacon profiles.
Minor
Set a minor ID for the iBeacon module.
2402 MHz, 2426 MHz, 2480 MHz
Specify here which channels the iBeacon module uses to transmit.
Transmission power
Specify the power used by the iBeacon module to transmit. The following values are possible:
1
High: The module sends with maximum power (default).
1
Medium: The module sends with medium power.
1
Low: The module sends with minimum power.
Stations
The station table defines which WLAN clients can associate with the WLAN networks of the APs which are centrally
managed by the WLC. Furthermore, the method offers a convenient way to give each WLAN client an individual
authentication passphrase and a VLAN ID.
To use the station table, it is imperative that the RADIUS server is activated in the WLC under WLAN Controller >
Stations > Stations. As an alternative, requests can be forwarded to another RADIUS server. More information on
RADIUS is available under
RADIUS
.
For every logical WLAN in which WLAN clients are authenticated by RADIUS, the MAC check has to be activated.
MAC address
MAC address of the WLAN client for this entry. The following entries are possible:
Individual MAC address
A MAC address in the format 00a057112233, 00-a0-57-11-22-33 or 00:a0:57:11:22:33.
Wildcards
The wildcards '*' and '?' uses to specify MAC address ranges, e.g. 00a057*, 00-a0-57-11-??-??
or 00:a0:??:11:*.
1201
Reference Manual
14 WLAN Management
Vendor ID
The device contains a list of the major manufacturer OUIs (organizationally unique identifier). The MAC address
range is valid if this entry matches the first three bytes of the MAC address of the WLAN client.
4
It is possible to use wildcards.
SSID
WLAN clients with the corresponding MAC addresses have access that is limited to this SSID.
4
The use of wildcards makes it possible to allow access to multiple SSIDs.
Name
You can enter any name you wish and a comment for any WLAN client. This enables you to assign MAC
addresses more easily to specific stations or users.
Passphrase
Here you may enter a separate passphrase for each physical address (MAC address) that is used in a
802.11i/WPA/AES-PSK-secured network. If no separate passphrase is specified for this MAC address, then
the passphrases used are those stored for each logical wireless LAN network in the 802.11i/WEP section (for
WLCs, these are defined in the logical WLAN networks (SSIDs)).
TX bandwidth limit
Transmission-bandwidth restriction for WLAN clients currently authenticating themselves. A WLAN device in
client mode communicates its setting to the AP when logging on. This then uses uses these two values to set
the minimum bandwidth.
RX bandwidth limit
Reception-bandwidth restriction for WLAN clients currently authenticating themselves. A WLAN device in
client mode communicates its setting to the AP when logging on. This then uses uses these two values to set
the minimum bandwidth.
5
The RX bandwidth restriction is only active for WLAN devices in client mode. For value is not used by
normal WLAN clients.
VLAN-ID
This VLAN ID is assigned to packets that are received from the client with the MAC address entered here. In
case of VLAN-ID '0', the station is not assigned a specific VLAN ID. Instead, the VLAN ID of the radio cell
(SSID) applies.
If filter rules contradict, the individual rule has a higher priority: A rule without wildcards in the MAC address or SSID
takes precedence over a rule with wildcards. When creating these entries, the user should ensure that filter rules do not
contradict. The definitions in the filters can be checked in a Telnet session with the trace command trace WLAN-ACL.
5
The filter criteria in the station list either allow or deny WLAN clients to access your wireless network. The entries
Name, Bandwidth limit, VLAN ID and Passphrase are meaningless if the device uses valid filter criteria to
deny access to the WLAN.
Options for the WLAN controller
The Options area in the WLC configuration is used to define notifications in case of events and to set various default
values.
1202
Reference Manual
14 WLAN Management
Event notification
Notification can take place via SYSLOG or e-mail. You can define the following parameters:
LANconfig: WLAN Controller > Options
WEBconfig: LCOS menu tree > Setup > WLAN-Management > Notification
1
SYSLOG
Activates notification by SYSLOG.
2
Possible values: On/off.
1
E-mail
Activates notification by e-mail.
2
Possible values: On/off.
1
Events
Selects the events that trigger notification.
2
Possible values:
3
Report active AP
3
Report lost AP
3
Report new AP
1203
Reference Manual
14 WLAN Management
Default parameters
For some parameters, default values can be defined centrally and these serve as reference default values for other parts
of the configuration.
LANconfig: WLAN Controller > Profiles > Default country
WEBconfig: LCOS menu tree > Setup > WLAN-Management > AP-Configuration > Country-default
1
Default country
The country in which the access points are to be operated. This information is used to define country-specific settings
such as the permitted channels, etc.
2
Possible values:
3
Selection from the list of available countries
2
Default:
3
Europe
LANconfig: WLAN-Controller > AP-Config >
WEBconfig: LCOS menu tree > Setup > WLAN-Management > AP-Configuration
1
WLAN-Interface 1
Frequency of the first WLAN module. This parameter can also be used to deactivate the WLAN module.
1204
Reference Manual
14 WLAN Management
1
WLAN-Interface 2
Frequency of the second WLAN module. This parameter can also be used to deactivate the WLAN module.
1
Encryption
Encryption for the communication over the control channel. Without encryption the control data is exchanged as
cleartext. In both cases authentication is by certificate.
Tutorial: Virtualization and guest access accounts via the WLAN controller
Many companies wish to offer Internet access to their visitors via WLAN. In larger installations the required settings
apply to multiple APs, and these can be programmed centrally in the WLC.
5
You will need the Public Spot option for this.
Objectives
1
Wireless LAN infrastructure available to internal employees and guests
1
Shared physical components (cables, switches, APs)
1
Separation of networks with VLAN and ARF
1
Break-out of data streams to certain target networks:
2
Guests: Internet only
2
Internal employees: Internet, all local devices and services
1
Guests login to the WLAN with a Web form.
1
Internal employees use WLAN encryption for authentication.
Establish
1
Management of the APs is handled centrally by the WLC.
1
The WLC serves as the DHCP server for the WLAN clients in the guest network.
1
The guest network is provided with Internet access via the WLC (e.g. separate DSL access or Internet access via the
company DMZ).
1
The wired infrastructure is based on managed VLAN-capable switches:
2
The VLAN management of APs is handled by the WLC.
2
The VLAN management of the switches is handled separately by the switch configuration.
1
The APs operate within the internal VLANs.
Wireless LAN configuration of the WLAN controllers
During the configuration of the WLAN, the necessary WLAN networks are defined and, along with the physical WLAN
settings, are assigned to the APs managed by the WLC.
1205
Reference Manual
14 WLAN Management
1. Create a logical WLAN for guests and one for the internal employees:
1
The WLAN with the SSID 'GUESTS' uses the VLAN ID '100'. No encryption is employed here.
1
The WLAN with the SSID 'INTERNAL' uses the VLAN ID '1' (i.e. transmitted to the Ethernet without a VLAN tag),
and WPA2 encryption is employed.
2. Create a set of physical parameters for the APs. The management VLAN ID is set to '1', which serves to activate the
VLAN function (but without a separate management VLAN for the device; the management data traffic is transmitted
untagged).
3. Create a WLAN profile to be assigned to the APs. The two logical WLAN networks and the set of physical parameters
defined earlier are collected into this WLAN profile.
1206
Reference Manual
14 WLAN Management
4. Assign this WLAN profile to the APs managed by the WLC. Do this either by entering the individual APs with their
MAC addresses or, alternatively, you can use the default profile.
Configuring the switch
A switch configuration is demonstrated with the example of a LANCOM ES-2126+.
1. Set the VLAN mode to 'Tag based', as the APs handle the assignment of VLAN tags.
1207
Reference Manual
14 WLAN Management
2. To differentiate between the VLANs in the switch, two groups are used. The internal network for the employees is
mapped to the default group, and a dedicated group is set up for the guests. This is handled with the VLAN IDs
entered into the WLC when configuring the WLANs.
3. The default VLAN is valid on all ports and remains untagged, i.e. the VLAN tags are removed from outgoing data
packets from this group.
4. The guests' VLAN group uses the VLAN ID '100' and is valid only for the ports connected to the WLC and APs (ports
10 to 16 in our example). Tags are not removed from outgoing data packets.
5. The port VLAN ID (PVID) is set to '1' for all ports, to assign the ports to the internal network. Untagged packets
arriving at these port will be forwarded with the VLAN ID '1'.
1208
Reference Manual
14 WLAN Management
Configuring the IP networks in the WLAN controller
To separate the data streams on layer 3, two different IP networks are employed (ARF – Advanced Routing and Forwarding).
1. Set the VLAN mode to 'Tag based', as the APs handle the assignment of VLAN tags.
1
For the internal network, set the 'Intranet' to the address '192.168.1.1'. This IP network uses the VLAN ID '0'.
This assigns all untagged data packets to this network (the VLAN module in the WLC itself must be activated for
this). The interface tag '1' is used.
1
For the guests, create a new IP network with the address '192.168.100.1'. This network uses the VLAN ID '100'
so that data packets with this ID are assigned to the guest network. Here, too, the interface tag '10' is used later
by the virtual router.
2. For both IP networks, an entry is created in the DHCP networks to permanently activate the DHCP server.
1209
Reference Manual
14 WLAN Management
3. With these settings, the WLAN clients of the internal employees and guests are assigned to the appropriate networks.
Configuring Public Spot access accounts
The Public Spot allows you to provide a strictly controlled point of access to your wireless LAN. User authentication is
handled by a Web interface. Access can optionally be subject to time limits.
1210
Reference Manual
14 WLAN Management
1. You should activate authentication for network access by name and password.
2. Activate user authentication for the WLC's interface that is connected to the switch.
3. By entering the VLAN ID of '100' for the guest network into the VLAN table, the data packets for Public Spot users
are restricted to this virtual LAN. Other data packets from other VLANs will be forwarded to the Public Spot without
a login. Ensure that access to WEBconfig via the Public Spot interface is restricted to the authentication pages only
and that HTTP and HTTPS are activated in the configuration protocols.
1211
Reference Manual
14 WLAN Management
5
If the interface is not restricted to the VLAN ID, the controller will no longer be reachable at the specified
physical Ethernet port!
4. In the Public Spot module, activate the "Cleanup user table automatically" option to ensure that unwanted entries
are automatically deleted.
1212
Reference Manual
14 WLAN Management
5
Use only necessary until LCOS version 7.7 or if the user list is used.
Configuring the RADIUS server for Public Spot use
In LCOS versions prior to 7.70, Public Spot access accounts were defined by entering users into into the Public Spot
module's user list by using the Wizard. As of LCOS version 7.70, the Wizard no longer stores the Public Spot access
accounts in this list, but in the user database of the internal RADIUS server instead. In order to use Public Spot access
accounts, the RADIUS server must be configured and the Public Spot module must be set to use the RADIUS server.
1213
Reference Manual
14 WLAN Management
1. In order to use the user database in the internal RADIUS server, the RADIUS server in the device must be activated
first. Activate the RADIUS server by entering authentication and accounting ports. Use the authentication port '1812'
and the accounting port '1813'.
5
If appropriate please activate the option "Clear user list automatically" so that the entries no longer required
in the user database can be deleted automatically.
2. In order for the Public Spot access accounts to be authenticated by the device's internal RADIUS server, the Public
Spot must know the address of the RADIUS server. To ensure that this is the case, under Public Spot > Public Spot
- users > Provider list create a new entry to define the internal RADIUS server as a "Provider". Enter the IP address
for the device with the activated RADIUS server as the authentication and accounting server.
5
If the Public Spot and the RADIUS server are provided by the same device, enter the device's internal loopback
address (127.0.0.1) here and leave the secret (password) field empty.
1214
Reference Manual
14 WLAN Management
5
After updating LCOS, user accounts that were created in the Public Spot module's user list with previous
versions of LCOS are still valid.
Configuring Internet access for the guest network
1. In order to provide users of the guest network with Internet access, the wizards can be used to create access to the
provider network.
2. In order for this access to be available to users of the guest network only, the corresponding route is set for the
routing tag '10'. This ensures that only data packets from the IP network 'GUEST' with the interface tag '10' are
transmitted to the provider's network. The different routing tag values ensure that data cannot be routed between
the guest network and the internal network.
5
If the Public Spot and the RADIUS server are provided by the same device, enter the device's internal loopback
address (127.0.0.1) here.
5
After updating LCOS, user accounts that were created in the Public Spot module's user list with previous
versions of LCOS are still valid.
WLAN layer-3 tunneling
Introduction
The CAPWAP standard for centralized WLAN management offers two different channels for transmissions:
1
The obligatory control channel transports administrative data between the managed AP and the WLC.
1
The optional data channel transmits the payload data from the various WLAN networks (SSID) between the managed
AP and the WLC.
The decision whether to use of the optional data channel between the managed AP and the WLC depends on the route
to be taken by the payload data:
1
If you deactivate the data channel, the AP forwards the payload data directly to the LAN. In this case, you control
the allocation of WLAN clients to specific LAN segments, for example by assigning VLAN IDs. The advantage of this
application lies in the low load on the WLC and on the network as a whole, because the AP transmits only the
management data via the CAPWAP tunnel and it transmits the payload data over the shortest available route.
1215
Reference Manual
14 WLAN Management
1
If you activate the data channel, the AP additionally forwards the payload data to the central WLC. This approach
has the following advantages:
2
The APs can provide access to networks that are only available on the WLC, such as a central Internet access for
a Public Spot.
2
The WLANs provided by the APs (SSIDs) can be separated from one another without the use of VLAN. Avoiding
the use of VLAN reduces the effort required for the configuration of other network components such as switches,
etc.
2
WLAN clients associated with the APs and in different IP networks can roam to other APs without interruption
to their IP connections, because the connection is continually managed by the central WLC and not by the APs
(layer-3 roaming).
The use of data channels forms additional logical networks on the basis of the existing physical infrastructure. These
logical networks are known as overlay networks.
Abbildung 4: Overlay network across multiple IP networks
Using the data channel even allows you to span logical overlay networks across multiple WLCs.
Several WLCs within a single broadcast domain can support the same overlay network. Disable the WLC data channel
between these WLCs (WEBconfig: LCOS Menu Tree > Setup > WLAN-Management > WLC-Cluster >
WLC-Data-Tunnel-active). Otherwise the multiple reception of the broadcast messages would give rise to loops. Since
routers drop broadcast messages, you can activate the CAPWAP data channel for WLCs in separate networks.
The APs use virtual WLC interfaces (WLC tunnels) to manage each SSID's data channels between AP and WLC. Depending
on the model, each WLC provides 16 to 32 WLC tunnels that you can use when configuring the logical WLANs.
5
Virtual WLC interfaces are available for selection in all dialogs used to select logical interfaces (LAN or WLAN),
such as in the port table of the LAN and VLAN settings or for the definition of IP networks.
Tutorials
The following sections present specific scenarios with step-by-step instructions for a number of standard situations when
operating WLCs.
Overlay network: Separating networks for access points without using VLAN
In many cases, networks in a shared physical infrastructure are separated by using VLANs. However, this method assumes
that the switches operated in the network are VLAN-capable and that these are configured for VLAN operations.
Consequently, the administrator has to rollout the VLAN configuration for the whole network.
1216
Reference Manual
14 WLAN Management
WLCs enable you to keep networks separate while minimizing the use of VLANs. The APs use a CAPWAP data tunnel to
direct the payload from the WLAN clients straight to the WLC, which then assigns the data to the corresponding VLANs.
In this situation, VLAN configuration is only required for the WLC and a single, central switch. All of the other switches
in this example work without a VLAN configuration.
5
With this configuration, you reduce the VLAN to the core of the network structure (illustrated with a blue
background). What's more, only 3 of the switch ports in use require a VLAN configuration.
Abbildung 5: Example application of an overlay network
The diagram shows a sample application with the following components:
1
The network consists of two segments, each with its own (not necessarily VLAN-capable) switch.
1
Each segment contains several APs, each of which is connected to one of the switches.
1
Each AP provides two SSIDs for the WLAN clients in two different user groups, shown in the diagram in green and
orange.
1
Each user group has access to its own dedicated server that is separated from other user group. The servers can only
be accessed via the corresponding VLANs, i.e. through the access ports configured on the switch.
1
A WLC manages all APs in the network.
1
A central, VLAN-capable switch connects the switches in each segment, the servers for each group, and the WLC.
The aim of the configuration: A WLAN client that associates with an SSID is to have access to its "own" server, regardless
of which AP is being used and regardless of the segment in which the client is located.
5
The following description assumes a working basic configuration of the WLC. The configuration of the VLAN
switch is not part of this description.
Configuring the WLAN settings
1217
Reference Manual
14 WLAN Management
1. For each SSID, create an entry in the list of logical networks. This entry requires a suitable name and the corresponding
SSID. Connect the SSID to a WLC tunnel, for example the first SSID to "WLC-TUNNEL-1" and the second to
"WLC-TUNNEL-2 '. Set the VLAN mode to 'tagged', set the VLAN ID '10' for the first logical network and the VLAN
ID '20' for the second logical network. In LANconfig you find these settings under Configuration > WLAN
Controller > Profiles > Logical WLAN networks (SSIDs).
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your APs, such as the
country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. For this profile in the
physical WLAN parameters, enable the option to turn on the VLAN module on the APs. Set the operating mode for
the management VLAN in the AP to 'Untagged'. In LANconfig you find these settings under Configuration > WLAN
Controller > Profiles > Physical WLAN parameters.
1218
Reference Manual
14 WLAN Management
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find these settings under Configuration >
WLAN Controller > Profiles > WLAN profiles.
4. For each managed AP, create an entry in the AP table with a suitable name and the associated MAC address. Assign
the WLAN profile created previously to this AP. In LANconfig you find these settings under Configuration > WLAN
Controller > AP config. > Access point table.
Configuring the interfaces on the WLC
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Make sure that the other Ethernet
ports are not assigned to the same LAN interface. In LANconfig you find these settings under Configuration >
Interfaces > LAN > Ethernet ports.
1219
Reference Manual
14 WLAN Management
6. Assign the logical LAN interface 'LAN-1' and the WLC tunnels 'WLC-tunnel-1' and 'WLC-tunnel-2' to the bridge-group
'BRG-1'. Make sure that the other LAN ports are not assigned to the same bridge group. In LANconfig you find these
settings under Configuration > Interfaces > LAN > Port table.
5
By default, the LAN interfaces and WLC tunnels do not belong to a bridge group. By assigning the LAN
interface 'LAN-1' and the two WLC tunnels 'WLC-Tunnel-1' and 'WLC-Tunnel-2' to the bridge group 'BRG-1',
the device transmits all data packets between LAN-1 and the WLC tunnels via the bridge.
7. Under Interfaces > VLAN, activate the VLAN module of the WLC and, under VLAN table, assign the LAN port you
selected above (LAN 1) together with the matching WLC tunnel to the desired VLAN.
1220
Reference Manual
14 WLAN Management
8. Under Interfaces > VLAN > Port table, enter the Tagging mode of the tunnel interface and the LAN interface, and
set the appropriate port VLAN ID.
Depending on how the switch is configured, set the Tagging mode of the LAN interface to 'Mixed' or 'Always'.
In most cases it is desirable to operate the tunnel interfaces with the mode 'Never', because packets here (from the
WLAN) always arrive untagged and the WLC marks them with the port VLAN ID
5
When you activate the VLAN module, please observe that the ARF networks configured on the WLC must be
given a VLAN ID. If the WLC is to reach the network without a VLAN tag, then for the VLAN configuration
used above the VLAN-ID for the IP network must be set to '1'.
4
A similar configuration can be achieved if you use the access point to set a VLAN tag for packets that are
intended to be sent via the tunnel instead of using the VLAN module of the WLC.
However, this bridging between the various WLC tunnels causes the WLC to redirect broadcasts into all of
the tunnels; with a certain number of tunnels/SSIDs and APs, this can lead to load problems on the network
and on the WLC. This configuration of VLAN module prevents this.
9. Under IPv4 > General > IP networks you additionally configure the IP settings for the networks separated on layer
2.
5
To prevent the device connecting these networks on layer 3, the separation needs to be configured on this
layer too, for example by using a port tag or by means of the firewall.
10. The WLC can optionally act as a DHCP server for the APs. To set this up, activate the DHCP server for the 'INTRANET'.
In LANconfig you find these settings under IPv4 > DHCPv4 > DHCP networks.
"Layer 3 roaming"
Allowing payload data from the wireless LAN to pass-through the WLC tunnel to the WLC enables roaming even beyond
the limits of broadcast domains. In this example application, a layer-3 switch between the floors prevents the transmission
of broadcasts, and thus separates the broadcast domains.
1221
Reference Manual
14 WLAN Management
In this example, two user groups A and B each have access to their own WLAN (SSID). On all floors of the building, the
APs provide two SSIDs, 'GROUP_A' and 'GROUP_B'.
Abbildung 6: Example application for layer-3 roaming
The diagram shows a sample application with the following components:
1
The network consists of three segments on separate floors of a building.
1
A central layer-3 switch connects the segments and divides the network into three broadcast domains.
1
Each segment uses its own IP address space and its own VLAN.
1
Each segment operates a local DHCP server, which transmits the following information to the APs:
2
IP address of the gateway
2
IP address of the DNS server
2
Domain suffix
5
This information enables the APs to contact the WLC in another broadcast domain.
1222
Reference Manual
14 WLAN Management
The aim of the configuration: When moving to another floor, a WLAN client that associates with a particular SSID is to
retain access to its "own" WLAN, regardless of which AP is being used and regardless of the segment in which the client
is located. Since the segments in this example use different IP address ranges, this scenario can only be implemented
by managing the APs directly with the central WLC via layer 3 and across the boundaries of the VLANs.
5
The configuration corresponds to the example
Overlay network: Separating networks for access points without
using VLAN
auf Seite 1216.
WLAN controller with Public Spot
This scenario is based on the first scenario (overlay network) and enhances it to include specific settings for user
authentication.
The configuration of a Public Spot can be greatly simplified if the payload data sent from the WLAN to the WLC is routed
through a WLC tunnel. A Public Spot can, for example, provide guests with Internet access in parallel with, but separated
from, an internal wireless LAN.
In this example, the employees of a company have access to a private WLAN (SSID), while the guests use a Public Spot
to access the Internet. In all areas of the building, the APs provide two SSIDs, 'COMPANY' and 'GUESTS'.
Abbildung 7: Example application: WLAN controller with Public Spot
The aim of the configuration: A WLAN client that associates with the internal SSID should have access to all internal
resources and the Internet via the central gateway. The APs break-out the payload data from the internal clients locally
and pass it on directly to the LAN. The guests' WLAN clients associate with the Public Spot. The APs send the payload
data from the guest clients through a WLC tunnel directly to the WLC, which uses a separate WAN interface for Internet
access.
1. The internal WLAN and the guest WLAN each require an entry to be created in the list of logical networks, each with
a suitable name and the corresponding SSID. Link the SSID for internal use with the 'LAN at AP', and the SSID for
guests with (for example) 'WLC-TUNNEL-1'. Disable encryption for the guest network SSID so that the guests' WLAN
1223
Reference Manual
14 WLAN Management
clients can associate with the Public Spot. You should also prevent inter-station traffic for this SSID. In LANconfig
you find this setting under Configuration > WLAN Controller > Profiles > Logical WLAN networks (SSIDs).
1224
Reference Manual
14 WLAN Management
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your APs, such as the
country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. In LANconfig you find
this setting under Configuration > WLAN Controller > Profiles > Physical WLAN parameters.
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find this setting under Configuration > WLAN
Controller > Profiles > WLAN profiles.
4. For each managed AP, create an entry in the AP table with a suitable name and the associated MAC address. Assign
the WLAN profile created previously to this AP. In LANconfig you find this setting under Configuration > WLAN
Controller > AP config. > Access point table.
1225
Reference Manual
14 WLAN Management
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Set the 4th Ethernet port to the
logical interface 'DSL-1'. The WLC will use this LAN interface for the guest network Internet access. In LANconfig
you find this setting under Configuration > Interfaces > LAN > Ethernet ports.
6. Verify that the logical LAN interface 'WLC-tunnel-1' is not allocated to a bridge group. This ensures that the other
LAN interfaces do not transmit any data to the Public Spot. In LANconfig you find this setting under Configuration >
Interfaces > LAN > Port table.
7. For the guest Internet access, create an entry in the list of DSL remote sites with the hold time '9999' and the
pre-defined layer 'DHCPOE '. This example assumes that Internet access is provided by a router with DHCP server.
In LANconfig you find this setting under Configuration > Communications > Remote sites > Remote sites.
8. For internal users, create the IP network 'INTRANET' with (for example) the IP address '192.168.1.100' and the
interface tag '1'. For the guest access, create the IP network 'GUEST-ACCESS' with (for example) the IP address of
1226
Reference Manual
14 WLAN Management
'192.168.200.1' and the interface tag '2'. The virtual router in the WLC uses the interface tags to separate the routes
for the two networks. In LANconfig you find this setting under Configuration > TCP/IP > General > IP networks.
9. The WLC can act as a DHCP server for APs and the associated WLAN clients. To set this up, activate the DHCP server
for the 'INTRANET' and the 'GUEST-ACCESS'. In LANconfig you find this setting under Configuration > TCP/IP >
DHCP > DHCP networks.
5
Activation of the DHCP server is obligatory for the guest network and optional for the internal network. There
are other ways of realizing a DHCP server for the internal network.
1227
Reference Manual
14 WLAN Management
10. Create a new default route in the routing table to direct the data from the guest network to the Internet connection
used by the WLC. Select the routing tag '2' and the router 'Internet'. Also activate the option 'Masking intranet and
DMZ (default)'. In LANconfig you find this setting under Configuration > IP router > Routing > Routing table.
11. Activate the Public Spot user authentication for the logical LAN interface 'WLC-Tunnel-1'. In LANconfig you find this
setting under Configuration > Public-Spot > Server > Interfaces.
12. The final step is to enable authentication via the Public Spot for the WLC. In LANconfig you find this setting under
Configuration > Public Spot > Authentication.
1228
Reference Manual
14 WLAN Management
In addition to configuring the WLC, you must also configure the Public Spot either to use the internal user list or to
use a RADIUS server, according to your needs.
14.4.4 IP-dependent auto configuration and tagging of APs
The easiest way to manage all of the APs that you add to a managed network is to use a flat hierarchy. However, in the
largest installations with hundreds of APs across several locations, this type of organization quickly becomes confusing
and creates a high level of administrative effort. Setting up Assignment groups can help to simplify the management
of distributed APs. The WLC can automatically to configure each new AP based on the IP addresses it receives. Manual
assignment of an IP parameter profile, a WLAN profile and a Client-steering profile by an administrator is no longer
required.
The following describes how an assignment group is used when an unassociated AP registers with a central WLC: After
the new APs are installed on site (e.g. at a company or branch network), they try to establish a connection to the specified
WLC and obtain a configuration via CAPWAP. The WLC detects the connection requests and, for each new AP, it checks
the AP table for a suitable AP profile (e.g., the default profile) and/or whether a suitable assignment group has been
defined. If one or more configuration options are available, the WLC checks them for the following states:
1. For a new AP there is an assignment group but no AP profile. In this case, the WLC assigns the profile specified in
the assignment group to the new AP.
2. For a new AP there is both an assignment group as well as an AP profile. In this case, the WLC ignores the assignment
group and assigns the profile defined in the AP profile to the new AP.
3. For a new AP, there is an AP profile but no assignment group. The behavior is the same as point (2).
If a new AP has neither an AP profile nor an assignment group, the WLC issues an alarm to notify the administrator of
the incorrect configuration.
After successful group assignment, the WLC automatically creates an AP profile for every new AP in the access point
table. In the Groups field, the WLC references the assignment group used when it added the new AP.
5
An AP is only ever allowed to receive one assignment group. If the IP address ranges of the assignment groups
should overlap, LCOS immediately detects the configuration error and writes the messages to the corresponding
status table under Status > WLAN-Management > AP-Configuration.
The group field also gives you the the option of assigning individually definable tags to an AP. For example, these Tag
groups can be used to act as filter criteria in order for the WLC to restrict the actions it performs to a selection of APs.
Setting up assignment groups for IP-dependent auto configuration
The following tutorial shows you how you setup assignment groups on a WLC for the IP-dependent automatic configuration
of new APs.
1. Open the configuration dialog for your device and select WLAN controller > AP configuration > Assignment
groups
2. Click on Add to create a new group.
3. Enter under Name a unique descriptor for the assignment group, for example, Berlin_branch.
1229
Reference Manual
14 WLAN Management
4. Select the WLAN profile that the WLC automatically assigns to a new AP if the IP address of the new AP is within
the source IP range.
5. Enter the IP parameter profile if the new AP should receive a manual network configuration. Otherwise, leave the
value as DHCP, whereby the AP automatically gets a network configuration from the DHCP server. The DHCP server
must be configured to do this.
If you wish to assign a manual network configuration in which a new AP receives a different IP address, you specify
the corresponding address range in the IP parameter profile under Address assignment pool.
6. Optional: Specify a Client-steering profile in order to forward future WLAN clients to the ideal AP in case there
are several new APs within transmission range.
5
If you activate client steering, this must be activated for every AP in the managed infrastructure. Refer to
section
Client steering by WLC
for further information on this.
7. Enter the start and end of the Source IP range relevant to the assignment group.
A new AP must register at the WLC with an IP address from this range in order to obtain the configuration for this
group.
8. Close all dialog windows with OK and save the configuration to your device.
From now on, the WLC assigns the profiles referenced in the assignment groups to all new APs. The LCOS console can
now provide you with information about the categorization, see
Overview of CAPWAP parameters with the show command
.
5
Please ensure that the access point table does not contain an AP profile (e.g., the default profile), which the
WLC would assign to the unassociated APs. If an appropriate AP profile is available, this always takes higher
priority than the assignment groups.
Setting up tag groups for the detailed selection of APs
The following tutorial shows you how a tag group can be added to an AP configuration on a WLC. To do this, you first
create a tag group and then assign it to a WLAN profile.
1. Open the configuration dialog for your device and select WLAN controller > AP configuration > Tag groups
2. Click on Add to create a new group.
3. Under Name you enter the new tag and save the entry with OK.
4. Navigate to the dialog with WLAN controller > AP configuration > Access point table.
5. Select an existing AP profile with Edit or add a new one, if necessary.
6. Under Groups select the tag group(s) created earlier.
Multiple tag groups can be specified in a comma-separated list.
4
The tag groups are independent of the assignment groups, the assignment of which is specified in the same
field. Assignment groups are generally assigned by the device, so this does not need to be done by the user.
The manual allocation of an assignment group has no effect on the AP configuration, which is in line with
the state check described under
IP-dependent auto configuration and tagging of APs
auf Seite 1229. The only
effects are on the filtering in the command show capwap group at the console
5
The manual addition of assignment group for filtering purposes is not recommended. You should create
separate tag groups instead.
7. Close all dialog windows with OK and save the configuration to your device.
From now on the WLC gives the tags in the edited WLAN profile to those APs that received it.
1230
Reference Manual
14 WLAN Management
14.5 Tutorial: Virtualization and guest access accounts via the LANCOM WLAN
controller
Many companies wish to offer Internet access to their visitors via WLAN. In larger installations the required settings
apply to multiple access points, and these can be programmed centrally in the WLAN controller.
5
The Public Spot Option is mandatory for this tutorial.
Objectives
1
Wireless LAN infrastructure available to internal employees and guests
1
Shared physical components (cables, switches, access points)
1
Separation of networks with VLAN and ARF
1
Break-out of data streams to certain target networks:
2
Guests: Internet only
2
Internal employees: Internet, all local devices and services
1
Guests login to the WLAN with a Web form.
1
Internal employees use WLAN encryption for authentication.
Establish
1
Management of the access points is handled by the LANCOM WLC.
1
The LANCOM WLC serves as the DHCP server for the WLAN clients in the guest network.
1
The guest network is provided with Internet access via the LANCOM WLC (e.g. separate DSL access or Internet access
via the company DMZ).
1
The wired infrastructure is based on managed VLAN-capable switches:
2
The VLAN management of access points is handled by the LANCOM WLC.
2
The VLAN management of the switches is handled separately by the switch configuration.
1
The access points operate within the internal VLANs.
14.5.1 Wireless LAN configuration of the WLAN controllers
During the configuration of the WLAN, the necessary WLAN networks are defined and, along with the physical WLAN
settings, are assigned to the access points managed by the controller.
1. Create a logical WLAN for guests and one for the internal employees:
1
The WLAN with the SSID 'GUESTS' uses the VLAN ID '100'. No encryption is employed here.
1231
Reference Manual
14 WLAN Management
1
The WLAN with the SSID 'INTERNAL' uses the VLAN ID '1' (i.e. transmitted to the Ethernet without a VLAN tag),
and WPA encryption is employed.
2. Create a set of physical parameters for the access points. The management VLAN ID is set to '1', which serves to
activate the VLAN function (but without a separate management VLAN for the device; the management data traffic
is transmitted untagged).
3. Create a WLAN profile to be assigned to the access points. The two logical WLAN networks and the set of physical
parameters defined earlier are collected into this WLAN profile.
1232
Reference Manual
14 WLAN Management
4. Assign this WLAN profile to the access points managed by the controller. Do this either by entering the individual
access points with their MAC addresses or, alternatively, you can use the default profile.
14.5.2 Configuring the switch
A switch configuration is demonstrated with the example of a LANCOM ES-2126+.
1. Set the VLAN mode to &Tag based&, as the access points handle the assignment of VLAN tags.
1233
Reference Manual
14 WLAN Management
2. To differentiate between the VLANs in the switch, two groups are used. The internal network for the employees is
mapped to the default group, and a dedicated group is set up for the guests. This is handled with the VLAN IDs
entered into the controller when configuring the WLANs.
3. The default VLAN is valid on all ports and remains untagged, i.e. the VLAN tags are removed from outgoing data
packets from this group.
4. The guests' VLAN group uses the VLAN ID '100' and is valid only for the ports connected to the WLAN controller
and access points (ports 10 to 16 in our example). Tags are not removed from outgoing data packets.
1234
Reference Manual
14 WLAN Management
5. The port VLAN ID (PVID) is set to '1' for all ports, to assign the ports to the internal network. Untagged packets
arriving at these port will be forwarded with the VLAN ID '1'.
14.5.3 Configuring the IP networks in the WLAN controller
To separate the data streams on layer 3, two different IP networks are employed (ARF – Advanced Routing and Forwarding).
1. Set the VLAN mode to &Tag based&, as the access points handle the assignment of VLAN tags.
1
For the internal network, set the 'Intranet' to the address '192.168.1.1'. This IP network uses the VLAN ID '0'.
This assigns all untagged data packets to this network (the VLAN module in the controller itself must be activated
for this). The interface tag '1' is used for the subsequent break-out of data in the virtual router.
1
For the guests, create a new IP network with the address '192.168.100.1'. This network uses the VLAN ID '100'
so that data packets with this ID are assigned to the guest network. Here, too, the interface tag '10' is used later
by the virtual router.
1235
Reference Manual
14 WLAN Management
2. For both IP networks, an entry is created in the DHCP networks to permanently activate the DHCP server.
3. With these settings, the WLAN clients of the internal employees and guests are assigned to the appropriate networks.
1236
Reference Manual
14 WLAN Management
14.5.4 Configuring Public Spot access
The Public Spot allows you to provide a strictly controlled point of access to your wireless LAN. User authentication is
handled by a Web interface. Access can optionally be subject to time limits.
1. You should activate authentication for network access by name and password.
2. Activate user authentication for the controller's interface that is connected to the switch.
1237
Reference Manual
14 WLAN Management
3. By entering the VLAN ID of '100' for the guest network into the VLAN table, the data packets for Public Spot users
are restricted to this virtual LAN. Other data packets from other VLANs will be forwarded to the Public Spot without
a login. Ensure that access to WEBconfig via the Public Spot interface is restricted to the authentication pages only
and that HTTP is activated in the configuration protocols.
5
If the interface is not restricted to the VLAN ID, the controller will no longer be reachable at the specified
physical Ethernet port!
1238
Reference Manual
14 WLAN Management
4. In the Public Spot module, activate the "Cleanup user table automatically" option to ensure that unwanted entries
are automatically deleted.
14.5.5 Configuring the RADIUS server to operate a Public Spot
In LCOS versions prior to 7.70, Public Spot access accounts were defined by entering users into the Public Spot module's
user list by using the Wizard. As of LCOS version 7.70, the Wizard no longer stores the Public Spot access accounts in
this list, but in the user database of the internal RADIUS server instead. In order to use Public Spot access accounts, the
RADIUS server must be configured and the Public Spot module must be set to use the RADIUS server.
1239
Reference Manual
14 WLAN Management
1. In order to use the user database in the internal RADIUS server, the RADIUS server in the LANCOM must be activated
first. Activate the RADIUS server by entering authentication and accounting ports. Use the authentication port '1812'
and the accounting port '1813'.
5
If appropriate please activate the "Auto cleanup user table" option to ensure, that entries not used any longer
can be deleted automatically from the user database.
2. In order for the Public Spot access accounts to be authenticated by the LANCOM's internal RADIUS server, the Public
Spot must know the address of the RADIUS server. To ensure that this is the case, under Public Spot > Public Spot
- users > Provider list create a new entry to define the internal RADIUS server as a "Provider". Enter the IP address
for the LANCOM with the activated RADIUS server as the authentication and accounting server.
5
If the Public Spot and the RADIUS server are provided by the same LANCOM, enter the device's internal
loopback address (127.0.0.1) here.
1240
Reference Manual
14 WLAN Management
5
After an LCOS update, user accounts that were created in the Public Spot module's user list with previous
versions of LCOS are still valid.
14.5.6 Configuring Internet access for the guest network
1. In order to provide users of the guest network with Internet access, the wizards can be used to create access to the
provider network.
2. In order for this access to be available to users of the guest network only, the corresponding route is set for the
routing tag '10'. This ensures that only data packets from the IP network 'GUEST' with the interface tag '10' are
transmitted to the provider's network. The different routing tag values ensure that data cannot be routed between
the guest network and the internal network.
5
If the Public Spot and the RADIUS server are provided by the same LANCOM, enter the device's internal
loopback address (127.0.0.1) here.
5
After an LCOS update, user accounts that were created in the Public Spot module's user list with previous
versions of LCOS are still valid.
14.6 Access point administration
14.6.1 Accepting new access points into the WLAN infrastructure manually
If you prefer not to accept access points into the WLAN infrastructure automatically, you can accept access points
manually.
Using LANmonitor to accept access points
It is very easy to accept new access points with LANmonitor. A configuration is selected that will be assigned to the
access point after transmission of a new certificate.
1241
Reference Manual
14 WLAN Management
In LANmonitor, click on the new access point with the right-hand mouse key. From the context menu that pops up, you
select the configuration which is to be assigned to the device.
5
Assignment of the configuration causes the access point to be entered into the AP table in the WLAN controller.
It takes a few seconds for the WLAN controller to assign a certificate to the access point and for this to become
an active element in the central WLAN infrastructure. Due to this, the newly accepted access point is briefly
signaled as a "Lost AP" by the red Lost AP LED, in the device's display, and in LANmonitor until assignment of
the certificate is completed.
Accepting access points via WEBconfig with provision of a certificate
New access points that do not have a valid certificate but do have an entry in the AP table can be manually accepted
with WEBconfig.
1. Open the configuration of the LANCOM WLAN controller in WEBconfig.
2. Under LCOS Menu Tree > Setup > WLAN-Management select the action Accept AP.
3. When requested for additional arguments, enter the MAC address of the access point to be accepted and confirm
with Execute.
Accepting access points via WEBconfig with provision of a certificate and configuration
New access points that do not have a valid certificate and do not have an entry in the AP table can be manually accepted
by means of a wizard in WEBconfig. A configuration is selected that will be assigned to the access point after transmission
of a new certificate.
1242
Reference Manual
14 WLAN Management
1. Open the configuration of the LANCOM WLAN controller in WEBconfig. Click on Setup Wizards and select the
wizard Assign access points to profiles.
2. Click on the link to start the wizard. Select the desired access point by means of its MAC address and choose the
WLAN configuration that is to be assigned to the access point.
5
Assignment of the configuration causes the access point to be entered into the AP table in the WLAN
controller. It takes a few seconds for the WLAN controller to assign a certificate to the access point and for
this to become an active element in the central WLAN infrastructure. Due to this, the newly accepted access
point is briefly signaled as a "Lost AP" by the red Lost AP LED, in the device's display, and in LANmonitor
until assignment of the certificate is completed.
14.6.2 Manually removing access points from the WLAN infrastructure
The following actions are required to remove an access point under management of the WLAN controller from the WLAN
infrastructure:
1. In the access point, switch the WLAN operating mode of the WLAN module from 'Managed' to 'Client' or 'Access
Point'.
2. In the WLAN controller, delete the configuration for the access point and/or deactivate Automatically provide APs
with a default configuration via LCOS Menu Tree > Setup > WLAN-Management > Autoaccept-AP.
3. Disconnect the access point in WEBconfig by selecting LCOS Menu Tree > Setup > WLAN-Management and the
action Disconnect AP, or alternatively in LANmonitor.
1243
Reference Manual
14 WLAN Management
4. When requested for additional arguments, enter the MAC address of the access point to be disconnected and confirm
with Execute.
14.6.3 Deactivating access points or permanently removing them from the WLAN
infrastructure
Occasionally it is necessary to temporarily deactivate or even permanently remove a WLAN controller-managed access
point.
Deactivating an access point
To deactivate an access point, set its corresponding entry in the AP table to 'inactive' or delete the entry from the table.
In the access point, the WLAN modules in managed mode are switched off and the corresponding SSIDs are deleted.
5
The WLAN modules and the WLAN networks (SSIDs) are still switched off even if standalone operation is activated.
An access point deactivated in this way remains connected to the WLAN controller and the certificates are retained. The
WLAN controller can reactivate the access point and its managed-mode WLAN modules at any time. All you have to do
is to activate the entry in the AP table or make a new entry in the AP table for the corresponding MAC address.
If the connection to a deactivated access point is broken (either unintentionally due to a failure or intentionally by the
administrator) then the access point begins a new search for a suitable WLAN controller. Although the former WLAN
controller can check the validity of the certificate, due to the fact that there is no (active) entry in the AP table, the access
point treats it as a secondary WLAN controller. If the access point finds a primary WLAN controller then it will register
with it.
Permanently removing an access point from the WLAN infrastructure
In order to permanently remove an access point from a centrally managed WLAN infrastructure, the certificates in the
SCEP client have to be either deleted or revoked.
1
If you have access to the access point, the certificates are quickly deleted by resetting the device.
1
If the device has been stolen and consequently needs to be removed from the WLAN infrastructure, then the certificates
in the WLAN controller's CA have to be revoked. This is done in WEBconfig by navigating to Status > Certificates >
SCEP-CA > Certificates and accessing the Certificate status table. Here you delete the certificate for the MAC
address of the access point which is to be removed from the WLAN infrastructure. The certificates are not actually
deleted, but they are marked as expired.
5
In case of a backup solution featuring redundant WLAN controllers, the certificates have to be revoked in all of
the WLAN controllers!
14.7 Central firmware and script management
LANCOM WLAN controllers allow the configurations of multiple LANCOM WLAN routers and LANCOM access points to
be managed from a central location in a consistent and convenient manner. With central firmware and script management,
uploads of firmware and scripts can be automated for all of the WLAN devices.
To achieve this, the firmware and script files are stored on a Web server (firmware as *.upx files, scripts and *.lcs files).
The WLAN controller checks once daily, or when prompted by a user, to compare the available files with those on the
1244
Reference Manual
14 WLAN Management
devices. Alternatively, this procedure can be handled by a cron job—overnight, for example. If an update can be carried
out, or if the access point is not running the desired firmware version, then the WLAN controller downloads the file from
the Web server and uploads it to the appropriate WLAN routers and access points.
The configuration of firmware and script management provides precise control over the distribution of the files. It is
possible, for example, to limit certain firmware versions to certain device types or MAC addresses.
An update can be carried out in two possible states:
1
When a connection is established; the access point subsequently restarts automatically.
1
If the access point is already connected, the device does not restart automatically. In this case the access point is
manually restarted with the menu action Setup > WLAN-Management > Central-Firmware-Management >
Reboot-updated-APs or by a timed cron job.
1
The action Setup > WLAN-Management > Central-Firmware-Management >
Update-Firmware-and-Script-Information updates the script and firmware directories.
The parameters for configuration can be found under the following paths:
LANconfig: WLAN Controller > AP Update
WEBconfig: Setup > WLAN-Management > Central-Firmware-Management
14.7.1 General settings for firmware management
1
Firmware URL
The path to the directory with the firmware files.
2
Possible values: URL in the form Server/Directory or http://Server/Directory
2
Default: Blank
1
Simultaneously loaded FW
The number of firmware versions loaded simultaneously into the main memory of the WLAN controller.
1245
Reference Manual
14 WLAN Management
5
The firmware versions stored here are downloaded from the server just once and then used for all update
processes.
2
Possible values: 1 to 10
2
Default: 5
1
Firmware sender IP address
This is where you can configure an optional sender address for use instead of the one automatically selected for the
destination address.
Possible values:
2
Name of a defined IP network.
2
'INT' for the IP address in the first network with the setting 'Intranet'.
2
'DMZ' for the IP address in the first network with the setting 'DMZ'.
2
Name of a loopback address.
2
Any other IP address.
Default:
2
Blank
5
If the list of IP networks or loopback addresses contains an entry named 'INT' or 'DMZ', the associated IP
address of the IP network or the loopback address named 'INT' or 'DMZ' is used.
Firmware management table
Table with device type, MAC address and firmware version for the precise control of the firmware files in use.
1
Device types
Select here the type of device that the firmware version specified here is to be used for.
2
Possible values: All, or a selection from the list of available devices.
2
Default: All
1
MAC address
Select here the device (identified by its MAC address) that the firmware version specified here is to be used for.
2
Possible values: Valid MAC address
2
Default: Blank
1
Version
Firmware version that is to be used for the devices or device types specified here.
2
Possible values: Firmware version in the form X.XX
2
Default: Blank
General settings for script management
1
Script URL
The path to the directory with the script files.
2
Possible values: URL in the form Server/Directory or http://Server/Directory
2
Default: Blank
1
Script sender IP address
1246
Reference Manual
14 WLAN Management
This is where you can configure an optional sender address for use instead of the one automatically selected for the
destination address.
Possible values:
2
Name of a defined IP network.
2
'INT' for the IP address in the first network with the setting 'Intranet'.
2
'DMZ' for the IP address in the first network with the setting 'DMZ'.
2
Name of a loopback address.
2
Any other IP address.
Default:
2
Blank
5
If the list of IP networks or loopback addresses contains an entry named 'INT' or 'DMZ', the associated IP
address of the IP network or the loopback address named 'INT' or 'DMZ' is used.
Script management table
Table with the name of the script file and a WLAN profile for allocating the script to a WLAN profile.
Configuring a WLAN router and access point in the "Managed" mode is handled via WLAN profiles. A script can be used
for setting those detailed parameters in managed devices that are not handled by the pre-defined parameters in a WLAN
profile. Distribution is also handled by WLAN profiles to ensure that the wireless routers and access points with the same
WLC configuration also use the same script.
As only one script file can be defined per WLAN profile, versioning is not possible here. However, when distributing a
script to a wireless router or access point, an MD5 checksum of the script file is saved. This checksum allows the WLAN
Controller to determine whether the script file has to be transmitted again in case a new or altered script has the same
file name.
1
Script file name
Name of the script file to be used.
2
Possible values: File name in the form *.lcs
2
Default: Blank
1
WLAN profile
Select here the WLAN profile that the script file specified here should be used for.
2
Possible values: Selection from the list of defined WLAN profiles.
2
Default: Blank
Internal script storage (script management without an HTTP server)
In contrast to firmware files, scripts involve only small volumes of data. The WLAN controller's internal script storage
allows three scripts of up to 64KB each to be stored. If script requirements do not exceed this volume, an HTTP server
does not need to be configured for this purpose.
Script files are simply loaded from the designated storage location using WEBconfig. After upload the list of available
scripts must be updated with Setup > WLAN-Management > Central-Firmware-Management > Update Firmware
and Script Information.
The internal scripts can be referenced from the script management table using the relevant names (WLC_Script_1.lcs,
WLC_Script_2.lcs or WLC_Script_3.lcs).
1247
Reference Manual
14 WLAN Management
5
Please be careful with upper and lower case letters when entering script names.
14.8 WLAN layer-3 tunneling
14.8.1 Introduction
The CAPWAP standard for centralized WLAN management offers two different channels for transmissions:
1
The obligatory control channel transports administrative data between the managed access point and the WLAN
controller.
1
The optional data channel transmits the payload data from the various WLAN networks (SSID) between the managed
access point and the WLAN controller.
The decision whether to use of the optional data channel between the managed access point and the WLAN controller
depends on the route to be taken by the payload data:
1
If you deactivate the data channel, the access point forwards the payload data directly to the LAN. In this case, you
control the allocation of WLAN clients to specific LAN segments, for example by assigning VLAN IDs. The advantage
of this application lies in the low load on the controller and on the network as a whole, because the access point
transmits only the management data via the CAPWAP tunnel and it transmits the payload data over the shortest
available route.
1
If you activate the data channel, the access point additionally forwards the payload data to the central WLAN
controller. This approach has the following advantages:
2
The access points can provide access to networks that are only available on the WLAN controller, such as a central
Internet access for a Public Spot.
2
The WLANs provided by the access points (SSIDs) can be separated from one another without the use of VLAN.
Avoiding the use of VLAN reduces the effort required for the configuration of other network components such
as switches, etc.
2
WLAN clients associated with the access points and in different IP networks can roam to other access points
without interruption to their IP connections, because the connection is continually managed by the central
controller and not by the access points (layer-3 roaming).
1248
Reference Manual
14 WLAN Management
The use of data channels forms additional logical networks on the basis of the existing physical infrastructure. These
logical networks are known as overlay networks.
Overlay network across multiple IP networks
Using the data channel even allows you to span logical overlay networks across multiple WLAN controllers.
Several WLCs within a single broadcast domain can support the same overlay network. Disable the WLC data channel
between these controllers (WEBconfig: LCOS Menu Tree > Setup > WLAN-Management > WLC-Cluster >
WLC-Data-Tunnel-active). Otherwise the multiple reception of the broadcast messages would give rise to loops. Since
routers discard broadcast messages, you can activate the CAPWAP data channel for controllers in separate networks.
The access points use virtual WLC interfaces (WLC tunnels) to manage each SSID's data channels between access point
and WLAN controller. Depending on the model, each WLAN controller provides 16 to 32 WLC tunnels that you can use
when configuring the logical WLANs.
5
Virtual WLC interfaces are available for selection in all dialogs used to select logical interfaces (LAN or WLAN),
such as in the port table of the LAN and VLAN settings or for the definition of IP networks.
14.8.2 Tutorials
The following sections present specific scenarios with step-by-step instructions for a number of standard situations when
operating WLAN controllers.
Overlay network: Separating networks for access points without using VLAN
In many cases, networks in a shared physical infrastructure are separated by using VLANs. However, this method assumes
that the switches operated in the network are VLAN-capable and that these are configured for VLAN operations.
Consequently, the administrator has to rollout the VLAN configuration for the whole network.
WLAN controllers enable you to separate the networks while minimizing the use of VLANs. The access points use a
CAPWAP data tunnel to direct the payload from the WLAN clients straight to the controller, which then assigns the data
to the corresponding VLANs. In this situation, VLAN configuration is only required for the controller and a single, central
switch. All of the other switches in this example work without a VLAN configuration.
1249
Reference Manual
14 WLAN Management
5
With this configuration, you reduce the VLAN to the core of the network structure (illustrated with a blue
background). What's more, only 3 of the switch ports in use require a VLAN configuration.
Example application: Overlay network
The diagram shows a sample application with the following components:
1
The network consists of two segments, each with its own (not necessarily VLAN-capable) switch.
1
Each segment contains several access points, each of which is connected to one of the switches.
1
Each access point provides two SSIDs for the WLAN clients in two different user groups, shown in the diagram in
green and orange.
1
Each user group has access to its own dedicated server that is separated from other user group. The servers can only
be accessed via the corresponding VLANs, i.e. through the access ports configured on the switch.
1
A single WLAN controller manages all of the access points in the network.
1
A central, VLAN-capable switch connects the switches in each segment, the servers for each group, and the WLAN
controller.
The aim of the configuration: A WLAN client that associates with an SSID is to have access to its "own" server, regardless
of which access point is being used and regardless of the segment in which the client is located.
5
The following description assumes a working basic configuration of the WLAN controller. The configuration of
the VLAN switch is not part of this description.
Configuring the WLAN settings
1. For each SSID, create an entry in the list of logical networks. This entry requires a suitable name and the corresponding
SSID.Connect the SSID to a WLC tunnel, for example the first SSID to "WLC-TUNNEL-1" and the second to
"WLC-TUNNEL-2 '. Set the VLAN mode to 'tagged', set the VLAN ID '10' for the first logical network and the VLAN
1250
Reference Manual
14 WLAN Management
ID '20' for the second logical network. In LANconfig you find these settings under Configuration > WLAN
Controller > Profiles > Logical WLAN networks (SSIDs).
Logical WLAN networks for overlay networks
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your access points, such
as the country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. For this profile
in the physical WLAN parameters, enable the option to turn on the VLAN module on the access points. Set the
operating mode for the management VLAN in the access points to 'Untagged'. In LANconfig you find these settings
under Configuration > WLAN Controller > Profiles > Physical WLAN parameters.
1251
Reference Manual
14 WLAN Management
Physical WLAN parameters for overlay networks
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find these settings under Configuration >
WLAN Controller > Profiles > WLAN profiles.
WLAN profiles for overlay networks
4. For each managed access point, create an entry in the access point table with a suitable name and the associated
MAC address. Assign the WLAN profile created previously to this access point. In LANconfig you find these settings
under Configuration > WLAN Controller > AP config. > Access point table.
Access point table for overlay networks
Configuring the interfaces on the WLC
1252
Reference Manual
14 WLAN Management
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Make sure that the other Ethernet
ports are not assigned to the same LAN interface. In LANconfig you find these settings under Configuration >
Interfaces > LAN > Ethernet ports.
Ethernet setting for overlay networks
6. Assign the logical LAN interface 'LAN-1' and the WLC tunnels 'WLC-tunnel-1' and 'WLC-tunnel-2' to the bridge-group
'BRG-1'. Make sure that the other LAN ports are not assigned to the same bridge group. In LANconfig you find these
settings under Configuration > Interfaces > LAN > Port table.
Port settings for overlay networks
5
By default, the LAN interfaces and WLC tunnels do not belong to a bridge group. By assigning the LAN
interface 'LAN-1' and the two WLC tunnels 'WLC-Tunnel-1' and 'WLC-Tunnel-2' to the bridge group 'BRG-1',
the device transmits all data packets between LAN-1 and the WLC tunnels via the bridge.
1253
Reference Manual
14 WLAN Management
7. The WLAN controller can optionally act as a DHCP server for the access points. To set this up, activate the DHCP
server for the 'INTRANET'. In LANconfig you find these settings under Configuration > TCP > DHCP > DHCP
networks.
DHCP settings for overlay networks
Layer-3 roaming
Allowing payload data from the wireless LAN to pass-through the WLC tunnel to the controller enables roaming even
beyond the limits of broadcast domains. In this example application, a layer-3 switch between the floors prevents the
transmission of broadcasts, and thus separates the broadcast domains.
In this example, two user groups A and B each have access to their own WLAN (SSID). On all floors of the building, the
access points provide two SSIDs, 'GROUP_A' and 'GROUP_B'.
1254
Reference Manual
14 WLAN Management
Example application: Layer-3 roaming
The diagram shows a sample application with the following components:
1
The network consists of three segments on separate floors of a building.
1
A central layer-3 switch connects the segments and divides the network into three broadcast domains.
1
Each segment uses its own IP address space and its own VLAN.
1
Each segment operates a local DHCP server, which transmits the following information to the access points:
2
IP address of the gateway
2
IP address of the DNS server
2
Domain suffix
5
This information enables the access points to contact the WLC controller in another broadcast domain.
The aim of the configuration: When moving to another floor, a WLAN client that associates with a particular SSID is to
retain access to its "own" WLAN, regardless of which access point is being used and regardless of the segment in which
the client is located. Since the segments in this example use different IP address ranges, this scenario can only be
implemented by managing the access points directly with the central WLAN controller via layer 3 and across the boundaries
of the VLANs.
5
The configuration corresponds to the example
Overlay network: Separating networks for access points without
using VLAN
on page 1249.
WLAN controller with Public Spot
This scenario is based on the first scenario (overlay network) and enhances it to include specific settings for user
authentication.
The configuration of a Public Spot can be greatly simplified if the payload data sent from the WLAN to the controller is
routed through a WLC tunnel. A Public Spot can, for example, provide guests with Internet access in parallel with, but
separated from, an internal wireless LAN.
In this example, the employees of a company have access to a private WLAN (SSID), while the guests use a Public Spot
to access the Internet. In all areas of the building, the access points provide two SSIDs, 'COMPANY' and 'GUESTS'.
Example application: WLAN controller with Public Spot
1255
Reference Manual
14 WLAN Management
The aim of the configuration: A WLAN client that associates with the internal SSID should have access to all internal
resources and the Internet via the central gateway. The access points break-out the payload data from the internal clients
locally and pass it on directly to the LAN. The guests' WLAN clients associate with the Public Spot. The access points
send the payload data from the guest clients through a WLC tunnel directly to the WLAN controller, which uses a separate
WAN interface for Internet access.
1. The internal WLAN and the guest WLAN each require an entry to be created in the list of logical networks, each with
a suitable name and the corresponding SSID. Link the SSID for internal use with the 'LAN at AP', and the SSID for
guests with (for example) 'WLC-TUNNEL-1'. Disable encryption for the guest network SSID so that the guests' WLAN
clients can associate with the Public Spot. You should also prevent inter-station traffic for this SSID. In LANconfig
you find this setting under Configuration > WLAN Controller > Profiles > Logical WLAN networks (SSIDs).
Logical WLAN networks for internal use
1256
Reference Manual
14 WLAN Management
Logical WLAN networks for guest access accounts
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your access points, such
as the country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. In LANconfig
you find this setting under Configuration > WLAN Controller > Profiles > Physical WLAN parameters.
Physical WLAN parameters for Public Spot APs
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find this setting under Configuration > WLAN
Controller > Profiles > WLAN profiles.
WLAN profiles for Public Spot APs
1257
Reference Manual
14 WLAN Management
4. For each managed access point, create an entry in the access point table with a suitable name and the associated
MAC address. Assign the WLAN profile created previously to this access point. In LANconfig you find this setting
under Configuration > WLAN Controller > AP config. > Access point table.
Access point table for Public Spot APs
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Set the 4th Ethernet port to the
logical interface 'DSL-1'. The WLAN controller will use this LAN interface for the guest network Internet access. In
LANconfig you find this setting under Configuration > Interfaces > LAN > Ethernet ports.
Ethernet settings for Public Spot APs
6. Verify that the logical LAN interface 'WLC-tunnel-1' is not allocated to a bridge group. This ensures that the other
LAN interfaces do not transmit any data to the Public Spot. In LANconfig you find this setting under Configuration >
Interfaces > LAN > Port table.
Port settings for Public Spot APs
7. For the guest Internet access, create an entry in the list of DSL remote sites with the hold time '9999' and the
pre-defined layer 'DHCPOE '. This example assumes that Internet access is provided by a router with DHCP server.
1258
Reference Manual
14 WLAN Management
In LANconfig you find this setting under Configuration > Communications > Remote sites > Remote sites
(DSL).
Remote site for Internet access
8. For internal users, create the IP network 'INTRANET' with (for example) the IP address '192.168.1.100' and the
interface tag '1'. For the guest access, create the IP network 'GUEST-ACCESS' with (for example) the IP address of
'192.168.200.1' and the interface tag '2'. The virtual router in the WLAN controller uses the interface tags to separate
the routes for the two networks. In LANconfig you find this setting under Configuration > TCP- > IP > General >
IP networks.
IP network for internal use
IP network for guest access
9. The WLAN controller can act as a DHCP server for access points and the associated WLAN clients. To set this up,
activate the DHCP server for the 'INTRANET' and the 'GUEST-ACCESS'. In LANconfig you find this setting under
Configuration > TCP > DHCP > DHCP networks.
1259
Reference Manual
14 WLAN Management
5
Activation of the DHCP server is obligatory for the guest network and optional for the internal network. There
are other ways of realizing a DHCP server for the internal network.
DHCP network for guest access
10. Create a new default route in the routing table to direct the data from the guest network to the Internet connection
used by the WLAN controller. Select the routing tag '2' and the router 'Internet'. Also activate the option 'Masking
intranet and DMZ (default)'. In LANconfig you find this setting under Configuration > IP router > Routing >
Routing table.
Routing entry for Internet access
11. Activate the Public Spot user authentication for the logical LAN interface 'WLC-Tunnel-1'. In LANconfig you find this
setting under Configuration > Public Spot > Public Spot.
Activation of user authentication for the WLC tunnel
1260
Reference Manual
14 WLAN Management
12. The final step is to enable authentication via the Public Spot for the WLAN controller. In LANconfig you find this
setting under Configuration > Public Spot > Authentication.
Activation of authentication via Public Spot
In addition to configuring the WLAN controller, you must also configure the Public Spot either to use the internal
user list or to use a RADIUS server, according to your needs.
5
An example for the configuration of the Public Spot can be found in the tutorial
Virtualization and guest
access accounts via the LANCOM WLAN controller
.
14.9 RADIUS
14.9.1 Checking WLAN clients with RADIUS (MAC filter)
To use RADIUS to authenticate WLAN clients and grant them WLAN access based on their MAC address, an external
RADIUS server can be used, as can the internal user table in the LANCOM WLAN controller.
1261
Reference Manual
14 WLAN Management
In LANconfig enter the approved MAC addresses into the RADIUS database in the configuration section RADIUS servers
on the General tab. Enter the MAC address as Name and as Password and select the authentication method All.
Alternatively, the approved MAC addresses can be entered in WEBconfig under LCOS menu tree > Setup > RADIUS >
Server > Users.
5
The MAC address is entered as User name and as Password in the written form 'AABBCC-DDEEFF'.
14.9.2 External RADIUS server
By default the WLAN controller forwards any requests relating to the account and access management to a RADIUS
server. In order for access points to contact the RADIUS server directly, the necessary server information has to be defined
here. This ensures that the RADIUS application continues to function even if the WLAN controller is unavailable. However,
this means that the RADIUS server requires settings for each and every access point, and the managed access points
1262
Reference Manual
14 WLAN Management
must be able to access the RADIUS server from their management network. If the RADIUS server is on another IP network,
then it is vital that the gateway is set in the IP parameter profile.
LANconfig: WLAN Controller > Stations > RADIUS server
WEBconfig: LCOS Menu Tree > Setup > WLAN Management > RADIUS-Server
1
Type: Type of RADIUS application.
Possible values:
Account or access
Default:
The entries account, access, backup account and backup access are fixed settings that cannot be changed.
1
IP address: IP address to be used by the AP in order for it to reach the RADIUS server. If no value is entered the
controller's IP address is taken as default.
Possible values:
Valid IP address.
Default:
Blank
1
Port: Port number of the RADIUS server that is communicated to the AP in order for it to reach the RADIUS server.
The port must agree with the value configured in the RADIUS server. This value will be ignored if no IP address is
configured as the controller itself will be used as the RADIUS server.
Possible values:
Valid port number, generally 1812 for access management and 1813 for account management.
Default:
0
1
Secret: Password for the RADIUS service. The key (secret) must agree with the value configured in the RADIUS server.
This value will be ignored if no IP address is configured as the controller itself will be used as the RADIUS server.
Possible values:
Maximum 31 ASCII characters.
Default:
Blank
1263
Reference Manual
14 WLAN Management
14.10 Dynamic VLAN assignment
Larger WLAN infrastructures often require individual WLAN clients to be assigned to certain networks. Assuming that
the WLAN clients are always within range of the same access points, then assignment can be realized via the SSID in
connection with a particular IP network. If on the other hand the WLAN clients frequently change their position and
logon to different access points then, depending on the configuration, they may find themselves in a different IP network.
For WLAN clients to remain within a certain network independent of their current WLAN network, dynamically assigned
VLANs can be used. Unlike the situation where VLAN IDs are statically configured for a certain SSID, in this case a RADIUS
server directly assigns the VLAN ID to the WLAN client.
Example:
1
The WLAN clients of two employees log into an access point in the WPA-secured network with the SSID 'INTERNAL'.
During registration, the RADIUS requests from the WLAN clients are directed to the access point. If the corresponding
WLAN interface is in the operating mode 'managed' the RADIUS requests are automatically forwarded to the WLAN
controller. This forwards the request in turn to the defined RADIUS server. The RADIUS server can check the access
rights of the WLAN clients. It can also use the MAC address to assign a certain VLAN ID, for example for a certain
department. The WLAN client in Marketing, for example, receives the VLAN ID '10' and WLAN client from Research
& Development receives '20'. If no VLAN ID is specified for the user, the SSID's primary VLAN ID is used.
1
The WLAN clients of the guests log into the same access point in the unsecured network with the SSID 'PUBLIC'. This
SSID is statically bound to the VLAN ID '99' and leads the guests into a certain network. Static and dynamic VLAN
assignment can be elegantly operated in parallel.
5
Assignment of the VLAN ID by the RADIUS server can be controlled by other criteria, such as a combination of
user name and password, for example. In this way the unknown MAC address of a visitor to a company can be
assigned a VLAN ID that permits guest access for Internet access only, for example, but that prohibits access to
other network resources.
5
As an alternative to an external RADIUS server, WLAN clients can be assigned with a VLAN ID via the internal
RADIUS server or the stations table in the LANCOM WLAN controller.
1. Activate VLAN tagging for the WLAN controller. This is done in the physical parameters of the profile by entering a
value greater than '0' for the management VLAN ID.
2. For authentication via 802.1x, go to the encryption settings for the profile's logical WLAN network and choose a
setting that triggers an authentication request.
3. To check the MAC addresses, activate the MAC check for the profile's logical WLAN network.
1264
Reference Manual
14 WLAN Management
5
For the management of WLAN modules with a WLAN controller, a RADIUS server is required to operate
authentication via 802.1x and MAC-address checks. The WLAN controller automatically defines itself as the
RADIUS server in the access points that it is managing—all RADIUS requests sent to the access points are
then directly forwarded to the WLAN controller, which can either process the requests itself or forward them
to an external RADIUS server.
4. To forward RADIUS requests to another RADIUS server, use LANconfig to enter its address into the list of forwarding
servers in the configuration section 'RADIUS servers' on the Forwarding tab. Alternatively, external RADIUS servers
can be entered in WEBconfig under LCOS menu tree > Setup > RADIUS > Server > Forward server. Also, set
the standard realm and the empty realm to be able to react to different types of user information (with an unknown
realm, or even without a realm).
5. Configure the entries in the RADIUS server so that WLAN clients placing requests will be assigned the appropriate
VLAN IDs as based on the identification of certain characteristics.
5
Further information about RADIUS is available in the documentation for your RADIUS server.
14.11 Activating 802.1x accounting for logical WLANs in WLAN controllers
The configuration for logical WLAN networks is to be found in the following menu:
LANconfig: WLAN Controller > Profiles > Logical WLAN networks (SSIDs)
WEBconfig: LCOS Menu Tree > Setup > WLAN-Management > AP-Configuration > Network profiles
1
RADIUS accounting activated
This is where you can activate RADIUS accounting for this logical WLAN network.
Possible values:
2
Yes, No
Default:
2
No
1265
Reference Manual
14 WLAN Management
5
The access points supporting the logical WLAN network as configured by the WLAN controller must have an
LCOS version 8.00 or higher.
14.12 Displays and commands in LANmonitor
LANmonitor gives you a rapid overview of the LANCOM WLAN controllers in your network and the access points within
the WLAN infrastructure. LANmonitor displays the following information, among others:
1
Active WLAN networks with the logged-on WLAN clients and the descriptor of the access point that the WLAN clients
are associated with.
1
Display of new access points with IP and MAC address
1
Display of missing access points with IP and MAC address
1
Display of managed access points with IP and MAC address, the utilized frequency band and channel
Using the right-hand mouse key, a context menu can be opened for the access points and the following commands are
available:
1
Assign new access point to profile
Enables a new access point to be allocated to a profile and accepted into the WLAN infrastructure.
1
Disconnect access point
Disconnects the access point from the WLAN controller. The access point then carries out a new search for a suitable
WLAN controller. This command can be used after a backup event to disconnect access points from a backup controller
and to redirect them to the correct WLAN controller.
1266
Reference Manual
14 WLAN Management
1
Refresh
Updates LANmonitor's display.
14.13 Automatic RF optimization
Selecting the channel from the channel list defines a portion of the frequency band to be used by an access point for its
logical wireless LANs. The WLAN clients connected to an access point have to share the same channel on the same
frequency band. The 2.4-GHz band works with channels 1 to 13 (depending on the country) and the 5-GHz band works
with channels 36 to 64. On each of these channels, only one access point at a time can actually transfer data. In order
to operate another access point within radio range with maximum bandwidth, each access point must use a separate
channel—otherwise all of the participating WLANs would have to share a single channel's bandwidth.
5
With a completely empty channel list, the access points could automatically select channels which overlap in
some areas, so reducing signal quality. Similarly, the access points might select channels which the WLAN clients
cannot use due to the country settings. To steer access points towards certain channels, the non-overlapping
channels 1, 6, 11 can be activated in the channels list.
In larger installations with several access points it can be difficult to set a channel for every access point. With automatic
radio-field (RF) optimization, the LANCOM WLAN controllers provide an automatic method of setting the optimum
channels for access points that work in the 2.4-GHz band and 5-GHz band.
5
You should ensure that access points transmitting in the 5-GHz band are set to the "indoor only" mode.
WEBconfig: Setup > WLAN-Management > Start-automatic-radio-field-optimization
5
You can invoke optimization for a particular access point by entering its MAC address as a parameter for the
action.
LANmonitor: Right-click on the list of active access points or on a specific device, and in the context menu select Start
automatic RF optimization.
1267
Reference Manual
14 WLAN Management
Optimization is then carried out in the following stages:
1. The WLAN controller assigns the same channel to all access points. The selected channel is the one being used by
the majority of access points.
2. The access points carry out a background scan and report the results to the WLAN controller.
3. Based on the devices found by the background scan, the WLAN controller sets an interference value for each access
point.
4. It then deletes the AP channel list for all access points. With the channel list now empty, each access point receives
a configuration update with a new channel list for its respective profile.
5. The WLAN controller disables the radio modules of all access points.
6. The individual access points now go through the following sequence. This begins with the access point with the
highest interference value being the first to select a channel.
7. In the order of the interference values the WLAN controller enables the radio modules in the access points, which
then start their automatic calibration. Each access point automatically searches for the best channel from the channel
list assigned to it. To determine which channel is the best, the access point scans for interference to determine the
signal strengths and channels occupied by other access points. Because the former list in the WLAN controller's
configuration was deleted, this is now the profile channel list. If the profile channel list is empty, then the access
point has freedom of choice from the channels that are not occupied by other radio modules. The selected channel
is then communicated back to the WLAN controller and entered into the AP channel list there. This means that the
access point is given the same channel the next time it establishes a connection. The AP channel list has a higher
weighting than the profile channel list.
5
If an access point has multiple radio modules, each module goes through this process in succession.
1268
Reference Manual
14 WLAN Management
14.14 Channel-load display in WLC mode
The loads on the various channels used by each access point which is managed by a WLAN Controller are displayed as
three values, the minimum, maximum and average channel load. The values displayed are measured every three minutes.
Consequently, the first values are displayed after three minutes at the earliest.
14.15 Backing up the certificates
At system startup, a LANCOM WLAN controller generates the basic certificates for the assignment of certificates to the
access points, including the root certificates for the CA (Certification Authority) and the RA (Registration Authority).
Based on these two certificates, the WLAN controller issues device certificates for the access points.
If multiple WLAN controllers are employed in parallel in the same WLAN infrastructure (for load balancing) or if a device
is being replaced or reconfigured, the same root certificates should always be used to avoid problems with the operation
of the managed access points.
14.15.1 Create backups of the certificates
To restore the CA or RA, the corresponding root certificates with private keys will be required as were generated
automatically when the LANCOM WLAN controller was started. Furthermore the following files with information on
issued device certificates should also be backed up. To ensure that this confidential information remains protected even
when exported from the device, it is initially stored to a password-protected PCKS12 container.
1. Open the configuration of the LANCOM WLAN controller in WEBconfig and go to LCOS Menu Tree > Setup >
Certificates > SCEP-CA > CA-certificates.
1269
Reference Manual
14 WLAN Management
2. Select the command Create PKCS12 backup files and enter the passphrase for the PKCS12 container as the
additional argument.
This command backs up the certificates and private keys to the PKCS12 files and these can then be downloaded from
the device.
14.15.2 Uploading a certificate backup into the device
1. Click on File management > Upload certificate or file.
2. Select the two entries for SCEP-CA as data type one after the other:
1
PKCS12 container with CA backup
1
PKCS12 container with RA backup
3. For each upload, enter the file name, storage location, and the passphrase that was defined when the backup file
was created. Confirm with Start upload:
4. After loading the CA backup, the file controller_rootcert in the directory Status > File-System >
Contents must be deleted.
Enter the following commands in the console:
cd /Status/File-System/Contents
del controller_rootcert
5. After restoring the backup, delete all files that start with controller_ or eaptls_.
del controller_*
del eaptls_*
6. After that, access the directory Setup > Certificates > SCEP-Client and execute the command Reinit:
cd /Setup/Certificates/SCEP-Client
do Reinit
14.15.3 Backing up and restoring further files from the SCEP-CA
To be able to fully restore the SCEP-CA, it is important to have the information on the device certificates issued for the
individual access points by the SCEP-CA.
5
If the root certificates only were backed up, then any issued device certificates can no longer be revoked!
For this reason the following files have to be saved in addition to the certificates themselves:
1
SCEP certificate list: List of all certificates ever issued by the SCEP-CA.
1
SCEP serial numbers: Contains the serial number for the next certificate.
1. Click on File management > Download certificate or file.
1270
Reference Manual
14 WLAN Management
2. Select the entries listed above as data type one after the other and then confirm with Start download:
3. To upload these files to the device, go to the entry page of WEBconfig and select the command Upload certificate
or file.
4. Select the entries listed above as data type one after the other, enter each file name and storage location and confirm
with Start upload:
5
After installing a new certificate list, expired certificates are removed and a new CRL is created. Furthermore,
the CA reinitializes itself automatically if certificates and keys are successfully extracted after loading the certificate
backup.
14.16 Backup solutions
LANCOM WLAN controllers manage a large number of access points, which in turn may have a large number of WLAN
clients associated with them. WLAN controllers thus play a crucial role in the functioning of the entire WLAN
infrastructure—for which reason the organization of a backup solution in case of temporary WLAN controller failure is
in many cases indispensable.
In case of a backup event, a managed access point should connect to an alternative WLAN controller. Because this
connection will only function if the certificate in the access point has been authorized by the backup controller, it is
essential that all WLAN controllers sharing a backup solution have identical root certificates.
1271
Reference Manual
14 WLAN Management
14.16.1 Backup with redundant WLAN controllers
This is worthwhile for backing up a LANCOM WLAN controller with a second WLAN controller, the aim being to maintain
full control over all managed access points at all times. The backup Controller is configured in such a way that it uses
SCEP to obtain the necessary certificates from the backed-up primary WLAN controller.
1.
2. Switch off the CA on the backup Controller.
3. In the configuration of the SCEP client in the backup controller, create a new backup in the CA table (in LANconfig
under Certificates > SCEP client > CA table). The CA of the primary WLAN controller is entered here:
4. The URL is to be entered as the IP address or the DNS name of the primary WLAN controller followed by the path
to the CA /cgi-bin/pkiclient.exe. For example 10.1.1.99/cgi-bin/pkiclient.exe'.
1
Distinguished name: Standard name of the CA (/CN=LANCOM CA/O=LANCOM SYSTEMS/C=DE) or the name
given on the primary Controller
1
Switch on RA auto approve
1
Usage type: WLAN controller
1272
Reference Manual
14 WLAN Management
5. Then create a new entry in the certificate table with the following information:
1
CA distinguished name: The standard name under which the CA is entered, e.g. /CN=LANCOM CA/O=LANCOM
SYSTEMS/C=DE
1
Subject: Specification of the primary WLAN controller's MAC address in the form:
/CN=00:a0:57:01:23:45/O=LANCOM SYSTEMS/C=DE
1
Challenge password: The general challenge password of the CA on the primary WLAN controller or a password
for the Controller specified manually.
1
Extended key usage: critical,serverAuth,1.3.6.1.5.5.7.3.18
1
Key length: 2048 bits
1
Usage type: WLAN controller
6. If a SCEP configuration was previously active on the backup controller, the following actions must be executed under
WEBconfig (LCOS Menu Tree > Setup > Certificates > SCEP client):
1
Clear SCEP file system
1
Update (2x: the first time, the SCEP client retrieves the new CA/RA certificates only; the second time the device
certificate is updated)
7. Configure the first WLAN controller 1 according to your requirements with all profiles and the associated AT table.
The access points then establish connections to the first WLAN controller. Each access point receives a valid certificate
and a configuration for the WLAN module from the WLAN controller.
8. Transfer the configuration from the first WLAN controller 1, for example using LANconfig, to the backup controller
2. The profiles and the AP tables with the access point MAC addresses are transferred to the backup controller at
the same time. All access points remain logged on to the first WLAN controller.
Should WLAN controller 1 fail, the access points will automatically search for another WLAN controller and they will find
the backup controller 2. Because this has the same root certificate, it is able to check the validity of the access points'
certificates. Because the access points are also entered into the backup controller's AP table along with their MAC
addresses, the backup controller can fully take over the management of the access points. Changes to the WLAN profiles
in the backup controller will directly affect the managed access points.
5
In this scenario, the access points remain under the management of the backup controller until this itself becomes
unavailable or is manually disconnected.
5
If the access points are set up for standalone operation, they will remain operational while searching for a backup
controller and the WLAN clients will remain associated.
14.16.2 Backup with primary and secondary WLAN controllers
This second type of backup you can provide a larger number of "primary" WLAN controllers with one common "secondary"
backup controller. In case a WLAN controller should fail, the access points remain operational but they work with the
current configuration of the WLAN modules. As a secondary controller, the backup controller cannot assign any
configuration changes to the access points.
1273
Reference Manual
14 WLAN Management
14.16.3 Primary and secondary controllers
Connection establishment between an access point and the WLAN controller is always initiated by the access point. A
LANCOM access point in managed mode will search the LAN for a WLAN controller that will provide the configuration.
During this search the access point may find various suitable WLAN controllers:
1
The WLAN controller can authenticate the certificate in the access point and it has a configuration stored for the
access point's MAC address. A WLAN controller of this type is described as a "primary" WLAN controller.
1
A WLAN controller can authenticate the certificate of an access point, but it has neither a configuration stored
for the MAC address of the access point, nor does it have a default configuration. A WLAN controller of this type
is described as a "secondary" WLAN controller.
This is an example of a backup solution with three WLAN controllers for 50 managed access points: Two of the WLAN
controllers each manage 25 access points and the third is available as a backup:
5
A LANCOM WLAN controller is now able to accommodate in its AP table five times the maximum number of
access points that it can manage by itself. For each five WLAN controllers (identical models), just one additional
WLAN controller is sufficient to provide a full backup in case of failure.
1. Set the same time on all of the WLAN controllers 1, 2 and 3.
2. Transfer the CA and RA certificates from the first primary WLAN controller 1 to the second primary 2 and to the
secondary "backup controller" 3.
3. Configure the first WLAN controller 1 according to your requirements with the profiles and the associated AP table
for one half of the access points. This WLAN controller becomes the primary controller for the access points entered
into it.
5
For a backup solution using a secondary WLAN controller, be sure to set the time for standalone operations such
that the access point has time to find a backup controller. This is because the backup controller is not able to
provide a new configuration for the access point.
Once the access point has established a backup connection to a secondary WLAN controller, the countdown until expiry
of standalone operation is halted. The access point and its WLAN networks remain active as long as it has a connection
to a WLAN controller.
1. Configure the second WLAN controller 2 for the other half of the access points, which subsequently treat this WLAN
controller as their primary controller.
2. For the backup controller 3 the time and the root certificates are set up only. No further configuration is required.
1274
Reference Manual
14 WLAN Management
3. After being started, the access points search for a WLAN controller by emitting a discovery message. In this case,
all three LANCOM WLAN controllers respond to this message—the access points select "their" primary controller
for the DTLS connection that follows. One half of the access points decides on WLAN controller 1 and the other half
chooses WLAN controller 2. Because WLAN controller 3 does not function as primary controller for any of the access
points, none of the access points log on to it.
4. Should WLAN controller 2 fail, the access points will automatically search for another WLAN controller. They discover
the WLAN controllers 1 and 3, whereby 1 is already under full load with its 25 access points. Backup controller 3 is
able to check the validity of the certificates, i.e. it can authenticate the access points and accept them as managed
access points. However, because the access points are not entered with their MAC numbers into the backup controller's
AP table, the backup controller cannot manage the access points any longer; they simply continue to operate with
their current WLAN configurations.
5
If WLAN controller 1 is not under full load, for example because some of "its" access points are switched off,
then some of the searching access points could log on here. WLAN controller 1 remains a "secondary" controller
for these access points because it does not have their configuration profiles. If in this situation one of the access
points with an entry in the AP table of WLAN controller 1 is switched on again, then 1 accepts this reactivated
access point and, in exchange, it disconnects one of the backup-event access points.
5
If the access points are set up for standalone operation they will remain operational while searching for a backup
controller, and the WLAN clients can continue to use all of their functions.
14.16.4 Addition(s) to LCOS 9.10
Backup connections for dual-SIM devices
As of LCOS version 9.10, dual-SIM devices also support backup connections if the primary connection is based on a
cellular connection. You can also explicitly specify the time until the device returns to the primary connection.
Configuration of the backup connection
The following steps are necessary to define a backup connection:
1. The backup connection requires the appropriate WAN interface to be set up so that the remote site can be reached
via this alternative route. If, for example, the ISDN line is to serve as the backup connection, then the remote site is
set up as an ISDN remote site (along with the necessary entries in the communications layers and in the PPP list).
2. If the connection to the remote site cannot be checked with LCP requests, the monitoring of the connection should
be initiated with an entry in the polling table.
3. Assignment of the new backup connection to the remote site which is to be backed up. This entry is made in the
backup table. Dedicated entries in the routing table are not required for a backup connection. The backup connection
automatically takes over the source and target networks from the remote site that routes the data under normal
operating conditions.
A remote site can be assigned with multiple backup lines in the backup table. In the case of backup, the system
decides which backup line is to be used first:
1
The last remote site that was reached successfully
1
The first remote site in the list
The maximum backup time specifies the maximum amount of time in minutes that the backup state is maintained. If
a time is specified here, the backup connection is disconnected after this time and the backup state is terminated.
For backup scenarios via a cellular connection (multi-SIM), where for technical reasons the cellular module can only
maintain one connection at a time, it is only the termination of the backup state that triggers the main connection to
attempt to reconnect.
Regardless of the scenario, the backup event occurs again if the main connection cannot be re-established by the time
the backup time delay (set elsewhere than this dialog) expires.
1275
Reference Manual
14 WLAN Management
The backup table in LANconfig is located under Communication > Call management under Backup table.
Additions to the Setup menu
Fallback minutes
Specifies the maximum amount of time in minutes that the backup state is maintained. If a time is specified here, the
backup connection is disconnected after this time and the backup state is terminated.
For backup scenarios via a cellular connection (multi-SIM), where for technical reasons the cellular module can only
maintain one connection at a time, it is only the termination of the backup state that triggers the main connection to
attempt to reconnect.
Regardless of the scenario, the backup event occurs again if the main connection cannot be re-established by the time
the backup time delay (set elsewhere than this dialog) expires.
SNMP ID:
2.2.24.4
Telnet path:
Setup > WAN > Backup-Peers
Possible values:
Max. 4 characters from 0123456789
Default:
0
Special values:
0
The backup connection remains active permanently.
14.17 Addition(s) to LCOS 8.82
14.17.1 Band steering via WLAN controller
As of LCOS version 8.82, WLAN controllers can manage settings for band steering for the access points in the radio
profiles.
1276
Reference Manual
14 WLAN Management
Enhancements to LANconfig
Configuration
Most of the parameters for configuring the LANCOM WLAN controller correspond with those of the access points. For
this reason, this section does not explicitly describe all of the WLAN parameters, but only those aspects necessary for
operating the WLAN controller.
Profiles
The profiles area is used to define the logical WLAN networks, physical WLAN parameters, and the WLAN profiles which
combine these two elements.
Logical WLAN networks
Here the logical WLAN networks are set for assignment to the access points. The following parameters can be defined
for each logical WLAN network:
LANconfig: WLAN controller > Profiles > Logical WLAN networks
WEBconfig: LCOS Menu Tree > Setup > WLAN-Management > AP-Configuration > Network profiles
1
Network name (SSID)
Name of the logical WLAN network under which the settings are saved. This name is only used for internal
administration of logical networks.
1
Inheritance
Selection of a logical WLAN network defined earlier and from which the settings are to be inherited.
1
SSID connect to
Service Set Identifier – the name under which the logical WLAN network is offered to the WLAN clients.
1
VLAN-ID
VLAN ID for this logical WLAN network
5
Please note that to use VLAN IDs in a logical WLAN network, you must set up a management VLAN ID (see
physical WLAN parameters).
1
AP standalone time
1277
Reference Manual
14 WLAN Management
The time in minutes that a managed-mode access point continues to operate in its current configuration.
The configuration is provided to the access point by the WLAN controller and is optionally stored in flash memory
(in an area that is not accessible to LANconfig or other tools). Should the connection to the WLAN controller be
interrupted, the access point will continue to operate with the configuration stored in flash for the time period entered
here. The access point can also continue to work with this flash configuration after a local power outage.
If there is still no connection to the WLAN controller after this time period has expired then the flash configuration
is deleted and the access point goes out of operation. As soon as the WLAN controller is available again, the
configuration is transmitted again from the WLAN controller to the access point.
This option enables an access point to continue operating even if the connection to the WLAN controller is temporarily
interrupted. Furthermore this represents an effective measure against theft as all security-related configuration
parameters are automatically deleted after this time has expired.
5
If the access point establishes a backup connection to a secondary WLAN controller, then the countdown to
the expiry of standalone operation is halted. The access point and its WLAN networks remain active as long
as it has a connection to a WLAN controller.
5
Please note that the configuration in flash memory is deleted only after expiry of the time for standalone
operation, and not when the power is lost!
1
Minimum client signal strength
This entry determines the threshold, in percentage, for the minimum signal strength for clients when logging on. If
the client's signal strength is below this value, the access point stops sending probe responses and discards the
client's requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, since the list does not contain any access points that would
offer a weak connection at the client's current position.
5
All other WLAN network parameters correspond to those for the standard configuration of access points.
Physical WLAN parameters
Here the physical WLAN parameters are set for assignment to the access points. The following parameters can be defined
for each set of physical WLAN parameters:
LANconfig: WLAN Controller > Profiles > Physical WLAN parameters
WEBconfig: LCOS Menu Tree > Setup > WLAN management > AP configuration > Radio profiles
1
Name
Unique name for this combination of physical WLAN parameters.
1278
Reference Manual
14 WLAN Management
1
Inheritance
Selection of a physical WLAN parameter set defined earlier and from which the settings are to be inherited.
1
Country
The country in which the access points are to be operated. This information is used to define country-specific settings
such as the permitted channels, etc.
1
Automatic channel selection
By default, the access points can use all of the channels permitted in the country of operation. To restrict the selection
to certain channels, these can be entered here as a comma-separated list. It is also possible to specify ranges or lists
(e.g.'1,6,11').
1
Management VLAN-ID
The VLAN ID of the management network that is to manage the access points.
5
The Management VLAN ID must be set to a value not equal to zero in order for VLANs to be used over the
WLAN networks. This also applies when the management network itself is not to be tagged with VLAN IDs
(Mgmt-VLANID=1).
5
VLAN activation only applies to WLAN networks which are connected by means of these physical WLAN
parameters.
1
Band steering activated
This entry determines whether the access point should enable band steering. In this case, a dual-port access point
can forward a WLAN client to a preferred frequency band.
5
All other physical WLAN parameters correspond to those for the standard configuration of access points.
5
To successfully acquire a profile, HTTP access to the WLAN controller from the local network must be allowed.
Additions to the Setup menu
Report seen clients
This entry determines whether the access point should report clients detected in the WLAN network.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
Yes
No
Default:
Yes
Client steering
This entry determines whether the access point should enable band steering.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
1279
Reference Manual
14 WLAN Management
Possible values:
Yes
No
Default:
No
Preferred band
This entry determines the frequency band that the access point preferably should direct the WLAN client.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
5GHz
2.4GHz
Default:
5GHz
Probe request ageout in seconds
This entry determines the length of time in seconds that the access point should store a WLAN client's connection. When
this time expires, the access point deletes the entry from the table.
5
This value should be set to a low value if you are using clients in the WLAN that frequently switch from dual-band
to single-band mode.
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
max. 10 characters from 0 to 9
Special values:
0: The access point immediately considers seen probe requests as invalid.
Default:
120
Minimum client strength
This entry determines the threshold, in percentage, for the minimum signal strength for clients when logging on. If the
client's signal strength is below this value, the access point stops sending probe responses and discards the client's
requests.
A client with poor signal strength will not detect the access point and cannot associate with it. This ensures that the
client has an optimized list of available access points, since the list does not contain any access points that would offer
a weak connection at the client's current position.
1280
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management > AP-Configuration > Network-Profiles
Possible values:
max. 3 characters from 0 to 9
Default:
0
14.18 Addition(s) to LCOS 9.00
14.18.1 AutoWDS – wireless integration of APs via P2P connections
In a centrally managed WLAN network, access points (APs) are typically connected to the WLAN controller (WLC) via the
LAN. The LAN connections simultaneously determine the topology of the managed network. Network extension by means
of additional APs is restricted to the reach of the hard-wired network architecture and requires the extension of the
corresponding infrastructure.
By means of AutoWDS, you have the option of extending a WLAN by means of point-to-point (P2P) connections for the
cost-effective and fast installation of highly scalable networks. "AutoWDS" stands for "automatic wireless distribution
system". This feature enables you to create a radio network from several APs, which are interconnected via wireless only:
a logical connection is all you need. Potential applications include the seamless connection of smaller properties or even
entire districts to the Internet, or the establishment of a company network where connections via LAN are impracticable.
In the simplest case, all you need is a WLC connected via LAN to an AutoWDS-enabled AP. The AP supports the managed
network and at the same time acts as an "anchor AP". Using this anchor AP, unassociated AutoWDS-enabled APs connect
to the WLC, which transmits a configuration to them by means of CAPWAP. After obtaining the configuration and being
incorporated into the managed WLAN, the individual APs use P2P links to forward user data, to communicate with one
another, and to support the topology. Additional APs that join later are able to use the associated APs as their anchor
APs. In this manner, several APs can be chained together to establish meshed networks, which can optionally feature
1281
Reference Manual
14 WLAN Management
redundant connections via RSTP. From the perspective of an unassociated AP, associated APs are master APs. From the
perspective of the master AP, unassociated APs are slave APs.
Figure 8: Phase 1 – unassociated AP in building B seeks AutoWDS base network and finds anchor AP in
building A
Figure 9: Phase 2 – unassociated AP in building B finds WLC and retrieves AP configuration via CAPWAP
Figure 10: Phase 3 – unassociated AP in building B joins the managed WLAN. Unassociated AP in building C
seeks AutoWDS base network and finds anchor AP in building B
Precise information about the integration process and the operating modes for topology management can be found in
the following sections, which describe how AutoWDS functions.
5
AutoWDS is suitable for static infrastructure only, not for mobile APs. If an AP should move out of range of its
P2P partner and lose the connection to the network, there is a temporary downtime and a subsequent
reconfiguration
. However, the roaming of WLAN clients between individual AutoWDS APs is no different than
the roaming between conventional APs.
5
AutoWDS does not support the network separation of SSIDs to VLANs by means of a static configuration or a
dynamic VLAN assignment via RADIUS. Implementing a network separation of SSIDs requires these to be separated
by means of layer-3 tunnels.
5
The DFS processing by an AP in 5-GHz operation is unaffected by AutoWDS and has a higher priority. DFS radar
recognition may cause the AP to suddenly change the channel during operation. It can even completely deactivate
the WLAN for a period if radar recognition is running on different channels and the available frequencies drop
1282
Reference Manual
14 WLAN Management
out. The impacted AP can cause interference to the entire AutoWDS group, and may not be able to deploy any
SSIDs for some time. Within buildings you have the option of counteracting interference by enabling the indoor
mode.
4
If you operate AutoWDS on a device with a single physical WLAN interface, its data rate will be reduced to just
a third, since the device must send incoming/outgoing data multiple times: To the WLAN clients, to a master AP
and, if applicable, to a slave AP. This effect is mitigated by operating only devices that have multiple WLAN
physical interfaces and using these to divide up the data traffic. You do this by reserving one physical WLAN
interface for connecting the APs and one physical WLAN interface for connecting the clients.
MultiHop on the same WLAN interface can be enabled in the AutoWDS profile configuration, if necessary. This
is disabled by default due to the associated loss of performance.
Notes on operating AutoWDS
Owing to technical restrictions, the applications of AutoWDS are limited to certain specific application scenarios. Please
carefully observe the general remarks in this chapter to avoid possible complications. The items listed here are intended
to supplement the remarks elsewhere in the AutoWDS chapter, so some redundancies are possible.
1
APs must switch channels when radar is detected (5-GHz band, outdoor and DFS). This can potentially lead to
temporary interruptions to the WLAN due to necessary changes of channel.
1
In general, we recommend a maximum of 3 hops for AutoWDS operations.
1
When operating AutoWDS on one radio channel only, problems with multiple transfers and hidden stations can
occur. For this reason we recommend the use of APs with two physical WLAN interfaces (dual radio) operating on
separate radio channels.
1
AutoWDS does not support the network separation of SSIDs to VLANs by means of a static configuration or a dynamic
VLAN assignment via RADIUS. Implementing a network separation of SSIDs requires these to be separated by means
of layer-3 tunnels.
5
If you are operating DFS in combination with AutoWDS, you should set the continuation time for autonomous
operation of the AutoWDS profile to at least 2 minutes. After the downtime of a P2P connection, this extra minute
allows for the one-minute DFS scan, after which the CAPWAP layer restores the CAPWAP connection to the WLC
via the P2P connection.
5
If possible, ensure that all APs on each physical WLAN interface (WLAN-1, WLAN-2) consistently use the same
frequency band (2.4 GHz or 5 GHz) to exclude any potential problems with the automatic topology configuration.
The following is a overview of the suitability of AutoWDS for certain application scenarios.
Suitable:
Use of a dedicated physical WLAN interface for the P2P links.
1
Use of different channels for the P2P links (indoor)
1
Use of AutoWDS with up to 3 hops
1283
Reference Manual
14 WLAN Management
Partly suitable:
Use of single physical WLAN interface simultaneously for the AutoWDS uplink and downlink (repeater mode) where
all P2P links operate on the same radio channel.
1
Use for operation without DFS (indoor)
1
Use of AutoWDS with up to 3 hops
Difficulties can arise from the hidden station problem or throughput loss due to multiple transmissions.
1
Hidden station problem: Over larger distances, widely separated APs on the same network may not be able to
"see" each other. In this case, several APs could end up transmitting simultaneously to cause interference for the
APs between them. These collisions lead to multiple transmissions and performance losses.
Figure 11: Simultaneous transmissions to the middle AP: The two outer APs are unaware of the collision.
1
Throughput-loss due to multiple transmissions: An AP transmitting data packets multiple times on the same
channel leads to a reduction of the maximum available throughput (by half per hop).
Figure 12: Transmission of data packets on every hop
1284
Reference Manual
14 WLAN Management
Unsuitable:
Use of a physical WLAN interface simultaneously for AutoWDS uplink and downlink (repeater mode) during outdoor
operations with more than one hop in the 5-GHz band.
In repeater mode, the physical WLAN interface has a dual role: In the direction of the WLC the interface operates as a
master, while in the direction of neighboring APs it operates as a slave. For this purpose, all APs necessarily operate on
the same radio channel. However, if the DFS feature detects signals, the APs are required to stop transmitting on the
affected frequencies. This means that the APs cannot inform the WLC about the DFS event and the WLC cannot initiate
a change of frequency for the network. As a result, the affected APs are potentially permanently separated from the
network.
Figure 13: Connection lock after DFS detection
How it works
Deploying the AutoWDS base network
AutoWDS provides different integration modes for managing P2P links for meshed networks. The majority of the
configuration is performed on the WLC which manages the individual logical WLAN networks. You link an active AutoWDS
profile with an established WLAN profile of your managed wireless network. The AutoWDS profile groups the settings
and limits to form the P2P topology and of the AutoWDS base network.
The AutoWDS base network and its associated SSID (default name: AutoWDS-Rollout) is a management network only.
It serves two purposes: The first is to authenticate an AP during the preconfigured integration, and the second is to
establish the WLC tunnel for configuration exchange. In this way, unassociated APs remain isolated from operations
while they are being integrated into the managed WLAN. As soon as there is a P2P connection to a master AP, an
unassociated AP is considered to be integrated and it processes further communications via the bridge on Layer 2. Similar
to conventional P2P links, the P2P partners set up a management SSID, which they use to process the data traffic and
the CAPWAP tunnel to the WLC (see
Updating the AP configuration and establishing the P2P link
on page 1287).
4
The AutoWDS base network cannot be used by other WLAN clients such as smartphones, laptops, etc. These
devices require their own SSID within the WLAN infrastructure.
After assigning an active AutoWDS profile to your managed WLAN, the corresponding anchor APs deploy the AutoWDS
base network and transmit their beacons (assuming you have enabled 'SSID broadcast' in the AutoWDS profile) with an
1285
Reference Manual
14 WLAN Management
additional manufacturer-dependent identifier. This identifier, also known as an "AutoWDSInfoFlag", signals the general
support of the feature to unassociated AutoWDS-capable APs and informs them...
1
whether AutoWDS is enabled/disabled for the detected SSID;
1
whether the AP of the corresponding SSID has an enabled/disabled WLC connection;
1
whether the WLC accepts or prohibits the express mode for unassociated APs; and
1
whether integration requires the APs to connect to the equivalent physical WLAN interface of the anchor AP (strict
interface pairing, i.e. with WLAN-1 to WLAN-1 and with WLAN-2 to WLAN-2), or whether mixed interface pairs are
allowed.
A managed AP will automatically work as an AutoWDS AP after it has been initially paired with a WLC via LAN cable
and a valid certificate and an AutoWDS profile with the additional AP configuration has been transferred correctly. A
configured AutoWDS AP will automatically function as an unassociated AP after it has failed to establish a CAPWAP
connection to a WLC after a predefined time, for example if there is no wired LAN connection. This access point then
temporarily switches its operating mode to Client mode and scans each WLAN until it detects a suitable anchor AP. The
scan is carried out in the 2.4-GHz and 5-GHz frequency bands.
If your device has two physical WLAN interfaces and both are enabled, both WLAN interfaces simultaneously scan for a
suitable AutoWDS base network. If a physical WLAN interface detects a suitable SSID, then it associates with the anchor
AP, assuming that the interface pairing mentioned above permits this. The other physical WLAN interface continues to
scan in case the already associated physical WLAN interface loses the connection again. Until then, this physical WLAN
interface does not connect to any other AutoWDS base network. Once your device has received the WLC configuration,
the two physical WALN interfaces behave as specified in the profile, i.e. they deploy the SSIDs assigned to them and the
AutoWDS base network.
The procedure for searching for an AutoWDS base network is identical with that of the reconfiguration in the case that
the WLAN connection is lost (see
Connectivity loss and reconfiguration
on page 1288).
Differences between the integration modes
When integrating unassociated APs into your managed WLAN, you have the choice of two different integration modes.
The integration mode determines the conditions under which your WLC accepts an unassociated AP:
1
Preconfigured integration is the controlled and preferred method to integrate an unassociated AP into a managed
WLAN over a point-to-point link. In this mode, the WLC only allows the integration of APs that have a local,
preconfigured SSID and a valid WPA2 passphrase for the AutoWDS base network.
This mode is suitable for all productive environments, and is used to create a predefined relationship between an
unassociated AP and an AutoWDS base network. As soon as the AP obtains a configuration from the WLC, the AP
gives this configuration a higher priority than its own local AutoWDS configuration. This remains so until the WLC
revokes the configuration via CAPWAP or you reset the device.
1
Express integration is the quick way to integrate an unassociated AP into a managed WLAN via a point-to-point
link. In this mode, the WLC allows both the integration of preconfigured devices as well as devices that are not
configured at all. Unconfigured APs have neither a registered SSID nor an individual WPA2 passphrase for the
AutoWDS base network. Instead, APs can authenticate with any AutoWDS base network by using a pre-shared key
hard-coded in the firmware.
This mode is suitable for the easy integration of new APs into a managed WLAN. The choice of AutoWDS base network
is automatic and is outside your control. As soon as the corresponding APs obtain configurations from the WLC,
these devices save the settings as default values until the WLC revokes the configuration via CAPWAP, the device
executes the express
reconfiguration
after an interruption in the connection, or you reset the device.
5
For the express integration make sure that no other AutoWDS base network is in range. Otherwise it is
possible for an external WLC to take control of your AP and revoke your remote access. Having the express
mode enabled increases the vulnerability to attack. For this reason it is advisable to disable the express mode
if it is not absolutely necessary.
1286
Reference Manual
14 WLAN Management
5
For the security reasons name above, LANCOM recommends a preconfigured integration. Through the pairing
of WLC and APs, you can further reduce the effort required for the preconfigured integration. Learn more
about this in section
Accelerating preconfigured integration by pairing
on page 1293.
After successful authentication on the AutoWDS base network and retrieval of an IP address, the unassociated APs scan
the network for a WLC. As soon as they have detected a WLC, they attempt to connect with it and retrieve a configuration.
In LANmonitor, these APs are shown as unassociated devices. To include these in the managed WLAN, the administrator
must still confirm them and assign WLAN profiles to them. Assigning profiles in this way is no different from accepting
normal APs. Alternatively, assignment can be handled by the WLC if you
1
set up a default WLAN profile and activate its automatic assignment; or
1
enter the associated AP into the access point table and link it with a WLAN profile.
5
By simultaneously setting the automatic acceptance of unassociated APs by the WLC ("Auto Accept"), the
integration of unassociated APs can be fully automated. However, for express integration you should ensure
that you disable this setting in order to maintain a minimum level of security and hinder rogue AP intrusion.
4
The procedures for certificate generation, certificate checks, and the automatic acceptance or rejection of
connection requests by the WLC are identical to a WLAN scenario with cable-connected APs. Refer to the section
Communication between access point and WLAN controller
for further information on this.
Designing the topology
When the WLAN profile is assigned by the WLC, the slave APs simultaneously receive information about how their P2P
links in the meshed network are to be established. The topology results directly from the hierarchy of the P2P connections
established between the APs. The WLC offers the following management modes for this:
1
Automatic: The WLC automatically generates a P2P configuration. The device ignores manually specified P2P links.
1
Semi-automatic: The WLC only generates a P2P configuration if no manual P2P configuration exists for the
unassociated AP. Otherwise the WLC uses the manual configuration.
1
Manual: The WLC does not automatically generate a P2P configuration. A manual P2P configuration is taken, if
available. Otherwise, the WLC does not transmit a P2P configuration to the AP.
Normally, the WLC handles the automatic calculation of the topology, where a slave AP generally connects with the
closest master AP. Calculated in real-time, the topology is recorded by the WLC in the status table
AutoWDS-Auto-Topology. If you use semi-automatic or manual management, you define the static P2P links in the
setup table AutoWDS-Topology. To achieve this, you specify the relationships between the individual master APs and
slave APs in a similar manner to a normal P2P connection. For more on this, see the section
Manual topology management
on page 1295.
4
The automatic generation of a P2P configuration (e.g., for initial connection or reconnection of an AP) replaces
any existing entry in the AutoWDS-Auto-Topology table.
4
The automatically generated topology entries are not boot-persistent. The table is emptied when the WLC is
restarted.
4
For manual topology configuration, it is important for a configured P2P master AP within the topology to be
closer to the WLC than a corresponding P2P slave AP. This is because a brief interruption to the P2P connection
will cause the slave AP to scan for the master AP.
Updating the AP configuration and establishing the P2P link
If an unassociated AP has received the full WLAN profile with all its settings from the WLC via CAPWAP, as a slave it
attempts to establish a P2P link to the master AP assigned to it. The AP simultaneously changes its WLAN operation
mode from Client back to Managed.
Since the master AP is already in managed mode, it obtains only an update to its P2P configuration from the WLC via
CAPWAP. This informs the AP of the WPA2 passphrase and the peer identification of the AP. For an automatically
1287
Reference Manual
14 WLAN Management
generated P2P configuration, the peer identification corresponds to the MAC address; for a manual P2P configuration,
it corresponds to the name of the slave AP. The master AP labels the SSIDs with *** P2P Info ***.
Once both APs are successfully interconnected over a P2P link, the AutoWDS integration process is concluded. The
unassociated AP can then be used by clients (smartphones, laptops, other APs in client mode looking for a master, etc.).
4
As long as the unassociated AP is in client mode, bridging between a physical WLAN interface and a LAN interface
or another physical radio interface is disabled throughout the integration process. The device automatically puts
all physical WLAN interfaces on different bridges. Not until successful creation of a P2P connection does the AP
switch the bridging back to the original state.
Connectivity loss and reconfiguration
An automatic process of (re-)configuration is triggered as soon as you enable AutoWDS on an unassociated AP, if
authentication at an anchor AP fails, or if an associated AP loses contact to the WLC. This process follows the scheme
shown here:
An AP does not run the (re-)configuration process if it is in client mode and can connect to an anchor AP but not to the
WLC. The AP waits for 5 minutes after connecting to the AutoWDS base network to see whether the WLC performs a
configuration of the device. If no configuration is performed by the WLC by then (e.g., because no administrator accepts
the AP), the AP disconnects from the AutoWDS base network and scans for further suitable SSIDs. If there is only one
SSID in range, the AP contacts it again to repeat the integration process.
5
If there is a connection to a LAN, the AP tries to reach the WLC by broadcast over the LAN for the duration of
the downtime. If the AP finds the WLC via LAN, then no new P2P link is set up and the WLC deletes all
automatically generated P2P links that set the AP to be a slave.
Configuration timeouts
The initial configuration and the reconfiguration of an unassociated AP are triggered by various timeouts, which together
control the behavior of the device. This includes, if specified:
1288
Reference Manual
14 WLAN Management
1. The duration of standalone P2P-link operation if the CAPWAP connection is lost (except for reconfiguration);
2. The wait time until the start of the automatic (re-)configuration for the preconfigured integration; as well as
3. The wait time until the start of the automatic (re-)configuration for the express integration.
The continuation time refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to the WLC. If the AP
detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation time. Connections
to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails and the continuation
time expires, the AP discards the P2P part of the WLC configuration. If the standalone continuation time is specified as
0, the AP discards this part of the configuration immediately.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the wait times for the preconfigured and express integration—as a basis to count down the preset time
until the start of the (re-)configuration for the preconfigured integration. After this wait time expires, the device switches
its physical WLAN interface(s) into client mode and scans the available SSIDs for the last detected AutoWDS base network.
At the same time, the timer starts the countdown to the start of the automatic (re-)configuration for the express integration.
If the device has not found the expected AutoWDS base network when the express timer expires, the device automatically
switches to express integration. It then searches for any AutoWDS-enabled network until a suitable anchor AP is detected.
By adjusting the interaction between the various wait times, you can allow the device to react flexibly to unforeseen
events. This facilitates the implementation of a fallback solution, for example in the case that you change the pre-shared
key for the AutoWDS base network. If the change should fail on an unassociated AP, the device becomes inaccessible
as it has an invalid configuration. Please observe the notes under
Differences between the integration modes
on page
1286.
The relevant counters are configured on the AP (e.g. via LANconfig) and also on the WLC (Setup menu only). The counters
are only observed by the AP if no WLC configuration (initial configuration) is available. As soon as a configuration is
available, then the values specified in the AutoWDS profile apply (reconfiguration). Learn more about the setting the
priorities for configurations under
Differences between the integration modes
on page 1286.
5
If you disable the express timer or the preconfiguration timer, the device skips the corresponding integration
step. The automatic reconfiguration can be switched off by disabling both timers. This means that, after being
disconnected for long enough, the device can no longer be reached by AutoWDS. However, the device remains
accessible over the LAN interface and searches the LAN for a WLC.
5
The process of preconfigured integration does not start if the settings for the AutoWDS base network (SSID,
passphrase) are incomplete or if the preconfiguration timer is set to 0.
Example: Failure of an AP
Each AP maintains its CAPWAP connection by issuing echo requests to the WLC at a specified interval. If an AP fails or
its connection is interrupted, these requests will be lost. If the APs repeat the echo request and receive no response from
1289
Reference Manual
14 WLAN Management
the WLC, the CAPWAP connection is considered to be lost and the APs start the reconfiguration process described under
Connectivity loss and reconfiguration
on page 1288.
For the infrastructure illustrated above, a failure of AP-01 would have the following impact, assuming that automatic
topology management is enabled:
1. AP-01 is defective.
2. AP-02 and AP-03 repeat their echo-requests; all repeats fail.
3. AP-02 and AP-03 start the standalone operation of their P2P link (if configured) and continue to try to reach the
WLC (over wireless and LAN, assuming connectivity exists).
4. AP-02 and AP-03 stop their autonomous operation of P2P connections.
5. AP-02 and AP-03 count down the wait time until the start of the preconfigured integration.
6. After the wait time expires, AP-02 and AP-03 switch into client mode and scan the WLAN for the last known AutoWDS
base network.
7. AP-02 and AP-03 find a new anchor AP (e.g. B. AP-05 or AP-06) and login as clients.
8. AP-02 and AP-03 restore the CAPWAP connection via the WLC-TUNNEL-AUTOWDS and inform the WLC about the
new anchor AP and the physical WLAN interfaces they are using.
9. The WLC generates a P2P link for the corresponding physical WLAN interfaces and delivers the configuration to the
APs by CAPWAP.
10. The APs set up the new P2P link to the master APs assigned to them and stop communicating with the WLC via the
WLC-TUNNEL-AUTOWDS; they are bridged to the LAN instead.
1290
Reference Manual
14 WLAN Management
Setup by means of preconfigured integration
The following sections show you how to set up an AutoWDS network by means of the preconfigured integration.
Configuration relies on the automatic topology management of the WLC.
In this scenario, a company is expanding its business premises into a new building. The company wants to integrate the
new business premises into its existing managed WLAN. The relevant APs should be connected exclusively via point-to-point
link. Between building A (old) and B (new), no wired network connection can be installed.
To keep the configuration simple, a single WLC is used to configure all of the APs. The exact number of APs in building
A and building B is immaterial. Particular features, such as multiple physical WLAN interfaces, are automatically taken
into account by the WLC topology management.
The configuration itself is divided into two parts:
1. Configuration of the WLC in building A
2. Configuration of all APs in building B
4
The example application requires a valid WLAN configuration with valid certificates in the WLC. Just how to set
up a managed WLAN is described in the chapter on WLAN management.
Configuring the WLC
The following instructions describe how to configure the AutoWDS of a central WLC for preconfigured integration.
4
Ensure that the AutoWDS APs, which integrate with the network as WLAN clients, are able to reach a DHCP
server via the WLC-TUNNEL-AUTOWDS interface. Without an IP address, the APs do not search for the WLC and
thus do not receive a configuration from it.
1. Open the configuration dialog in LANconfig and click on WLAN controller > Profiles > AutoWDS to access the
AutoWDS dialog.
2. Click on AutoWDS activated to enable the feature on the device.
3. Enter the name of the AutoWDS base network under AutoWDS-Rollout-SSID. By default LANconfig uses the
identifier AutoWDS-Rollout.
1291
Reference Manual
14 WLAN Management
The SSID specified here acts as the management network for all APs that are searching for the AutoWDS network
and, apart from the passphrase, it offers no further options for configuration. The WLC internally connects the
specified SSID automatically using a WLC tunnel (WLC-TUNNEL-AUTOWDS). Normal WLAN clients are unable to
use this management network.
5
In this case, enter a custom AutoWDS rollout SSID that is different from the LANconfig default.
4
Setting up this AutoWDS base network reduces the maximum number of SSIDs that your device can support
on a physical WLAN interface by 1.
4. Under WPA2 passphrase you enter a key to secure the AutoWDS base network.
Select the most complex key possible, with at least 8 and maximum 63 characters. The key requires at least 32
characters to provide encryption of suitable strength.
5. Under Used radio bands you specify the frequency band used by the APs for the AutoWDS base network.
6. Select the WLAN profile with the SSID which is to be enhanced with AutoWDS.
The APs with this WLAN profile serve as anchor APs and support the AutoWDS base network. At the same time,
associated APs receive this WLAN profile via AutoWDS as a default configuration, which they use to transmit the
corresponding SSID.
7. Close the dialog window with OK and save the configuration to the device.
The WLC now assigns the AutoWDS settings to all managed AutoWDS-capable APs in your WLAN. These now form the
basis for your AutoWDS base network. For future reconfiguration processes, the APs use only the SSID and passphrase
stored here, unless configured otherwise (see
Differences between the integration modes
on page 1286).
This concludes the configuration of the WLC. We now continue with the configuration of the APs.
Configuring the APs
The following instructions describe how to configure the AutoWDS of an AP for preconfigured integration. The configuration
steps are identical for all unassociated APs.
4
There is no need to configure an AP that is already paired with a WLC. If devices are out of range of the WLC,
thus making pairing impossible, then the SSID and passphrase can optionally be entered manually.
1. Open the configuration dialog in LANconfig and click on Wireless LAN > AutoWDS to access the AutoWDS dialog.
2. Click on AutoWDS activated to enable the feature on the device.
3. Under Network name (SSID) enter the name of the AutoWDS base network that you configured on the WLC (e.g.
AutoWDS-Rollout).
4. Enter the key for the AutoWDS base network under WPA2 passphrase that you have configured on the WLC (e.g.
AutoWDS-Control).
1292
Reference Manual
14 WLAN Management
5. Change the timeout values for the Time till search mode 'Preconfig' to 1 and for the Time until search mode
'Express' to 0.
6. Under Wireless LAN > General > Physical WLAN settings., make sure that at least one physical WLAN interface
is in Managed mode.
Otherwise the device will never search for an AutoWDS base network.
7. Close the dialog window with OK and save the configuration to the device.
After a successful configuration update, the AP switches its physical WLAN interface(s) into client mode and searches
for the specified AutoWDS base network. To learn more about the procedure, refer to the
chapter about the function
.
Accelerating preconfigured integration by pairing
Through the one-time pairing of WLC and APs, you can further reduce the effort required for the preconfigured integration.
For pairing, you reset an AP and connect it via LAN to the WLC used for running your managed WLAN including AutoWDS.
In the reset state, the AP is automatically in managed mode after being switching on. Once the AP finds the WLC and
the WLC accepts the AP, the AP automatically receives all relevant certificates and partial configurations required to
configure the parameters in the device. Pairing is then complete. On location, a coworker installs the AP and switches
it on. Your device then searches for the preconfigured AutoWDS base network.
The following steps summarize the pairing procedure. They also include the steps for automatic configuration assignment,
which further simplifies the pairing of a high number of APs.
1. Start LANconfig and, on your WLC, set up a managed WLAN with a valid WLAN profile, if you have not already done
so. In LANconfig you configure this type of profile under WLAN controller > Profiles > WLAN profiles.
2. Activate AutoWDS for this WLAN profile as described in
Configuring the WLC
on page 1291.
3. Create a profile that is valid for all APs under WLAN controller > AP configuration > Access point table with
the button Default. Assign the WLAN profile you created earlier to this profile
4. Enable the option Automatically provide APs with a default configuration under WLAN controller > General.
5. Optional: To avoid having to manually accept unassociated APs in LANmonitor by allowing the WLC to do this
automatically, you should additionally select the option Automatically accept new APs (auto-accept).
5
For security reasons, you should only enable this option if you have connected the unassociated APs to the
WLC via a LAN interface. To exclude the possibility of rogue AP intrusion, make sure that no other devices
are connected with the WLC.
6. Send the configuration to the WLC.
7. Reset the unassociated AP and connect the device to the WLC via the LAN.
The device automatically starts to search for a WLC.
8. In LANmonitor, you accept the new AP under Wireless LAN > New APs, unless you have set up automatic acceptance.
The WLC sends the device those parts of the configuration that it needs for its future operation in managed mode.
After successful configuration, LANmonitor lists the device in the Active APs.
This completes the pairing and the AP is ready for AutoWDS operation.
Express integration
The following sections show you how to set up an AutoWDS network by means of the express integration. Configuration
relies on the automatic topology management of the WLC.
The initial scenario is similar to the
preconfigured integration
.
4
By default, AutoWDS is disabled on a reset AP and you must first use a wired access to activate the feature.
5
Express configuration has certain characteristics that are relevant to security. We recommend that you read the
section
Differences between the integration modes
on page 1286 carefully.
1293
Reference Manual
14 WLAN Management
Configuring the WLC
The following instructions describe how to configure the AutoWDS of a central WLC for express integration.
1. Carry out each step under
Configuring the WLC
on page 1291 for the preconfigured integration.
2. Log on to your device via WEBconfig or the console.
3. In the setup menu, navigate to the table WLAN-Management > AP-Configuration > AutoWDS-Profiles.
4. Edit the AutoWDS default profile by clicking on the entry DEFAULT.
5. Change the Allow-Express-Integration parameter to Yes and save the settings by clicking on Send.
This concludes the configuration of the WLC. We now continue with the configuration of the APs.
Configuring the APs
The following instructions describe how to configure the AutoWDS of an AP for express integration. The configuration
steps are identical for all unassociated APs.
1. Open the configuration dialog in LANconfig and click on Wireless LAN > AutoWDS to access the AutoWDS dialog.
2. Click on AutoWDS activated to enable the feature on the device.
3. Under Wireless LAN > General > Physical WLAN settings., make sure that at least one physical WLAN interface
is in Managed mode.
Otherwise the device will never search for an AutoWDS base network.
4. Close the dialog window with OK and save the configuration to the device.
After a successful configuration update, the AP switches its physical WLAN interface(s) into client mode and searches
for any AutoWDS base network. For further information on this procedure please refer to
Deploying the AutoWDS base
network
on page 1285.
Switching from express to preconfigured integration
Following a network rollout and the express integration, the switch to a preconfigured integration is implemented by
disabling the express integration on the WLC. There is no need to change anything on the APs because they have already
received an AutoWDS configuration during the express integration, and this pre-configures an AutoWDS network for
subsequent re-configuration procedures.
1. Log on to your device via WEBconfig or the console.
2. In the setup menu, navigate to the table WLAN-Management > AP-Configuration > AutoWDS-Profiles.
3. Edit the AutoWDS default profile by clicking on the entry DEFAULT.
4. Change the Allow-Express-Integration parameter to No and save the settings by clicking on Send.
You have now disabled the express integration of further unassociated APs.
1294
Reference Manual
14 WLAN Management
Manual topology management
The examples of AutoWDS installation rely upon automatic topology management by the WLC, which simplifies the
configuration. Depending on the usage scenario, it may be necessary to setup individual or all of the P2P links manually.
The following section shows you how to disable the automatic topology management on the WLC and create a manual
P2P configuration. To configure the P2P links, you first assign unique names to each of the APs. Then link these names
with the topology configuration and the physical WLAN interfaces being used. The chapter assumes that you have already
performed the steps for the WLC under
Setup by means of preconfigured integration
on page 1291, so that you can
complete the basic configuration and enable AutoWDS on the WLC.
4
In general, we recommend a maximum of 3 hops for AutoWDS operations.
Changes to the initial scenario
The initial scenario is similar to the preconfigured integration. The entire infrastructure is based on dual-radio APs, which
are arranged according to the illustration below. The managed WLAN initially consists of a single AP, which serves as
the initial anchor AP for the unassociated APs.
Configuring the WLC
The following instructions describe how to disable the automatic topology management and the configuration of manual
P2P links according to the scenario described under
Manual topology management
on page 1295.
1295
Reference Manual
14 WLAN Management
1. Open the configuration dialog in LANconfig and click on WLAN controller > AP configuration > Access point
table to access the list of managed access points.
2. For each unassociated AP, enter the MAC address and a unique identifier under AP name. You will reference this
name later in the topology configuration.
For the example scenario, the individual configuration entries are as follows:
Table 11: Configuring the unassociated APs in the access point table
AP nameMAC addressEntry
AP-0000-80-63-a6-3d-f001
AP-0100-a0-57-99-c6-4f02
AP-0200-80-63-b1-df-8703
AP-0300-a0-57-12-a8-0104
AP-0400-80-63-d9-ae-2205
AP-0500-a0-57-60-c4-3d06
AP-0600-a0-57-24-d4-1b07
AP-0700-80-63-a8-b1-3708
AP-0800-80-63-b1-df-9909
AP-0900-a0-57-33-e1-0510
4
The table entry AP-00 refers to your existing AP, which the unassociated APs use as an anchor AP.
3. Select the WLAN profile for which you have enabled AutoWDS.
By means of the corresponding WLAN profile, the APs automatically receive the settings for AutoWDS and hence
for the P2P configuration.
4. Close the dialog window with OK and save the configuration to the device.
5. Log on to your device via WEBconfig or the console.
6. In the setup menu, navigate to the table WLAN-Management > AP-Configuration > AutoWDS-Profiles.
7. Edit the AutoWDS default profile by clicking on the entry DEFAULT.
1296
Reference Manual
14 WLAN Management
8. Change the Topology-Management parameter to Manual and save the settings by clicking on Send.
9. Navigate to the table WLAN-Management > AP-Configuration > AutoWDS-Topology and click on Add.
10. For each P2P pair, create a manual P2P configuration. The specified P2P link is always considered from the perspective
of the slave AP.
a) In the field AutoWDS-Profile, specify the AutoWDS profile that applies for the manual P2P configuration, for
example DEFAULT.
b) Set the Priority of the P2P configuration to 0 (highest priority).
c) For the Slave-AP-Name and Master-AP-Name, enter the names of the APs according to your hierarchy.
For the example scenario, the individual configuration entries in the case of strict interface pairing are as follows:
Table 12: Configuring the P2P pairs in the AutoWDS topology table
Master-AP-WLAN-Ifc.Master-AP-NameSlave-AP-WLAN-Ifc.Slave-AP-NameEntry
WLAN-1AP-00WLAN-1AP-0101
WLAN-2AP-01WLAN-2AP-0202
WLAN-1AP-02WLAN-1AP-0303
WLAN-2AP-00WLAN-2AP-0404
WLAN-1AP-04WLAN-1AP-0505
WLAN-2AP-05WLAN-2AP-0606
WLAN-1AP-00WLAN-1AP-0707
WLAN-2AP-07WLAN-2AP-0808
WLAN-1AP-08WLAN-1AP-0909
d) Under Key specify the WPA2 passphrase used by the P2P partners to encrypt the P2P link.
Select the most complex key possible, with at least 8 and maximum 63 characters. The key requires at least 32
characters to provide encryption of suitable strength. If you leave the field blank, the device automatically
generates a passphrase with a length of 32 characters.
e) Switch the entry Enabled to Yes.
f) Save the entries by clicking on Send.
If APs were already connected, the WLC sends the new configuration to these APs, which triggers the reconfiguration
procedure for each one. If no APs were connected, the WLC transmits the P2P configuration when the unassociated APs
connect for the first time.
Redundant paths by means of RSTP
In combination with the rapid spanning tree protocol (RSTP), manual topology management allows you to set up
redundant P2P links to improve the failover reliability of your entire AutoWDS base network. To do this, you must first
enable RSTP in the Setup menu of each AP, because the WLC management settings do not include this part of the
configuration. You can reduce the work involved by transmitting a script to all of the APs by means of the WLC script
management.
The following steps show you how to do this. These steps assume that you have successfully set up an AutoWDS base
network. After activation, RSTP automatically performs the path search.
1. Create a text file with the name WLC_Script_1.lcs.
2. Copy the following lines of code into the text file and save it.
# Script (9.000.0000 / 15.07.2014)
lang English
flash No
1297
Reference Manual
14 WLAN Management
set /Setup/LAN-Bridge/Spanning-Tree/Protocol-Version Rapid
set /Setup/LAN-Bridge/Spanning-Tree/Path-Cost-Computation Rapid
set /Setup/LAN-Bridge/Spanning-Tree/Operating yes
flash Yes
# done
exit
3. Login to the WEBconfig interface of your WLC and navigate to File management > Upload certificate or file.
4. In the File type selection list, select CAPWAP - WLC_Script_1.lcs and use the Browse button to locate your script
file. Then click on Start upload.
You can check if the file was successfully uploaded to the WLC in the Status menu under File system > Contents.
5. Navigate to the Setup menu item WLAN management > Central firmware management > Script management
and click on Add.
6. For the Profile enter the corresponding WLAN profile and under Name enter WLC_Script_1.lcs in order
to link the AutoWDS profile with the script name and to roll it out to the APs.
7. As described in section
Configuring the WLC
on page 1295, assign unique names to the APs in the WLC and set up
the manual P2P links.
You have now successfully completed the configuration.
Additions to the Status menu
AutoWDS
Indicates whether the connected client is an AutoWDS-capable AP in client mode, and which mode it is currently using
to connect to your managed WLAN.
SNMP ID:
1.3.32.62
Telnet path:
Status > WLAN > Station-table
Possible values:
No
AutoWDS not enabled or not supported.
Preconfigured
AutoWDS is enabled; SSID and WPA2 passphrase are preconfigured.
Express
AutoWDS is enabled; SSID and WPA2 passphrase are not preconfigured.
AutoWDS
Indicates whether the detected WLAN is an AutoWDS base network.
SNMP ID:
1.3.34.42
1298
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN > Scan-Results
Possible values:
No
Yes
AutoWDS
Indicates whether the detected WLAN is an AutoWDS base network.
SNMP ID:
1.3.44.42
Telnet path:
Status > WLAN > Competing-networks
Possible values:
No
Yes
AutoWDS profile
This table shows the settings for the AutoWDS profile received by your device from the WLC.
SNMP ID:
1.59.106
Telnet path:
Status > WLAN-Management
Name
Name of of the AutoWDS profile assigned to your device by the WLC.
SNMP ID:
1.59.106.1
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
1299
Reference Manual
14 WLAN Management
SSID
The name of the logical WLAN network (SSID) that a managed access point uses to deploy the AutoWDS base network.
In client mode, unassociated APs use the SSID entered here to receive a configuration from the WLC.
4
This SSID is reserved exclusively for AutoWDS. The AutoWDS base network cannot be used by other WLAN clients
such as smartphones, laptops, etc.
SNMP ID:
1.59.106.3
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Key
Displays the WPA2 passphrase used for the AutoWDS base network.
SNMP ID:
1.59.106.4
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Net-Number
Displays the internal representation of the common profile as a number.
SNMP ID:
1.59.106.5
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Active
Indicates whether the assigned AutoWDS is enabled or disabled.
SNMP ID:
1.59.106.6
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
1300
Reference Manual
14 WLAN Management
Possible values:
No
Yes
Allow-Express-Integration
Specifies whether your device allows the express integration of unassociated APs by means of the AutoWDS profile
assigned to it.
SNMP ID:
1.59.106.7
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Possible values:
No
Yes
Time-till-Preconf-Scan
Displays the specified wait time after which the AP switches to client mode and scans for an AutoWDS base network
according to the values from the preconfiguration (the SSID and passphrase that are stored in the AutoWDS profile).
This occurs after all of the continuation times have expired. If the AP finds a matching SSID, the device attempts to
authenticate with the respective WPA2 passphrase in order to subsequently perform the reconfiguration process.
Parallel to this process, the configured
wait time for the start of express integration
.
SNMP ID:
1.59.106.15
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Time-till-Express-Scan
Displays the specified wait time after which the AP switches to client mode and scans for any AutoWDS base networks,
if all continuation times and also the
wait time for the start of the preconfigured integration
(if set) have expired. If the
AP finds a suitable SSID, the device attempts to authenticate at the WLAN in order to subsequently perform the
reconfiguration process. The device authenticates with an express pre-shared key, which is hard-coded in the firmware.
SNMP ID:
1.59.106.16
1301
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Interface-Pairing
Indicates the type of interface pairings allowed by an anchor AP, based on the AutoWDS profile assigned to it.
The interface pairing influences the search by an AP in client mode for suitable anchor APs, while taking the participating
WLAN interfaces into account. This specifies whether the unassociated AP has to connect to the equivalent physical
WLAN interface of the anchor AP to integrate (i.e. with WLAN-1 to WLAN-1 or with WLAN-2 to WLAN-2), or whether it
may pair with other physical interfaces. The definition of the interface pairing makes it possible to exclude invalid pairings,
which may occur due to the assignment of different frequency bands due to the WLC configuration.
SNMP ID:
1.59.106.17
Telnet path:
Status > WLAN-Management > AutoWDS-Profile
Possible values:
Automatic
The WLC checks if a problematic configuration can occur. If no problematic configuration occurs, it
accepts the interface pairing via the anchor AP. Otherwise, the WLC rejects it and the unassociated AP
must connect again.
Strict
An unassociated AP may only connect its physical WLAN interface X to the equivalent WLAN interface
of the anchor AP.
Mixed
An unassociated AP may connect its physical WLAN interface X to any WLAN interface of the anchor
AP.
AutoWDS-Topology
This table shows the topology or P2P configuration of the AutoWDS network provisioned to your device by the WLC.
Using the information stored here, your device establishes the P2P link to its child slave APs and to its parent master
APs.
SNMP ID:
1.59.107
Telnet path:
Status > WLAN-Management
AutoWDS profile
Name of the AutoWDS profile that applies to the selected P2P configuration.
1302
Reference Manual
14 WLAN Management
SNMP ID:
1.59.107.1
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Priority
Shows the priority of a P2P connection from the perspective of a slave AP's physical WLAN interface.
SNMP ID:
1.59.107.2
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Slave-AP-Name
Name of the AP with the role of slave in the WLC configuration.
SNMP ID:
1.59.107.3
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Slave-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the slave AP for the P2P link to the master AP.
SNMP ID:
1.59.107.4
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Possible values:
Automatic
WLAN-1
WLAN-2
Slave-AP-WLAN-MAC
MAC address of the slave AP.
1303
Reference Manual
14 WLAN Management
SNMP ID:
1.59.107.5
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Master-AP-Name
Name of the AP with the role of master in the WLC configuration.
SNMP ID:
1.59.107.6
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Master-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the master AP for the P2P link to the slave AP.
SNMP ID:
1.59.107.7
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Possible values:
Automatic
WLAN-1
WLAN-2
Master-AP-WLAN-MAC
MAC address of the master AP.
SNMP ID:
1.59.107.8
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Key
WPA2 passphrase for the P2P link.
1304
Reference Manual
14 WLAN Management
SNMP ID:
1.59.107.9
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Active
Indicates whether the corresponding P2P configuration is enabled or disabled.
SNMP ID:
1.59.107.10
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Possible values:
No
Yes
Slave-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from slave AP to master AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.59.107.12
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Master-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from master AP to slave AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.59.107.13
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
1305
Reference Manual
14 WLAN Management
Link-Loss-Timeout
Shows the time after which the AP tags the connection to its P2P partner as interrupted. If the device has marked a P2P
link as interrupted, its physical WLAN interface starts scanning the WLAN for the lost P2P partner.
SNMP ID:
1.59.107.14
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Continuation
Shows the continuation time of the P2P configuration obtained from the WLC.
The continuation time mentioned above refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to
the WLC. If the AP detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation
time. Connections to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails
and the continuation time expires, the AP discards this part of the WLC configuration. If the standalone continuation
time is specified as 0, the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
1.59.107.16
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Generated
Indicates whether the received P2P configuration was generated automatically by the WLC or set manually in the WLC
by the network administrator.
SNMP ID:
1.59.107.17
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
1306
Reference Manual
14 WLAN Management
Possible values:
No
Yes
P2P index
This status value shows the static P2P port used by the APs (e.g. P2P-1-1).
SNMP ID:
1.59.107.19
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
P2P-Role
This status value indicates whether your device assumes the role of slave or master for the listed P2P configuration.
SNMP ID:
1.59.107.20
Telnet path:
Status > WLAN-Management > AutoWDS-Topology
Possible values:
None
Slave
Master
AutoWDS operation
This menu displays the status values for the AutoWDS operation of your device.
SNMP ID:
1.59.109
Telnet path:
Status > WLAN-Management
Active scan mode
Indicates the AutoWDS integration mode currently used by your device, and whether the mode is active.
1307
Reference Manual
14 WLAN Management
SNMP ID:
1.59.109.1
Telnet path:
Status > WLAN-Management > AutoWDS-Operation
Possible values:
No
Your device is not currently searching for an AutoWDS base network.
Preconfigured
Your device is currently searching for the preconfigured AutoWDS base network.
Express
Your device is currently searching for any AutoWDS base network.
AutoWDS-Profile
This table shows the settings of the AutoWDS profiles that the WLC has assigned to the individual APs.
SNMP ID:
1.73.2.11
Telnet path:
Status > WLAN-Management > AP-Configuration
Name
Name of of the AutoWDS profile assigned to the APs by the WLC.
SNMP ID:
1.73.2.11.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Commonprofile
Then name of the WLAN profile assigned to the AutoWDS base network. All APs that have been assigned this WLAN
profile support the AutoWDS base network at the same time.
SNMP ID:
1.73.2.11.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
1308
Reference Manual
14 WLAN Management
SSID
The name of the logical WLAN network (SSID) that a managed access point uses to deploy the AutoWDS base network.
In client mode, unassociated APs use the SSID entered here to receive a configuration from the WLC.
4
This SSID is reserved exclusively for AutoWDS. The AutoWDS base network cannot be used by other WLAN clients
such as smartphones, laptops, etc.
SNMP ID:
1.73.2.11.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Key
Displays the WPA2 passphrase used for the AutoWDS base network.
SNMP ID:
1.73.2.11.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Active
Indicates whether the corresponding AutoWDS is enabled or disabled.
SNMP ID:
1.73.2.11.6
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
No
Yes
Allow-Express-Integration
Specifies whether the APs with the corresponding WLAN profile allow the express integration of unassociated APs via
the AutoWDS base network.
SNMP ID:
1.73.2.11.7
1309
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
No
Yes
Topology-Management
Specifies which type of topology management the WLC uses for the respective AutoWDS profile.
For further information on this, see the corresponding setup parameters
2.37.1.15.8 Topology-Management
on page
1333.
SNMP ID:
1.73.2.11.8
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Automatic
The WLC automatically generates a P2P configuration. The device ignores manually specified P2P links.
semi-automatic
The WLC only generates a P2P configuration if no manual P2P configuration exists for the unassociated
AP. Otherwise the WLC uses the manual configuration.
Manual
The WLC does not automatically generate a P2P configuration. A manual P2P configuration is taken, if
available. Otherwise, the WLC does not transmit a P2P configuration to the AP.
Slave-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from slave AP to master AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.73.2.11.10
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Master-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from master AP to slave AP (in kbps). The value 0 means 'unlimited'.
1310
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.11.11
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Link-Loss-Timeout
Shows the time after which the AP tags the connection to its P2P partner as interrupted. If the device has marked a P2P
link as interrupted, its physical WLAN interface starts scanning the WLAN for the lost P2P partner.
SNMP ID:
1.73.2.11.12
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Continuation
Shows the continuation time of the automatically generated P2P configuration.
This continuation time refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to the WLC. If the
AP detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation time. Connections
to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails and the continuation
time expires, the AP discards this part of the WLC configuration. If the standalone continuation time is specified as 0,
the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
1.73.2.11.14
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Time-till-Preconf-Scan
Displays the specified wait time after which the AP switches to client mode and scans for an AutoWDS base network
according to the values from the preconfiguration (the SSID and passphrase that are stored in the AutoWDS profile).
This occurs after all of the continuation times have expired. If the AP finds a matching SSID, the device attempts to
authenticate with the respective WPA2 passphrase in order to subsequently perform the reconfiguration process.
Parallel to this process, the configured
wait time for the start of express integration
.
SNMP ID:
1.73.2.11.15
1311
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Time-till-Express-Scan
Displays the specified wait time after which the AP switches to client mode and scans for any AutoWDS base networks,
if all continuation times and also the
wait time for the start of the preconfigured integration
(if set) have expired. If the
AP finds a suitable SSID, the device attempts to authenticate at the WLAN in order to subsequently perform the
reconfiguration process. The device authenticates with an express pre-shared key, which is hard-coded in the firmware.
SNMP ID:
1.73.2.11.16
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Interface-Pairing
Indicates the type of interface pairings allowed by an anchor AP, based on the AutoWDS profile assigned to it.
The interface pairing influences the search by an AP in client mode for suitable anchor APs, while taking the participating
WLAN interfaces into account. This specifies whether the unassociated AP has to connect to the equivalent physical
WLAN interface of the anchor AP to integrate (i.e. with WLAN-1 to WLAN-1 or with WLAN-2 to WLAN-2), or whether it
may pair with other physical interfaces. The definition of the interface pairing makes it possible to exclude invalid pairings,
which may occur due to the assignment of different frequency bands due to the WLC configuration.
SNMP ID:
1.73.2.11.17
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Automatic
The WLC checks if a problematic configuration can occur. If no problematic configuration occurs, it
accepts the interface pairing via the anchor AP. Otherwise, the WLC rejects it and the unassociated AP
must connect again.
Strict
An unassociated AP may only connect its physical WLAN interface X to the equivalent WLAN interface
of the anchor AP.
Mixed
An unassociated AP may connect its physical WLAN interface X to any WLAN interface of the anchor
AP.
1312
Reference Manual
14 WLAN Management
AutoWDS-Topology
This table shows manual components of the AutoWDS topology, or more specifically, the manual P2P links between the
individual slave APs and master APs as sent to the individual APs by the WLC. The P2P links set up in this way should
always be seen from the perspective of the slave AP's physical WLAN interface.
SNMP ID:
1.73.2.12
Telnet path:
Status > WLAN-Management > AP-Configuration
AutoWDS profile
Name of the AutoWDS profile that applies to the selected P2P configuration.
SNMP ID:
1.73.2.12.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Priority
Shows the priority of a P2P connection from the perspective of a slave AP's physical WLAN interface.
SNMP ID:
1.73.2.12.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Slave-AP-Name
Name of the AP with the role of slave in the WLC configuration.
SNMP ID:
1.73.2.12.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Slave-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the slave AP for the P2P link to the master AP.
1313
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.12.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Automatic
WLAN-1
WLAN-2
Slave-AP-WLAN-MAC
MAC address of the slave AP.
SNMP ID:
1.73.2.12.5
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Master-AP-Name
Name of the AP with the role of master in the WLC configuration.
SNMP ID:
1.73.2.12.6
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Master-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the master AP for the P2P link to the slave AP.
SNMP ID:
1.73.2.12.7
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
1314
Reference Manual
14 WLAN Management
Possible values:
Automatic
WLAN-1
WLAN-2
Master-AP-WLAN-MAC
MAC address of the master AP.
SNMP ID:
1.73.2.12.8
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Key
WPA2 passphrase for the P2P link.
SNMP ID:
1.73.2.12.9
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Active
Indicates whether the corresponding P2P configuration is enabled or disabled.
4
The WLC does not transmit disabled P2P configurations to the AP and, when evaluating the manual AutoWDS
topology table in semi-automatic mode, it ignores disabled entries.
SNMP ID:
1.73.2.12.10
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
1315
Reference Manual
14 WLAN Management
Possible values:
No
Yes
Slave-Tx-Limit
Shows the maximum transmission bandwidth which applies to the manual P2P link in the direction of transmission from
slave AP to master AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.73.2.12.12
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Master-Tx-Limit
Shows the maximum transmission bandwidth which applies to the manual P2P link in the direction of transmission from
master AP to slave AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.73.2.12.13
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Link-Loss-Timeout
Shows the time after which the AP tags the connection to its P2P partner as interrupted. If the device has marked a P2P
link as interrupted, its physical WLAN interface starts scanning the WLAN for the lost P2P partner.
SNMP ID:
1.73.2.12.14
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Continuation
Shows the continuation time of the manual P2P configuration.
The continuation time mentioned above refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to
the WLC. If the AP detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation
time. Connections to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails
1316
Reference Manual
14 WLAN Management
and the continuation time expires, the AP discards this part of the WLC configuration. If the standalone continuation
time is specified as 0, the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
1.73.2.12.16
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Generated
Indicates whether the P2P configuration was generated automatically by the WLC or set manually in the WLC by the
network administrator.
SNMP ID:
1.73.2.12.17
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
No
Yes
State
Displays the status of the corresponding P2P link.
SNMP ID:
1.73.2.12.18
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
None
The status of the corresponding P2P partners could not be recognized ('unknown').
Active
The corresponding P2P partners are connected to each other.
Idle
The corresponding P2P partners are not connected to each other.
1317
Reference Manual
14 WLAN Management
AutoWDS-Auto-Topology
This table shows components of the AutoWDS topology that were automatically generated by the WLC, or more specifically,
the generated P2P links between the individual slave APs and master APs as sent to the individual APs by the WLC. The
P2P links generated in this way should always be seen from the perspective of the slave AP's physical WLAN interface.
SNMP ID:
1.73.2.13
Telnet path:
Status > WLAN-Management > AP-Configuration
AutoWDS profile
Name of the AutoWDS profile that applies to the selected P2P configuration.
SNMP ID:
1.73.2.13.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Priority
Shows the priority of a P2P connection from the perspective of a slave AP's physical WLAN interface.
SNMP ID:
1.73.2.13.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Slave-AP-Name
Name of the AP with the role of slave in the WLC configuration.
SNMP ID:
1.73.2.13.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Slave-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the slave AP for the P2P link to the master AP.
1318
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.13.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Possible values:
Automatic
WLAN-1
WLAN-2
Slave-AP-WLAN-MAC
MAC address of the slave AP.
SNMP ID:
1.73.2.13.5
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Master-AP-Name
Name of the AP with the role of master in the WLC configuration.
SNMP ID:
1.73.2.13.6
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Master-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the master AP for the P2P link to the slave AP.
SNMP ID:
1.73.2.13.7
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
1319
Reference Manual
14 WLAN Management
Possible values:
Automatic
WLAN-1
WLAN-2
Master-AP-WLAN-MAC
MAC address of the master AP.
SNMP ID:
1.73.2.13.8
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Key
WPA2 passphrase for the P2P link.
SNMP ID:
1.73.2.13.9
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Active
Indicates whether the corresponding P2P configuration is enabled or disabled.
4
The WLC does not transmit disabled P2P configurations to the AP and, when evaluating the manual AutoWDS
topology table in semi-automatic mode, it ignores disabled entries.
SNMP ID:
1.73.2.13.10
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
1320
Reference Manual
14 WLAN Management
Possible values:
No
Yes
Slave-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from slave AP to master AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.73.2.13.12
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Master-Tx-Limit
Shows the maximum transmission bandwidth which applies to the generated P2P link in the direction of transmission
from master AP to slave AP (in kbps). The value 0 means 'unlimited'.
SNMP ID:
1.73.2.13.13
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Link-Loss-Timeout
Shows the time after which the AP tags the connection to its P2P partner as interrupted. If the device has marked a P2P
link as interrupted, its physical WLAN interface starts scanning the WLAN for the lost P2P partner.
SNMP ID:
1.73.2.13.14
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Continuation
Shows the continuation time of the automatically generated P2P configuration.
This continuation time refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to the WLC. If the
AP detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation time. Connections
to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails and the continuation
1321
Reference Manual
14 WLAN Management
time expires, the AP discards this part of the WLC configuration. If the standalone continuation time is specified as 0,
the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
1.73.2.13.16
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Generated
Indicates whether the P2P configuration was generated automatically by the WLC or set manually in the WLC by the
network administrator.
SNMP ID:
1.73.2.13.17
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Auto-Topology
Possible values:
No
Yes
State
Displays the status of the corresponding P2P link.
SNMP ID:
1.73.2.13.18
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
None
The status of the corresponding P2P partners could not be recognized ('unknown').
Active
The corresponding P2P partners are connected to each other.
Idle
The corresponding P2P partners are not connected to each other.
1322
Reference Manual
14 WLAN Management
AutoWDS-Prof.-Errors
This table contains the error messages that occurred when an AutoWDS profile was assigned.
SNMP ID:
1.73.2.14
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.14.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Prof.-Errors
Name
Name of the AutoWDS profile where the error occurred.
SNMP ID:
1.73.2.14.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Prof.-Errors
Error
Content of the error message.
SNMP ID:
1.73.2.14.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Prof.-Errors
Network/AP-Parameters
WLAN and AP parameters pertaining to the error.
1323
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.14.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Prof.-Errors
AutoWDS-Topo.-Errors
This table contains the error messages that occurred when assigning a P2P configuration for AutoWDS.
SNMP ID:
1.73.2.15
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.15.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
AutoWDS profile
Name of the AutoWDS profile where the error occurred.
SNMP ID:
1.73.2.15.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Priority
Shows the priority of a P2P connection from the perspective of a slave AP's physical WLAN interface.
SNMP ID:
1.73.2.15.3
1324
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Slave-AP-Name
Name of the AP with the role of slave in the WLC configuration.
SNMP ID:
1.73.2.15.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Slave-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the slave AP for the P2P link to the master AP.
SNMP ID:
1.73.2.15.5
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Slave-AP-WLAN-MAC
MAC address of the slave AP.
SNMP ID:
1.73.2.15.6
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Master-AP-Name
Name of the AP with the role of master in the WLC configuration.
SNMP ID:
1.73.2.15.7
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
1325
Reference Manual
14 WLAN Management
Master-AP-WLAN-Ifc.
Shows the physical WLAN interface used by the master AP for the P2P link to the slave AP.
SNMP ID:
1.73.2.15.8
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Master-AP-WLAN-MAC
MAC address of the master AP.
SNMP ID:
1.73.2.15.
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
Error
Content of the error message.
SNMP ID:
1.73.2.15.
Telnet path:
Status > WLAN-Management > AP-Configuration > AutoWDS-Topo.-Errors
AutoWDS-Integration
Indicates whether the unassociated AP established the CAPWAP connection via LAN or WLAN and which integration
mode is being used.
SNMP ID:
1.73.9.3.7
Telnet path:
Status > WLAN-Management > AP-Status > New-AP
Possible values:
None
CAPWAP via LAN
1326
Reference Manual
14 WLAN Management
Express
CAPWAP via WLAN
Preconfigured
CAPWAP via WLAN
Additions to the Setup menu
AutoWDS
This table contains the local factory settings of your device for the search for and the authentication at an AutoWDS
base network. You use the timeout times to specify whether your device employs preconfigured integration, express
integration, or a stepped combination of both.
As long as your device still has not received any AutoWDS settings from the WLC, the device uses the default settings
specified here. However, as soon as your device receives an AutoWDS profile from a WLC, that configuration has a higher
priority until the WLC revokes the configuration via CAPWAP or you reset the AP.
4
The parameters specified here exclusively effect the initial login of an unassociated slave AP to a master AP for
a subsequent search for a WLC. They do not affect the P2P links to a master AP that are set up later; your device
uses the WLC configuration it obtains then.
You can check whether the device has received an AutoWDS configuration from the WLC with the status table
AutoWDS-Profile (SNMP-ID 1.59.106).
SNMP ID:
2.59.4
Telnet path:
Setup > WLAN-Management
Active
Switches the AutoWDS function on your device on/off. In the disabled state, the device does not attempt to autonomously
integrate itself into a managed WLAN and also does not perform scans for an active AutoWDS network.
SNMP ID:
2.59.4.1
Telnet path:
Setup > WLAN-Management > AutoWDS
Possible values:
No
Yes
Default:
No
1327
Reference Manual
14 WLAN Management
Preconf-SSID
Enter the SSID of the AutoWDS base network here. Your device will search here for a preconfigured integration. AutoWDS
must be enabled and the
wait time until the preconfigured search
has to be set to higher than 0.
After the wait time expires, the device switches all physical WLAN interfaces to client mode and starts the search for the
SSID. If the device finds a matching SSID, it attempts to authenticate with the WPA2 passphrase entered for the
corresponding WLAN.
5
The process of preconfigured integration does not start if the settings for the AutoWDS base network (SSID,
passphrase) are incomplete or if the preconfiguration timer is set to 0.
SNMP ID:
2.59.4.2
Telnet path:
Setup > WLAN-Management > AutoWDS
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Preconf-Key
Specify the WPA2 passphrase that your device uses for authentication on the preconfigured AutoWDS base network.
5
The process of preconfigured integration does not start if the settings for the AutoWDS base network (SSID,
passphrase) are incomplete or if the preconfiguration timer is set to 0.
SNMP ID:
2.59.4.3
Telnet path:
Setup > WLAN-Management > AutoWDS
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Time-till-Preconf-Scan
Specify the wait time after which the AP switches to client mode and scans for an AutoWDS base network based on the
corresponding values in the preconfiguration (the SSID and passphrase that are stored locally). This assumes that there
are no configuration parts from a WLC available. If the AP finds a matching SSID, the device attempts to authenticate
with the respective WPA2 passphrase and then perform the configuration procedure.
Parallel to this process, the configured
wait time for the start of express integration
is counted down.
1328
Reference Manual
14 WLAN Management
5
The process of preconfigured integration does not start if the settings for the AutoWDS base network (SSID,
passphrase) are incomplete or if the preconfiguration timer is set to 0.
SNMP ID:
2.59.4.4
Telnet path:
Setup > WLAN-Management > AutoWDS
Possible values:
0 … 4294967295 Seconds
Special values:
0
This value disables the wait time and the preconfigured integration procedure. The device immediately
starts to count down the wait time for starting the express integration.
Default:
0
Time-till-Express-Scan
Specify the wait time after which the AP switches to client mode and scans for any AutoWDS base networks. This assumes
that there no configuration parts from a WLC available and the
wait time for the start of the preconfigured integration
(if set) has expired. If the AP finds a suitable SSID, the device attempts to authenticate at the WLAN in order to subsequently
perform the reconfiguration process. The device authenticates with an express pre-shared key, which is hard-coded in
the firmware.
SNMP ID:
2.59.4.5
Telnet path:
Setup > WLAN-Management > AutoWDS
Possible values:
0 … 4294967295 Seconds
Special values:
0
This value disables the wait time and the preconfigured integration procedure.
Default:
1
Configuration delay
This parameter specifies the delay time after which an AP executes the configuration update just rolled out by the WLC.
1329
Reference Manual
14 WLAN Management
The delay time is primarily relevant for APs, which you are integrating into your managed WLAN via a point-to-point link
(e.g. with AutoWDS). This reduces the probability of undelivered configuration updates leading only to a partial
configuration of your network, so making the other APs unreachable. The higher you set the delay time, the more likely
it is that all unassociated APs will receive the configuration update rolled out by the WLC.
A value of at least 1 second per (AutoWDS-) hop is recommended.
SNMP ID:
2.37.1.3.7
Telnet path:
Setup > WLAN-Management > AP-Configuration > Commonprofiles
Possible values:
0 … 4294967295 Seconds
Special values:
0
This value disables the delayed configuration update.
Default:
0
AutoWDS-Profile
This table contains the parameters for the AutoWDS profile which you assign to the individual access points by means
of the WLAN profile in order to implement meshed networks. The AutoWDS profile groups the settings and limits to form
the P2P topology and of the AutoWDS base network.
SNMP ID:
2.37.1.15
Telnet path:
Setup > WLAN-Management > AP-Configuration
Name
Name of the AutoWDS profile which you reference from other tables.
SNMP ID:
2.37.1.15.1
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
1330
Reference Manual
14 WLAN Management
Default:
empty
Commonprofile
Enter the name of the WLAN profile which the AutoWDS base network is assigned to. All APs operating with this WLAN
profile simultaneously deploy the corresponding AutoWDS base network.
SNMP ID:
2.37.1.15.2
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > Commonprofiles.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
SSID
Enter the name of the logical WLAN network (SSID) that a managed AP uses to deploy the AutoWDS base network. In
client mode, unassociated APs use the SSID entered here to receive a configuration from the WLC.
4
This SSID is reserved exclusively for AutoWDS. The AutoWDS base network cannot be used by other WLAN clients
such as smartphones, laptops, etc. These devices require their own SSID within your WLAN infrastructure.
SNMP ID:
2.37.1.15.3
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
AutoWDS-Rollout
Key
Enter the WPA2 passphrase for the AutoWDS base network supported by a managed AP. Select the most complex key
possible, with at least 8 and maximum 63 characters. The key requires at least 32 characters to provide encryption of
suitable strength.
1331
Reference Manual
14 WLAN Management
SNMP ID:
2.37.1.15.4
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
min. 8 characters; max. 63 characters from
[A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Enabled
Specify whether the AutoWDS is enabled or disabled for the selected profile. Inactive profiles are not transmitted by the
WLC to an AP.
SNMP ID:
2.37.1.15.6
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
No
Yes
Default:
No
Allow-Express-Integration
Here you specify whether the APs of the corresponding WLAN profile permit the express integration of unassociated APs
via the AutoWDS base network. If you enable this setting, the affected master APs send an additional vendor-specific
identifier in their beacons (assuming you have enabled 'SSID broadcast' in the AutoWDS profile) and probe responses
to signal the availability of this integration option to unassociated APs.
If you enable AutoWDS and prohibit express integration, the AutoWDS base network allows only the preconfigured
integration of unassociated or already associated APs in client mode.
SNMP ID:
2.37.1.15.7
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
1332
Reference Manual
14 WLAN Management
Possible values:
No
The AutoWDS base network allows only the preconfigured integration for unassociated clients.
Yes
The AutoWDS base network allows preconfigured integration as well as express integration of
unassociated APs.
Default:
No
Topology-Management
Enter which type of topology management the WLC uses for the respective AutoWDS profile.
Due to the assignment of the WLAN profile by the WLC, the slave APs simultaneously receive information about the
topology of the meshed network. The topology results directly from the hierarchy of the P2P connections established
between the APs. The two affected WLAN interfaces form a P2P pairing for this: The physical WLAN interface of the
unassociated AP becomes the P2P slave; that of the selected anchor AP becomes the P2P master.
By default, the WLC accepts the automatic calculation of the topology where one slave AP generally connects with the
nearest master AP. Calculated in real-time, the topology is recorded by the WLC in the status table
AutoWDS-Auto-Topology (SNMP-ID 1.73.2.13). If you use semi-automatic or manual management, you define the
static P2P links in the setup table AutoWDS-Topology. For this, you specify the relationships between the individual
master APs and slave APs in a manner similar to a normal P2P link.
4
The automatically generated topology entries are not boot-persistent. The table is emptied when the WLC is
restarted.
4
For manual topology configuration, it is important for a configured P2P master AP within the topology to be
closer to the WLC than a corresponding P2P slave AP. This is because a brief interruption to the P2P connection
will cause the slave AP to scan for the master AP.
SNMP ID:
2.37.1.15.8
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Automatic
The WLC automatically generates a P2P configuration. The device ignores manually specified P2P links.
semi-automatic
The WLC only generates a P2P configuration if no manual P2P configuration exists for the unassociated
AP. Otherwise the WLC uses the manual configuration.
Manual
The WLC does not automatically generate a P2P configuration. A manual P2P configuration is taken, if
available. Otherwise, the WLC does not transmit a P2P configuration to the AP.
1333
Reference Manual
14 WLAN Management
Default:
Automatic
Slave-Tx-Limit
Optionally, limit the maximum transmission bandwidth which applies to the P2P connections in the direction of transmission
from slave AP to master AP. The setting only affects P2P connections which the WLC has generated automatically.
SNMP ID:
2.37.1.15.10
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the bandwidth limit.
Default:
0
Master-Tx-Limit
Optionally, limit the maximum transmission bandwidth which applies to the P2P connections in the direction of transmission
from master AP to slave AP. The setting only affects P2P connections which the WLC has generated automatically.
SNMP ID:
2.37.1.15.11
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the bandwidth limit.
Default:
0
1334
Reference Manual
14 WLAN Management
Link-Loss-Timeout
Specify the time after which the AP tags the connection to its P2P partner as interrupted. The setting only affects P2P
connections which the WLC has generated automatically. If the device has marked a P2P link as interrupted, its physical
WLAN interface starts scanning the WLAN for the lost P2P partner.
4
The link-loss timeout is independent of the other timeouts. In the interests of stable connectivity of the overall
AutoWDS base network, we recommend that you do not use a value less than the default value.
SNMP ID:
2.37.1.15.12
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 4294967295 Seconds
Default:
4
Continuation
Define the continuation time of the automatically generated P2P configuration.
The continuation time refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to the WLC. If the AP
detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation time. Connections
to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails and the continuation
time expires, the AP discards this part of the WLC configuration. If the standalone continuation time is specified as 0,
the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
2.37.1.15.14
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 9999 Minutes
Special values:
0
The AP immediately switches off its physical WLAN interface(s) as soon as contact to the WLC is lost.
The device immediately deletes its configuration parameters so that the WLC must re-transmit them
when reestablishing the connecting.
Select this setting to protect the configuration parameters that are relevant for security from unauthorized
access and misuse (e.g., in case the AP is stolen).
1335
Reference Manual
14 WLAN Management
9999
The configuration parameters are permanently stored in the device. The AP continues to operate
regardless how long the contact to the WLC is lost.
Default:
0
Time-till-Preconf-Scan
Specify the wait time after which the AP switches to client mode and scans for an AutoWDS base network using the
values in the preconfiguration (the SSID and passphrase that are stored in the AutoWDS profile), if all continuation times
have expired. If the AP finds a matching SSID, the device attempts to authenticate with the respective WPA2 passphrase
in order to subsequently perform the reconfiguration process.
Parallel to this process, the configured
wait time for the start of express integration
is counted down.
5
The process of preconfigured integration does not start if the settings for the AutoWDS base network (SSID,
passphrase) are incomplete or if the preconfiguration timer is set to 0.
SNMP ID:
2.37.1.15.15
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 4294967295 Seconds
Special values:
0
This value disables preconfigured integration on the respective AP.
Default:
60
Time-till-Express-Scan
Specify the wait time after which the AP switches to client mode and scans for any AutoWDS base networks, if all
continuation times and also the
wait time for the start of the preconfigured integration
have expired (if set). If the AP
finds a suitable SSID, the device attempts to authenticate at the WLAN in order to subsequently perform the reconfiguration
process. The device authenticates with an express pre-shared key, which is hard-coded in the firmware.
SNMP ID:
2.37.1.15.16
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
0 … 4294967295 Seconds
1336
Reference Manual
14 WLAN Management
Special values:
0
This value disables express integration on the corresponding AP.
Default:
0
Interface-Pairing
Specify which type of interface pairings an anchor AP allows based on the AutoWDS profile assigned to it. The setting
is mainly relevant for devices with more than one physical WLAN interface.
The interface pairing influences the search by the AP for suitable anchor APs in client mode, taking the participating
WLAN interfaces into account. This specifies whether the unassociated AP has to connect to the equivalent physical
WLAN interface of the anchor AP to integrate (i.e. with WLAN-1 to WLAN-1 or with WLAN-2 to WLAN-2), or whether it
may pair with other physical interfaces. The definition of the interface pairing makes it possible to exclude invalid pairings,
which may occur due to the assignment of different frequency bands by the WLC configuration.
For instance, the anchor APs of your AutoWDS base network might be operating with the physical WLAN interfaces
WLAN-1 set to the 2.4GHz band and WLAN-2 on the 5GHz band: If, for example, an unassociated AP is using a physical
WLAN interface to search on both frequency bands, the interface pairing Strict prevents it from selecting WLAN-1 in
the 5 GHz band in order to connect with the WLAN-2 of the anchor AP. Although this connection would be legitimate
for the WLC configuration, the different radio settings would make it impossible to establish the P2P connection. The
unassociated AP would lose the connection and would have to start a reconfiguration process.
If, on the other hand, both physical WLAN interfaces transmit on the same band, the interface pairing Mixed is also
permissible, as the problematic configuration described above cannot occur.
5
If possible, ensure that all APs sharing a physical WLAN interface (WLAN-1, WLAN-2) consistently use the same
frequency band (2.4 GHz or 5 GHz). This excludes any potential problems during the automatic topology
configuration.
SNMP ID:
2.37.1.15.17
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Automatic
The WLC checks if a problematic configuration can occur. If no problematic configuration occurs, it
accepts the interface pairing via the anchor AP. Otherwise, the WLC rejects it and the unassociated AP
must connect again.
Strict
An unassociated AP may only connect its physical WLAN interface X to the equivalent WLAN interface
of the anchor AP.
Mixed
An unassociated AP may connect its physical WLAN interface X to any WLAN interface of the anchor
AP.
1337
Reference Manual
14 WLAN Management
Default:
Automatic
Slave-Radio-Multi-Hop
This parameter determines whether connection requests from unassociated APs can be accepted on the same physical
WLAN interface that the anchor APs in your AutoWDS base network are using as slaves to connect to the master.
4
Disabling this parameter can improve the stability and the load distribution within your AutoWDS base network.
As a result of this however, single-radio APs can no longer function as anchor APs for extending your AutoWDS
base network, and are the end of a hierarchy branch.
SNMP ID:
2.37.1.15.18
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
No
An anchor AP never accepts connection requests from unassociated APs on the same physical WLAN
interface that it is using to connect to the AutoWDS base network as a slave. WLAN multi-hops are only
possible on devices with two managed physical WLAN interfaces.
Yes
An anchor AP also accepts connection requests from unassociated APs on the same physical WLAN
interface that it is using to connect to the AutoWDS base network as a slave. WLAN multi-hops are
possible on devices with one or two managed physical WLAN interfaces.
Single-radio-AP-only
Case-specific setting:
The setting Yes applies to devices with one physical WLAN interface.
The setting No applies to devices with more than one physical WLAN interface.
Default:
No
Band
Specify the frequency band used by the APs for the AutoWDS base network.
SNMP ID:
2.37.1.15.19
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
1338
Reference Manual
14 WLAN Management
Possible values:
2.4GHz/5GHz
Both the 2.4-GHz and the 5-GHz bands are used for AutoWDS base network.
2.4GHz
Only the 2.4-GHz band is used for the AutoWDS base network.
5GHz
Only the 5-GHz band is used for the AutoWDS base network.
Default:
5GHz
Band
This parameter specifies whether or not the APs broadcast the SSID of the AutoWDS base network in their beacons.
SNMP ID:
2.37.1.15.20
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Profiles
Possible values:
Yes
The APs broadcast the SSID of the AutoWDS base network. The network is visible for other WLAN clients.
No
The APs hide the SSID of the AutoWDS base network. The network is invisible for other WLAN clients.
Default:
No
AutoWDS-Topology
In this table you specify the manual elements of the AutoWDS topology; or, more specifically, the P2P routes between
the individual slave APs and master APs. The device only processes this table if you activated manual or semi-automatic
topology management
.
SNMP ID:
2.37.1.16
Telnet path:
Setup > WLAN-Management > AP-Configuration
1339
Reference Manual
14 WLAN Management
AutoWDS-Topology
Name of the AutoWDS profile for which this manual P2P configuration applies.
SNMP ID:
2.37.1.16.1
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > AutoWDS-Profile.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Priority
Enter the priority of a P2P connection from the viewpoint of the physical WLAN interface of the slave AP.
5
This setting is currently a placeholder as the evaluation of the priorities has not been implemented yet. Please
always enter the value 0 for the priority.
SNMP ID:
2.37.1.16.2
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
0 … 4294967295
Default:
empty
Slave-AP-Name
Enter the name of the AP which takes on the role of the slave.
SNMP ID:
2.37.1.16.3
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > AutoWDS-Profile.
1340
Reference Manual
14 WLAN Management
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Slave-AP-WLAN-Ifc.
Here you set the physical WLAN interface used by the slave AP for the P2P link to the master AP.
SNMP ID:
2.37.1.16.4
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Selection from the available physical WLAN interfaces.
Default:
WLAN-1
Master-AP-Name
Enter the name of the AP which takes on the role of the master.
SNMP ID:
2.37.1.16.6
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > AutoWDS-Profile.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Master-AP-WLAN-Ifc.
Here you set the physical WLAN interface used by the master AP for the P2P link to the slave AP.
SNMP ID:
2.37.1.16.7
1341
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
Selection from the available physical WLAN interfaces.
Default:
WLAN-1
Key
You can also enter an individual WPA2 passphrase for the P2P connection. If you leave the field empty, the device
automatically generates a passphrase with a length of 32 characters.
SNMP ID:
2.37.1.16.9
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
min. 8 characters; max. 63 characters from
[A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Active
Specify whether the P2P configuration is enabled or disabled for the selected AutoWDS profile.
4
The WLC does not transmit disabled P2P configurations to the AP and ignores disabled entries when evaluating
the manual AutoWDS topology table in semi-automatic mode
SNMP ID:
2.37.1.16.10
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
No
Yes
Default:
No
1342
Reference Manual
14 WLAN Management
Slave-Tx-Limit
Optionally, limit the maximum transmission bandwidth which applies to the P2P connections in the direction of transmission
from slave AP to master AP. This setting only affects P2P connections that you created manually.
SNMP ID:
2.37.1.16.12
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the bandwidth limit.
Default:
0
Master-Tx-Limit
Optionally, limit the maximum transmission bandwidth which applies to the P2P connections in the direction of transmission
from master AP to slave AP. This setting only affects P2P connections that you created manually.
SNMP ID:
2.37.1.16.13
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
0 … 4294967295 kbps
Special values:
0
This value disables the bandwidth limit.
Default:
0
Link-Loss-Timeout
Specify the time after which the AP tags the connection to its P2P partner as interrupted. This setting only affects P2P
connections that you created manually. If the device has marked a P2P link as interrupted, its physical WLAN interface
starts scanning the WLAN for the lost P2P partner.
1343
Reference Manual
14 WLAN Management
4
The link-loss timeout is independent of the other timeouts. In the interests of stable connectivity of the overall
AutoWDS base network, we recommend that you set the timeout to 4 seconds as a minimum.
SNMP ID:
2.37.1.16.14
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
0 … 4294967295 Seconds
Special values:
0
For this value, the WLC retrieves the specified value for Link-Loss-Timeout from Setup >
WLAN-Management > AP-Configuration > AutoWDS-Profile.
Default:
0
Continuation
Define the continuation time of the manual P2P configuration.
The continuation time refers to the lifetime of any P2P link if the AP loses the CAPWAP connection to the WLC. If the AP
detects a loss of the CAPWAP connection, it attempts to reconnect within the specified continuation time. Connections
to P2P partners and associated WLAN clients remain intact during these times. If the recovery fails and the continuation
time expires, the AP discards this part of the WLC configuration. If the standalone continuation time is specified as 0,
the AP immediately discards this part of the configuration.
Next, the device uses the remaining configuration parts—the SSID of the AutoWDS base network, the related WPA2
passphrase, and the timeout periods for the preconfigured and express integrations—as a basis to count down the
preset time
until the start of the automatic (re-)configuration for the preconfigured integration.
SNMP ID:
2.37.1.16.16
Telnet path:
Setup > WLAN-Management > AP-Configuration > AutoWDS-Topology
Possible values:
0 … 9999 Minutes
Special values:
0
The AP immediately switches off its physical WLAN interface(s) as soon as contact to the WLC is lost.
The device immediately deletes its configuration parameters so that the WLC must re-transmit them
when reestablishing the connecting.
Select this setting to protect the configuration parameters that are relevant for security from unauthorized
access and misuse (e.g., in case the AP is stolen).
1344
Reference Manual
14 WLAN Management
9999
The configuration parameters are permanently stored in the device. The AP continues to operate
regardless how long the contact to the WLC is lost.
Default:
0
14.18.2 IP-dependent auto configuration and tagging of APs
The easiest way to manage all of the APs that you add to a managed network is to use a flat hierarchy. However, in the
largest installations with hundreds of APs across several locations, this type of organization quickly becomes confusing
and creates a high level of administrative effort. Setting up Assignment groups can help to simplify the management
of distributed APs. The WLC can automatically to configure each new AP based on the IP addresses it receives. Manual
assignment of an IP parameter profile, a WLAN profile and a Client-steering profile by an administrator is no longer
required.
The following describes how an assignment group is used when an unassociated AP registers with a central WLC: After
the new APs are installed on site (e.g. at a company or branch network), they try to establish a connection to the specified
WLC and obtain a configuration via CAPWAP. The WLC detects the connection requests and, for each new AP, it checks
the access point table for a suitable AP profile (e.g., the default profile) and/or whether a suitable assignment group has
been defined. If one or more configuration options are available, the WLC checks them for the following states:
1. For a new AP there is an assignment group but no AP profile. In this case, the WLC assigns the profile specified in
the assignment group to the new AP.
2. For a new AP there is both an assignment group as well as an AP profile. In this case, the WLC ignores the assignment
group and assigns the profile defined in the AP profile to the new AP.
3. For a new AP, there is an AP profile but no assignment group. The behavior is the same as point (2).
If a new AP has neither an AP profile nor an assignment group, the WLC issues an alarm to notify the administrator of
the incorrect configuration.
After successful group assignment, the WLC automatically creates an AP profile for every new AP in the access point
table. In the Groups field, the WLC references the assignment group used when it added the new AP.
5
An AP is only ever allowed to receive one assignment group. If the IP address ranges of the assignment groups
should overlap, LCOS immediately detects the configuration error and writes the messages to the corresponding
status table under Status > WLAN-Management > AP-Configuration.
The group field also gives you the the option of assigning individually definable tags to an AP. For example, these Tag
groups can be used to act as filter criteria in order for the WLC to restrict the actions it performs to a selection of APs.
Setting up assignment groups for IP-dependent auto configuration
The following tutorial shows you how you setup assignment groups on a WLC for the IP-dependent automatic configuration
of new APs.
1. Open the configuration dialog for your device and select WLAN controller > AP configuration > Assignment
groups
1345
Reference Manual
14 WLAN Management
2. Click on Add to create a new group.
3. Enter under Name a unique descriptor for the assignment group, for example, Berlin_branch.
4. Select the WLAN profile that the WLC automatically assigns to a new AP if the IP address of the new AP is within
the source IP range.
5. Enter the IP parameter profile if the new AP should receive a manual network configuration. Otherwise, leave the
value as DHCP, whereby the AP automatically gets a network configuration from the DHCP server. The DHCP server
must be configured to do this.
If you wish to assign a manual network configuration in which a new AP receives a different IP address, you specify
the corresponding address range in the IP parameter profile under Address assignment pool.
6. Optional: Specify a Client-steering profile in order to forward future WLAN clients to the ideal AP in case there
are several new APs within transmission range.
5
If you activate client steering, this must be activated for every AP in the managed infrastructure. Refer to
section
Client steering by WLC
on page 1387 for further information on this.
7. Enter the start and end of the Source IP range relevant to the assignment group.
A new AP must register at the WLC with an IP address from this range in order to obtain the configuration for this
group.
8. Close all dialog windows with OK and save the configuration to your device.
From now on, the WLC assigns the profiles referenced in the assignment groups to all new APs. The LCOS console can
now provide you with information about the categorization, see
Overview of CAPWAP parameters with the show command
on page 1358.
5
Please ensure that the access point table does not contain an AP profile (e.g., the default profile), which the
WLC would assign to the unassociated APs. If an appropriate AP profile is available, this always takes higher
priority than the assignment groups.
Setting up tag groups for the detailed selection of APs
The following tutorial shows you how a tag group can be added to an AP configuration on a WLC. To do this, you first
create a tag group and then assign it to a WLAN profile.
1. Open the configuration dialog for your device and select WLAN controller > AP configuration > Tag groups
2. Click on Add to create a new group.
3. Under Name you enter the new tag and save the entry with OK.
4. Navigate to the dialog with WLAN controller > AP configuration > Access point table.
5. Select an existing access point profile with Edit or add a new one, if necessary.
1346
Reference Manual
14 WLAN Management
6. Under Groups select the tag group(s) created earlier.
Multiple tag groups can be specified in a comma-separated list.
4
The tag groups are independent of the assignment groups, the assignment of which is specified in the same
field. Assignment groups are generally assigned by the device, so this does not need to be done by the user.
The manual allocation of an assignment group has no effect on the AP configuration, which is in line with
the state check described under
IP-dependent auto configuration and tagging of APs
on page 1345. The only
effects are on the filtering in the command show capwap group at the console
5
The manual addition of assignment group for filtering purposes is not recommended. You should create
separate tag groups instead.
7. Close all dialog windows with OK and save the configuration to your device.
From now on the WLC gives the tags in the edited WLAN profile to those APs that received it.
Additions to the Status menu
Netw.-Prof.-Errors
This table contains the error messages that occurred when assigning the network profiles.
SNMP ID:
1.73.2.5
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.5.1
Telnet path:
Status > WLAN-Management > AP-Configuration > Netw.-Prof.-Errors
Name
Name of the network profile.
SNMP ID:
1.73.2.5.2
Telnet path:
Status > WLAN-Management > AP-Configuration > Netw.-Prof.-Errors
1347
Reference Manual
14 WLAN Management
Error
Content of the error message.
SNMP ID:
1.73.2.20.3
Telnet path:
Status > WLAN-Management > AP-Configuration > Netw.-Prof.-Errors
AP-Conf.-Errors
This table contains messages about any configuration errors that occurred in the access point table under Setup >
WLAN-Management > AP-Configuration > Access-Points.
SNMP ID:
1.73.2.8
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.8.1
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
Name
Name of the AP with the error.
SNMP ID:
1.73.2.8.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
Error
Content of the error message.
1348
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.8.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
Profile
Name of the WLAN profile where the error occurred.
SNMP ID:
1.73.2.8.4
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
MAC address
MAC address of the AP.
SNMP ID:
1.73.2.8.5
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
Group
Name of the assignment group where the error occurred.
SNMP ID:
1.73.2.8.6
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Conf.-Errors
AP-Intranet-Errors
This table contains the error messages that occurred when assigning the IP parameter profiles.
SNMP ID:
1.73.2.10
1349
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.10
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Intranet-Errors
Name
Name of the IP parameter profile.
SNMP ID:
1.73.2.10.2
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Intranet-Errors
Error
Content of the error message.
SNMP ID:
1.73.2.10.3
Telnet path:
Status > WLAN-Management > AP-Configuration > AP-Intranet-Errors
Config-Assignment-Groups
This table shows the assignment groups that the WLC has transmitted to the individual access points.
SNMP ID:
1.73.2.19
Telnet path:
Status > WLAN-Management > AP-Configuration
1350
Reference Manual
14 WLAN Management
Name
Name of the assignment group.
SNMP ID:
1.73.2.19.1
Telnet path:
Status > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Profile
Name of the WLAN profile that the WLC automatically assigned to an unassociated AP via the assignment group.
SNMP ID:
1.73.2.19.2
Telnet path:
Status > WLAN-Management > AP-Configuration > Config-Assignment-Groups
AP-Intranet
Name of the IP parameter profile that the WLC automatically assigned to an unassociated AP via the assignment group.
SNMP ID:
1.73.2.19.3
Telnet path:
Status > WLAN-Management > AP-Configuration > Config-Assignment-Groups
IPv4-Reference-Pool-Start
Start of the IPv4 address range for the corresponding assignment group. A new AP must register at the WLC with an IP
address from this range in order to obtain the configuration for this group.
SNMP ID:
1.73.2.19.4
Telnet path:
Status > WLAN-Management > AP-Configuration > Config-Assignment-Groups
IPv4-Reference-Pool-End
End of the IPv4 address range for the corresponding assignment group. A new AP must register at the WLC with an IP
address from this range in order to obtain the configuration for this group.
1351
Reference Manual
14 WLAN Management
SNMP ID:
1.73.2.19.5
Telnet path:
Status > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Groups-Config-Errors
This table contains messages about any configuration errors that occurred within the assignment groups specified under
Setup > WLAN-Management > AP Configuration > Config-Assignment-Groups.
SNMP ID:
1.73.2.20
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Index number for table entries.
SNMP ID:
1.73.2.20.1
Telnet path:
Status > WLAN-Management > AP-Configuration > Groups-Config-Errors
Group
Name of the assignment group.
SNMP ID:
1.73.2.20.2
Telnet path:
Status > WLAN-Management > AP-Configuration > Groups-Config-Errors
Error
Content of the error message.
SNMP ID:
1.73.2.20.3
1352
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > AP-Configuration > Groups-Config-Errors
Tag groups
This table shows the tag groups that the WLC has transmitted to the individual access points.
SNMP ID:
1.73.2.21
Telnet path:
Status > WLAN-Management > AP-Configuration
Name
Name of the tag group.
SNMP ID:
1.73.2.21.1
Telnet path:
Status > WLAN-Management > AP-Configuration > Tag-Groups
Additions to the Setup menu
Groups
Using this parameter, you optionally assign the corresponding AP profile to one or more tag groups. If you edit an AP
profile, this parameter may additionally contain those assignment groups assigned by the WLC to the corresponding AP
during the IP-dependent auto-configuration. For more information, see the Reference Manual.
4
The tag groups are independent of the assignment groups that are specified in the same field. Assignment groups
are generally assigned by the device, so this does not need to be done by the user. Manually assigning an
assignment group has no effect on the AP configuration. The only effects are on the filtering in the command
show capwap group at the console.
5
The manual addition of assignment groups for filtering purposes is not recommended. You should create separate
tag groups instead.
SNMP ID:
2.37.1.4.24
Telnet path:
Setup > WLAN-Management > AP-Configuration > Base stations
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups. Multiple
entries can be provided in a comma-separated list.
1353
Reference Manual
14 WLAN Management
Name from Setup > WLAN-Management > AP-Configuration > Tag-Groups. Multiple entries can be
provided in a comma-separated list.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
IPv4-Config-Pool-Start
The start of the IPv4 address range from which a new AP receives an IP address if the WLC can allocate an assignment
group to the AP and you have not defined a specific IP address for the AP in the access-point table.
SNMP ID:
2.37.1.9.9
Telnet path:
Setup > WLAN-Management > AP-Configuration > AP-Intranets
Possible values:
0.0.0.0 … 255,255,255,255
Default:
empty
IPv4-Config-Pool-End
The end of the IPv4 address range from which a new AP receives an IP address if the WLC can allocate an assignment
group to the AP and you have not defined a specific IP address for the AP in the access-point table.
SNMP ID:
2.37.1.9.10
Telnet path:
Setup > WLAN-Management > AP-Configuration > AP-Intranets
Possible values:
0.0.0.0 … 255,255,255,255
Default:
empty
Config-Assignment-Groups
This table contains the assignment groups. Based on these, the WLC automatically assigns the network configuration,
a WLAN profile and a client-steering profile to the unassociated APs. For this purpose, you specify an IP address range
for each individual assignment group. For example, in a centrally managed WLAN you can use IP address ranges to
automatically assign a location-specific configuration to unassociated APs (e.g., Branch A, Branch B, etc.).
1354
Reference Manual
14 WLAN Management
5
An AP is only ever allowed to receive one assignment group. If the IP address ranges of the assignment groups
should overlap, LCOS immediately detects the configuration error and writes the messages to the corresponding
status table under Status > WLAN-Management > AP-Configuration.
5
Please ensure that the access point table does not contain an AP profile (e.g., the default profile), which the
WLC would assign to the unassociated APs. If an appropriate AP profile is available, this always takes higher
priority than the assignment groups.
SNMP ID:
2.37.1.18
Telnet path:
Setup > WLAN-Management > AP-Configuration
Name
Name of the assignment group which you reference from other tables.
SNMP ID:
2.37.1.18.1
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Profile
Name of the WLAN profile that the WLC automatically assigns to an unassociated AP via the assignment group.
SNMP ID:
2.37.1.18.2
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > Commonprofiles.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
1355
Reference Manual
14 WLAN Management
AP-Intranet
Name of the IP parameter profile that the WLC automatically assigns to an unassociated AP via the assignment group.
SNMP ID:
2.37.1.18.3
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
Name from Setup > WLAN-Management > AP-Configuration > AP-Intranets.
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Special values:
DHCP
The AP retrieves its network configuration via DHCP.
Default:
empty
IPv4-Reference-Pool-Start
Start of the IPv4 address range for the corresponding assignment group. A new AP must register at the WLC with an IP
address from this range in order to obtain the configuration for this group.
SNMP ID:
2.37.1.18.4
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
0.0.0.0 … 255,255,255,255
Default:
empty
IPv4-Reference-Pool-End
End of the IPv4 address range for the corresponding assignment group. A new AP must register at the WLC with an IP
address from this range in order to obtain the configuration for this group.
SNMP ID:
2.37.1.18.5
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
1356
Reference Manual
14 WLAN Management
Possible values:
0.0.0.0 … 255,255,255,255
Default:
empty
Client-Steering-Profile
Client-steering profiles control how the WLC decides which APs are to accept a client at the next login attempt.
SNMP ID:
2.37.1.18.6
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
Name from Setup > WLAN-Management > Client-Steering > Profiles
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Tag groups
This table contains the tag groups that the WLC automatically assigns to the APs belonging to a WLAN profile. Among
other things, tag groups allow actions performed on the WLC to be restricted to a selection of APs.
SNMP ID:
2.37.1.20
Telnet path:
Setup > WLAN-Management > AP-Configuration
Name
You use this parameter to specify the name of the tag being created.
SNMP ID:
2.37.1.20.1
Telnet path:
Setup > WLAN-Management > AP-Configuration > Tag-Groups
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'() +-,/:;<=>?[\]^_.
1357
Reference Manual
14 WLAN Management
Default:
empty
Enhancements to command-line commands
Overview of CAPWAP parameters with the show command
The following information about the CAPWAP service can be viewed using the command line:
Table 13: Overview of all CAPWAP parameters with the show command
MeaningParameters
Shows the address tables of an individual or all WLC tunnels. In the case of an
individual WLC tunnel, enter for the <IfcNum> the number of logical WLC
tunnel interface, for example 10.
-addresses [<IfcNum>]
Shows the information for an individual or all available assignment/tag groups.
-groups
You can supplement the command show capwap groups with the parameters listed below, which control the
scope of the displayed information:
Table 14: Overview of all CAPWAP group parameters with the show command
MeaningParameters
Shows the names configured in the setup menu and the device's internal names
for all assignment/tag groups as well as the default groups that were set up. The
default group represents an internal group which contains all APs.
all
Shows all APs of the respective assignment/tag groups.
<group1> <group2> <…>
Shows all APs of the respective location.
-l <location>
Shows all APs of the respective country.
-c <country>
Shows all APs of the respective city.
-i <city>
Shows all APs of the respective street.
-s <street>
Shows all APs of the respective building.
-b <building>
Shows all APs of the respective floor.
-f <floor>
Shows all APs of the respective room description.
-r <room>
Shows all APs that have the specified device name.
-d <device>
Shows all APs which have the specified antenna number.
-a <antenna>
Shows all APs which have the specified firmware. To do this, enter the version
number for <firmware> followed by the build number, e.g., 9.00.0001.
-v <firmware>
Shows all APs with a firmware version lower than the one installed on the current
device.
-x <firmware>
Shows all APs with a firmware version the same or lower than the one installed on
the current device.
-y <firmware>
Shows all APs with a firmware version higher than the one installed on the current
device.
-z <firmware>
Shows all APs with a firmware version the same or higher than the one installed
on the current device.
-t <firmware>
1358
Reference Manual
14 WLAN Management
MeaningParameters
Shows all APs with an IP belonging to the specified Intranet address.
-n <intranet>
Shows all APs that have been assigned with the specified WLAN profile.
-p <profile>
Deletes the group(s) with the specified internal names from the memory of the
device. Use this command to free up the main memory if too large a number of
rmgrp <group1 intern_name>
<group2 intern_name> …
groups is degrading the performance of the device. The entry in the setup menu is
unaffected by this action.
Deletes all groups except the default group.
resetgrps
For location information the device evaluates the information entered under Location in the access point table. The
following field names are available:
1
co=Country
1
ci=City
1
st=Street
1
bu=Building
1
fl=Floor
1
ro=Room
For instance, the location entry co=Germany, ci=Aachen allows you to list all of the managed APs in Aachen
from the console of the WLC with the command +show capwap group -i Aachen.
Example commands
show capwap group all
show capwap group group1
show capwap group -l yourlocation
show capwap group -s yourstreetname
show capwap group -d yourdevicename
show capwap group -p yourprofilename
show capwap group -d yourdevicename -p yourprofile -v yourfirmversion …
14.18.3 Automatic selection of the 2.4-/5-GHz mode
As of LCOS 9.00, the configuration of the WLAN physical parameters on WLCs and also on APs now includes the option
of allowing the AP to select a suitable 2.4-/5-GHz mode.
1
2.4-GHz mode / 5-GHz mode
Here you specify the wireless standard(s) that the physical WLAN interface provides to the WLAN clients.
In the 2.4-GHz and the 5-GHz frequency bands, there are several different wireless standards that an AP can use for
transmission. In the 2.5-GHz frequency band, these were to date the standards IEEE 802.11b, IEEE 802.11g and
IEEE 802.11n; in the 5-GHz frequency band, the standards are IEEE 802.11a, IEEE 802.11n and IEEE 802.11ac.
Depending on the device type and selected frequency band, you have the option of operating an AP in just one
particular mode or one of the compatibility modes.
5
Please observe that WLAN clients supporting only a slower standard may not be able to associate with the
WLAN if the value for the mode is set too high. However, compatibility is always achieved at the expense of
performance. It is therefore recommended to allow only those modes of operation that are absolutely necessary
for the wireless LAN clients in use.
For example, if there are only 802.11n-enabled devices in your WLAN, it is recommended to select greenfield mode
(802.11n only): By doing this you prevent login of slower clients which would otherwise act as a brake on the
network.
By selecting a compatibility mode, you are able to achieve the best possible data rates without excluding slower
WLAN clients (e.g., for 2.4 GHz 802.11g/b/n (mixed); for 5 GHz 802.11a/n (mixed)). In compatibility mode, a
1359
Reference Manual
14 WLAN Management
physical WLAN interface works according to the fastest standard, but reverts to a slower standard if a slower WLAN
client logs on to the network. When using 802.11b, you can select whether the physical WLAN interface should
exclusively support 11-Mbps mode or also the older 2-Mbps mode (... (2-Mbps-compatible)).
For APs operating according to the 802.11g standard you can optionally increase the data transfer speeds up to
108Mbps. In what is referred to as Turbo mode, an AP simultaneously uses two neighboring free channels for the
radio transmission. With an AP in the 108Mbps Turbo mode, the only WLAN clients that can establish a connection
to this AP are those also operating with the 108Mbpss Turbo mode.
4
Turbo mode is associated with the 802.11g standard, although it was never officially adopted by the IEEE.
The technology represents the proprietary extensions of various chipset manufacturers who also market this
technology under the name “802.11g+” or “802.11g++”. Turbo mode is therefore exclusively available on
APs with pure 802.11g hardware.
If you leave the selection of the 2.5/5-GHz mode up to the device with the Automatic setting, the selection of the
best mode depends on the frequency band in use and the capabilities of the device hardware:
2
In the 2.4-GHz mode, the automatic setting results in either 802.11g/b/n (mixed) or 802.11 g/b (mixed).
2
In the 5-GHz mode, the automatic setting results in either 802.11ac/a/n (mixed), 802.11 a/n (mixed), or
54Mbps mode.
In principle, according to 802.11n APs in the 2.4-GHz frequency band are backwards compatible to the IEEE 802.11b
and IEEE 802.11g standards. Only the 802.11n-specific functions are not available for 802.11n hardware operated
in 802.11b or 802.11g mode. However, this backwards compatibility is not available in the 5-GHz frequency band:
The affected 802.11n devices must explicitly support 802.11a.
Additions to the Status menu
2.4-GHz mode
This status value indicates the 2.4-GHz mode being operated by the WLAN module of the managed APs.
SNMP ID:
1.73.2.2.6
Telnet path:
Status > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
11bg mixed
802.11g/b (mixed)
11b only
802.11b only (11Mbps)
11g only
802.11g only (54Mbps)
108Mbps
802.11g++ (108Mbps mode / turbo mode)
11bgn mixed
802.11g/b/n
11gn mixed
802.11g/n
Greenfield
802.11n only (greenfield mode)
1360
Reference Manual
14 WLAN Management
Auto
Automatic
5GHz mode
This status value indicates the 5-GHz mode being operated by the WLAN module of the managed APs.
SNMP ID:
1.73.2.2.7
Telnet path:
Status > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
Normal
802.11 g (54Mbps mode)
108Mbps
802.11g++ (108Mbps mode / turbo mode)
11an mixed
802.11a/n (mixed)
Greenfield
802.11n only (greenfield mode)
11anac mixed
802.11a/n/ac (mixed)
11nac mixed
802.11n/ac (mixed)
11ac only
802.11ac only
Auto
Automatic
Additions to the Setup menu
2.4-GHz mode
Here you specify the radio standard(s) that the physical WLAN interface provides to the WLAN clients in the 2.4-GHz
frequency band. Depending on the device type and frequency band, you have the choice of operating an AP exclusively
in one specific mode, or you can set one of the compatibility modes.
5
Please observe that clients supporting only a slower standard may not be able to associate with the WLAN if the
value for the mode is set too high. However, compatibility is always achieved at the expense of performance. It
is therefore recommended to allow only those modes of operation that are absolutely necessary for the wireless
LAN clients in use.
SNMP ID:
2.37.1.2.6
1361
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
11bg mixed
802.11g/b (mixed)
11b only
802.11b only (11Mbps)
11g only
802.11g only (54Mbps)
108Mbps
802.11g++ (108Mbps mode / turbo mode)
11bgn mixed
802.11g/b/n
11gn mixed
802.11g/n
Greenfield
802.11n only (greenfield mode)
Auto
Automatic. In the 2.4-GHz mode, automatic selection provides either 11bgn-mixed or 11bg-mixed.
Default:
Auto
5GHz mode
Here you specify the radio standard(s) that the physical WLAN interface provides to the WLAN clients in the 5-GHz
frequency band. Depending on the device type and frequency band, you have the choice of operating an AP exclusively
in one specific mode, or you can set one of the compatibility modes.
5
Please observe that clients supporting only a slower standard may not be able to associate with the WLAN if the
value for the mode is set too high. However, compatibility is always achieved at the expense of performance. It
is therefore recommended to allow only those modes of operation that are absolutely necessary for the wireless
LAN clients in use.
SNMP ID:
2.37.1.2.7
Telnet path:
Setup > WLAN-Management > AP-Configuration > Radioprofiles
Possible values:
Normal
802.11 g (54Mbps mode)
108Mbps
802.11g++ (108Mbps mode / turbo mode)
1362
Reference Manual
14 WLAN Management
11an mixed
802.11a/n (mixed)
Greenfield
802.11n only (greenfield mode)
11anac mixed
802.11a/n/ac (mixed)
11nac mixed
802.11n/ac (mixed)
11ac only
802.11ac only
Auto
Automatic. In the 5-GHz mode, automatic selection provides either 11anac-mixed, 11an-mixed, or
Normal.
Default:
Auto
14.18.4 WLC cluster
If you are operating multiple WLCs in your network, you can collect these devices into a cluster. The APs in a managed
WLAN are no longer managed by a single, central WLC but by multiple, synchronized WLCs. For large networks in
particular, a WLC cluster provides numerous advantages:
1
Automatic network “load balancing” between the individual APs and WLCs;
1
Increased failover reliability through the provision of backup WLCs (“hot standby”) and automatic redistribution of
the APs in the case of a WLC failure;
1
Setting up a certificate hierarchy: Management of certificates by a central certification authority (CA), represented
either by a master WLC or an external station (such as a server).
As of LCOS 9.00, the cluster function received numerous enhancements described below.
WLC tunnel for internal communication
The use of WLC tunnels is essential for a WLC cluster. The WLCs in the WLC cluster use this tunnel to communicate with
one another and keep their status information aligned. With the feature extensions as of LCOS 9.00, the way that LCOS
deals with WLC tunnels is also improved:
1
WLCs are able to find one another automatically.
1
You have the option to statically configure WLC tunnels.
1
WLCs disconnect a WLC tunnel only after a timeout.
1
WLC tunnels can be switched on or off globally.
The settings for the WLC tunnels and other WLCs (remote WLCs) are located in the section WLAN controller > General >
WLC cluster. The setting WLC tunnel active allows you to disable the usage of WLC tunnels, which in effect causes
the clustering feature to be switched off.
Additions to the Setup menu
WLC cluster
This menu contains the settings for the data connections and status connections between multiple WLCs (WLC cluster).
1363
Reference Manual
14 WLAN Management
SNMP ID:
2.37.34
Telnet path:
Setup > WLAN-Management
WLC-Tunnel-active
Using this parameter, you can enable or disable the WLC tunnel used for WLC clustering. This indirectly switches the
cluster functionality for the corresponding WLC on or off.
SNMP ID:
2.37.34.6
Telnet path:
Setup > WLAN-Management > WLC-Cluster
Possible values:
No
WLC cluster tunnels on the device are disabled.
Yes
WLC cluster tunnels on the device are enabled.
Default:
No
WLC-Discovery
This table is used for each of your IPv4 networks to enable or disable the automatic search for WLCs in the same local
network.
4
Enter the addresses of WLCs that are not on the local network (remote WLCs) into the static WLC list (SNMP ID
2.37.34.3
). The automatic search does not find remote WLCs.
SNMP ID:
2.37.34.4
Telnet path:
Setup > WLAN-Management > WLC-Cluster
Network
Specify the name of the IPv4 network, in which the WLC automatically searches for remote WLCs.
1364
Reference Manual
14 WLAN Management
SNMP ID:
2.37.34.4.1
Telnet path:
Setup > WLAN-Management > WLC-Cluster > WLC-Discovery
Possible values:
Network name from Setup > TCP-IP > Network-list
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Enabled
Using this option, you can enable or disable the automatic search for remote WLCs in the selected network.
The automatic search for remote WLCs is one way of establishing the connection between several WLCs. If you disable
this option, the WLC cannot automatically connect to another WLC over the corresponding network, even if the use of
WLC tunnels in general has been enabled. An alternative is to specify the remote sites in the static WLC list.
SNMP ID:
2.37.34.4.2
Telnet path:
Setup > WLAN-Management > WLC-Cluster > WLC-Discovery
Possible values:
Yes
No
Default:
No
Port
Specify the port used for the automatic search for remote WLCs.
SNMP ID:
2.37.34.4.3
Telnet path:
Setup > WLAN-Management > WLC-Cluster > WLC-Discovery
Possible values:
0 … 65535
1365
Reference Manual
14 WLAN Management
Special values:
0
The device uses default port 1027.
Default:
0
WLC-Data-Tunnel-active
This option activates or disables the use of data tunnels (L3 tunnels) between multiple WLCs. This allows you to extend
a transparent layer-2 network as an overlay network across the remote WLCs.
5
Be sure never to bridge the corresponding WLC tunnels if the individual WLCs are located in the same broadcast
domain. Otherwise you will create a switching loop that will overload your network.
4
In order to maximize data throughput and the network performance, you can forward the AP data traffic directly
into the LAN. In this case there is no need for a layer-3 tunnel between the WLCs even when they are in different
layer-2 networks.
SNMP ID:
2.37.34.2
Telnet path:
Setup > WLAN-Management > WLC-Cluster
Possible values:
Yes
The WLC connects to remote WLCs via a layer-3 tunnel.
No
The WLC does not connect to remote WLCs via a layer-3 tunnel.
Default:
No
Static WLC list
In this table, you define the static IPv4 addresses of the remote WLCs which your WLC connects to. As an alternative,
this table can also be used to bypass the search of the local network as performed by the WLC Discovery table.
If you connect to a remote WLC at a static IPv4 address, your WLC initially establishes a control tunnel to this remote
site. If you have enabled the data tunnel option, your WLC automatically establishes a data tunnel to this remote site.
5
The WLCs can only interconnect if they have a certificate from the same certificate hierarchy.
SNMP ID:
2.37.34.3
1366
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management > WLC-Cluster
IP address
Here you specify the IPv4 address of the remote WLC to which your WLC establishes a connection.
SNMP ID:
2.37.34.3.1
Telnet path:
Setup > WLAN-Management > WLC-Cluster > Static-WLC-List
Possible values:
0.0.0.0 … 255,255,255,255
Default:
empty
Loopback-Addr.
Here you can optionally specify another address (name or IP) used by your device to identify itself to the remote WLC as
the sender.
By default, your device sends its IP address from the corresponding ARF context, without you having to enter it here. By
entering an optional loopback address you change the source address and route that your device uses to contact the
remote site. This can be useful, for example, if your device is available over different paths and the remote site should
use a specific path for its reply message.
5
If the sender address set here is a loopback address, then even for masked remote stations, this address will be
used unmasked !
SNMP ID:
2.37.34.3.2
Telnet path:
Setup > WLAN-Management > WLC-Cluster > Static-WLC-List
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Special values:
Name of the IP network (ARF network), whose address should be used.
INT for the address of the first Intranet
DMZ for the address of the first DMZ
5
If the lists of IP networks or loopback addresses contains an interface named 'DMZ', then the
device selects the associated IP address instead!
1367
Reference Manual
14 WLAN Management
LB0…LBF for one of the 16 loopback addresses or its name
Any IPv4 address
Default:
empty
Port
Specify the port used by your WLC to establish a data tunnel to the remote WLC.
SNMP ID:
2.37.34.3.3
Telnet path:
Setup > WLAN-Management > WLC-Cluster > Static-WLC-List
Possible values:
0 … 65535
Special values:
0
The device uses default port 1027.
Default:
0
Setting up a CA hierarchy
In order to operate multiple WLAN controllers in a WLC cluster, they must all have identical configurations. This also
includes the certificates used within the WLC cluster. The solution lies in establishing a certificate hierarchy, also known
as a CA hierarchy: This involves defining the CA of a WLC as the root-CA. The other WLCs retrieve this certificate for their
(sub-) CA.
The following scenario shows you the configuration steps which are necessary for setting up a CA hierarchy. As examples,
the configuration is done using two WLCs:
1
WLC-MAIN represents the device with the root-CA;
1
WLC-SUB is the device which obtains a certificate from the root-CA in order to issue further certificates as a sub-CA.
Configuring the root-CA
The following section describes how to set up a root CA on a WLC. These steps assume that the device has been reset,
that you have commissioned the device in the standard manner, and that you have set the correct time.
1. Login to your device via WEBconfig or the command line.
2. Navigate to the menu Setup > Certificates > SCEP-CA > CA-Certificates. Customize the name of the certificate
authority (CA) and the registration authority (RA) with the parameters CA-Distinguished-Name and
RA-Distinguished-Name.
Example: /CN=WLC-MAIN CA/O=LANCOM SYSTEMS/C=DE
3. Navigate to the menu Setup > Certificates > SCEP-CA and set the parameter Operating to Yes.
You have now completed the configuration of the root CA. The command show ca cert on the command line
allows you to verify that the WLC has created the certificate correctly.
1368
Reference Manual
14 WLAN Management
Configuring the sub-CA
The following section describes how to set up a sub-CA on a WLC. These steps assume that the device has been reset,
that you have commissioned the device in the standard manner, and that you have set the correct time.
1. Login to your device via WEBconfig or the command line.
2. Navigate to the menu Setup > Certificates > SCEP-CA and set the parameter Root-CA to No.
3. Navigate to the menu Setup > Certificates > SCEP-CA > CA-Certificates. Customize the name of the certificate
authority (CA) and the registration authority (RA) with the parameters CA-Distinguished-Name and
RA-Distinguished-Name.
Example: /CN=WLC-SUB CA/O=LANCOM SYSTEMS/C=DE
4. Switch to the menu Setup > Certificates > SCEP-CA > Sub-CA and enter the distinguished name of the root-CA
under the parameter CADN.
Example: /CN=WLC-MAIN CA/O=LANCOM SYSTEMS/C=DE
5. For the parameter Challenge-Pwd , enter the challenge password that is stored on WLC-MAIN under Setup >
Certificates > SCEP-CA.
6. Enter the URL (address) to the root CA in the CA-Url-address parameter.
If another WLC with the LCOS operating system provides the root CA, all you need to do is replace the IP address in
the default value with the address where the corresponding device is to be reached. Example:
http://192.168.1.1/cgi-bin/pkiclient.exe.
7. Optional: Specify the Ext-Key-Usage and Cert-Key Usage to restrict the functions of the sub-CA. For more
information, see the Menu Reference Guide.
8. Set the parameter Auto-generated-request to Yes to activate the sub-CA.
9. Navigate to the menu Setup > Certificates > SCEP-CA and set the parameter Operating to Yes to enable the CA
server with SCEP.
You have now completed the configuration of the sub-CA. The command show ca cert on the command line
allows you to verify that the WLC has created the certificate correctly. The hierarchy of certificates must be visible here:
The WLC first displays the certificate of the root CA and then the certificate of the sub-CA.
Additions to the Setup menu
Root CA
This parameter specifies whether or not the CA of the relevant WLC represents the root CA.
SNMP ID:
2.39.2.11
Telnet path:
Setup > Certificates > SCEP-CA
Possible values:
No
Yes
Default:
Yes
1369
Reference Manual
14 WLAN Management
CA-Path-Length
Use this parameter to specify the maximum permitted length of the hierarchy of sub-CAs below the root CA (length of
the “Chain of Trust”).
A value of 1 means that only the root CA can issue certificates for sub-CAs. Sub-CAs themselves cannot issue certificates
to other sub-CAs and so extend the “Chain of Trust” . When set to 0, not even the root CA is capable of issuing certificates
for sub-CAs. In this case, the root CA can only sign end-user certificates.
SNMP ID:
2.39.2.12
Telnet path:
Setup > Certificates > SCEP-CA
Possible values:
0 … 65535
Default:
1
Sub-CA
This menu contains all of the settings you need for retrieving a certificate for the sub-CA.
SNMP ID:
2.39.2.13
Telnet path:
Setup > Certificates > SCEP-CA
Auto-generated-request
With this parameter you specify whether the WLC forwards the request for a certificate for the sub-CA automatically to
the root CA.
SNMP ID:
2.39.2.13.1
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
1370
Reference Manual
14 WLAN Management
Possible values:
No
Yes
Default:
No
CADN
Enter the certificate authority distinguished name (CADN) of the parent CA (e.g. the root CA) where the WLC obtains the
certificate for the sub-CA.
SNMP ID:
2.39.2.13.2
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible values:
Max. 100 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
Challenge-Pwd
Set the challenge password used by the sub-CA to obtain the certificate from the parent CA (e.g., the root CA). You set
the challenge password for the parent CA in LCOS in the menu Setup > Certificates > SCEP-CA > Client-Certificates.
SNMP ID:
2.39.2.13.3
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible values:
Max. 100 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
Ext-Key-Usage
With this item you specify additional designated purposes for the key usage. The extended key usage consists of a
comma-separated list of key usages. These indicate the purposes for which the certificate's public key may be used.
1371
Reference Manual
14 WLAN Management
The purposes are entered either as their abbreviations or the point-separated form of the OIDs. Although any OID can
be used, only a few of them are meaningful (see below). Specifically the following PKIX, NS and MS values are significant
and can be entered in any combination:
Table 15: Extended usage purposes: Meaningful abbreviations
MeaningValue
SSL/TLS Web server authenticationserverAuth
SSL/TLS Web client authenticationclientAuth
Code signingcodeSigning
E-mail protection (S/MIME)emailProtection
Trusted time stampingtimeStamping
Microsoft personal code signing (Authenticode)msCodeInd
Microsoft commercial code signing (Authenticode)msCodeCom
Microsoft trust list signingmsCTLSign
Microsoft server gated cryptomsSGC
Microsoft encrypted file systemmsEFS
Netscape server gated cryptonsSGC
By setting this restriction, the key usage extension must always
be observed. If the extension is not supported, the certificate is
rejected as invalid.
critical
Table 16: Extended usage purposes: Meaningful OIDs for WLAN switching
OIDDevice
1.3.6.1.5.5.7.3.18WLAN controller
1.3.6.1.5.5.7.3.19Managed AP
Sample input: critical,clientAuth,1.3.6.1.5.5.7.3.19
SNMP ID:
2.39.2.13.4
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible values:
Comma separated list of the abbreviations and/or OIDs listed above. Max. 100 characters from
#[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
1372
Reference Manual
14 WLAN Management
Cert-Key-Usage
Specify the intended application of the specified certificates (key usage). The WLC queries the certificates for the sub-CA
only for the purpose indicated.
Table 17: Usage: Abbreviation
MeaningValue
digitalSignature
nonRepudiation
keyEncipherment
dataEncipherment
keyAgreement
keyCertSign
cRLSign
encipherOnly
decipherOnly
By setting this restriction, the key usage extension must always
be observed. If the extension is not supported, the certificate is
rejected as invalid.
critical
Sample input: digitalSignature, nonRepudiation
SNMP ID:
2.39.2.13.5
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible values:
Comma separated list of the abbreviations listed above. Max. 100 characters from
#[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
CA-Url-Address
Specify the URL (address) where the parent CA is to be found. If another WLC with the LCOS operating system provides
the CA, all you need to do is replace the IP address in the default value with the address where the corresponding device
is to be reached.
SNMP ID:
2.39.2.13.8
1373
Reference Manual
14 WLAN Management
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible values:
Max. 251 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
http://127.0.0.1/cgi-bin/pkiclient.exe
Restart
This action causes a restart of the sub-CA. Execute this action after performing configuration changes on the sub-CA.
SNMP ID:
2.39.2.13.9
Telnet path:
Setup > Certificates > SCEP-CA > Sub-CA
Possible arguments:
none
Enabling/disabling CAPWAP in the WLC
In order to operate multiple WLAN controllers in a cluster, they must all have identical configurations. This is not the
case on one WLC by default, since it automatically generates certain configuration parts (such as certificates). By disabling
CAPWAP on all devices except one, you have the option of setting one of the devices in your WLC cluster as a master
controller. The other WLCs can be synchronized with the master controller's configuration.
Additions to the Setup menu
CAPWAP-enabled
Enables or disabled the CAPWAP service on your device.
In order to operate several WLAN controllers in the group (cluster), all involved devices must have an identical
configuration. This is not the case on one WLC by default, since it automatically generates certain configuration parts
(such as certificates). By disabling CAPWAP on all devices except one, you have the option of setting one of the devices
in your WLC cluster as a master controller. The other WLCs can be synchronized with the master controller's configuration.
SNMP ID:
2.37.36
Telnet path:
Setup > WLAN-Management
1374
Reference Manual
14 WLAN Management
Possible values:
No
Yes
Default:
Yes
Finding the ideal WLC
The algorithms implemented in LCOS ensure that the APS are intelligently distributed between the individual WLCs. This
allows the APs to equally distribute the network load between all of the WLCs in a cluster, or to select an alternative
WLC if one should fail. For this, an AP first sends out a discovery request on the network to identify all available WLCs.
The WLCs then respond with a discovery response which an AP uses to create a prioritized list of WLCs. This AP prioritizes
the list based on various criteria.
An AP works through the different criteria sequentially: If multiple WLCs appear to be ideal candidates after applying a
criterion, the AP uses the next criteria to prioritize. This process ends when a WLC finally identifies just one WLC as being
ideal after the prioritization described in the following.
Criteria for prioritization
1
Specificity of the AP configuration: An AP evaluates whether a WLC can provide it with a configuration, and
whether this contains a specific AP profile or a default profile. The AP prioritizes a specific AP profile as highest,
followed by a default profile. If a profile is missing, it is given the lowest priority.
1
The preference value: The AP evaluates the preference value that you have assigned to a WLC. The higher the
number between 0 and 255, the higher the AP prioritizes the WLC.
If there still remain several WLCs which are considered to be ideal, the prioritization process continues by evaluating the
connection status and the type of selection process (automatically vs. manually initiated):
1
When the calculation is triggered for the first time, an AP calculates a weighted value for each of the remaining
WLCs by taking the number of APs connected to each WLC and comparing this with the maximum possible number
of APs (license usage). Ultimately, the ideal WLC is taken as that with the lowest license usage.
4
If a WLC has reached the maximum possible number of AP connections (license quota exhausted), an AP no
longer considers the affected WLC for the current selection.
1
In the case of automatic checking of the ideal AP distribution, an AP stays with the WLC it is connected to if this
WLC is included in the list of the remaining WLCs. Otherwise, a randomized algorithm causes the AP to select an
arbitrary AP.
1
In the case of a manually triggered check, a randomized algorithm ensures that the APs distribute the available
license quotas as evenly as possible across the network.
Additions to the Setup menu
Preference
This parameter specifies a priority value used by an AP to set the priority of a WLC within a WLC cluster. The AP evaluates
the priority value that you have assigned to a WLC. The higher the number between 0 and 255, the higher the AP
prioritizes the WLC.
SNMP ID:
2.37.37
1375
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management
Possible values:
0 … 255
Default:
0
Determining the ideal AP distribution
The identification of the ideal AP distribution in a WLC cluster and any redistribution that may be triggered by it occur
automatically. Every AP automatically performs the
Finding the ideal WLC
process at irregular intervals between 30 and
60 minutes. If the result of the process is positive for the WLC which is already connected, no redistribution takes place.
If a different WLC has a higher priority, the AP attempts to connect to this WLC.
However, as an administrator you can use LANmonitor to manually trigger a calculation of the ideal AP distribution and
the resulting redistribution of the APs (see
Manually initiate ideal AP distribution
on page 1376).
Manually initiate ideal AP distribution
The following steps show you how to start the recalculation of an ideal distribution, and if necessary to trigger a
redistribution.
1. Start LANmonitor and select a WLC.
2. Navigate to the menu item Wireless LAN > Active APs.
3. Open the context menu on any AP and select Start WLC search on APs.
1376
Reference Manual
14 WLAN Management
The access points each find their optimum WLC and distribute themselves across the WLC cluster according to the
specifications.
Additions to the Setup menu
Trigger-WLC-rediscovery-on-WTPs
With this action, you command all of the managed APs to calculate the ideal distribution of the APs in the WLC cluster.
The result of this calculation may cause the APs to be redistributed.
SNMP ID:
2.37.34.5
Telnet path:
Setup > WLAN-Management > WLC-Cluster
Possible arguments:
none
14.18.5 One-click backup of the SCEP-CA
In order to simplify the backup of the CA in the WLC, the device offers the option to generate a complete certificate
record with a single action (one-click backup). This record makes it possible to completely back up and restore the CA
and prevent certificate conflicts from occurring.
These conflicts can occur if you have downloaded the individual PKCS12 containers from the device separately and then
reloaded: If the WLC has created a new CA in the meantime and has issued new certificates, the deviating CAs temporarily
lead to authentication problems for the different services in LCOS. If you cannot wait until the individual services request
new certificates, a manual resolution requires deleting the SCEP files from the LCOS file system and re-initialization of
the SCEP clients. By reloading a one-click backup, on the other hand, LCOS performs the necessary steps automatically.
Creating a backup file
In order to create a certificate record, perform the action Create PKCS12 backup files under Setup > Certificate >
SCEP-CA > CA certificate. This action generates a ZIP file within the LCOS file system that contains all necessary files.
To protect the certificates and keys contained therein, the ZIP file is automatically protected with the device password,
unless you enter another password. The ZIP file that was generated can then be downloaded, for example, in WEBconfig
via File management > Download certificate or file > SCEP-CA - One Click Backup.
Reloading the backup file
In order to reload certificate records, load the saved ZIP file directly into the device using the passphrase. In WEBconfig,
for example, this is done by selecting File management > Upload certificate or file > SCEP-CA - One Click Backup.
Enable the option Replace existing CA certificates so that the device automatically restores the certificate record after
the upload.
4
If you do not use this option, or if you upload the backup file to the device by other means, you must execute
the action
2.39.2.2.11 Restore-certificates-from-Backup
in order for the device to restore the certificate record.
14.18.6 Automatic restart of managed APs after firmware update
As of LCOS 9.00 you have the option in the WEBconfig menu Extras > Load firmware in managed APs to automatically
start the APs after the manual upload of a new firmware version.
1377
Reference Manual
14 WLAN Management
Load firmware in managed AP
This menu item is only available on WLAN controllers (WLCs).
On this page, you have the option of using remote access to manually update the firmware on an AP managed by the
WLC. For example, this might make sense in order to test firmware on selected APs before using it productively. To do
this, select an AP by its MAC address and select the appropriate firmware file. Next click on Start upload to load the
firmware in the AP.
5
Please note that this process disables the firmware management in the AP table for the selected AP. This prevents
the WLC from automatically uploading a different firmware version. Firmware management can be re-enabled
at any time in the setup menu under WLAN-Management > AP-Configuration > Manage-firmware.
In order for the access point to use the loaded firmware, you must subsequently perform a restart. By enabling the setting
Restart AP after updating the firmware you trigger an automatic restart as soon as the firmware upload is completed.
14.18.7 Automatic search for alternative WLCs
As of LCOS 9.00, an AP no longer attempts to reconnect to the last known WLC in case of a disconnection. Instead, the
AP searches in the network for an available WLC which corresponds to the criteria for the
Finding the ideal WLC
.
14.18.8 U-APSD configurable by WLC
As of LCOS 9.00 you have the additional option of enabling WLCs to configure the power-saving mechanism (U-)APSD
for individual SSIDs.
Additions to the Status menu
APSD
Indicates whether the APSD power saving mode is enabled for the corresponding logical WLAN network.
SNMP ID:
1.73.2.1.42
Telnet path:
Status > WLAN-Management > AP-Configuration > Networkprofiles
Possible values:
Yes
No
APSD
Indicates whether the APSD power saving mode is enabled for the corresponding logical WLAN network.
SNMP ID:
1.53.103.42
Telnet path:
Status > WLAN-Management > Network-profiles
1378
Reference Manual
14 WLAN Management
Possible values:
Yes
No
Additions to the Setup menu
APSD
Activates APSD power saving for the corresponding logical WLAN network.
5
Please note that in order for the APSD function to work in a logical WLAN, QoS must be activated on the device.
APSD uses mechanisms in QoS to optimize power consumption for the application.
SNMP ID:
2.37.1.1.42
Telnet path:
Setup > WLAN-Management > AP-Configuration > Networkprofiles
Possible values:
Yes
No
Default:
Yes
14.18.9 Group-related radio field optimization
The LANCOM WLAN controllers can form groups of access points based on location information, device properties or
network structure. This grouping can also be used as a basis for radio field optimization. Instead of performing a radio
field optimization either for all access points or just for one of them, you can address all of the access points within a
building tract, with a particular name, or with a particular firmware version.
You can address the groups by using the appropriate group parameters in WEBconfig, LANmonitor and from the command
line:
do /Setup/WLAN-Management/start optimization <Group>
The access points can be filtered with the following group-parameter options:
-g <Group name>
Access points belonging to the group. Multiple group names can be separated by commas.
-l <Location>
Access points with the matching setting for location.
4
The combination of -l and one of the location options -c to -r is not useful.
-c <Country>
Access points with the matching country.
1379
Reference Manual
14 WLAN Management
-i <City>
Access points with the matching city.
-s <Street>
Access points with the matching street.
-b <Building>
Access points with the matching building.
-f <Floor>
Access points with the matching floor.
-r <Room>
Access points with the matching room.
-d <Device name>
Access points with the matching device name.
-a <Antenna>
Access points with the matching number of antennas.
4
A combination of the options -d and -a is not useful.
-v <Firmware>
Access points with this firmware version only.
-x <Firmware>
Access points with a firmware version lower than that specified here.
-y <Firmware>
Access points with a firmware version lower than or equal to that specified here.
-z <Firmware>
Access points with a firmware version higher than that specified here.
-t <Firmware>
Access points with a firmware version higher than or equal to that specified here.
4
Combinations are possible, e.g. to address access points with a firmware version between two versions.
-n <Intranet address>
Access points located on the intranet with the address specified here.
-p <Profile name>
Access points included in the WLAN profile specified here.
14.18.10 Adding new APs with the WEBconfig Setup Wizard
As of LCOS 9.00, WLCs have a revised Setup Wizard Assign Access Points to Profiles, which makes it easier to add
new APs via WEBconfig. Just a few mouse clicks with the new Setup Wizard allows you to
1
Make a targeted search for a new AP;
1
Accept one or more new APs at the same time;
1
Assign a WLAN profile or a channel list to a new AP;
1380
Reference Manual
14 WLAN Management
1
Allow a new AP to inherit the configuration from an accepted AP;
1
To exchange the configuration in a new AP for that of an accepted missing AP. When exchanging a configuration,
the new AP receives the complete configuration of the accepted missing AP (except for its MAC address). When the
new AP has been integrated, the WLC then deletes the configuration of the accepted missing AP.
Click Accept AP to include the new AP with its new settings into the network.
5
If you have allowed an AP to be configured via assignment groups, there is no need for any further settings for
this AP in the Setup Wizard. The WLC automatically assigns the settings for the appropriate groups to the AP.
Additions to the Status menu
Accept-AP
This action triggers the integration of a new AP. The action accepts different arguments depending on the firmware
version of the device. A MAC address must be specified in any case; further arguments are optional.
Syntax used in versions before LCOS 9.00
[-c] <WTP-MAC> [<Profile>] [<Name>] [<IP>] [<Netmask>] [<Gateway>]
Syntax used in versions as of LCOS 9.00
<WTP-MAC> [<WTP-MAC-2> … <WTP-MAC-n> ] [-c] [-l <Location>] [-p <Profile>] [-i
<IP>] [-n <Name>] [-m <Netmask>] [-g <Gateway>] [-1 <Wlan1Channels>] [-2
<Wlan2Channels>]
5
If you define multiple MAC addresses, the device ignores the arguments [-i <IP>] and [-n
<Name>].
SNMP ID:
2.37.7
Telnet path:
Setup > WLAN-Management
Possible arguments:
-c
The WLC generates a configuration entry for the AP.
-l <Location>
The WLC supplements the AP configuration with the specified location.
We recommend that you store each location in the device as a unique field value pair so that, for
example, the filter function in LCOS can be used at the console. The following field identifiers are
available:
1381
Reference Manual
14 WLAN Management
1
co=Country
1
ci=City
1
st=Street
1
bu=Building
1
fl=Floor
1
ro=Room
-p <Profile>
The WLC supplements the AP configuration with the specified WLAN profile.
-i <IP>
The WLC supplements the AP configuration with the specified IPv4 address.
-n <Name>
The WLC supplements the AP configuration with the specified device identifier.
-m <Netmask>
The WLC supplements the AP configuration with the specified netmask.
-g <Gateway>
The WLC supplements the AP configuration with the specified gateway address (IPv4).
-1 <Wlan1Channels>
The WLC supplements the AP configuration with the first channel list.
-2 <Wlan2Channels>
The WLC supplements the AP configuration with the second channel list.
14.18.11 Maximum bandwidth can be adjusted for each WLAN module
As of LCOS 9.00, you are able to set the maximum bandwidth for each WLAN module.
It is no longer possible to force 40MHz channel bundling.
Changes to WLCs
Max. channel bandwidth
Enter how and to what extent the AP specifies the channel bandwidth for the physical WLAN interface(s).
The following values are possible:
1
Automatic: The access point automatically detects the maximum channel bandwidth (default).
1382
Reference Manual
14 WLAN Management
1
20MHz: The access point uses channels bundled at 20 MHz.
1
40MHz: The access point uses channels bundled at 40MHz.
1
80MHz: The access point uses channels bundled at 80MHz.
By default, the physical WLAN interface automatically determines the frequency range used to modulate the
data onto the carrier signals. 802.11a/b/g use 48 carrier signals in one 20-MHz channel. The use of double
the frequency range of 40 MHz means that 96 carrier signals can be used, resulting in a doubling of the data
throughput.
802.11n can use 52 carrier signals in a 20-MHz channel for modulation, and even up to 108 carrier signals
in a 40-MHz channel. The use of the 40 MHz option for 802.11n therefore means a performance gain of more
than double.
Changes to stand-alone APs
Additions to the Status menu
Channel bandwidths
Indicates which channel bandwidths are supported by the corresponding WLAN client.
SNMP ID:
1.3.32.66
Telnet path:
Status > WLAN > Station-table
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
1383
Reference Manual
14 WLAN Management
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidths
Indicates which channel bandwidths are supported by the corresponding remote station.
SNMP ID:
1.3.34.44
Telnet path:
Status > WLAN > Scan-Results
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidth
Indicates which channel bandwidths are currently being used by the corresponding remote station.
SNMP ID:
1.3.34.45
Telnet path:
Status > WLAN > Scan-Results
1384
Reference Manual
14 WLAN Management
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Channel bandwidths
Displays the channel bandwidths that the AP supports for the P2P connection.
SNMP ID:
1.3.36.1.46
Telnet path:
Status > WLAN > Interpoints > Access-point-list
Possible values:
20MHz
Channels bundled at 20MHz.
40MHz
Channels bundled at 40MHz.
80MHz
Channels bundled at 80MHz.
160MHz
Channels bundled at 160MHz.
80+80MHz
160MHz channel bandwidth with two disjunct 80MHz channels (802.11ac devices only).
T-40MHz
Channels bundled at 40MHz in the 108Mbit Turbo mode (802.11g devices only)
Additions to the Setup menu
Max. channel bandwidth
Specify the maximum frequency range in which the physical WLAN interface is able to modulate the data to be transmitted
onto the carrier signals (channel bandwidth).
1385
Reference Manual
14 WLAN Management
In the setting Auto, the AP automatically adjusts the channel bandwidth to the optimum. You have also the option to
disable the automation and deliberately limit the bandwidth. The available values depend on the WLAN standards
supported by the device.
SNMP ID:
2.23.20.8.24
Telnet path:
Setup > Interfaces > WLAN > Radio-settings
Possible values:
Auto
The AP automatically adjusts the channel bandwidth to the optimum. The AP allows the use of the
maximum available bandwidth, assuming that the current operating conditions allow this. Otherwise,
the AP limits channel bandwidth to 20MHz.
20MHz
The AP uses channels bundled at 20 MHz.
40MHz
The AP uses channels bundled at 40MHz.
80MHz
The AP uses channels bundled at 80MHz.
Default:
Auto
Module-2-Max.-Channel-Bandwidth
Here you specify how and to what extent the AP sets the channel bandwidth for the second physical WLAN interface.
By default, the physical WLAN interface automatically determines the frequency range used to modulate the data onto
the carrier signals. 802.11a/b/g use 48 carrier signals in one 20-MHz channel. Doubling the frequency range to 40 MHz
allows 96 carrier signals to be used, resulting in a doubling of data throughput.
802.11n can use 52 carrier signals in a 20-MHz channel for modulation, and even up to 108 carrier signals in a 40-MHz
channel. The use of the 40 MHz option for 802.11n therefore means a performance gain of more than double.
SNMP ID:
2.37.1.4.25
Telnet path:
Setup > WLAN-Management > AP-Configuration > Base stations
Possible values:
Automatic
The AP automatically detects the maximum channel bandwidth.
20MHz
The AP uses channels bundled at 20 MHz.
1386
Reference Manual
14 WLAN Management
40MHz
The AP uses channels bundled at 40MHz.
80MHz
The AP uses channels bundled at 80MHz.
Default:
Automatic
Module-1-Max.-Channel-Bandwidth
Here you specify how and to what extent the AP sets the channel bandwidth for the first physical WLAN interface.
By default, the physical WLAN interface automatically determines the frequency range used to modulate the data onto
the carrier signals. 802.11a/b/g use 48 carrier signals in one 20-MHz channel. Doubling the frequency range to 40 MHz
allows 96 carrier signals to be used, resulting in a doubling of data throughput.
802.11n can use 52 carrier signals in a 20-MHz channel for modulation, and even up to 108 carrier signals in a 40-MHz
channel. The use of the 40 MHz option for 802.11n therefore means a performance gain of more than double.
SNMP ID:
2.37.1.4.26
Telnet path:
Setup > WLAN-Management > AP-Configuration > Base stations
Possible values:
Automatic
The AP automatically detects the maximum channel bandwidth.
20MHz
The AP uses channels bundled at 20 MHz.
40MHz
The AP uses channels bundled at 40MHz.
80MHz
The AP uses channels bundled at 80MHz.
Default:
Automatic
14.18.12 Client steering by WLC
With client steering, certain criteria are used to help WLAN clients located within transmission range to connect to the
best suited AP. These criteria are centrally defined in the WLAN controller. Managed access points constantly report the
current values to the WLAN controller, which uses these criteria to decide which access points may respond to requests
from WLAN clients. For this reason, client steering is only possible with access points that are centrally managed by a
WLAN controller.
In managed networks a WLC centralizes the client steering for all connected APs. In this case, client steering works as
follows:
1387
Reference Manual
14 WLAN Management
1. The WLC collects the data about the associated WLAN clients from the APs connected to it. These data are the basis
for the WLC to control the client steering.
2. All APs are configured so that client steering is handled by the WLC.
3. An unassociated WLAN client sends a probe request to the APs within its range.
4. Using CAPWAP, the APs transmit the request and the signal strength of the WLAN client to the WLC.
5. For each AP within range of the WLAN client, the WLC calculates a value from three factors:
1
A value for signal strength
1
A value for the number of clients associated at the AP
1
A value for the frequency band
The WLC weights these factors and multiplies them together to derive the final value.
6. APs with the highest value, or a value that deviates from it within a specified tolerance level, receive a message from
the WLC that they may accept the WLAN client at the next login attempt.
7. WLAN clients attempting to connect to an AP before it has received the response from the WLC are rejected.
8. If a WLAN client is acting "sticky", i.e. it does not attempt to connect to another AP with a good connection quality
even though its current connection is of a lower quality, the WLC can prompt the current AP to log off the WLAN
client. The WLAN client is then forced to connect with the AP offering the better connection.
4
If an AP loses connection to the WLC which is responsible for client steering, the AP accepts all connections from
authenticated WLAN clients.
5
In order to optimize managed client steering, all APs require the installation of LCOS9.00 or later. If you have
mixed operations with APs using earlier versions of LCOS, your WLAN will not be capable of optimizing the
distribution of clients.
5
In scenarios with time-critical roaming, such as with VoIP phones, you should not use client steering, as this can
delay the client's login process.
Configuration
You configure client steering with LANconfig as follows:
1. First, in the WLC you activate client steering for an AP under WLAN controller > Profiles > Physical WLAN
parameters using the selection list Client steering.
1
Off: Client steering is deactivated.
1
AP-based band steering: The AP independently steers the WLAN client to a preferred frequency band.
1
On: The AP lets the WLC handle the client steering.
1388
Reference Manual
14 WLAN Management
2. Create a client-steering profile under WLAN controller > AP configuration > Client steering profiles.
5
This menu already contains two preconfigured default profiles (high density, default), which are sufficient
for most use cases.
Client-steering profiles control how the WLC decides which APs are to accept a client at the next login attempt.
The items have the following meanings:
Name
Name of the client steering profile.
Pref. Frequency band
Specifies the frequency band to which the WLC steers the AP.
1
2.4GHz: The WLC steers the AP to the 2.4 GHz frequency band.
1
5GHz: The WLC steers the AP to the 5 GHz frequency band.
Tolerance level
The calculated value for an AP may deviate from the maximum calculated value by this percentage value in
order for the AP to be allowed to accept the client at the next login attempt.
Signal weighting
Specifies with how many percent the signal-strength value is entered into the final value.
Associated-Clients-Weighting
Specifies with how many percent the number of clients associated with an AP is entered into the final value.
Radio weighting
Specifies with how many percent the value for the frequency band is entered into the final value.
Disassociation threshold
Specifies the threshold value below which the connection to the client must drop before the AP disconnects
from the client and initiates a new client-steering operation.
Disassociation delay
Specifies the number of seconds in which no data is transferred between AP and client before the AP
disconnects the client.
1389
Reference Manual
14 WLAN Management
3. Optional: Enable the capture of client-steering statistics with the parameter Acquire statistical data. This statistical
data is suitable for analysis by LANmonitor, for example.
4
Statistics capture increases the load on the WLC. LANCOM does not recommend the permanent recording
of statistics.
4. Now assign one of the client-steering profiles to the corresponding AP in the AP table under WLAN controller >
AP configuration > Access point table.
5. Optional: If necessary, assign a suitable client-steering group to the defined assignment groups.
You have now completed the configuration of the client steering.
1390
Reference Manual
14 WLAN Management
Additions to the Status menu
Client steering
The client-steering statistics are located in this directory.
SNMP ID:
1.73.123
Telnet path:
Status > WLAN-Management
Active
Indicates whether client steering by WLC controller is enabled.
SNMP ID:
1.73.123.1
Telnet path:
Status > WLAN-Management > Client-Steering
Client-steering-success-rate
The value indicates the ratio of successfully steered clients to all associated clients. In this case, success means that the
client has associated with an AP after receiving permission to do so from the WLC.
SNMP ID:
1.73.123.3
Telnet path:
Status > WLAN-Management > Client-Steering
Client info
This table contains the data of all WLAN clients that have successfully associated to the connected APs.
SNMP ID:
1.73.123.4
Telnet path:
Status > WLAN-Management > Client-Steering
1391
Reference Manual
14 WLAN Management
Client-MAC
This column shows the MAC address of the associated WLAN client.
SNMP ID:
1.73.123.4.1
Telnet path:
Status > WLAN-Management > Client-Steering > Client-Steering
APs-got-OK
Displays the number of APs that have currently received permission from the WLC to accept this client.
SNMP ID:
1.73.123.4.2
Telnet path:
Status > WLAN-Management > Client-Steering > Client-Steering
State
This column displays the status of the WLAN client.
SNMP ID:
1.73.123.4.3
Telnet path:
Status > WLAN-Management > Client-Steering > Client-Steering
Possible values:
Steering OK
Shows whether the client has associated with an AP after receiving permission to do so from the WLC.
Steering NOK
Shows whether the client has associated with an AP without receiving permission to do so from the
WLC.
Pending
The controller has sent a message with "OK" or "NOK" for this client. This state is maintained until the
controller receives information from an AP that the client has associated with it. The controller checks
whether the AP had previously received an "OK". If this is the case, then it sets the status to "OK",
otherwise it sets it to "NOK".
Additions to the Setup menu
Client-Steering-Profile
Client-steering profiles control how the WLC decides which APs are to accept a client at the next login attempt.
1392
Reference Manual
14 WLAN Management
SNMP ID:
2.37.1.4.27
Telnet path:
Setup > WLAN-Management > AP-Configuration > Base stations
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Client-Steering-Profile
Client-steering profiles control how the WLC decides which APs are to accept a client at the next login attempt.
SNMP ID:
2.37.1.18.6
Telnet path:
Setup > WLAN-Management > AP-Configuration > Config-Assignment-Groups
Possible values:
Name from Setup > WLAN-Management > Client-Steering > Profiles
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Client steering
This directory is used to configure the client steering by the WLC.
SNMP ID:
2.37.40
Telnet path:
Setup > WLAN-Management
Trace-Mac
An as aid to troubleshooting, only the MAC address you entered is shown when the trace is enabled (trace #
wlc-steering).
SNMP ID:
2.37.40.11
1393
Reference Manual
14 WLAN Management
Telnet path:
Setup > WLAN-Management > Client-Steering
Possible values:
16 characters from 0123456789abcdef
Default:
0000000000000000
Show statistics
Using this parameter, you enable or disable the recording of client-steering statistics. This statistical data is suitable for
analysis by LANmonitor, for example. Another option for viewing the statistics is available under Status >
WLAN-Management > Client-Steering.
4
Recording the statistics increases the load on the WLC. LANCOM does not recommend the permanent recording
of statistics.
SNMP ID:
2.37.40.17
Telnet path:
Setup > WLAN-Management > Client-Steering
Possible values:
Yes
Enables the recording of client-steering statistics.
No
Disables the recording of client-steering statistics.
Default:
No
Profiles
This table is used to manage the profiles for the client steering. A client-steering profile specifies the conditions under
which the WLC triggers a client-steering operation.
SNMP ID:
2.37.40.19
Telnet path:
Setup > WLAN-Management > Client-Steering
1394
Reference Manual
14 WLAN Management
Name
Name of the client-steering profile.
SNMP ID:
2.37.40.19.1
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Tolerance level
The calculated value for an AP may deviate from the maximum calculated value by this percentage value in order for
the AP to be allowed to accept the client at the next login attempt.
SNMP ID:
2.37.40.19.2
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 100 Percent
Default:
0
Signal weighting
Specifies with how many percent the signal-strength value is entered into the final value.
SNMP ID:
2.37.40.19.4
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 100 Percent
Default:
100
1395
Reference Manual
14 WLAN Management
Associated-Clients-Weighting
Specifies with how many percent the number of clients associated with an AP is entered into the final value.
SNMP ID:
2.37.40.19.5
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 100 Percent
Default:
100
Radio weighting
Specifies with how many percent the value for the frequency band is entered into the final value.
SNMP ID:
2.37.40.19.6
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 100 Percent
Default:
100
Preferred band
Specifies with how many percent the number of clients associated with an AP is entered into the final value.
SNMP ID:
2.37.40.19.9
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
2.4GHz
The WLC steers the AP to the 2.4 GHz frequency band.
5GHz
The WLC steers the AP to the 5 GHz frequency band.
1396
Reference Manual
14 WLAN Management
Default:
5GHz
Disassociation-Threshold
Specifies the threshold value below which the connection to the client must drop before the AP disconnects from the
client and initiates a new client-steering operation.
SNMP ID:
2.37.40.19.10
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 100 Percent
Default:
30
Time-to-Disassociation
Specifies the number of seconds in which no data is transferred between AP and client before the AP disconnects the
client.
SNMP ID:
2.37.40.19.11
Telnet path:
Setup > WLAN-Management > Client-Steering > Profiles
Possible values:
0 … 10 Seconds
Default:
1
Client-MAC-Statistic-Filter
This parameter specifies a list of MAC addresses, for which the WLC explicitly records statistical data. The WLC writes
statistics for the listed MAC addresses to the Event-Table under Status > WLAN-Management > Client-Steering.
Enter multiple MAC addresses into a comma-separated list.
5
The recording of statistical is enabled elsewhere using the parameter
2.37.40.17 Show statistics
on page 1394.
1397
Reference Manual
14 WLAN Management
SNMP ID:
2.37.40.20
Telnet path:
Setup > WLAN-Management > Client-Steering
Possible values:
Max. 251 characters from [0-9][a-f]:-,
Special values:
empty
The device collects statistical data on all MAC addresses (filtering disabled).
Default:
empty
14.18.13 Automatic frequency-band selection
As of LCOS9.00 you have the option to allow a managed AP to choose the preferred frequency band for the physical
WLAN interface by itself. In LANconfig the configuration is carried out in the dialog WLAN Controller > AP
configuration > Access point table:
Mode WLAN ifc. 1
This setting allows you to configure the frequency band in which the AP operates the 1st physical WLAN
interface. When set to Default, the AP independently selects the frequency band for the physical WLAN
interface. The AP prefers the 2.4GHz band, if available.
Mode WLAN ifc. 2
This setting allows you to configure the frequency band in which the AP operates the 2nd physical WLAN
interface. When set to Default, the AP independently selects the frequency band for the physical WLAN
interface. The AP prefers the 5GHz band, if available.
4
If a managed AP only has one physical WLAN interface, the AP ignores the settings for the 2nd physical
WLAN interface.
Additions to the Setup menu
WLAN module 1 default
This setting allows you to configure the frequency band in which the AP operates the 1st physical WLAN interface.
SNMP ID:
2.37.1.5
Telnet path:
Setup > WLAN-Management > AP-Configuration
Possible values:
Auto
The AP independently selects the frequency band for the physical WLAN interface. The AP prefers the
2.4GHz band, if available.
1398
Reference Manual
14 WLAN Management
2.4GHz
The AP operates the physical WLAN interface in the 2.4Ghz band.
5GHz
The AP operates the physical WLAN interface in the 5Ghz band.
Off
The AP disables the physical WLAN interface.
Default:
Auto
WLAN module 2 default
This setting allows you to configure the frequency band in which the AP operates the 2nd physical WLAN interface.
4
If a managed AP only has one physical WLAN interface, the AP ignores the settings for the 2nd physical WLAN
interface.
SNMP ID:
2.37.1.6
Telnet path:
Setup > WLAN-Management > AP-Configuration
Possible values:
Auto
The AP independently selects the frequency band for the physical WLAN interface. The AP prefers the
5GHz band, if available.
2.4GHz
The AP operates the physical WLAN interface in the 2.4Ghz band.
5GHz
The AP operates the physical WLAN interface in the 5Ghz band.
Off
The AP disables the physical WLAN interface.
Default:
Auto
1399
Reference Manual
14 WLAN Management
14.19 Addition(s) to LCOS 9.10
14.19.1 AutoWDS operation
Additions to the Status menu
CAPWAP up
Indicates whether CAPWAP is active.
SNMP ID:
1.59.109.2
Telnet path:
Status > WLAN Management > AutoWDS-operation
Possible values:
No
Yes
CAPWAP up again after config
Indicates whether CAPWAP is active again after a successful configuration.
SNMP ID:
1.59.109.3
Telnet path:
Status > WLAN Management > AutoWDS-operation
Possible values:
No
Yes
AutoWDS fallback timer
Displays the value of the AutoWDS fallback timer.
SNMP ID:
1.59.109.4
Telnet path:
Status > WLAN Management > AutoWDS-operation
1400
Reference Manual
14 WLAN Management
AutoWDS fallback force deassoc timer
Displays the value of the AutoWDS force deassoc timer.
SNMP ID:
1.59.109.5
Telnet path:
Status > WLAN Management > AutoWDS-operation
CAPWAP continuation timer
Displays the value of the CAPWAP continuation timer.
SNMP ID:
1.59.109.6
Telnet path:
Status > WLAN Management > AutoWDS-operation
CAPWAP silent timer
Displays the value of the CAPWAP silent timer.
SNMP ID:
1.59.109.7
Telnet path:
Status > WLAN Management > AutoWDS-operation
14.19.2 Disable responses to CAPWAP requests from a WAN connection
As of LCOS version 9.10 it is possible to disable responses to CAPWAP requests from a WAN remote station.
Protection against unauthorized CAPWAP access from the WAN
The WLC or LANCOM router with activated WLC option handles CAPWAP requests from the LAN and the WAN in the
same way. In the case of requests from WAN remote stations, it accepts the APs into its AP management and, under
certain circumstances, it sends a default configuration. If configured appropriately, the CAPWAP service is no longer
available to WAN remote stations, meaning that for WAN remote stations, APs are no longer accepted and configurations
are not provisioned.
1401
Reference Manual
14 WLAN Management
The configuration is done under WLAN Controller > General in the section Wireless LAN controller. If the automatic
acceptance of new APs is enabled, you can use the feature Accept new AP over WAN connection to control whether
the CAPWAP service is available to WAN remote stations.
No
The device accepts no new APs over the WAN connection.
Only via VPN
The device only accepts new APs if the WAN connection is via VPN.
Yes
The device accepts all new APs over the WAN connection.
Additions to the Setup menu
Allow WAN connections
This item configures the way that the WLC handles requests from the WAN. For example, it is desirable to prevent
CAPWAP requests from unknown WAN peers from accidentally assigning a default configuration with internal network
settings to these APs.
SNMP ID:
2.37.29
Telnet path:
Setup > WLAN-Management
Possible values:
Yes
When an AP sends a request from the WAN, the WLC includes it into the AP management and, with
the appropriate setting, it sends a default configuration.
VPN
When an AP sends a request from the WAN, the WLC includes it into the AP management and, with
the appropriate setting, it sends a default configuration only if the WAN connection uses a VPN tunnel.
No
When an AP sends a request from the WAN, the WLC does not include it into the AP management.
Default:
No
14.19.3 Additional date information for central firmware management
As of LCOS version 9.10, the table for central firmware management by the WLC now contains date information.
1402
Reference Manual
14 WLAN Management
Firmware management table
This table is used to store information about which firmware versions are to be operated with which devices (MAC
address) and device types.
Device types
Select here the type of device that the firmware version specified here is to be used for.
1
Possible values: All or a selection from the list of available devices.
1
Default: All
MAC address
Select here the device (identified by its MAC address) that the firmware version specified here is to be used
for.
1
Possible values: Valid MAC address
1
Default: Blank
Version
Firmware version that is to be used for the devices or device types specified here.
1
Possible values: Firmware version in the form X.XX
1
Default: Blank
Date
The date allows you to downgrade to a specific firmware version within a release, for example from a Release
Upgrade (RU) on an earlier upgrade.
1
Possible values: 8 characters from 0123456789 The entry must match the format of the UPX header, e.g.
"01092014" for the September 01, 2014.
1
Default: Blank
Additions to the Setup menu
Date
Date of the corresponding firmware version.
SNMP ID:
2.37.27.15.5
Telnet path:
Setup > WLAN-Management > Central-Firmware-Management > Firmware-Version-Management
Possible values:
Max. 8 characters from [0-9]
Default:
Corresponds to the UPX header of the firmware (such as "01072014" for the July 01, 2014)
1403
Reference Manual
14 WLAN Management
14.19.4 Display of channel and frequency of clients logged on to the AP
As of LCOS version 9.10, the station table in the WLC additionally displays the channel and frequency of clients logged
on to active WLAN networks.
4
For APs with an older firmware version and unable to transmit this data, the WLC takes the channel and frequency
information from the Active radios status table under Status > Active-Radios > WLAN-Management >
AP-Status.
Additions to the Status menu
Radio band
This value displays the radio band used by the client that is logged in to the AP.
SNMP ID:
1.73.100.27
Telnet path:
Status > WLAN-Management > Station-table
Possible values:
0
Unknown
1404
Reference Manual
14 WLAN Management
2.4GHz
The client is using the 2.4GHz band.
5GHz
The client is using the 5GHz band.
Radio channel
This value displays the radio channel used by the client that is logged in to the AP.
SNMP ID:
1.73.100.28
Telnet path:
Status > WLAN-Management > Station-table
Possible values:
1 … 140
14.19.5 Using LANconfig to backup certificates
As of LCOS version 9.10, LANconfig is fully able to backup and upload certificates.
Using LANconfig to backup and restore certificates
Certificates are stored and uploaded with LANconfig as follows:
Save
1. Highlight the WLC in the device view section and in the menu select Device > Configuration
management and the item Save certificate as file.
2. Set the Certificate type to PKCS12 container and click Save.
Upload
1. Highlight the WLC in the device view section and in the menu select Device > Configuration
management and the item Upload certificate or file.
1405
Reference Manual
14 WLAN Management
2. Set the Certificate type to PKCS12 container.
3. Now navigate to the desired file, enter the password if necessary and click Open.
One Click Backup
For the One Click Backup, select the entry "SCEP-CA - One Click Backup" from the dialog list.
14.19.6 Displaying the certificate status of an AP
As of LCOS version 9.10, an AP transmits its certificate status to the WLC.
Additions to the Status menu
Certificate status
Displays the status of the APs.
SNMP ID:
1.73.9.3.9
Telnet path:
Status > WLAN-Management > AP-Status > New-AP
Possible values:
0
Unknown (default for APs with older firmware)
1
Missing
2
Expired
3
Incompatible (certificate does not match the CA chain of the WLC)
1406
Reference Manual
14 WLAN Management
4
Still not valid (e.g. if clocks in the WLC and AP are not synchronized)
5
Valid
14.19.7 On/off switch for AP LEDs per WLC
As of LCOS version 9.10, the device LEDs of every AP in a multi-AP environments an be separately configured on a WLC.
For each WLAN profile you can specify the following parameters under WLAN controller > Profiles > WLAN profiles:
Device LED profile
The device LED profile selected here applies to the WLAN profile. To manage the devices LED profiles, see
WLAN controller > Profiles > Device LED profiles.
Device LED profiles
The LEDs on the device are configurable so that you can, for instance, operate an AP while drawing a minimum of
attention to it. In order to perform this configuration by WLC, you need to create the corresponding profile under WLAN
Controller > Profiles > Device LED profiles and assign this to a WLAN profile.
Name
Give a name to the device LED profile here.
LED mode
The following options are available:
1
Normal: The LEDs are always enabled, also after rebooting the device.
1
Timed off: After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This
is useful for the LEDs to indicate critical errors during the restart process.
1407
Reference Manual
14 WLAN Management
1
All off: The LEDs are all off. Even after restarting the device, the LEDs remain off.
LED switch-off delay
The Timed off option uses the setting in the field LED switch-off delay in seconds to control the time before
the LEDs are disabled after a restart.
Additions to the Setup menu
LED profiles
The LEDs on the device are configurable so that you can, for instance, operate an AP while drawing a minimum of
attention to it. In order to perform this configuration by WLC, you need to create the corresponding profile and assign
this to a WLAN profile.
SNMP ID:
2.37.1.21
Telnet path:
Setup > WLAN-Management > AP-Configuration
Name
Give a name to the device LED profile here.
SNMP ID:
2.37.1.21.1
Telnet path:
Setup > WLAN-Management > AP-Configuration > LED-Profiles
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]
Default:
empty
LED mode
Set the operating mode for the LEDs here.
SNMP ID:
2.37.1.21.4
Telnet path:
Setup > WLAN-Management > AP-Configuration > LED-Profiles
1408
Reference Manual
14 WLAN Management
Possible values:
On
The LEDs are always enabled, also after rebooting the device.
Off
The LEDs are all off. Even after restarting the device, the LEDs remain off.
Timed off
After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This is useful
for the LEDs to indicate critical errors during the restart process.
Default:
On
LED off seconds
In the operating mode Timed off you can specify the delay in seconds after which the LEDs are disabled following a
restart. This is useful for the LEDs to indicate critical errors during the restart process.
SNMP ID:
2.37.1.21.5
Telnet path:
Setup > WLAN-Management > AP-Configuration > LED-Profiles
Possible values:
Max. 4 characters from [0-9]
Default:
300
LED profiles
The device LED profile selected here applies to the WLAN profile.
SNMP ID:
2.37.1.3.8
Telnet path:
Setup > WLAN-Management > AP-Configuration > Commonprofiles
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]
Default:
empty
1409
Reference Manual
14 WLAN Management
Additions to the Status menu
LED profiles
This entry displays the existing LED profiles.
SNMP ID:
1.59.110
Telnet path:
Status > WLAN-Management
LED profiles
Displays information about the LED profiles.
SNMP ID:
1.73.2.23
Telnet path:
Status > WLAN-Management > AP-Configuration
Name
Contains the name of the LED profile.
SNMP ID:
1.73.2.23.1
Telnet path:
Status > WLAN-Management > LED-Profiles >
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]
Default:
empty
LED mode
Indicates the LED mode.
SNMP ID:
1.73.2.23.4
1410
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > LED-Profiles >
Possible values:
On
The LEDs are always enabled, also after rebooting the device.
Off
The LEDs are all off. Even after restarting the device, the LEDs remain off.
Timed off
After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This is useful
for the LEDs to indicate critical errors during the restart process.
LED off seconds
In the operating mode Timed off this column indicates after how many seconds the device disables the LEDs after a
restart.
SNMP ID:
1.73.2.23.5
Telnet path:
Status > WLAN-Management > LED-Profiles >
Possible values:
Max. 4 characters from [0-9]
Default:
300
LED profiles
This column indicates the assigned LED profile.
SNMP ID:
1.73.2.3.8
Telnet path:
Status > WLAN-Management > AP-Configuration > Commonprofiles
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]
Default:
empty
1411
Reference Manual
14 WLAN Management
LED prof. errors
Contains the error codes displayed by the device LEDs.
SNMP ID:
1.73.2.22
Telnet path:
Status > WLAN-Management > AP-Configuration
Index
Contains the sequential index of the error messages.
SNMP ID:
1.73.2.22.1
Telnet path:
Status > WLAN-Management > AP-Configuration > LED-Prof.-Errors
Index
Contains the name of the LED profile.
SNMP ID:
1.73.2.22.2
Telnet path:
Status > WLAN-Management > AP-Configuration > LED-Prof.-Errors
Error
Contains the error that occurred.
SNMP ID:
1.73.2.22.3
Telnet path:
Status > WLAN-Management > AP-Configuration > LED-Prof.-Errors
Possible values:
None
No error
1412
Reference Manual
14 WLAN Management
Inheritance error
No profile
Profile not found
No memory
SSID missing
Network not found
AP parameters not found
AP intranet not found
RADIUS profile not found
AutoWDS profile not found
Master equal to slave
No profile either Group found
Info profiles WINS group
Group wrong defined
SSID WLC tunnel missing
SSID inter-station traffic allowed
Too many networks for AutoWDS
Reported by AP
14.19.8 Managing Wireless-ePaper and iBeacon profiles with WLCs
As of LCOS version 9.10, it is possible to create and distribute Wireless-ePaper and iBeacon profiles for E-series access
points.
ESL- and iBeacon profiles
In order to use a WLC to manage the settings of the Wireless ePaper information and iBeacon information of the individual
APs, you create the corresponding profiles for Wireless ePaper and iBeacon via WLAN-Controller > AP-Configuration
with the button Extended settings.
1413
Reference Manual
14 WLAN Management
The button iBeacon profiles is used to create iBeacon profiles for the assignment groups and the AP table, which specify
the iBeacon information to be broadcast by the individual APs.
Name
Name of the profile
Entry active
Activates or deactivates this profile.
UUID
Unique identification of the transmitter
Major
Specifies the Major value of the iBeacon.
The button Wireless ePaper profiles is used to create Wireless ePaper profiles for the WLAN-profiles table, which
specify the Wireless ePaper information to be broadcast by the individual APs.
Name
Name of the profile
Entry active
Activates or deactivates this profile.
Port
Specifies the port.
Additions to the Setup menu
iBeacon
This entry allows you to configure the iBeacon module.
SNMP ID:
2.23.90.1
Telnet path:
Setup > Interfaces > Bluetooth
1414
Reference Manual
14 WLAN Management
UUID
This entry allows you to assign a "universally unique identifier" (UUID) to the iBeacon module.
SNMP ID:
2.23.90.1.2
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Max. 36 characters from [0-9][a-f][A-F]-
Default:
00000000-0000-0000-0000-000000000000
Major
Assign a unique major ID to the iBeacon module.
SNMP ID:
2.23.90.1.3
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Max. 5 characters from [0-9]
1 … 65535 Integer value
Default:
2002
Minor
Assign a unique minor ID to the iBeacon module.
SNMP ID:
2.23.90.1.4
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Max. 5 characters from [0-9]
1 … 65535 Integer value
1415
Reference Manual
14 WLAN Management
Default:
1001
Reception power shift
Specify the reception power shift.
SNMP ID:
2.23.90.1.5
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Max. 4 characters from [0-9]-
-128 … 127
Default:
0
Transmission power
Set the transmission power of the iBeacon module.
SNMP ID:
2.23.90.1.6
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Low
The module sends with minimum power.
Medium
The module sends with medium power.
High
The module sends with maximum power.
Default:
High
Channel/channels
Set which channels the iBeacon module should use to transmit.
1416
Reference Manual
14 WLAN Management
SNMP ID:
2.23.90.1.7
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
2402MHz
The module transmits on channel 2402.
2426MHz
The module transmits on channel 2426.
2480MHz
The module transmits on channel 2480.
2402MHz, 2426MHz, 2480MHz
The module transmits on all channels.
Default:
2402MHz, 2426MHz, 2480MHz
Coexistence
Specify here whether iBeacon is to be operated in parallel with the Wireless ePaper service.
SNMP ID:
2.23.90.1.8
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
No
Yes
Default:
Yes
Wireless ePaper
Configure the settings for the Wireless ePaper module here.
SNMP ID:
2.88
1417
Reference Manual
14 WLAN Management
Telnet path:
Setup
Port
Assign a port to the Wireless ePaper module.
SNMP ID:
2.88.2
Telnet path:
Setup > Wireless-ePaper
Possible values:
Max. 5 characters from [0-9]
Default:
2002
Channel
Set which channel the Wireless ePaper module should use.
SNMP ID:
2.88.3
Telnet path:
Setup > Wireless-ePaper
Possible values:
2404MHz
2410MHz
2422MHz
2425MHz
2442MHz
2450MHz
2462MHz
2470MHz
2474MHz
2477MHz
2480MHz
Auto
Default:
2425MHz
1418
Reference Manual
14 WLAN Management
14.19.9 The modules iBeacon and Wireless ePaper have an additional "Managed" mode
As of LCOS version 9.10 you can operate the iBeacon/BLE and Wireless ePaper modules in "Managed" mode.
5
Existing configurations continue to run in the "Manual" mode and the corresponding module uses the local
configuration. New configurations start in the "Managed" mode. In this case it is necessary for the configuration
to be carried out by a WLAN controller.
Additions to the Setup menu
iBeacon
This entry allows you to configure the iBeacon module.
SNMP ID:
2.23.90.1
Telnet path:
Setup > Interfaces > Bluetooth
Operating
This entry allows you to set the operating mode of the module.
SNMP ID:
2.23.90.1.1
Telnet path:
Setup > Interfaces > Bluetooth > iBeacon
Possible values:
Off
The module is not enabled.
Manual
iBeacon configurations are done manually.
Managed
The module is managed by a WLAN controller.
Default:
Managed
Wireless ePaper
Configure the settings for the Wireless ePaper module here.
1419
Reference Manual
14 WLAN Management
SNMP ID:
2.88
Telnet path:
Setup
Operating
This entry allows you to set the operating mode of the module.
SNMP ID:
2.88.1
Telnet path:
Setup > Wireless-ePaper
Possible values:
Off
The module is not enabled.
Manual
Wireless ePaper configurations are done manually.
Managed
The module is managed by a WLAN controller.
Default:
Manual
14.19.10 WLAN profiles divided into basic and advanced profiles
As of LCOS version 9.10, LANconfig can be used to configure advanced profiles of a WLC under WLAN controller >
Profiles, for example to manage profiles for the location-based services (LBS).
14.19.11 General LBS profile and device location profile
As of LCOS version 9.10, you can create and map LBS servers and device location profiles for WLAN profiles on WLCs.
These profiles are mapped to WLAN profiles as follows:
1420
Reference Manual
14 WLAN Management
For each WLAN profile you can specify the following parameters under WLAN controller > Profiles > WLAN profiles:
LBS general profile
The general LBS profile selected here applies to the WLAN profile. You select the general LBS profile under
WLAN Controller > Profiles > Advanced profiles with the button LBS - General.
The AP table is a central element of the configuration for WLCs. Here, the WLC assigns WLAN profiles (i.e. the combinations
of logical and physical WLAN parameters) to the APs via their MAC addresses. Furthermore, the existence of an entry in
the AP table for a specific AP affects its ability to connect to a WLC. Under WLAN Controller > AP Configuration >
Access Point Table you can define the following parameters for each AP:
LBS AP location profile
LBS location profile from the list of defined profiles.
1421
Reference Manual
14 WLAN Management
General LBS profile and device location profile
In order to conveniently manage the settings for location-based services servers (LBS) and the AP locations by means of
a WLC, you create the appropriate profiles for LBS servers and AP device locations via the menu WLAN Controller >
Profiles and the button Advanced profiles.
The button LBS - General opens the dialog for creating a general LBS server profile.
Name
Enter a descriptive name for the profile.
LBS enabled
Enable or disable LBS.
LBS server address
Enter the address of the LBS server.
LBS server port
Enter the port used by the LBS server (default: 9091).
1422
Reference Manual
14 WLAN Management
The button LBS - AP locations opens the dialog for creating a location profile for the LBS APs.
Name
Enter a descriptive name for the profile.
Floor (0-based)
Here you enter the floor on which the device is located. This allows you to differentiate between the top floor
and bottom floor, for example.
Height
Here you enter the height of the device installation. It is possible to specify a negative value so that you can
differentiate between a location above and below sea level.
Degrees (latitude)
This field specifies the angle in degrees of the geographic coordinate system.
Minutes (latitude)
This field specifies the minutes of the geographic coordinate system.
Seconds (latitude)
This field specifies the seconds of the geographic coordinate system.
Hemisphere (latitude)
This field specifies the orientation of the geographic coordinate system. The following values are possible for
geographical latitude:
1
North: Northerly latitude
1
South: Southerly latitude
Degrees (longitude)
This field specifies the angle in degrees of the geographic coordinate system.
Minutes (longitude)
This field specifies the minutes of the geographic coordinate system.
1423
Reference Manual
14 WLAN Management
Seconds (longitude)
This field specifies the seconds of the geographic coordinate system.
Hemisphere (longitude)
This field specifies the orientation of the geographic coordinate system. The following values are possible for
geographical longitude:
1
East: Easterly longitude
1
West: Westerly longitude
Description
Enter a description of the device.
Additions to the Status menu
Common profiles
This column indicates the assigned LBS general profile.
SNMP ID:
1.73.2.3
Telnet path:
Status > WLAN-Management > AP-Configuration > Commonprofiles
Additions to the Setup menu
LBS general profile
The LBS general profile selected here applies to the WLAN profile.
SNMP ID:
2.37.1.3.9
Telnet path:
Setup > WLAN-Management > AP-Configuration > Commonprofiles
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]
Default:
empty
14.19.12 Additions to the Status menu
Acquire statistical data
This entry indicates whether the device collects statistical data.
SNMP ID:
1.73.123.9
1424
Reference Manual
14 WLAN Management
Telnet path:
Status > WLAN-Management > Client-Steering
Possible values:
Yes
The device collects statistical data.
No
The device does not collect statistical data.
14.19.13 WLC Clustering Wizard
As of LCOS version 9.10 it is possible to use the Clustering Wizard in LANconfig to configure the WLCs all at once.
4
With WLCs equipped with the “WLC High Availability Clustering XL option” you are able to select all of the listed
WLCs and configure them all in one go using the WLC Clustering Wizard (see
1-Click WLC High Availability
Clustering Wizard
).
1425
Reference Manual
14 WLAN Management
15 Public Spot
15.1 Introduction
This chapter provides answers to the following two questions:
1
What is a Public Spot?
1
Which functions and properties apply to the LANCOM Public Spot module?
15.1.1 What is a Public Spot?
Public Spots, also called hotspots, are places where users can connect their terminals – such as smartphones, tablet PCs
or laptops – to a publicly accessible network. Normally, these networks provide connections to the Internet; however a
Public Spot can also be limited to a local network in order to offer extra information to users visiting a museum or a
trade show, for example. The term is usually synonymous to the devices with which the user can connect to the network,
which is also why this manual does not differentiate between the location and the device.
Access via wireless LAN is widespread, however, it is also possible to access a Public Spot using a cabled LAN connection.
The most popular demand for these services originally came from business travelers at airports, in hotels, or at other
locations where their end devices require access to online content. The public rarely has access to modems, ISDN or
broadband connections in areas like this. However, the recreational use of Public Spots by private persons has become
very popular.
The solution: (W)LAN technology
Public Spot scenarios make use of the widespread (W)LAN technologies based on the internationally established IEEE
802.11/802.3 standards:
1
Access via WLANs provides fast, uncomplicated network access by radio. The user only needs a WLAN adapter for
their mobile device, which, for modern devices, is usually part of the standard equipment or can be inexpensively
added, usually with a USB interface. The bandwidth is sufficient for most applications, even when multiple users are
simultaneously logged in to a Public Spot.
1
With automatic address allocation via DHCP, access via LAN is similarly uncomplicated: In this case, the user only
needs a LAN adapter and a suitable cable for their end device, in order to connect their device to the Public Spot
network at a wall socket.
However, when accessing via LAN the user loses mobility and uninterrupted flexibility. However, this access – assuming
that a corresponding infrastructure is available – also provides stable network operation with the highest network load
(for example, for multimedia content such as video-on-demand) and a higher number of users (for example, in a large
hotel), where connections via WLAN may reach their limits sooner. It is also possible to add a Public Spot offering to an
existing cable infrastructure (for example, in a college) with the use of a Public Spot via LAN.
Noteworthy issues of access using (W)LAN
It is difficult to employ a standard WLAN access point or LAN router as a Public Spot for two main reasons:
1
User authentication is only possible by employing RADIUS/802.11x, so requiring the appropriate infrastructure and
configuration.
1
There is no facility for billing / accounting.
For this reason, the use of devices without the Public Spot function is not practical, since these devices are not able to
separate and log the specific network usage of authorized and unauthorized users of publicly accessible networks.
1426
Reference Manual
15 Public Spot
User authorization and authentication
As soon as an end device moves within range of an access point, the user can spontaneously established a connect to
this access point. The same is true for open LAN connections. However, the problem is that access should not be available
to the public in general, but only to certain selected users. Setting up restrictions of this type is the task of a Public Spot.
For this purpose, a Public Spot must be in a position to control access to the WLAN on a user basis. For simple Public
Spot installations, user data can be locally stored and managed in the router or access point – or alternatively on a
WLAN controller. Instead, complex installations employ a direct database connection to a central authentication server
in the interests of detailed accounting or direct management. Central servers of this type generally work with RADIUS
technology.
Accounting
If the Public Spot operator does not want to offer this service free of charge, connection data has to be collected and
billed for each user. Typical methods include: Purchase of a limited amount of online time (pre-paid method), retrospective
payment of consumed resources (credit payment), or unrestricted access until a certain time (e.g. checking out of a hotel).
For smaller Public Spot installations, accounting functions should be as simple as possible, and they should be implemented
locally in the device. Larger installations offer the facilities for billing via an external RADIUS server. For each application
scenario, the connection to an external system can also be implemented using a software interface which has access to
the accounting data and can control the user authentication (e.g. hotel reservation systems).
Logging
The operation of commercial telecommunications services is subject to national regulations. Certain information is to be
recorded and presented to law enforcement agencies upon request.
The Public Spot module provides suitable functions for recording user data with RADIUS accounting and SYSLOG.
5
Please note that operating a Public Spot (also referred to as a hotspot) can be subject to legal regulations in
your country. Before installing a Public Spot, please inform yourself about any applicable regulations. You can
also find information about this topic in the LANCOM techpaper "Public Spot" which is available at
www.lancom-systems.de/en/publications/products
.
15.1.2 Possible application scenarios
Guest access accounts in hotels
Wireless LAN makes it easier than ever for hotel operators to offer their guests convenient Internet access. Quick and
easy to install, hotspot solutions from LANCOM enable guests to use their own laptop, tablet or smartphone to access
the Internet via WLAN. Whether in the lobby, the conference room or in the hotel rooms—securely separated from the
internal network, guest access can be provided anywhere it is desired.
The option LANCOM Public Spot PMS Accounting Plus is ideal for straightforward accounting: All Public Spot logins are
automatically sent to the central PMS server where the hotel's accounting system is installed. In this way, guests can
login to the hotspot using their room number and last name. For fee-based Internet access, the usage fees can be billed
directly to the room. Needless to say, it is easy to set up free guest-access accounts in hotels, if desired.
1
Convenient setup and configuration – a user-friendly setup and configuration wizard guarantees easy setup of
the hotspot. For more details see the chapter
Basic installation of a Public Spot for simple scenarios
on page 1437.
1
No access by unauthorized persons to internal data – secure separation of the in-house and guest networks
within a single infrastructure is ensured with VLAN or Layer 3 tunneling. Also, data can be securely encrypted on the
wireless interface so that guests cannot penetrate the hotel network over the WLAN. For more details see the chapter
Virtualization and guest access via WLAN controller with VLAN
on page 1518.
1
Simplified guest login on the WLAN – The integrated Smart Ticket function ensures that the guest receives the
login data for the Public Spot conveniently and automatically via text message (SMS) or e-mail. Alternatively, vouchers
can also be printed out or guests can login with their room number and/or last name. For more details see the chapter
Alternative login methods
on page 1472.
1427
Reference Manual
15 Public Spot
1
Simple billing of fee-based Internet access – with the addition of the LANCOM Public Spot PMS Accounting Plus
option, it is possible to connect to hotel accounting systems such as Micros Fidelio. For more details see the chapter
Interface for property management systems
on page 1501.
Guest access in sport arenas
Stadiums that host large sporting events increasingly offer a range of modern services. For example, they should allow
very large numbers of spectators to use Internet access with their own end devices, for example to view live content
about the event, or to surf online. In order to offer spectators an Internet connection that is faster than the overloaded
cellular networks, a promising solution is to offload the data to the stadium WLAN with the aid of LANCOM solutions.
By connecting the clients to the stadium WLAN, the stadium operator has the possibility to create additional advertising
space for sponsors—and thus additional sources of income. For example, the hotspot login page can be customized or
sponsor websites can be invoked.
1
Multi-media fan experience – with a WLAN Internet access, fans have the attractive option of watching current
sports news live, and looking up information as well as watching replays.
1
New advertising spaces generate additional income – additional, attractive advertising spaces can be made
available to stadium operators by using the individual configuration options of the hotspot login page and also the
configuration of pre-defined websites which do not require a login (walled garden function). For more details see
the chapter
Open access networks (no login)
on page 1459.
1428
Reference Manual
15 Public Spot
1
Convenient setup and configuration – a user-friendly setup and configuration wizard guarantees easy setup of
the hotspot. For more details see the chapter
Basic installation of a Public Spot for simple scenarios
on page 1437.
Guest access at camping grounds
Camping grounds are exposed to the weather and are often quite large. Nevertheless, people vacationing at modern
camping grounds expect to have the convenience of Internet access from their own laptop, tablet or smartphone. Whether
in a tent, a camper or around the campfire, ubiquitously available Internet access is a real competitive advantage for
camping ground operators.
With the robust, weather-proof outdoor devices from LANCOM and the LANCOM Public Spot option, even these demanding
scenarios can be implemented with ease – and without the laborious and costly need to lay cables. For example, in
administration buildings for camping grounds, a WLAN controller (incl. LANCOM Public Spot option) is connected to a
LANCOM dual-radio outdoor access point. This sends the signal via point-to-point connections in the 5-GHz frequency
band to further outdoor access points, which provide WLAN coverage in the 2.4-GHz frequency band to the desired
areas—such as campsites or recreational areas for guests. The secure separation of the guest and administrative networks
is assured throughout, thanks to VLAN assignment.
1
Online convenience without laying cables – even in wide-open areas, guests can be connected to the Internet
without a costly and complicated installation.
1
Convenient setup and configuration – a user-friendly setup and configuration wizard guarantees easy setup of
the hotspot. For more details see the chapter
Basic installation of a Public Spot for simple scenarios
on page 1437.
1
Simplified guest access – The integrated Smart Ticket function ensures that the client receives the login data for
the Public Spot conveniently and automatically via text message (SMS) or e-mail. Or as an alternative, vouchers can
be printed out. For more details see the chapter
Alternative login methods
on page 1472.
1429
Reference Manual
15 Public Spot
1
Reliable even in extreme conditions – thanks to the robust IP66 outdoor housing and an extended temperature
range, LANCOM outdoor devices are reliable and defy even extreme weather conditions from -33° to +70°C.
Guest access in schools and universities
Researching at home, learning for tests, preparing classes, or interactive design: The potential of Internet usage for
students and pupils as well as teachers and staff of modern schools and universities is indispensable today—including
at isolated buildings, preferably wireless, and with the users' own end devices.
With the help of LANCOM WLAN solutions, this is easy to implement. By configuring separate networks, the Internet
access of the pupils and students is securely separated from the administrative access. Thanks to dynamic VLAN access,
the different user groups are assigned to the VLANs that are intended for them, using just one SSID. For example, only
staff have access to the university servers. At the same time, school and university students have the convenience of an
extensive WLAN guest access, which is so important these days. The authentication in the pupil and student networks
(e.g., Eduroam) can be implemented with IEEE 802.1X. This makes it possible for guest students from partner universities
to connect to the WLAN of the host university. And even conference guests can be provided with a temporary guest
access by means of a voucher.
1
Secure login for university affiliates – professors, students and staff of universities can have access to the Internet
and various online libraries over the securely encrypted WLAN.
1430
Reference Manual
15 Public Spot
1
No access by unauthorized persons to internal data – secure separation of the administrative, students', and
professors' and guests' networks within a single infrastructure is ensured with VLAN or Layer 3 tunneling. For more
details see the chapter
Virtualization and guest access via WLAN controller with VLAN
on page 1518.
1
No misuse of the network – with the LANCOM Content Filter, professional, database-supported verification of
websites is performed. Undesirable websites or web content can be made inaccessible to specified user groups.
1
Comfortable, cable-free Internet access – even in large open areas, guests have Internet access with their
WLAN-enabled end devices without a costly and complicated installation.
Guest access in companies
At any company with a complex network structure, the flexibility and stability of Internet access is extremely important.
Branch offices must have cross-site access to the company network, and home office employees also need access to
e-mail accounts and databases. In addition, customers and visitors should be offered a separate guess access.
With devices from LANCOM and the LANCOM Public Spot option, these scenarios are easy to implement. The sites are
connected using a VPN tunnel. Companies can provide access to the Internet for their external guests on their own
mobile devices ("Bring Your Own Device") using a separate guest network in the company main office and even at
networked branch offices. Access to the company's internal data is reserved for authorized employees only.
1431
Reference Manual
15 Public Spot
1
Secure separation of company and guest networks – the secure separation of employee and guess networks
within a single infrastructure is achieved by using VLAN or a Layer 3 tunnel. This keeps internal data safe from
unauthorized access. For more details see the chapter
Virtualization and guest access via WLAN controller with VLAN
on page 1518.
1
User-friendly setup and configuration – a LANCOM WLAN controller allows different user profiles to be defined
and configurations to be uploaded to the different WLAN devices – including those at remote sites.
1
Easy guest access – using vouchers, it is a simple task for your reception desk to provide guests with login data
for the Public Spot so that they can use their own mobile clients ("Bring Your Own Device"). In this way, only registered
users have access to the Internet and e-mail.
1
No misuse of the network – with the LANCOM Content Filter, professional, database-supported verification of
websites is performed. Undesirable websites or web content can be made inaccessible to specified user groups.
Guest access for providers
With the solutions from LANCOM, it is very easy for Internet providers to offer their customers a network with guest
access. The provider receives all necessary network products from one source, LANCOM, and manages the networks of
its clients centrally and conveniently—without a technician on site.
For the implementation, LANCOM access points are installed behind a LANCOM VPN router at the site of the provider's
client (for example, a hotel, hospital or business). An individually separated internal network is given direct Internet
access. The guest access is provided over a secure VPN tunnel to the central-site VPN gateway at the provider, who can
log incoming requests on their internal servers. With the LANCOM Content Filter, the provider can also limit or block
access to undesirable or illegal websites for customer guest-access accounts.
1
Simple and central management and roll-out – even without a technician on site, the provider can centrally
monitor and configure the networks for the customer. For more details see the chapter
Basic installation of a Public
Spot for simple scenarios
on page 1437.
1
Different redirect options – network separation means that the hotspot services can be designed and implemented
in various ways. For example, services offered to end customers can be limited to hotspot administration only, or
they can include full-service administration, whereby all data traffic from the end customer is forwarded to the
provider via a tunnel.
1
Connection of proprietary AAA systems – LANCOM provides different interfaces (RADIUS, XML, FIAS) which can
be combined with proprietary AAA servers. Custom authentication and login to the hotspot, as well as accounting,
1432
Reference Manual
15 Public Spot
can be implemented specific to each provider. For more details see the chapter
Alternative login methods
on page
1472.
1
Multi-provider support – LANCOM devices are not locked into access via a specific provider. Hotspot service
providers who cooperate with different providers can combine their software solutions over a variety of interfaces
with the help of LANCOM devices. For more details see the chapter
Alternative login methods
on page 1472.
1
No misuse of the network – with the LANCOM Content Filter, professional, database-supported verification of
websites is performed. Undesirable websites or web content can be made inaccessible to specified user groups.
1
Data offloading – WLAN hotspots can provide effective relief for cellular networks by offloading data traffic to
different infrastructures.
Guest access in gastronomy
Providing guests in a modern restaurant or café with a hotspot can significantly increase the appeal of any location.
With the WLAN solutions from LANCOM, guests benefit from a WLAN guest network in such a way that they can
comfortably use the Internet with their mobile smartphones, tablet PCs or laptops—while being securely and completely
separated from the internal administrative network. For a significant increase in efficiency in work processes, wait staff
also have the option of taking orders with the help of a WLAN-enabled hand-held device, and transmitting the order
directly to the checkout system, kitchen, or drink serving station. Needless to say, WLAN access for the guests and for
taking orders can also be made available on the patio or outdoor areas of the restaurant, since a robust LANCOM outdoor
access point is ideal for outdoor areas.
1
Customizable and flexible creative leeway – whether with proprietary logos, texts or images—the welcome
page of the Public Spot can be easily tailored to your own requirements. Even displaying pre-defined websites is
possible (walled garden feature), so that, for example, the menu of the restaurant or its own website is shown to
the guest without a prior login to the hotspot by the guest. For more details see the chapter
Default and customized
authentication pages
on page 1505.
1
No access by unauthorized persons to internal data – secure separation of the networks within a single
infrastructure is ensured with VLAN or Layer 3 tunneling. For more details see the chapter
Virtualization and guest
access via WLAN controller with VLAN
on page 1518.
1
Convenient setup and configuration – a user-friendly setup and configuration wizard guarantees the easy setup
of hotspots. For more details see the chapter
Basic installation of a Public Spot for simple scenarios
on page 1437.
1433
Reference Manual
15 Public Spot
1
Simplified guest access – The integrated Smart Ticket function ensures that guests receive their login data for the
Public Spot conveniently and automatically via text message (SMS) or e-mail. Or as an alternative, vouchers can be
printed out. For more details see the chapter
Alternative login methods
on page 1472.
15.1.3 Overview of the Public Spot module
The demands placed on devices operating Public Spots are as varied as the environments they are employed in. A Public
Spot offers various functions which are described in more detail in the following sections.
Open User Authentication (OUA)
Open User Authentication (OUA) is a method developed by LANCOM Systems It provides Web-based authentication by
means of an online form and is ideal for Public Spot installations.
Typical procedure for an online session with OUA
1. The user of a W(LAN)-enabled end device is within reach of an access point or a network outlet in a Public Spot
mode.
1
WLAN: After system startup, the WLAN adapter automatically logs on to the appropriate access point.
1
LAN: After system startup the user connects to the network with a suitable cable and is assigned an address by
the DHCP server.
Internet access or the use of chargeable services is not yet possible at this stage.
2. The user starts a web browser. The device offering the Public Spot service automatically directs the user to the login
page of the Public Spot. This page provides detailed information on using the services.
1434
Reference Manual
15 Public Spot
Generally, the user purchases a voucher with login data that grants a limited amount of access time. Other login
methods are also possible, such as login after confirming the provider's terms of use or independently requesting
login data via e-mail or a text message (SMS).
3. In the case of a login using a voucher, the user enters his login data (username and password) on the login page.
Depending on the configuration, the RADIUS server on the device (internal) or an external one checks the login data
that was entered. If the login is successful, the user gains access to the Public Spot. Otherwise an error message will
be displayed. If a prepaid model is employed, i.e. access is to be granted for a limited period of time only, then the
RADIUS server additionally informs the Public Spot about the user's time credit.
4. The user can log off from the Public Spot at any time. The Public Spot can terminate a session itself if the time credit
has expired, if a specified expiry date is reached, or if contact is lost for an extended period.
During and at the end of a session the Public Spot provides the user with an overview of the session data. If required,
the Public Spot can simultaneously transmit all important accounting information to the RADIUS server. This can be
the device's internal server or an external server.
OUA can be employed universally
The big advantage of the OUA method is that it is completely based on standard protocols. This guarantees that OUA
can be operated universally. It works with any (W)LAN adapter, can be seamlessly integrated in existing network
infrastructures, and makes it possible to implement additional features, for example, when the WLAN is between cells
during roaming.
Security in the (W)LAN
Wireless LANs are potentially a significant security risk. Public Spots present similar risks to the operator and users.
Security for the operator
Operators of Public Spots are primarily interested in the security of their own network infrastructure. A Public Spot module
provides operators with a range of security technologies and methods:
1
Multi-SSID (only WLAN), VLAN and virtual routers
2
The safe separation of public access can be achieved using one or more different radio cells for an access point
(Multi-SSID).
2
VLAN technology can separate public access from the private network of the operator.
2
Virtual routing technology ARF (Advanced Routing and Forwarding) from LANCOM supplies one SSID with its
own security and QoS settings and only specific destinations are routed on it.
This ensures that guest access over a Public Spot is securely and effectively separated from the productive network,
even though they share the same infrastructure. The device's internal firewall can, for example, limit the available
bandwidth in the WAN to max. 50 %, and access can be restricted to web pages (HTTP, port 80) and name resolutions
(UDP 53).
5
Further information on Multi-SSID, VLANs and ARF is available in the LCOS Reference Manual.
1
Traffic limit
To avoid denial-of-service (DoS) and brute-force attacks on the Public Spot you can restrict the permissible data
transfer for non-authenticated Public Spot participants to a harmless volume.
1
Locking access to the configuration
You can lock access from your Public Spot network to device configurations (e.g., your access points, WLAN controllers
or routers) so that access to configurations is only possible using other specified management interfaces.
1435
Reference Manual
15 Public Spot
Security for the user
The primary security concern for users of Public Spots is the confidentiality of their data. Users are also interested in
security of user data to avoid misuse. Users are protected by the following security technologies:
1
Intra-cell blocking (WLAN Only)
Prevent communication between the WLAN clients in your Public Spot network. Along with the user's existing security
mechanisms, this measure helps to prevent unauthorized access to the resources of your Public Spot users.
1
Encryption during the login phase
If you have a digital certificate, you can load it on your device in order to secure usernames and passwords using an
encrypted HTTPS method. The digital certificate should be signed by a recognized public authority so that browsers
classify it as trustworthy and do not display security errors to the users. If there is no certificate, data is sent
unencrypted.
5
The certificate merely secures the login process, as the data within a Public Spot network are normally not
encrypted. This is true for LAN as well as WLAN connections. If your users wish to secure their regular data
traffic as well, they will have to use their own encryption methods.
An exception to this are the WLAN connections via HotSpot 2.0: Since the HotSpot 2.0 standard is based on
WPA2 (802.1X/802.11i), EAP and 802.11u, data packets are always encrypted for transmission, both for
authentication and during the session.
LANCOM Systems strongly recommends that sensitive user data should only ever be transferred via encrypted
connections, such as the IPSec-based VPN tunnel with the LANCOM Advanced VPN Client or over normal encrypted
data connections based on HTTPS. In addition to this, Public Spot users should ensure that a personal firewall is
active on their end devices.
Setup wizard for Public Spots
The Setup Public Spot wizard helps you to setup and perform the initial configuration of your Public Spot. You can set
up a functional Public Spot network with just a few clicks. The wizard groups the necessary settings together (e.g. assign
an interface, choose an IP range, specify the access format and login procedure, logging) and offers you the option to
create an administrator with limited rights who can only create and manage Public Spot users.
Wizard for creating and managing users
Using the setup wizard Create Public Spot account you can use WEBconfig to create temporary accesses to the Public
Spot network with just a few clicks of the mouse. In the simplest case, you only need to enter the duration of access,
the wizard assigns the username and password automatically and stores the credentials in the user database of the
internal RADIUS server. The user receives a printed, personalized voucher, which the user can use to login to the Public
Spot network for the specified period.
The setup wizard Manage Public Spot account displays all registered Public-Spot user accounts in a table on a web
page. With just one click you have the most important data for your users on one screen, and you can easily view the
login status, information about login data and corresponding validity periods, extend a voucher, or delete a user account.
15.2 Setup and operation
This chapter contains the main information required for setting up and operating a Public Spot.
1
1) step: Basic configuration
First, we describe the basic configuration. After completing the basic configuration, the Public Spot is operational
and pre-configured for a simple application scenario (login using voucher).
1
2) step: Security settings
1436
Reference Manual
15 Public Spot
This chapter describes in detail the security settings that impede attacks on your Public Spot network and promote
stable operation. If you have not already made these settings during previous setup steps, you should pay close
attention to the following pages.
1
3) step: Extended functions and settings
Finally, we review the wide variety of available extended functions and settings. Detailed descriptions inform you on
how to individually adapt your device to its task and its environment. In addition, this chapter informs you on how
to keep an overview of the status and activities of your Public Spot.
5
Please note that operating a Public Spot (also referred to as a hotspot) can be subject to legal regulations in
your country. Before installing a Public Spot, please inform yourself about any applicable regulations. You can
also find information about this topic in the LANCOM techpaper "Public Spot" which is available at
www.lancom-systems.de/en/publications/products
.
15.2.1 Basic configuration
The instructions for the basic settings are divided into several separate sections:
1
The first section describes the setup of an operational Public Spot using a Wireless Router as an example.
5
To set up a Public Spot for a simple application scenario, you can start the corresponding wizard, which
assists you in configuring the Public Spot.
1
The second section describes the configuration of the default values for the user wizard with which new employees
can easily create and manage new Public Spot users without the need for general administrator rights. This also
includes creating a limited access account with which your employees can access this wizard only.
1
The third section describes user administration on the local RADIUS server, either using the user wizard or manually
with LANconfig.
To a certain extent these sections are dependent on one another, and ideally you should work through them in sequence.
Basic installation of a Public Spot for simple scenarios
Installation using the setup wizards
The following tutorial describes how to use LANconfig's Public Spot setup wizard to perform a basic Public Spot installation.
5
The wizard for the basic configuration of the Public Spot shows different dialogs depending on the device type
and your previous choices. This tutorial is only an example.
1. To do this, start LANconfig and select the device for which you want to set up the Public Spot, for example, a LANCOM
access point.
2. Start the Setup Wizard with Device > Setup wizard, select the action Setup Public Spot and then click Next.
1437
Reference Manual
15 Public Spot
3. If you want the Public Spot to be available over WLAN, enable the corresponding option and then click Next.
4. Select the logical interface from the drop-down menu which the Public Spot should offer (e.g., WLAN-1), and enter
a descriptive name for the wireless network (SSID). Click on Next.
5. Assign the IP address and netmask to the device that your Public Spot network should specify and click Next.
The Public Spot module has its own address on your network, which is independent from the address that you
assigned to your device. For example, if you have a 192.168.0.0/24 network set up and your device has the IP address
192.168.2.1, you can assign the IP address 192.168.3.1 and the subnet mask 255.255.255.0, as long
as this IP address has not already been used elsewhere.
If you want to separate the Public Spot network from internal networks for security reasons, make sure that the
corresponding option is enabled.
1438
Reference Manual
15 Public Spot
5
If your device is not directly connected to the Internet and you have a different address range for your Public
Spot, you must set up a return route to your Public Spot network on your Internet gateway. If there is no
return route, Public Spot users will see an HTTP error after they have successfully authenticated.
Please find the directions on how to set up a return route, in the documentation for your Internet gateway.
If it is a LANCOM device, you can configure it under IP router > Routing > IPv4 routing table. To do this,
create a new entry and enter the network address of your Public Spot network under IP Address and under
Router enter the address of the Public Spot in your local network.
6. Specify which login data your users are to use to login to the Public Spot. Also, you can optionally add customized
text to the login page. To continue, click on Next.
You can either give each user their own login data or set up a general account that all users use to access the Public
Spot. If you issue vouchers later and would like to set up permanent user accounts, select the option Individual
tickets per guest.
The login text is a customized text entered in HTML format, which appears on the login page inside the box on the
registration form. You can manually add or edit this text at a later time (see section
Customized text on the login
page
on page 1507).
7. If necessary, create an administrator with limited rights who can use the setup wizards in WEBconfig to create and
manage Public Spot users. To continue, click on Next.
This type of administrator is useful when you want your employees to be able to manage user accounts themselves
without the help of a device administrator. The right to create new accounts in WEBconfig enables the Create Public
Spot account wizard, and administrator rights enable the Manage Public Spot account wizard.
Using the user creation wizard Create Public Spot account, the administrator has the option of creating time-limited
accounts for Public Spot users and print the corresponding login data on a voucher.
1439
Reference Manual
15 Public Spot
The Manage Public Spot accounts wizard enable the administrator to manage the users. The administrator can
extend or reduce the validity period of access, or completely delete a specific user account. In addition, the
administrator can call up information about the user account using the wizard, such as the password in plain text,
the authentication status, the IP address, the sent/received data volume or any restrictions that apply to the account.
5
Make sure that the password you create is secure. The Setup Wizard will check the quality of the password
you enter. For passwords that are not secure the input field appears in red, when it is more secure it changes
to yellow, and when it is very secure the background turns green.
8. Select the procedure for user login. To continue, click on Next.
You can select HTTPS or HTTP in the drop-down list. Using a connection with HTTPS provides a secure connection
for Public Spot users.
9. Determine whether automatic re-login is allowed for all Public-Spot users, and the maximum absence that is allowed
before the user must login again on the Public Spot webpage. To continue, click on Next.
The Automatic re-login option is a convenience option that allows the Public Spot to automatically authenticate
known users or devices. However, if known devices are to be recognized exclusively from the MAC address of the
1440
Reference Manual
15 Public Spot
network adapter, the fact that MAC addresses can be falsified represents a potential security risk. For this reason
this option is disabled by default.
10. If needed, enable logging of logins and logouts for Public Spot users in the internal SYSLOG storage of your device.
To continue, click on Next.
Since the logs comply with country-specific regulations, this option is disabled by default. Before enabling this
function, you need to determine what the data protection regulations are for your country in order to avoid any legal
issues.
11. Save your changes if necessary.
Before you save the configuration to your device, you have the option of saving the configuration locally on your PC,
sending it by e-mail, or printing a summary.
12. The click Next and finally Finish to complete the basic installation of the Public Spot. The Setup Wizard will now
send the settings to the device.
1441
Reference Manual
15 Public Spot
That's it! You have completed configuration of your Public Spot module! Now, if you come within range of a Public Spot
with a WLAN-capable device, the device can find the SSID that you set up as a public network and login to it.
Manual installation
The following configuration steps show you how to manually setup a Public Spot for simple scenarios. For the application
scenario described here, you enable the Public Spot on an interface over which there is no other data traffic other than
the Public Spot traffic – where Public Spot and normal WLAN users do not share the same network (dedicated SSID).
5
This tutorial is only an example. Depending on the device type (access point, router, WLAN controller, etc.) or
complexity of the network configuration (e.g., use of VLAN or ARF), different or additional steps may be required
for setting up a Public Spot. Since this type of network configuration can be highly customized, this tutorial
concentrates specifically on a simple example, so that you can adapt the steps as needed.
1. To do this, start LANconfig and select the device for which you want to set up the Public Spot, for example, a LANCOM
access point. Next, open the configuration menu for the device.
2. Check that the time is correct.
To check the certificates and correctly record and bill session data, it is important for the Public Spot's time setting
to be accurate. First make settings such as time zone and time changes (summer and standard time):
1
LANconfig: Date/time > General
5
In order to ensure that the time of the Public Spot remains correct, the device should be set up as an NTP
client. Enter the time server that is necessary for that under Date/Time > Synchronization > Time server.
Open the "Add" window to show a list of possible server addresses.
3. Select the interfaces for the Public Spot operation.
Here you activate the interfaces which will be available to registered users. Along with the logical WLAN interfaces
which Public Spot users directly login to, the logical LAN interfaces (LAN-1, etc.), and the point-to-point connections
(P2P-1, etc.) can also be selected. When connected via the LAN or P2P interface, you can integrate additional access
points into a LANCOM Wireless router Public Spot. For an access point select, for example, the logical WLAN interface
WLAN-1.
1
LANconfig: Public Spot > Server > Interfaces
By activating the authentication for a WLAN interface, you automatically release the associated SSID for the Public
Spot operation.
5
On a LANCOM WLAN controller you can enable certain Ethernet interfaces for the Public Spot. In this manner
you can also set up selective restrictions for certain VLANs.
4. Access to your device from the Public Spot network should be restricted to the authentication pages.
If you do not restrict access, Public Spot users will be able to access the configuration interface of your device
(WEBconfig). For security reasons you should not permit this.
1442
Reference Manual
15 Public Spot
1
LANconfig: Public Spot > Server > WEBconfig access by Public Spot interfaces limited to authentication
pages
5. Disconnect the interface which is to be used for Public Spot operations from the other network traffic.
In order for end devices to be able to communicate with each other using different interfaces of a LANCOM (e.g.,
between LAN-1 and WLAN-1), these interfaces are logically connected to each other (bridged) within your device.
However, in a Public Spot scenario this type of bridging may not be desirable for security reasons. In order to
disconnect the communication between an interface (e.g., WLAN-1) assigned to a Public Spot and the rest of the
network, you have to remove bridging. In the Port table set the Bridge group for the respective interface to none.
1
LANconfig: Interfaces > LAN > Port table
6. Enable the WLAN for the Public Spot.
This setting does not affect: LANCOM routers, WLAN controllers, central-site gateways.
Activate the logical WLAN which you enabled for the Public Spot login and assign a descriptive name to this network
(SSID).
1443
Reference Manual
15 Public Spot
1
LANconfig: Wireless LAN > General > Logical WLAN settings > WLAN network <number> > Network
7. Assign the IP address and netmask to the device that your Public Spot network should specify.
The Public Spot module has its own address on your network, which is independent from the address that you
assigned to your device. For example, if you have a 192.168.0.0/24 network set up and your device has the IP address
192.168.2.1, you can assign the IP address 192.168.3.1 and the subnet mask 255.255.255.0, as long
as this IP address has not already been used elsewhere. Select the interface that you chose under Interface
assignment e.g., WLAN-1.
1
LANconfig: IPv4 > General > IP networks
5
If your device is not directly connected to the Internet and you have a different address range for your Public
Spot, you must set up a return route to your Public Spot network on your Internet gateway. If there is no
return route, Public Spot users will see an HTTP error after they have successfully authenticated.
Please find the directions on how to set up a return route, in the documentation for your Internet gateway.
If it is a LANCOM device, you can configure it under IP router > Routing > IPv4 routing table. To do this,
1444
Reference Manual
15 Public Spot
create a new entry and enter the network address of your Public Spot network under IP Address and under
Router enter the address of the Public Spot in your local network.
8. Configure the DHCP server settings for the Public Spot network.
Since the device has an IP network that is independent from the network where it is located, you must configure a
DHCP server for this network. For the previously set up IP network (e.g., PS-WLAN-1), set the value for DHCP
server enabled to automatic.
1
LANconfig: IPv4 > DHCPv4 > DHCP networks
9. Disable the encryption for the interface that you are using for the Public Spot.
This setting does not affect: LANCOM routers, WLAN controllers, central-site gateways.
Encryption for all logical WLANs is enabled by default. In Public Spot applications, the payload data between the
WLAN clients and the access point are usually transmitted unencrypted. For this reason, disable encryption for the
logical WLAN which you previously set up for the Public Spot login.
1445
Reference Manual
15 Public Spot
1
LANconfig: Wireless LAN > 802.11i/WEP > WPA or Private WEP settings
10. Select the authentication mode and the protocol used for the user login.
The authentication method that you select determines the information which users of the Public Spot WLAN must
enter when logging in. Select Authenticate with name and password to allow your users the option to login with
an individual username and password that you have previously assigned them. This setting also allows you to quickly
provide Hotspot access to your guests using vouchers (tickets).
Use HTTPS as the protocol in order to be able to send encrypted login data to your users during login.
1
LANconfig: Public Spot > Authentication > Authentication mode
11. Specify the internal RADIUS server as the server responsible for user administration and accounting. To do this, enter
the Authentication port1.812 and Accounting port1.813.
You store Public Spot access accounts in the user database on the device's own RADIUS server. In order to use Public
Spot access accounts, you must configure the RADIUS server and the Public Spot module to use the RADIUS server.
1446
Reference Manual
15 Public Spot
1
LANconfig: RADIUS server > General
12. Create an entry for the internal RADIUS server in the list of authentication servers of the Public Spot. Under Auth.
server IP address and Acc. server IP address enter the loopback address 127.0.0.1. Use the Auth. server
port and Acc. server port used for the authentication port and accounting port in the previous settings.
The list entry is necessary in order for the Public Spot to recognize the address of the RADIUS server and so that it
can authenticate Public Spot access on the internal RADIUS server.
1
LANconfig: Public Spot > Users > Authentication servers
13. Set up filter rules in the Public Spot's firewall to secure your local network. In each case, create an "accept" rule (for
example, ALLOW_PS-WLAN-1) and a "reject" rule (for example, DENY_PS-WLAN-1).
You use the accept rule when devices are to be able to send DNS requests from the Public Spot network to all local
networks, e.g., your local intranet. On the other hand, with a reject rule you generally block all access or requests
from the Public Spot network to your local network. The order – accept before reject – is essential, since the firewall
applies rules from top to bottom of the list.
1447
Reference Manual
15 Public Spot
1
LANconfig: Firewall/QoS > IPv4 Rules > Rules…
1
"Accept" rule settings:
a) Enter the name of the rule in General, for example, ALLOW_PS-WLAN-1.
b) Remove all possible predefined action objects from the list and using Actions > Add.. add an action object of
type ACCEPT.
c) In Stations > Connection source, enable the option Connections from the following stations and select
Add... > Add custom station.
d) In the Stations window that opens, select the option All stations in local network and for Network name
select the name of your Public Spot IP network, e.g., PS-WLAN-1. Close the dialog with OK.
e) In Stations > Connection destination, enable the option Connections to the following stations and after
selection Add... choose LOCALNET.
f) In Services > Protocol/target services enable the option Following protocol/target services and select
Add... > DNS.
g) End the filter rule dialog with a final click on OK.
LANconfig then enters the allow rule into the rule table.
1
"Reject" rule settings
a) Enter the name of the rule in General, for example, DENY_PS-WLAN-1.
b) Remove all possible predefined action objects from the list and using Actions > Add.. add an action object of
type REJECT.
c) In Stations > Connection source, enable the option Connections from the following stations and select
Add... > Add custom station.
d) In the Stations window that opens, select the option All stations in local network and for Network name
select the name of your Public Spot IP network, e.g., PS-WLAN-1. Close the dialog with OK.
e) In Stations > Connection destination, enable the option Connections to the following stations and after
selection Add... choose LOCALNET.
f) End the filter rule dialog with a final click on OK.
LANconfig then enters the rejection rule in the rule table.
1448
Reference Manual
15 Public Spot
14. Store the configuration on your device.
That's it! You have completed configuration of your Public Spot module! Now, if you come within range of a Public Spot
with a WLAN-capable device, the device can find the SSID that you set up as a public network and login to it.
Setting default values for the Public Spot wizard
The following section describes how you define default values for the new-user wizard (Create Public Spot account).
1. Start LANconfig and open the configuration dialog for the device.
2. Change the view to Public Spot > Wizard.
3. In Default validity periods, define which default validity periods for user accounts and vouchers are to be available
by default.
The new-user wizard takes the shortest validity period as the default.
4. In User name pattern you indicate what pattern is used by the new user wizard to create usernames.
You can enter up to 19 characters, whereby the wizard will automatically create a unique number for every user if
you enter "%n". The default description user%n will be shown later on the voucher, for example, as user12345.
5. Using Password length you specify the length of the passwords that the new user wizard generates for Public Spot
access.
The default is 6 characters. If you would like to have longer passwords, keep in mind that guests can make mistakes
when entering them, which can cause unnecessary problems and complaints.
1449
Reference Manual
15 Public Spot
6. Public Spot via WLAN only: Using Public Spot SSIDs you specify the names of the Public Spot networks taken by
default when you create new user accounts using the Create Public Spot account wizard.
The Create Public Spot account wizard automatically marks the specified network names as SSID selected when
creating a new Public Spot user. If you employ an access point, WLAN controller or WLAN router, for example, you
can select several network names as default values in order to give users access to various different WLANs (e.g.,
for WLANs in the hotel lobby, the conference room, and floors where their rooms are located). When creating a new
user and subsequently printing the voucher, these SSIDs are also printed out on the voucher.
Using the arrow buttons, you can change the display order of the SSIDs. In this way, SSIDs that are used most often
can be kept at the top of the list.
Setting up limited administrator rights for Public Spot managers
In order for employees to be able to manage a Public Spot on the device without further permissions, you can explicitly
assign them the function rights to use the Public Spot wizard. This tutorial describes the steps to set up Public Spot
function rights for employees without giving them additional administrator rights.
5
You need to have the "Supervisor" permission to be able to assign Public Spot management to an employee.
1. Start LANconfig.
2. Open the configuration for the device for which you want to register a Public Spot administrator.
The Public Spot option has to be enabled on this device.
3. Change to the view Management > Admin, click in the section Device configuration on Further administrators,
and then click on Add.
If you want to allow an existing user to perform Public Spot management, select the user's entry in the table and
click on Change.
4. You activate the profile by checking the Entry enabled box.
5. Assign a descriptive name in the field Administrator.
6. Enter a password and repeat it to be sure.
7. Set the Access rights to None.
When you modify an existing user, you should not modify existing function rights.
1450
Reference Manual
15 Public Spot
8. In the section Function rights enable the Public Spot wizard (add user), and Public Spot wizard (manage
user).
When you modify an existing user, you should not modify existing function rights.
9. Save the new or modified profile by clicking on OK.
The Public Spot administrator is offered the Public-Spot wizards in the navigation when they log on using WEBconfig.
Using the user creation wizard Create Public Spot account, the administrator has the option of creating time-limited
accounts for Public Spot users and print the corresponding login data on a voucher.
Using the user management wizard Manage Public Spot account, the administrator has the option of managing these
users as well as the users that you created as the main administrator using the RADIUS user database. The administrator
can extend or reduce the validity period of access, or completely delete a specific user account. In addition, the
administrator can call up information about the user account using the wizard, such as the password in plain text, the
authentication status, the IP address, the sent/received data volume or any restrictions that apply to the account.
5
The function right Public Spot XML interface is not needed by a normal Public Spot admin. The right is only
relevant if you use the
XML interface
, and should not be combined with the function rights described above for
security reasons.
Setting up and managing Public Spot users for simple scenarios
You can set up and manage Public Spot users either manually or by using the setup wizard. Setting up and managing
the configuration options manually offers you more extensive options and allows you, for example, to create self-defined
users with an unlimited lifetime.
On the other hand, the setup wizard allows you to create generic Public Spot users with automatically generated login
data with limited lifetimes. The respective setup wizard is only accessible using WEBconfig, which allows you to quickly
create users without requiring administrator permissions for the entire device. The only requirement is an administrator
with limited permissions.
You naturally also have the option to initially create generic users with the aid of the setup wizard and then manually
adapt them to your needs (e.g., change the usernames).
Setup and management using the Setup Wizard (WEBconfig)
The Setup Wizards provide you with an easy method of managing Public Spot users.
Adding Public Spot users with a single click and voucher printing
The following section describes the setup of a Public Spot user using WEBconfig and then printing a voucher. You can
also prepare vouchers in advance.
5
You need the permissions for the Public Spot Wizard, in order to create a new Public Spot user.
1. Log on to the WEBconfig home page as an Administrator.
1451
Reference Manual
15 Public Spot
2. Start the setup wizard by clicking on Setup wizards > Create Public Spot account
3. The new user wizard starts with an input screen. The fields have default values.
The wizard automatically creates a username and a password. In the subsequent printout dialog you can select the
voucher printer and print-out the voucher.
4. If necessary, you can change the default values before you print it.
The following entries affect the appearance as well as the validity of the vouchers:
1
Starting time for account: Sets the time when the voucher becomes valid. Possible values are:
2
First login: Access is valid as of the user's initial login
2
Immediately: Access is valid as of the creation of the user's account
5
To a supply of vouchers in advance, select First login as the validity of the vouchers. That way
the vouchers will still be valid even after a longer period.
1
Validity period: Voucher expires after: Enter the overall time period within which the voucher can remain
valid.
5
If the access is to be valid immediately, it is not possible to enter a validity period.
1
Duration: Set how long access is to be available after registration or the first login. The values listed here are
managed in the Default validity periods table. The pre-defined values are:
2
1 Hour(s)
2
1 Day(s)
2
5 Day(s)
1
Max. concurrent logins: Select the maximum number of concurrent devices that can have access to the user
account for the corresponding user. The values listed here are managed in the Max. concurrent logins table.
The pre-defined values are:
2
Unlimited
1452
Reference Manual
15 Public Spot
2
Only 3 device(s)
2
Only 10 device(s)
1
Multiple login: Select this option in order to allow a user to login with several devices using the same login
data. The number of devices that can be logged on simultaneously is specified using the drop-down list
Max-concurrent-logins.
1
Bandwidth profile: Select a bandwidth profile from the list in order to selectively restrict the amount of bandwidth
available to the user (uplink and downlink). Create a bandwidth profile in the Bandwidth profile table.
1
SSID (network name): Specify which wireless LAN network the access applies to. This SSIDs listed here are
managed in the SSID table. By pressing the "Ctrl" button you have the option of selecting multiple entries.
Default entries are already pre-selected.
5
If you have not defined any entries in the table, the wizard conceals this option.
1
Number of vouchers: Specify how many vouchers you want to create at a time. If you set the login time as the
access start time, you can print-out a supply of vouchers in advance.
1
Time budget (minutes): Specify the amount of time after which access to the Public Spot is closed.
5
Depending on the chosen expiry method, access time is limited either to the time budget (incremental)
or to the set voucher validity period (absolute).
1
Volume budget (MByte): Specify the available data volume after which access is closed.
1
Comment (optional): Enter a comment here. This comment can contain, for example, additional notes about
the access duration or the telephone number of the receptionist in case of access problems.
1
Print comment on voucher: Check this option if the comment is to appear on the voucher.
1
Print: Check this option to print the vouchers as soon as they are registered.
1
User name case-sensitive: Enable this option if Public Spot users have to pay attention to capitalization when
entering their user name at login.
5. If you want to keep the default values or accept the new values without changing them, you click on Save and print
at the end.
If the Print option is disabled, the wizard displays a summary of the new Public Spot users after they have been
registered. You then have the opportunity to print the vouchers again.
Wizard for Public Spot user management
The following section describes how to use WEBconfig to manage the registered Public Spot users.
5
You need the Public Spot wizard permission, in order to manage a Public Spot account.
5
Unsaved changes are lost once you finish this wizard.
1. Log on to the WEBconfig home page as an Administrator.
2. Start the setup wizard by clicking on Setup-Wizards > Manage Public Spot accounts
1453
Reference Manual
15 Public Spot
3. The Public Spot wizard starts with a list of registered Public Spot users.
In the Show... entries per page drop-down list you set how many entries are displayed per page. The corresponding
pages are accessed via the page navigation at the lower right:
1
First page: Shows the page with the first entries.
1
Previous page: Returns to the previous page.
1
Page numbers (1, 2, 3, ...): Goes directly to the chosen page.
1
Next page: Goes to the next page.
1
Last page: Shows the page with the latest entries.
With Search you can filter the displayed entries. The filter immediately searches for entered strings.
You export highlighted entries with Save as CSV.
The column headers have the following meaning:
1
Page/All: This column is used to select the user for the desired action (print, delete, save). To select all entries
on the current page, select Page. To select all of the entries, select All.
1
Name: Manually or automatically displays the username generated by the system.
1
Password: Manually or automatically displays the password generated by the system.
1
Comment: Includes the comment entered at registration (in brackets) and any changes to the user data
(automatically documented by the system).
1
Expiry type: Indicates whether the validity period of this user account is absolute (e.g. expires on a set date) or
relative (expires after the time has elapsed since the first successful login).
1
Abs. expiry: If "absolute" has been selected as the expiry type, the user account becomes invalid at the time
defined in this field.
1
Rel. expiry: If "relative" has been selected as the expiry type, the user account becomes invalid after this time
period has expired since the user logged in for the first time.
1
Time budget: Specifies the maximum access time for this user account. The user can use this duration of access
time until a relative or absolute expiry time (if set) is reached.
1
Volume budget: Specifies the maximum data volume for this user account. The user can use this data volume
until a relative or absolute expiry time (if set) is reached.
1
Case sensitive: Indicates whether the login page takes capitalization of the user name into account.
1
Tx-Limit: If a bandwidth profile was entered for the user, this entry shows the maximum transmission bandwidth
available to that user.
1
Rx-Limit: If a bandwidth profile was entered for the user, this entry shows the maximum receiving bandwidth
available to that user.
1
Traffic (Rx/Tx Kbyte): Indicates the data volume in kilobytes that the user has received (Rx) or sent (Tx) so far.
1
State: Shows the authentication status of the individual users. Possible values are:
2
Unauthenticated: The user is currently not logged on to the Public Spot.
2
Authenticated: The user is currently logged on to the Public Spot.
1
MAC-Address: Indicates the physical address of the network adapter for the device with which the user is
currently connected.
1
IP-Address: This shows the IPv4 address that the system currently has allocated to the user.
The buttons at the bottom of the window have the following functions:
1454
Reference Manual
15 Public Spot
1
Print: Print out the voucher for the selected user.
1
Delete: Delete the selected user.
1
Save: Save the changes.
1
Back to main page: Return to the main page; all unsaved changes will be lost.
You can edit the following user information by changing the contents of the corresponding fields:
1
Expiry type
1
Abs. expiry
1
Case sensitive
4. Select the account that you want to edit in the first column.
5. Change the corresponding field values and click Save to apply the changes. Unsaved changes are lost once you
finish this wizard.
6. If you would like to delete a user, mark the corresponding entry in the first column and click Delete.
5
The deletion takes place immediately without confirmation.
Manual set up and management
The following configuration steps show you how to use LANconfig to manually setup a Public Spot user for simple
scenarios. You create and manage Public Spot users using the User database of the device's internal RADIUS server
under RADIUS server > General. Here you enter all of the users who should have access to the Public Spot – just as
the setup wizard does as well.
5
For user administration, the Public Spot module also has its own internal list (found under Public Spot > Users >
User list). During technical development, this list was replaced as of LCOS 7.70 by the user administration via
RADIUS. For compatibility reasons, the device still evaluates the internal user list of the Public Spot module if it
is enabled. However, for a new installation you should no longer use this list, since it prevents you from using
many features (setup and administration using the wizard, bandwidth restrictions, accounting via RADIUS, VLAN
IDs for Public Spot users, etc.).
1. In Name you enter the usernames of future users or the MAC addresses of their end devices.
If you selected the authentication mode Login with name and password, enter the name of the username that
the user employs to authenticate on the Public Spot. Entering a password is optional, however it is recommended
for the authentication mode above.
1
LANconfig: RADIUS server > General > User database
1455
Reference Manual
15 Public Spot
5
If the authentication is performed using the MAC address (authentication modus Authenticate with name,
password and MAC address), you define the MAC address using the field Calling station in the format
12:34:56:78:90:AB.
2. Set the Service-Type to Login.
3. You remove all protocol restrictions by deselecting all check boxes.
Two-phase authentication is not performed in a Public Spot scenario. This only makes sense for direct WLAN
connections without Public Spot operations and the associated RADIUS users.
5
If you do not completely remove the protocol restrictions, a user cannot log in using the login web page of
your Public Spot!
4. Optional: On request, you can also, for example,
1
Enter a relative and/or absolute expiry date for the validity of the user account in the section Validity/Expiry
(relative = validity in seconds after the first login);
1
Limit the uplink/downlink under TX/RX bandwidth limit;
1
Enable Multiple login and enter the Max. concurrent logins of end devices
5. Store the configuration on your device.
That's it! Your Public Spot users can now login with the credentials that you specified.
15.2.2 Security settings
The Public Spot has two additional safety mechanisms that effectively protect it against abuse.
Traffic limit option
In order for clients to login to the Public Spot via a browser, it must be possible for unauthorized users to transfer data
packets (e.g. for DNS requests) to the access point. By default, there is no limit on this data. The following risks are
associated with this:
1
Unauthorized use of a Public Spot: Certain tools enable a user to pack data into a DNS packet (i.e. to establish
a DNS tunnel) and to work with the Public Spot without logging in.
1
Denial-of-Service: The attacker could send large amounts of data to the device and thus try to block the device or
Public Spot.
1
Brute force: The attacker could repeatedly try to access the base station by guessing the login data until successfully
breaking in.
The traffic limit option can effectively eliminate these risks.
You enable the traffic limit option by setting a value other than "0". This value determines the maximum data quantity
in bytes that can be transmitted between the base station and an unauthorized terminal device.
1
LANconfig: Public Spot > Server > Allow access without authentication > Maximum data volume
When a terminal device exceeds this traffic volume, the Public Spot locks this device and drops all data received from it
without inspection. This lock expires only when the device entry disappears from the station table.
5
For WLAN devices, this deletion can follow the general idle timeout, for example:
WEBconfig: LCOS menu tree > Setup > WLAN > Idle timeout
1
Please keep in mind that if station monitoring is active, the lock may be removed earlier. If the mobile station
cannot be reached for 60 seconds, the device removes its entry from the station table, and also the block.
5
The idle timeout for the Public Spot module has the same purpose as the idle timeout for WLANs, but it applies
only to connections via Public Spots. If the idle timeout is set and no further data packages are received from a
user, the device automatically logs the device out at the end of the specified time period.
1
LANconfig: Public Spot > Server > Idle timeout
1456
Reference Manual
15 Public Spot
On the one hand the optimal value for traffic limit depends on the data volume of the login page. On the other hand,
this value has a significant effect on the potential number of failed login attempts per user. Generally, a traffic limit of
60,000 bytes provides effective protection for a Public Spot but allows a sufficient number of login attempts. You can
adjust this value to your individual needs, if necessary. The default value of "0" bytes allows an unlimited volume of
data.
5
The traffic limit option only monitors the traffic before authentication. It does not take into account the traffic
to and from a free Web server. This remains unlimited at all times.
Restricting access to the configuration
Public Spot access to a Public Spot network's configuration (WEBconfig) should always be prohibited for security reasons.
A special switch allows access via the Public Spot interface to be restricted to the Public Spot authentication pages only.
All other configuration protocols are automatically blocked.
1
LANconfig: Public Spot > Server > WEBconfig access by Public Spot interfaces limited to authentication
pages
5
Note that using permissions under Management > Admin > Configurations access ways > Access rights
you cannot generally limit the access via HTTP(S) to the device.
15.2.3 Extended functions and settings
The Public Spot offers a wide range of extended functions, options and parameters, which can be used to adapt it to
the specific requirements of the application at hand.
In the following sections you will find information about:
1
Multiple logins
By default, the use of login data is restricted to login with one device. Find out how you increase this limit or completely
remove this limit for a user account.
1
Open access networks (no login)
1457
Reference Manual
15 Public Spot
Setup additional networks so that Public Spot users can also reach them without logging in to the Public Spot to
provide the user with additional information (e.g., customer web sites inside the company, event calendars in a
hotel).
1
User administration using the Web API
Use URLs to create and administrate Public Spot users with file links or scripts.
1
Individual bandwidth limitation
Individually set uplink and downlink restrictions for each Public Spot user.
1
Automatic cleanup of user accounts and mobile stations
Use the device's own functions to automatically delete expired Public Spot user accounts and improperly logged off
mobile stations (WLAN only) from the device's internal databases.
1
WLAN handover of sessions between devices
Find out more about the roaming possibilities of mobile stations between access points, and what special configurations
are necessary so that your users benefit from the seamless handover of WLAN sessions.
1
Authentication via RADIUS
Find out how you can provide multiple RADIUS servers for authentication and accounting, and how you can chain
them, in order to forward the user data to the appropriate backup system in case individual systems are unavailable.
1
Accounting for Public Spot connections for commercial operation
Learn more about the accounting functions provided by the Public Spot for commercial operations. These billing
functions can be roughly divided into two models:
2
Retrospective payment for the resources actually used (credit accounting)
2
Service use on a debit payment basis (PrePaid)
1
Using multi-level certificates
Find out how to load certificate chains on your device.
1
Individual assignment of VLAN IDs
Find out how to assign individual VLAN IDs to specific Public Spot users.
Multiple logins
You have the ability to allow Public Spot users to simultaneously sign in using one user account for multiple devices.
This can be necessary for a group of people (for example, a family) that has multiple devices, which they would like to
use to simultaneously access the Internet.
Setting default values
To use this feature, define the number of concurrent devices in the setup menu under Public Spot module > Add user
wizard > Max. concurrent logins table. Enter the values here that you assigned in the second step with the Add user
wizard. The value 0 stands for "unlimited".
Enabling multiple logins in the new user wizard
When you invoke the Wizard Create Public Spot account, you will see the menu item Max concurrent logins. The
values shown here correspond to the numbers that you previously entered in the table of the same name. The values
are shown within the phrase "Only ... device(s)".
1458
Reference Manual
15 Public Spot
Select the maximum number of concurrent devices that can have access to the user account for the corresponding user.
Please note that to enable the feature in the wizard, the option Allow multiple logins must also be enabled.
Open access networks (no login)
To provide users with access to important information without them having to login (e.g., important contact information)
you can define any publicly available Web server.
1
LANconfig: Public Spot > Server > Web server name/IP Address
If you do not want to completely release this service, you can optionally define an alternative path to the web server.
1
LANconfig: Public Spot > Server > Directory
In addition to freely available web servers, you can define other networks and special sites which your customers can
access without having to log on.
1
LANconfig: Public Spot > Server > Free networks or Page table
1459
Reference Manual
15 Public Spot
Free networks
Enter the IP address of the server or of the network with its netmask, that your Public Spot users are to be given
access to. Alternatively, you have the option of entering a domain name (with or without a wildcard "*"). Wildcards
2
can be used, for example, to allow free access to all of the subdomains of a particular domain. The entry
*.google.com allows the addresses mail.google.com, and maps.google.com, etc.
If you wish to authorize a domain or just a single workstation with the address named earlier, set
255.255.255.255 as the netmask here. If you wish to authorize a whole IP network, specify the
corresponding netmask. If you do not set a netmask (value 0.0.0.0), the device ignores the table entry.
2
Page table
Enter the addresses (URLs) of the web pages to be displayed to users on the Public Spot in case of login, error,
status display, etc. Read the chapter about
Default and customized authentication pages
.
DNS snooping
Web services with a high number of users distribute the requests for data to multiple servers for better utilization. This
means that two DNS queries for the same hostname (e.g. "www.google.com") can lead to to two different IP addresses.
If a Public Spot receives more than one valid IP address for the specified host name from the DNS server, it chooses one
of them and stores it for future requests by Public Spot users. If a different IP address for the same host name is allocated
to the user by a different server for a subsequent request, the Public Spot blocks this connection because this IP address
is not stored as the authenticated one.
In order for Public Spot users to be able to connect to the requested host despite changing IP addresses, the Public Spot
analyzes the user's DNS queries and stores the returned IP address with the host name, the valid time to live (TTL ), the
age and the data source as a free destination address in the table Status > Public Spot > Free-Hosts for subsequent
use.
The entries in this table will expire after the time period defined in the DNS response (TTL). When the limits are very low
(e.g. 5 seconds), you can avoid locking out Public Spot users immediately after a request by setting a minimum validity
under Setup > Public Spot-Module > Free-Hosts-Minimum-TTL.
Managing Public Spot users via the web API
As an alternative to using the Setup Wizard, entering a special URL in the address bar gives you the option of displaying,
creating or deleting Public-Spot users directly.
URL structure
The URL is structured as follows:
http://<Device-URL>/cmdpbspotuser/...?action=actiontodo&parameter1=value1&parameter2=value2
The following actions are available:
1
action=addpbspotuser: Creates one or more new Public Spot users and then prints out the required number of
vouchers.
1
action=delpbspotuser: Deletes the Public Spot user with the specified user ID.
1
action=editpbspotuser: Displays the Public Spot user with the specified user ID. You can then print out the user's
voucher again.
1460
Reference Manual
15 Public Spot
The required parameters and their values depend on the action specified.
5
The Wizard ignores incorrect parameter information and accepts only the correct parameters. If you omit a
required parameter or specify it incorrectly, the wizard displays an input mask. Enter the correct parameter values
here.
Adding a Public Spot user
To register a new Public Spot user, simply enter the following URL:
http://<deviceURL>/cmdpbspotuser/
?action=addpbspotuser&parameter1=value1&parameter2=value2&...
The following parameters are available:
comment
Comment on the registered user
If it is possible to enter multiple comments for a Public Spot user, you can enter the comments and their
corresponding comment-field names as follows:
&comment=<Content1>:<FieldName1>;<Content2>:<FieldName2>;...;<Content5>:<FeildName5>
If there is just one comment field per user, then the comment is entered as follows:
&comment=<Comment>
5
Special characters such as German umlauts are not supported.
5
The maximum number of characters for the comment parameter is 191 characters.
print
Automatic print-out of the voucher.
If this parameter is omitted, the wizard displays a button that you can use to print the voucher.
printcomment
Print the comment on the voucher.
If this parameter is omitted, no comment will appear on the voucher (default setting).
nbGuests
Number of Public Spot users to be created.
If this parameter is omitted, the wizard creates one user only (default setting).
defaults
Use default values
The wizard replaces missing or incorrect parameters with default values.
expiretype
Combined output of expiry type and validity period of the voucher.
Specify this parameter as follows:
&expiretype=<Value1>+validper=<Value2>
The parameter values have the following meaning:
1
Value1: Expiry type (absolute, relative, absolute and relative, none)
1
Value2: Voucher validity period
1461
Reference Manual
15 Public Spot
If these parameters are omitted or set with incorrect values the wizard will apply the default values.
ssid
Network name
If this parameter is omitted, the wizard uses the default network name (default setting).
unit
Access time
Specify this parameter as follows:
&unit=<Value1>+runtime=<Value2>
The parameter values have the following meaning:
1
Value1: LIfetime units. Possible values are: Minute, hour, day
1
Value2: Duration
timebudget
Time budget
If this parameter is omitted, the wizard uses the default value.
volumebudget
Volume budget
If this parameter is omitted, the wizard uses the default value.
multilogin
Multiple logins
If you specify this parameter, the user can login multiple times with his/her user account. If this parameter is
missing, multiple logins are disabled by default.
maxconclogin
Maximum number of concurrent logins
With this parameter you specify with how many different end devices a user can login to a Public Spot. Valid
entries are integers such as 0, 1, 2, ....
If this parameter is missing or if the parameter has the value 0, this means that the number of devices is
unlimited.
5
This parameter requires that multiple logins be enabled. Setting this parameter in isolation has no
other effects.
casesensitive
User name case-sensitive:
If you enter this parameter, the Public Spot user must pay attention to capitalization when entering the user
name at login. Valid values are:
1
0: Case-sensitive username is disabled
1
1: Case-sensitive username is enabled
If this parameter is omitted, the wizard uses the default value.
bandwidthprof
Bandwidth profile
1462
Reference Manual
15 Public Spot
With this parameter you assign a pre-defined bandwidth profile to a Public Spot user. Enter the valid value
for this parameter as the line number of an existing profile name under Setup > Public Spot module >
Add user wizard > Bandwidth profiles, such as
&bandwidthprof=1
to index the first entry in the table.
If this parameter is missing or the line number is invalid (for example, the table is empty), the wizard does
not limit the bandwidth.
5
If the Public Spot administration contains no default values to replace missing parameters, the wizard opens a
dialog. Enter the missing values here.
Modifying a Public Spot user
Modify one or more Public Spot users simply by entering the following URL:
http://<device-URL>/cmdpbspotuser/...?action=editpbspotuser&parameter1=value1&parameter2=value2&...
The following parameters are available:
pbspotuser
Name of the Public Spot user
Specify multiple users in the form &=pbspotuser=<User1>+<User2>+....
If the wizard cannot find the specified user, you have the option to search for a user.
After making your changes, accept these and print them out if necessary.
expiretype
Combined output of expiry type and validity period of the voucher.
Specify this parameter as follows:
&expiretype=<Value1>+validper=<Value2>
The parameter values have the following meaning:
1
Value1: Expiry type (absolute, relative, absolute and relative, none)
1
Value2: Voucher validity period
unit
Access time
Specify this parameter as follows:
&unit=<Value1>+runtime=<Value2>
The parameter values have the following meaning:
1
Value1: LIfetime units. Possible values are
2
Minute
2
Hour
2
Day
1
Value2: Duration
timebudget
Time budget
If this parameter is omitted, the wizard uses the default value.
1463
Reference Manual
15 Public Spot
volumebudget
Volume budget
If this parameter is omitted, the wizard uses the default value.
print
Automatic print-out of the voucher.
If this parameter is omitted, the wizard displays a button. Use this to print out the voucher.
bandwidthprof
Bandwidth profile
With this parameter you assign a pre-defined bandwidth profile to a Public Spot user. Enter the valid value
for this parameter as the line number of an existing profile name under Setup > Public Spot module >
Add user wizard > Bandwidth profiles, such as
&bandwidthprof=1
to index the first entry in the table.
If this parameter is missing or the line number is invalid (for example, the table is empty), the wizard does
not limit the bandwidth.
5
If the Public Spot administration contains no default values to replace missing parameters, the wizard opens a
dialog. Enter the missing values here.
Deleting a Public Spot user
Delete one or more Public Spot users simply by entering the following URL:
http://<deviceURL>/cmdpbspotuser/...?action=delpbspotuser&pbSpotuser=<User1>+<User2>+...
If the wizard finds the specified user in the user list, the user is deleted and the wizard displays a confirming message.
If the wizard cannot find the specified user, it displays a table of registered Public Spot users. Mark the entries for deletion
here.
Bandwidth profile
As of LCOS 8.82 you have the option of setting up bandwidth profiles for Public Spot users.
Manage bandwidth profiles
Using the window Public-Spot > Wizard > Bandwidth profiles, you have the ability to set up profiles that limit the
available bandwidth (uplink and downlink) for Public Spot users. These profiles can be assigned to new users when
access is created for the Public Spot by calling the Setup-Wizard Cerate Public Spot account in WEBconfig.
In order to edit the entries in the table Bandwidth profiles, click on the button Add.... The entries in the edit window
have the following meaning:
1
Profile name: Enter the name for the bandwidth profile here.
1
TX bandwidth: Enter the maximum uplink bandwidth (in kbps), which should be available to a Public Spot user. To
limit the bandwidth, for example, to 1 Mbps, enter the value 1024.
1464
Reference Manual
15 Public Spot
1
RX bandwidth: Enter the maximum downlink bandwidth (in kbps), which should be available to a Public Spot user.
To limit the bandwidth, for example, to 1 Mbps, enter the value 1024.
Assigning bandwidth profiles
The following steps describe how you assign the available bandwidth profiles to a Public Spot user.
1. Open WEBconfig.
2. Start the add user wizard under Setup Wizards > Create Public Spot account.
3. Assign the new user an appropriate profile from the selection list Bandwidth profile.
When creating a new user, the RADIUS server automatically assigns the upper and lower boundaries of the bandwidth
profile (not the bandwidth profile per se) to the associated account.
Clear user list automatically
The device gives you the option to delete expired accounts for Public Spot users automatically.
Users of the Public Spot Wizard are generally administrators with restricted rights who are often unable to delete user
table entries themselves. Because the user table has a limited number of entries, outdated entries could limit the capacity
of the Public Spot. We strongly recommend that you activate this option.
If you use the internal RADIUS server for the administration of user accounts, enable automatic clean-up under RADIUS
server > General > Clear user lists automatically
5
These settings have no effect on the user table on an external RADIUS server.
The following list offers you a general overview of which capacity limits apply to specific models. If you cannot find your
device, please check the exact details in the product description.
Table 18: Size of the user table for specific LANCOM models
User table sizeLANCOM model
64
1
access points
1
Routers from the 178x series
with "Public Spot" option
256
1
WLC-4006(+)
unlimited*
1
WLC-4025
1
WLC-4025(+)
1
WLC-4100
1
7100(+) VPN
1
9100(+) VPN
with "Public Spot XL" option
1465
Reference Manual
15 Public Spot
*) No limitation on the table; however, an upper limit of max. 2,500 users is recommended
Station monitoring
If station monitoring is activated, the Public Spot regularly checks to see if the associated end devices are still available.
Lost end devices are automatically deleted from the local user table. If station monitoring is switched off, a user is not
logged off until the validity period of the user's authentication expires.
5
Station monitoring is extremely important for Public Spots operating commercially on a time basis. In installations
of this type, users must be assured that they are only paying for the time actually spent using the Public Spot
services.
Configuration
Station monitoring for the Public Spot Module is disabled by default. You activate it by entering a value greater than 0
– this value disables the function – under Public Spot > Server > Interface selection > Idle timeout. From this point
on, all end devices are automatically disconnected from the Public Spot after a specific time.
5
If your device has WLAN, you also have the option of enabling station monitoring globally for all WLAN interfaces.
You can find the corresponding settings under Wireless LAN > Security > Monitor stations to detect inactive
ones. To do this, the device disconnects mobile stations after 60 seconds (default value). If WLAN station
monitoring is disabled, this may take up to an hour.
If you offer Public Spot via WLAN, please note that the station monitoring of the WLAN takes priority over that
for the Public Spot, and a disconnection can occur earlier if the idle timeout for WLAN (configurable in the Setup
menu under WLAN > Idle timeout) is less than that for the Public Spot.
Surveillance
You can monitor the Public Spot during operation using WEBconfig. The station table in the user authentication menu
provides an overview of:
1
Users currently logged in to the Public Spot and
1
End devices in the WLAN which are not logged in.
You can navigate to the Station table in the Status menu under Public Spot > Station Table. Using the button Monitor
this table you automatically refresh the table display at regular intervals.
WLAN handover of sessions between devices
Whenever a site equipped with WLAN hotspots expands, it may be necessary to deploy more than one access point to
cover the whole area. One option would be to use a central device as an authentication gateway, enable the Public Spot
option on this device only, and require all other access points to redirect requests to the central device. In this way, all
other access points act as simple, transparent bridges, which connect to the central gateway using the Ethernet backbone.
This allows clients to freely roam among the access points since all session information is kept in the central gateway.
This variant has two drawbacks, however:
1
The central gateway is a single point of failure, and is not scalable. You can reduce the risk of failures by using VRRP
to create a redundancy solution.
5
This solution requires an external RADIUS server, since VRRP cannot synchronize configurations, e.g. the user
database. However, this means that certain functions (such as the Public Spot wizards in WEBconfig) are no
longer available.
1
Roaming is only necessary when the Public Spot module is installed on the access points themselves. Using a WLC,
the authentication can be forwarded to the central gateway. In this case, the roaming between access points is
transparent to the WLAN controller.
1466
Reference Manual
15 Public Spot
An alternative to this type of centralized setup is to enable the Public Spot module in all of the access points. Authentication
and page processing handling is thereby distributed over all devices, and a single point of failure is eliminated.
IAPP (inter access point protocol)
Since the Public Spot module is implemented as a "switchable" transparent bridge, there is no need for clients to acquire
a new IP address after they roamed to another access point, so there is no need to terminate open connections. This
results in the requirement that an already authenticated client does not have to re-authenticate after roaming to a new
access point. Thus the authentication information should be carried over from the old to the new access point.
Access points use the IAPP (inter access point protocol) to share information about roaming clients: Whenever a wireless
client decides to change to another access point, it has the option of informing the new AP about which AP it was
previously connected to. This information, combined with regular Hello packets on the Ethernet backbone, enable the
new access point to inform the old access point. The old access point can then remove the client from its station table
and acknowledge the handover.
If a client does not use the corresponding Reassociate packet for connecting to the new access point, the new access
point sends a handover request as a multicast on the backbone, instead of a directed packet to the old access point.
This means that this handover also works for clients that do not support IAPP.
The main task of the IAPP in a WLAN is to tell the old access point not to send any more packets to the corresponding
client in its wireless area, since it will no longer receive them. This type of behavior (based on the definition of the 802.11
frame exchange protocol) could otherwise cause problems with other clients that are connected with it.
In case of an enabled Public Spot module, the communication channel provided by IAPP is used to transport the session
information of wireless clients. Whenever an access point receives a handover request for one of its wireless clients, and
if a session record for this client is available in its station table, it will append state information about this client to the
requesting access point. This information includes:
1
The client’s current state (authenticated or not authenticated)
In case the client is authenticated, it also includes:
2
The username used to authenticate
2
The amount of data traffic generated by the client so far
2
The session duration so far
2
The IP address of the client
2
Possible limits on the session duration and data volumes
2
Possible information about idle timeouts
1
If RADIUS accounting was used for the session:
2
The entry used for RADIUS accounting in the authentication server list, referenced by name
2
The accounting cycle used for interim updates
After a successful transfer, the old access point terminates the session, which, in the case of RADIUS accounting, means
that it sends an accounting stop request to the RADIUS accounting server. This is necessary since a RADIUS server can
use the NAS identification to associate requests with specific sessions, and these requests can no longer be associated
with the correct sessions once the data packets for a session come from more than one device. If an access point receives
this information in a handover reply, it immediately marks the client as authenticated and starts a new RADIUS accounting
session, if possible.
5
Note that the new access point requires a corresponding entry in its Authentication server list in order to
receive the necessary information. The specific part of the handover reply for the Public Spot module is protected
by a shared secret, which is set in the setup menu under Public-Spot-Module > Roaming-Secret. These security
measures should prevent falsification of handover replies. Without a password configured, the access point does
not append the information above on a handover reply, which forces the client to authenticate again.
1467
Reference Manual
15 Public Spot
Authentication via RADIUS
RADIUS is an extensively accepted protocol for providing large groups of users access to a server. Although it was
originally developed for dial-in server access over telephone lines, the concept is also useful for the hotspot authentication
process. For that reason, it can be used in a more complex provider network, for example, to provide access for the same
users via dial-in and hotspots. You configure RADIUS servers and their access parameters in the dialog Public Spot >
Server under Authentication servers.
In certain scenarios, it can be feasible to use more than one RADIUS server. In general, a RADIUS server is specified by
its IP address, the UDP port the RADIUS service is bound to (typical ports are 1645 or 1812), and a so-called "shared
secret". This is a random character string which acts as a password for access to the server. Only clients which know the
shared secret can interact with the RADIUS server, since the password for the user account is hashed instead of being
sent in plain text.
In theory, the simplest possible RADIUS transaction consists of the device sending the entered account data (user name
+ password) to the RADIUS server and the RADIUS server responding with either "yes" or "no". However, the RADIUS
protocol also allows more complex responses and requests where the communication partners use a list of variables –
so-called "attributes" – for requests and responses. In the
Appendix
there is a list of which attributes a device can send
to a RADIUS server and which attributes from a RADIUS response are understood by the device.
Multiple authentication servers
As mentioned previously, the list of authentication servers can contain more than one entry. There may be situations
where the hotspot provides access to the Internet for customers from different service providers. These providers may
have separate user databases and their own RADIUS servers. The device must select which provider corresponds to the
user based on the username.
Whenever the device does not find an entry for an authenticated user in its local table, it will first search through the
authentication server list to find the provider that corresponds to the user. For example, user account names like
JohnDoe@lancom.de contains the authentication server entry named LANCOM. If the first allocation does not
work, the device attempts to allocate the entry DEFAULT to the user. If this entry also does not exist, the device selects
the authentication server that is first in the list. If the device does not find an entry (i.e., the list is empty), the user
authentication fails.
Depending on the allocation of a user to a authentication server, your device always transmits the complete username
to the selected RADIUS server. The selected RADIUS server is stored as the provider for the subsequent session and used
for optional RADIUS accounting.
Chaining of backup servers
Internet access providers wish to provide a very high level of availability, and a common method to achieve this relies
on redundancy. This redundancy is achieved using the backup servers which are needed when a request times out on
the primary server, for example, because the server or another network component along the way was unavailable.
The requirements for backup servers varies widely among the different providers, which is why the list of authentication
servers does not have a specific number of input fields. Instead, the device offers you a series of backup servers (backup
chaining). Here, two or more entries in the authentication server table may be chained together to form a list of RADIUS
servers. The device looks through the list of RADIUS servers one by one until the end of the list is reached (authentication
failure due to server unavailability) or a response from a server (either positive or negative) is obtained.
You chain backup servers using the input field Backup name in the add/edit dialog under Public Spot > Server >
Authentication server. Whenever a RADIUS request fails (i.e. times out), the device checks the backup field, and
continues to try the RADIUS server specified in the entry that is referenced by the backup name. In general, an unlimited
number of servers can be connected this way, which makes it possible for several providers to assign the same fallback
server. The chain of backup servers is considered to be terminated if one of the following conditions occurs:
1
Querying a RADIUS server failed and the corresponding authentication server table entry has an empty backup field.
1
Querying a RADIUS server failed and the corresponding provider table entry has an invalid backup field, i.e. the entry
referenced is not present in the authentication server list.
1468
Reference Manual
15 Public Spot
1
Querying a RADIUS server failed and the corresponding authentication server list entry refers to an entry that has
already been used in the query process. This avoids endless RADIUS requests due to circular references. It is possible
to specify two RADIUS servers that reference each other as backups, with the primary server being selected by the
user account name.
5
While the device is sending a RADIUS request, the TCP/HTTP connection to the client still exists. If the runtime
of the chaining exceeds the lifetime of the TCP/HTTP connection, the client interrupts the login attempt. Therefore,
it may be recommended to reduce the number of request retries to the individual backup servers as well as the
time intervals between requests. These settings can be made in RADIUS server > Options.
Billing without a RADIUS accounting server
If user administration is performed using the internal user list of the Public Spot module, and you do not want to use a
RADIUS accounting server, your only option is to use the expiry date of the user account for accounting purposes.
The use of the internal user list is no longer recommended. Instead, in order to take advantage of all of the options the
Public Spot offers, you should use the internal RADIUS server for new installations.
5
For the purposes of billing by credit payment, the Public Spot can use SYSLOG to output detailed connection
information to any computer in the network. Using the appropriate software on the destination computer allows
you to precisely bill the resources that were actually used (such as connection times or transfer volumes).
Billing via RADIUS accounting server
For the purposes of billing via a RADIUS server, you can set up the Public Spot so that it regularly supplies the current
connection information for every active user to the specified accounting server. Accounting is started when a client is
authenticated using RADIUS and a valid Accounting server is configured for the relevant Authentication server in
the list of Authentication servers. It is possible to use different RADIUS servers for authentication and accounting.
Each of the regular message packets to the accounting server contains information about the resources (time, transferred
data volumes, etc.) consumed by the user since the last message. This means that, even in the worst case of a Public
Spot failure (e.g., due to a power outage or similar), only a small amount of accounting information will be lost.
Periodic messaging of accounting information to the accounting server (interim updates) is deactivated by default. It is
activated by setting a value for the accounting cycle which is greater than 0.
1
LANconfig: Public Spot > Users > Update cycle
5
This cycle is defined in seconds. This sets the time interval of when your device regularly sends connection
information to the accounting server. Setting the cycle to 0 deactivates this function. If this is the case, your
device only sends accounting information at the beginning and end of the session.
When accounting on a prepaid basis, the RADIUS server monitors the restrictions on the users (limits on connection
times or transfer volumes, expiry date). As soon as a user has used up the prepaid amount, the RADIUS server locks the
user account. Your device rejects future login attempts for the user.
5
Time limits for prepaid models can be monitored by the Public Spot during active sessions. If a time limit is
exceeded, the Public Spot automatically terminates the corresponding session. The monitoring of prepaid amounts
is possible if the RADIUS server transmits the user's time credit to the Public Spot as the "Session timeout"
attribute at the start of the session.
Request types
Your device is able to send different types of RADIUS requests to an accounting server. These requests differ according
to a user's session state:
1
An accounting start request is sent after a successful authentication.
1
An accounting stop request is sent after a Public Spot session is terminated.
1
Optional: Interim updates are sent throughout the session.
1469
Reference Manual
15 Public Spot
There are two types of interim updates: An initial update is sent immediately after the start request since some RADIUS
servers need this in order to create a session in the accounting database. All further updates depend on whether an
accounting cycle was created for the respective session (see Public Spot > Users > Accounting update cycle).
Alternatively, this value may be included in a RADIUS authentication response: The RADIUS server offers the RADIUS
client (for example, your Public Spot) an interim accounting interval, which the client will use if it has the appropriate
support for this and as long as no interval was set locally on the device itself.
5
If a local value was set, it will always be given a higher priority than the one received from a RADIUS server,
which the RADIUS RFCs require by default!
In the
Appendix
there is a list of which attributes a device can send to a RADIUS server and which attributes from a
RADIUS response are understood by the device.
Accounting backup
The backup solution for RADIUS accounting is the same as the one for RADIUS authentication, in that your device goes
through the entries in the authentication server list one by one (see chapter
Chaining of backup servers
. The backup
entries for the accounting server should be chosen with the same care as for the authentication server: If you are using
multiple backups, you will probably have to reduce the timeout/try values for the requests in order to achieve reasonable
response times for the entire system.
5
User sessions are not paused while the device sends accounting requests, which consumes additional resources
in the device—in contrast to authentication. Please ensure that the time required for the selection of an accounting
server* should be less than the length of an accounting cycle for interim update requests. This stops the requests
from queuing up, which would result in a stack overflow.
* Number of backups x (idle timeout + number of retries)
Multi-level certificates for PublicSpots
SSL certificate chains can be loaded into the device as a PKCS#12 container. These certificate chains can be used for
Public Spot authentication pages by using the HTTPS server implemented in the device. Certificates from recognized trust
centers are normally multi-level. Officially signed certificates in the Public Spot are necessary to avoid certificate-related
error messages from the browser when authenticating at a Public Spot.
The certificate is loaded into the device for example by using WEBconfig in File Management to upload the individual
files of the root CA certificate or a PKCS#12 container:
1470
Reference Manual
15 Public Spot
Certificates are normally issued for DNS names, so the Public Spot must specify the certificate's DNS name as the
destination and not an internal IP address (enter in Setup > Public Spot Module > Device Host Name). This name
has to be resolved by the DNS server to provide the corresponding IP address of the Public Spot.
Assigning users to individual VLANs
Regardless of the assignment of a VLAN ID for the entire Public Spot module, the device offers you the option of separately
assigning individual VLAN IDs for individual Public Spot users. This ID is automatically assigned by the RADIUS server
to your users after successful authentication. In this way it is possible, for example, to classify different Public Spot users
in separate networks with different access rights and access options without having them login to separate SSIDs or
requiring you to publicize the availability of various networks (e.g., networks for different customer types). The relevant
rules can be realized via the firewall by specifying the VLAN ID of the respective user/the relevant user groups as the
source tag.
5
An enabled VLAN module is a prerequisite for the functions described above.
1
Open the User table in the dialog RADIUS server General and click Add... to create a new user.
1
Assign an individual VLAN ID to the new user with the input field VLAN-ID. After authentication by the RADIUS
server, the individual VLAN ID overwrites a global VLAN ID that a user would otherwise obtain from the interface.
The value 0 disables the assignment of an individual VLAN ID.
5
For technical reasons, the assignment of a VLAN ID requires a new address assignment by the DHCP server. As
long as a client is not yet assigned a new address after successful authentication, the client is still in the previous
(e.g., untagged) network. In order for the clients to be transferred to the new network as quickly as possible, it
is necessary to set the lease time of the DHCP server as low as possible under IPv4 > DHCPv4. Possible values
(in minutes) include, for example:
1
Maximum lease time:2
1
Default lease time:1
Take into account that a strong reduction in global lease time can flood your network with DHCP messages, and
when there is a larger number of users, it leads to an increased network load! Alternatively, you have the option
of using an external DHCP server or allowing your users to manually request a new address by using their client.
1471
Reference Manual
15 Public Spot
In the Windows command line this is done, for example, using the commands ipconfig /release and
ipconfig /renew.
5
By assigning a VLAN-ID, the user loses his connection after the initial DHCP lease expires. The connection only
remains stable as of the second lease, i.e. after successfully assigning the VLAN-ID.
15.2.4 Alternative login methods
In addition to the login using the login data that was sent previously, your users can also request login data themselves
via e-mail or text message (SMS), or by accepting the terms and conditions for the Public Spot (one-click login).
Alternatively, in order to implement more complex or multi-level login scenarios, you can link your Public Spot to other
software systems using the XML or PMS interface (module optionally available).
You can also offer your users additional convenience by allowing, for example, automatic login processes (automatic
login as well as re-login using a MAC address, login using WISPr, Hotspot 2.0), and also the related roaming services.
5
Hotspot 2.0 and roaming features are only available in conjunction with WLAN.
Overview of authentication modes
In this window, specify the settings for authentication to the network.
The following authentication modes are available:
1
No authentication required
Users get free access to the Public Spot, authentication is not required.
5
Do not use this setting if your device has unlimited access to the Internet.
1
No credentials required (login after agreement)
Users get free access to the Public Spot after they accept the operator's terms of use (one-click login). With a RADIUS
server, login is completely transparent for the user. The prerequisite is that you have set up an individual welcome
page with its own terms of use: In this case, the Public Spot initially forwards a user to the welcome page, where he
1472
Reference Manual
15 Public Spot
must agree to the terms of use. After confirmation, the device automatically creates a user account according to the
default values in the Add user wizard (under Public-Spot > Wizard) and provides access to the connected network.
Under Login after agreement you specify the framework conditions for the creation of free user accounts by the
RADIUS server:
2
Maximum requests per hour: Specify how many users per hour can automatically create an account on the
device. Decrease this value to reduce performance degradation caused by an excessive number of users.
2
Accounts per day: Specify how many accounts a user may create per day. If this value is reached and the user
session has expired, a user can not automatically register and get authenticated on the Public Spot for the rest
of the day.
2
Username prefix: Enter a prefix which can be used to identify the user in the RADIUS user table that the device
created automatically after confirmation of the terms of use.
5
To load a custom welcome page (htm, html) on the device, use the upload function under Device >
Configuration management > Upload certificate or file and reference this file under Public-Spot >
Server > Page-Table > Welcome in the field Page address (URL) with
file://pbspot_template_welcome. Templates for a welcome page and detailed information
for uploading your own templates is available on the Internet in the LANCOM Support Knowledge Base under
Implementing your own websites
.
5
The terms featured on the Welcome screen are not to be confused with the terms-of-use page itself. The
Terms of use page is a special page that is displayed only after a separate activation in connection with
notification by e-mail/SMS.
5
If no welcome page is set up, the device displays an error message when accessing the Public Spot.
1
Authenticate with name and password
Users log on to the Public Spot with their name and their password. Users get their login data from a network
administrator as a voucher.
1
Authenticate with name, password and MAC address
Users log on to the Public Spot with their name and their password. Users get their login data from a network
administrator as a voucher. For this login mode, the MAC address of the client must also match the one stored in
the user list by the administrator.
1
Login data will be sent by e-mail
Users log on to the Public Spot with their name and their password. Users generate the credentials themselves, and
the data is sent via e-mail. No action by an administrator is necessary.
1
Login data will be sent by SMS (text message)
Users log on to the Public Spot with their name and their password. Users generate the credentials themselves, and
the data is sent by SMS (text message). No action by an administrator is necessary.
Independent user authentication (Smart Ticket)
Devices operating a Public Spot provide users with time-limited access to wireless networks. Until now an administrator
account was necessary to create a login on a device with the Public Spot. For employees at a hotel reception desk, for
example, you can set up an administrator account that only has the function rights to create Public Spot users. With a
few mouse clicks the employee can print a voucher for the hotel guests for access to the wireless network.
However, the easy voucher solution still requires action from an administrator. Alternatively, you can give the users the
option to generate their own login data for the wireless network from the homepage of the Public Spot, and send it to
themselves by e-mail or SMS (text message). In order to send e-mail, an SMTP account must be fully set up in the device
settings. To send SMS/text messages the device uses an external SMS provider, which can charge fees to the Public-Spot
operator or user, if desired.
1473
Reference Manual
15 Public Spot
Alternatively, the device gives you the ability to handle the login for Public Spot users transparently using a RADIUS
server. In this case, the user login is preceded by checking the terms of use, whereby the user must first consent to the
terms of use stored on the device before automatically receiving access to the Public Spot (one-click login). The creation
of credentials by the user via e-mail or SMS does not apply for this authentication method.
Configuring e-mail/SMS authentication
You define the settings for sending the login credentials via e-mail or SMS in the dialog Public Spot > E-mail/SMS.
You have following configuration options:
1
Max. e-mails send: Here, enter the maximum number of e-mails that the Public Spot module may send per hour
to users authenticating via e-mail. Lower the value to reduce the number of new users per hour.
1
Max. requests per MAC: Specify how many different sets of credentials the device can provide to a MAC address
within one day.
1
User has to accept the terms of use: If you select this option, the Public Spot login page displays an additional
option, which prompts the user to accept the terms of use before registering via e-mail/SMS.
5
Remember to upload a page with terms and conditions onto the device before you enable this option.
Otherwise, the device will only show the user a placeholder instead of the terms and conditions.
1
Sender e-mail address: Enter the e-mail address that your e-mail contains as the return address, e.g.
support@providerX.org.
1
Name of sender: Specify the name shown to your users as the sender of the e-mail, e.g. Provider X. If you
leave this field blank, the device automatically enters the default text as described in the following section.
1
E-mail subject: Type the subject line for the e-mail. If you leave this field blank, the device automatically enters the
default text as described in the following section.
1
E-mail body: Type the message text for the e-mail. You can use the following variables:
$PSpotPasswd
Placeholder for user-specific password for the Public Spot access.
$PSpotLogoutLink
Placeholder for the logout URL of the Public Spot in the form http://<IP address of the
Public Spot>/authen/logout. This URL enables Public Spot users to log off from the Public
1474
Reference Manual
15 Public Spot
Spot. This may be useful if the session window (which also contains this link) that is normally displayed after
a successful login is blocked by the browser or closed by the user.
If you leave this field blank, the device automatically enters the default text as described in the following section.
1
Use domain table as: Specify whether the device uses the table E-mail domains as a blacklist or whitelist. This
definition sets which e-mail addresses or domains may be entered by your Public Spot users in order to register.
2
Blacklist: Registration is permitted on all e-mail domains except those in this table.
2
Whitelist: Registration is possible only via the e-mail domains that are present in this table.
1
Gateway e-mail address: Here you enter the IP address or the hostname of the gateway server, which converts
the e-mail into SMS. If the provider expects to find the mobile phone number in the local part of the e-mail, you can
use the variable $PSpotUserMobileNo.
1
Country codes: In this table, enter the country codes accepted by the device. Country codes can be entered directly
or with a prefixed double-zero, for example for Germany 49 or 0049.
5
This table acts as a whitelist. You must define country codes in order for the login data to be delivered.
Standard texts for sender, subject and body
If you leave the following input fields in the dialog Public Spot > E-mail/SMS blank, the device automatically reverts
to the standard texts stored in LCOS when generating the e-mail. The language used depends on the language setting
of the browser used by the user for registration.
Table 19: Overview of the internal standard texts for authentication via e-mail/SMS
EnglishGerman
Public SpotPublic SpotName of sender
Your Public Spot accountIhre Anmeldedaten für den Public SpotE-mail subject
Your password for the LANCOM Public Spot:
$PSpotPasswd $PSpotLogoutLink
Ihr Passwort für den LANCOM Public Spot:
$PSpotPasswd $PSpotLogoutLink
E-mail body
Automatic re-login
Mobile WLAN clients (e.g., smart phones and tablet PCs) automatically log in to known WLAN networks (SSID) when
they reenter the cell. In this case, many apps automatically and directly access web content using the web browser in
order to request current data (such as e-mails, social networks, weather reports, etc.) It is similar for mobile LAN clients
(e.g., notebooks) which have to be disconnected from the network for a short time for a change of location (e.g., for
changes from a lecture hall to a library in a college). In all of these cases, it is impractical to make the user manually log
in to the Public Spot again in the browser.
With automatic re-login, the user only has to be identified on the Public Spot once. After a temporary absence, the user
can seamlessly use the Public Spot again.
The Public Spot records the manual login and logout as well as a re-login in the SYSLOG. It stores the same login data
for a re-login that a user had employed for initial authentication.
5
The authentication is only performed on the MAC address of the client when re-login is enabled. Since it can
lead to security problems, re-login is disabled by default.
1475
Reference Manual
15 Public Spot
The settings for automatic re-login can be found in LANconfig in the device configuration under Public Spot > Users
in the section Users and authentication servers.
The selection box Allow automatic re-login enables this function.
You specify the number of clients (maximum 65536) in the field Automatic re-login table limit that the re-login function
may use.
In the field Automatic re-login valid time you specify how long the Public Spot stores the credentials of a client in the
table for a re-login. After this period expires, the Public Spot user must log in again using the login page of the Public
Spot in the browser.
Automatic authentication with the MAC address
After successful authentication, a Public Spot gives the user access to certain services. The Public Spot usually displays
a login website to allow users to authenticate themselves. The user enters the authorization credentials into the login
page and the Public Spot then redirects the user to the allowed sites.
In some applications, authentication via web site may not be desired or not possible, as the following examples illustrate:
1
The end device does not have a browser and therefore cannot open the login page.
1
Manually accessing the login page may be undesirable, such as when carrying out a performance test.
Automatic authentication on the Public Spot with a MAC address makes it possible to use the Public Spot without first
opening the login page. The administrator enters the MAC addresses of the corresponding end device into the table of
permissible MAC addresses under Public Spot > Users > MAC authenticated users.
The MAC-address check procedure
When the device receives a request from a client, the Public Spot executes the following steps for the automatic
authentication by MAC address:
1
If the Public Spot has already authenticated the MAC address of the received data packets, the device forwards the
data packets without further delay.
1
If the MAC address is in the list of allowed clients, the Public Spot starts a new session for the user and forwards the
corresponding data packets.
1476
Reference Manual
15 Public Spot
1
If a provider has been defined for verification of the MAC addresses by RADIUS, and a positive, valid MAC address
authentication is cached in the Public Spot, then the Public Spot starts a new session for that user and forwards the
associated data packets.
1
If a provider chooses to check the MAC address with the RADIUS server, but does not have a valid authentication
for the MAC address saved in the cache of the Public Spot, the Public Spot starts authentication on the corresponding
RADIUS server. After a positive response, the Public Spot starts a new session for that user and forwards the associated
packages.
1
All of the above checks are unsuccessful, the Public Spot directs the user to the login page.
Authentication of the MAC address by RADIUS
If the MAC address of a WLAN client requesting to associate is not included in the list of permissible addresses, the
Public Spot can alternatively authenticate the address via a RADIUS server.
To enable RADIUS authentication, the administrator selects one of the RADIUS servers that has defined in the device
and saved to the list of providers.
In addition, the administrator defines a lifetime for the rejected MAC addresses. This lifetime is used by the Public Spot
to prevent the RADIUS server from being flooded with repeated requests for MAC addresses which cannot be authenticated
(without login) via the RADIUS server or MAC address table.
If a MAC address authentication is rejected by the RADIUS server, the Public Spot saves this rejection for the lifetime
defined here. The Public Spot responds to further requests for the same MAC address directly and without forwarding
them to the RADIUS server first.
Configuration in LANconfig
For the configuration in LANconfig, you can find the parameters for the authentication of the clients using the MAC
address in the dialog Public Spot > Users > MAC authenticated users.
Automatic authentication via WISPr
Your device provides an interface for authentication via WISPr. The WISPr standard is the technological predecessor of
the 802.11u and Hotspot 2.0 specifications. The acronym stands for Wireless Internet Service Provider roaming and
designates both a process and a protocol that allow users of WLAN enabled devices to roam seamlessly between the
WLANs of different operators – and, therefore, between their Internet service providers. The idea behind it is similar to
that of 802.11u and Hotspot 2.0; however, it requires more comprehensive support by the respective users.
Using the WISPr protocol, you can provide logins and network usage on your hotspot in a manner similar to Hotspot
2.0, even for end devices that no longer support Hotspot 2.0. The prerequisite is that your service provider provides the
necessary infrastructure. Support for the user's device is provided either by the operating system or a suitable app (smart
client). This client handles authentication to the hotspot for the user. If no credentials are available for the relevant
network, the client queries the user for valid credentials at the system level. In any case, this eliminates the user having
to log in via a login web page in the browser.
Because of its age, almost all current end devices with iOS, Android and Windows 8 support the WISPr protocol. In
addition, larger WLAN Internet service providers often have their own apps to make the login for their clients easier:
These apps include a preconfigured database of the provider's own hotspots and, optionally, those of their roaming
partners. The authentication process corresponds to the following schema:
1. A customer installs his provider's hotspot app to act as a client, which provides a database of preconfigured hotspot
SSIDs.
1477
Reference Manual
15 Public Spot
2. The client connects automatically with one of the hotspots and sends a HTTP-GET-Request to a random URL to test
if direct Internet access is available or the Public Spot requires authentication.
3. In HTTP-Redirect the hotspot sends a WISPr-XML-Tag with the Login-URL.
4. The client sends its login data to the Login-URL in an HTTP-Post.
Example for an XML-Tag in redirect:
<HTML>
<?xml version=”1.0” encoding=”UTF-8”?>
<WISPAccessGatewayParam xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
xsi:noNamespaceSchemaLocation=”http://www.acmewisp.com/WISPAccess GatewayParam.xsd”>
<Redirect>
<AccessProcedure>1.0</AccessProcedure>
<AccessLocation>Hotel Contoso Guest Network</AccessLocation>
<LocationName>Hotel Contoso</LocationName>
<LoginURL>https://captiveportal.com/login</LoginURL>
<MessageType>100</MessageType>
<ResponseCode>0</ResponseCode>
</Redirect>
</WISPAccessGatewayParam>
</HTML>
5
In order to use WISPr, the device must have an SSL certificate and a private key installed. Further information
about loading these objects on your device can be found in the LANCOM techpaper "Certificate Management
in Public Spots". The certificate must either be signed by a trusted authority or – if it is a self-signed certificate
– be imported as a trusted certificate on the client. Otherwise the client will reject the login via WISPr.
Configuring WISPr
Configure the WISPr function of your device in the menu Public Spot > WISPr.
In this window you have the following options:
1
WISPr activated: Enable or disable the WISPr function for the device.
1
Location ID: Use this ID to assign a unique location number or ID for your device, for example, in the format
isocc=<ISO_Country_Code>,cc=<E.164_Country_Code>,ac=<E.164_Area_Code>,
network=<SSID/ZONE>
1478
Reference Manual
15 Public Spot
1
Operator name: Enter the name of the hotspot operator, e.g., providerX. This information helps the user to
manually select an Internet service provider.
1
Location: Describe the location of your device, e.g., CafeX_Market3. This helps to better identify a user in
your hotspot.
1
Login URL (HTTPS): Enter the HTTPS address, that the WISPr client uses to transfer the credentials to your Internet
service provider. Any external URL can be entered or the LANCOM Public Spot itself. If the LANCOM Public Spot
should authenticate users using WISPr, enter the URL in the format
https://<FQDN-of-the-LANCOM>/wisprlogin. For "wisprlogin" in the example, any freely defined
path can be used.
1
Logoff URL (HTTPS): Enter the HTTPS address that a WISPr client uses for logging off at your Internet service provider.
The same rules apply as for the login URL.
1
Abort login URL (HTTPS): Enter the HTTPS address to which the device forwards a WISPr client if authentication
fails. The same rules apply as for the login URL.
5
The three URLs must be different, if the Public Spot is used in the LANCOM domain, for example:
2
Login URL: https://<FQDN-of-the-LANCOM>/wisprlogin
2
Logoff URL: https://<FQDN-of-the-LANCOM>/wisprlogoff
2
Abort-Login-URL: https://<FQDN-of-the-LANCOM>/wisprabort
Finally, for test purposes, you can also configure an URL with IP addresses. In a production system, the client
will check the FQDN of the certificate!
1
Max. auth. failures: Enter the maximum number of failed attempts which the login page of your Internet service
provider allows. If the Public Spot is used, the Public Spot rejects further login attempts by the specified client after
this number of failed attempts.
IEEE 802.11u and Hotspot 2.0
As of LCOS 8.82, your device supports WLAN connections according to the IEEE 802.11u standard and—based on
that—the Hotspot 2.0 specification. Using 802.11u you have the option to implement automatic authorization and
authentication of your users on a local WLAN network (for example, within your company) or a Public Spot network. The
prerequisite for this is that the relevant stations (smartphones, tablet PCs, notebooks, etc. ) also support connections for
802.11u and Hotspot 2.0. In detail, the following functions are offered:
1
Automatic network selection
In a 802.11u-enabled environment, the user does not have to manually detect and select an SSID. Instead, the client
independently searches for and selects a suitable Wi-Fi network by automatically requesting and evaluating the
operator and network data of all 802.11u-enabled access points that are in range. A previous login to the access
point is not required.
Hotspot 2.0 stations also have the ability to retrieve information about the services available in a Wi-Fi network. If
specific services that are relevant for a user (e.g., connections via HTTP, VPN or VoIP) are not available for a Wi-Fi
network, any networks that do not meet the criteria are excluded from further searches. This ensures that users are
always connected to the optimal network.
1
Automatic authentication and authorization
In 802.11u-enabled environments, the station automatically carries out the user's login if the necessary credentials
are available. Authentication can be done, for example, using a SIM card, a username and password, or a digital
certificate. Repetitive manual input of the credentials by the user in a login screen is no longer necessary. After
successful authentication, the user can immediately use the desired services.
1
Seamless handover
Connections according to 802.11u and in conjunction with 802.21 facilitate the uninterrupted exchange of data
connections between different network types. This enables users to switch their stations seamlessly from a cellular
network to a WLAN network as soon as they get within range of a Hotspot 2.0 zone—and vice versa. The same is
true for the transfer between two different operators if, for example, the user goes from one homogeneous network
to another during a bus trip
1479
Reference Manual
15 Public Spot
1
Automatic roaming
Connections as per 802.11u facilitate roaming between different operator networks. If a user is in range of a Hotspot
2.0 zone of an operator for which he does not have any credentials, his station still has the option to switch to its
home network. Authentication at a third-party Hotspot 2.0 zone is handled by the operator's roaming partner, which
then allows the user to access the third-party Wi-Fi network. This is interesting not only in areas where there are only
single network operators with access points, it is also especially attractive for people traveling abroad.
Example: For example, a user who is in transit in the city with his 802.11u-enabled smartphone (station) can enable
the WLAN feature to browse the Internet. The station then starts trying to find all available Wi-Fi networks in the area.
If any of the access points offer 802.11u, the station selects the one network that best fits the required service based
on the operator and network information that was previously obtained, for example, from a hotspot offering Internet
access from its own cellular network company. In this case, the subsequent authentication can be performed automatically
via the SIM card so that the user does not need to intervene at any time during the process. The encryption method
selected for the connection – e.g., WPA2 – is unaffected.
In summary, connections according to 802.11u and with Hotspot 2.0 enabled combine the security features and
performance of classic Wi-Fi hotspots with the flexibility and simplicity of data cellular network connections. At the same
time, they relieve the cellular networks by redistributing data traffic (and possibly also telephony) to the network
connections and frequency bands offered by access points.
Hotspot operators and service providers
The Hotspot 2.0 specification of the Wi-Fi Alliance differentiates between hotspot operators and hotspot service providers:
A hotspot operator only operates one Wi-Fi network, while a hotspot service provider (SP) provides the connection
for the user to the Internet or a cellular network. Of course, it is possible for an operator to also be an SP. However, in
all other cases, a hotspot operator requires the corresponding roaming agreements with an SP or a group of multiple
SPs (called a roaming consortium). Only when an operator has made these agreements are the various roaming partners'
customers able to authenticate with the hotspot operator. Each service provider operates its own AAA infrastructure. A
hotspot communicates this list of possible roaming partners and the name of the hotspot operator using ANQP (see
functional description).
Functional description
The 802.11u standard is the base standard of IEEE. This standard essentially expands access points or hotspots with
the ability to broadcast so-called ANQP data packets (Advanced Message Queuing Protocol) in its broadcast signals.
ANQP is a query/response protocol that a device can use to request a range of information about the hotspot. This
includes both meta-data, such as information about the owner and the venue, as well as information on the underlying
network, such as information on operator domains, roaming partners, authentication methods, forwarding addresses,
etc. All 802.11u-enabled devices in range have the ability to request these data packets without a prior login to the
access point in order to select a network based on the network information.
The Wi-Fi Alliance has added further ANQP elements to the standard, and markets this specification as Hotspot 2.0.
This Hotspot 2.0 function merely adds additional elements to the standard, which the device can use as criteria for
selecting its network. These criteria include, for example, information about the services and WAN metrics available at
the hotspot. The associated certification program is called Pass Points™. Certain LANCOM access points are Passpoint™
CERTIFIED by the Wi-Fi Alliance.
The ANQP data packets are the central information element of the 802.11u standard. However, to signal the support
for 802.11u and to transmit data packets, further elements are required for the operation of 802.11u:
1
The signaling of 802.11u support in the beacons and probes of a hotspot are done by the element known as the
Interworking element. In this element, the initial basic network information—such as the network classification,
Internet availability (Internet bit) and the OI of the roaming consortium and/or of the operator—are already included.
At the same time, it is used by 802.11-enabled devices as an initial screening criterion when detecting a network.
1
ANQP data packets are transferred within the so-called GAS containers. GAS stands for Generic Advertisement
Service, and is the name of generic containers that allow a device to request additional internal and external
information for the network selection from the hotspot, in addition to the information in the beacons. The GAS
containers are transmitted on layer 2 by what are referred to as public action frames.
1480
Reference Manual
15 Public Spot
Login by an 802.11u-enabled client at a Hotspot 2.0
The following functional description schematically illustrates the selection and login process of an 802.11u-enabled
device at a Hotspot 2.0.
Login via username/password or digital certificate
1. The hotspots reply with an ANQP response, which contains, among other things, the name of the hotspot operator
and a list of NAI realms, which list all available roaming partners (service provider, abbreviated SP).
2. The device loads the locally stored credentials from the WLAN profiles or installed certificates that were set up by
the user, and compares the local realms with the NAI realm lists obtained in (2).
a. If the device successfully finds one, it knows that it can be authenticated successfully on the relevant Wi-Fi
network.
b. If the device successfully finds more than one, the selection of a Wi-Fi network is made based on the user's
preference list. This list defines the preferred order of operators in conjunction with the potential roaming partners.
In this case, the device compares the operator names listed under (2) with the list, and selects the operator with
the highest priority.
3. The device authenticates itself with its local credentials at the hotspot of the preferred operator for the appropriate
SP. The access point then transmits this data over its SSPN interface (Subscription Service Provider Network) to an
AAA system responsible for authentication. The authentication is performed using the authentication method
determined by the SP. The authentication via username/password uses EAP-TTLS, and authentication via digital
certificate uses EAP-TLS.
Login via (U)SIM
1. In contrast to the login via username/password or digital certificate, a device with a (U)SIM does not request the list
of NAI realms in its ANQP requests, but rather the 3GPP Cellular Network Information. The ANQP responses contain
the cellular network information list of all cellular network providers for which the access point offers authentication.
2. The device loads the parameters for the cellular network from its local (U)SIM card, and compares it with the data
retrieved from the cellular network information lists. The list comparison and selection of a preferred provider network
is performed analogous to the login via username/password or digital certificate.
3. The device authenticates itself with its local credentials at the hotspot of the preferred operator for the appropriate
cellular network company. The hotspot then transmits this data over its SSPN interface (Subscription Service Provider
Network) to an AAA system responsible for the authentication. The presence of a (U)SIM card changes the possible
authentication method for the device to EAP-SIM or EAP-AKA.
4. The AAA system verifies the credentials for authentication via the interface MAP (Mobile Application Part) at the
HLR server (Home Location Register) of the cellular network company.
If authentication is successful, the device gets access to the WLAN network either via hotspot (credentials for the operator's
network are available) or automatic roaming (credentials for the operator's network are not available).
If there are multiple authentication options available for the device (e.g., SIM card and username/password), it has the
option of using the preferred EAP authentication method and, therefore, the preferred credentials based on the NAI
realm or cellular network information list.
Recommended general settings
The Hotspot 2.0 specification recommends the following general settings for the 802.11u operator:
1
WPA2-Enterprise Security (802.1x) enabled
1
Authentication using EAP with the corresponding variant:
2
EAP-SIM/EAP-AKA for authentication with SIM / USIM card
2
EAP-TLS for authentication with a digital certificate
2
EAP-TTLS for authentication with a username and password
1
Enabled and properly configured ARP proxy
1
Disabled multicasts and broadcast in cellular networks (new in LCOS 8.82)
1481
Reference Manual
15 Public Spot
1
Non-approved data traffic between the cellular network devices (Layer 2 traffic inspection and filtering). The
corresponding settings can be found in LANconfig under Wireless LAN > Security.
1
Enabled and implemented firewall on the access router, which provides Internet access
Configuration menu for IEEE 802.11u / Hotspot 2.0
You can find the configuration menu for IEEE 802.11u and Hotspot 2.0 under Configuration > Wireless LAN > IEEE
802.11u.
The device offers the ability to individually enable or disable and configure the support the IEEE 802.11u standard as
well as the Hotspot 2.0 functionality for each logical WLAN interface using the button Interfaces.
Some of the parameters that need to be configured are located in so-called "profiles". Using profiles, you can group
different rows in lists, which you only have to reference from the other windows. Essentially, these are profiles for ANQP
data packets and Hotspot 2.0. The relationships between the profile lists is as follows:
|-- Interfaces
|-- ANQP-Profiles
|-- NAI-Realms
|-- Cellular-Network-Information-List
|-- Network-Authentication-Types
|-- Hotspot 2.0 Profiles
|-- Operator-List
1482
Reference Manual
15 Public Spot
Activating interfaces
The table Interfaces is the highest administrative level for 802.11u and Hotspot 2.0. Here you have the option of enabling
or disabling functions for each interface, assigning them different profiles, or modifying general settings.
In order to edit the entries in the table Interfaces, click on the button Edit.... The entries in the edit window have the
following meaning:
1
Interface: Name of the logical WLAN interface that you are currently editing.
1
IEEE 802.11u enabled: Enable or disable support for connections according to IEEE 802.11u at the appropriate
interface. If you enable support, the device sends the interworking element in beacons/probes for the interface or
for the associated SSID, respectively. This element is used as an identifying feature for IEEE 802.11u-enabled
connections: It includes, for example, the Internet bit, the ASRA bit, the HESSID, and the location group code and
the location type code. These individual elements use 802.11-enabled devices as the first filtering criteria for network
detection.
1
Hotspot 2.0: Enable or disable the support for Hotspot 2.0 according to the Wi-Fi Alliance® at the appropriate
interface. Hotspot 2.0 extends the IEEE standard 802.11u with additional network information, which stations can
request using an ANQP request. These include, for example, the operator-friendly name, the connection capabilities,
operating class and WAN metrics. Using this additional information, stations are in a position to make an even more
selective choice of Wi-Fi network.
1
Internet: Select whether the Internet bit is set. Over the Internet-bit, all stations are explicitly informed that the Wi-Fi
network allows Internet access. Enable this setting if services other than internal services are accessible via your
device.
5
Using this function you only communicate the availability of an Internet connection. You configure the
corresponding regulations on the firewall, irrespective of this option.
1
ASRA - Additional steps for access required: Select whether the ASRA bit (Additional Step Required for Access)
is set. Using the ASRA bit explicitly informs all stations that further authentication steps are needed to access the
Wi-Fi network. Enable this setting if you have, for example, set up online registration, additional authentication, or
a consent form for your terms of use on your web site.
5
Please remember to specify a forwarding address in the Network authentication types table for the
additional authentication and/or WISPr for the Public Spot module if you set the ASRA bit.
1483
Reference Manual
15 Public Spot
1
Network type: Select a network type from the available list which most closely describes the Wi-Fi network behind
the selected interface. Based on the setting made here, the user has the option to limit network detection of their
devices to specific network types. Possible values include:
2
Private network: Describes networks which are blocked to unauthorized users. Select this type, for
example, for home networks or corporate networks where access is limited to employees.
2
Private with guest access: Similar to Private network, but with guest access for
unauthorized users. Select this type, for example, for corporate networks where visitors may use the Wi-Fi network
in addition to employees.
2
Chargeable public network: Describes public networks that are accessible to everyone and can be
used for a fee. Information about fees may be available through other channels (e.g.: IEEE 802.21, HTTP/HTTPS
or DNS forwarding). Select this type, for example, for hotspots in shops or hotels that offer fee-based Internet
access.
2
Free public network: Describes public networks that are accessible to everyone and for which no fee
is payable. Select this type, for example, for hotspots in public, local and long-distance transport, or for community
networks where Wi-Fi access is an included service.
2
Personal device network: In general, it describes networks that connect wireless devices. Select
this type, for example, for digital cameras that are connected to a printer via WLAN.
2
Emergency services only network: Describes networks that are intended for, and limited to,
emergency services. Select this type, for example, for connected ESS or EBR systems.
2
Test or experimental: Describes networks that are set up for testing purposes or are still in the setup
stage.
2
Wildcard: Placeholder for previously undefined network types.
1
HESSID mode: Specify where the device gets its HESSID for the homogeneous ESS. A homogeneous ESS is defined
as a group of a specific number of access points, which all belong to the same network. The MAC address of a
connected access point serves as a globally unique identifier (HESSID). The SSID can not be used as an identifier in
this case, because different network service providers can have the same SSID assigned in a hotspot zone, e.g., by
common names such as "HOTSPOT". Possible values for the HESSID mode include:
2
BSSID: Select this item to set the BSSID of the device as the HESSID for your homogeneous ESS.
2
User: Select this item to manually assign a HESSID.
2
None: Select this item in order to not assign any homogeneous ESS and to isolate it from the device network.
1
HESSID-MAC: If you selected the setting user for the HESSID mode, enter the HESSID of your homogeneous ESS
as a 6-octet MAC address. Select the BSSID for the HESSID for any access point in your homogeneous ESS in capital
letters and without separators, e.g., 008041AEFD7E for the MAC address 00:80:41:ae:fd:7e.
5
If your device is not present in multiple homogeneous ESS's, the HESSID is identical for all interfaces
1
ANQP profile: Select an ANQP profile from the list. You create ANQP profiles in the configuration menu using the
button of the same name.
1
Hotspot 2.0 profiles: Select the Hotspot 2.0 profile from the list. You create the Hotspot 2.0 profiles in the
configuration menu using the button of the same name.
Configuring ANQP data packets
Venue information and group
Using the table Venue information and the following dialogs Venue group and Venue type code, you manage the
information about the access point's location.
In the event of a manual search, additional details on the Venue information help a user to select the correct hotspot.
If more than one operator (e.g., multiple cafés) in a single hotspot zone uses the same SSID, the user can clearly identify
the appropriate location using the venue information.
1484
Reference Manual
15 Public Spot
You can place your device in a predefined category using the Venue group and Venue type code – as opposed to the
user-defined location information.
In order to edit the entries in the table Venue information, click on the button Add.... The entries in the edit window
have the following meaning:
1
Language: You have the ability to specify custom information for the location of the access point for each language.
The location name that matches your user's language will then be displayed. If a language is not available for a user,
its station chooses one based, for example, on the default language.
1
Venue name: Enter a short description of the location of your device for the selected language, for example:
Ice Café Valencia
123 Street
City, State 12345
The Venue group describes the environment where you operate the access point. You define them globally for all
languages. The possible values, which are set by the venue group code, are specified in the 802.11u standard.
Using the Venue type code, you have the option to specify the details for the venue group. These values are also
specified by the standard. The possible type codes can be found in the following table.
Table 20: Overview of possible values for venue groups and types
Code = Venue type codeVenue group
Unspecified
Assembly
1
0 = unspecified assembly
1
1 = stage
1
2 = stadium
1
3 = passenger terminal (e.g., airport, bus station, ferry terminal, train station)
1
4 = amphitheater
1
5 = amusement park
1
6 = place of worship
1
7 = convention center
1
8 = library
1
9 = museum
1
10 = restaurant
1
11 = theater
1485
Reference Manual
15 Public Spot
Code = Venue type codeVenue group
1
12 = bar
1
13 = café
1
14 = zoo, aquarium
1
15 = emergency control center
Business
1
0 = unspecified business
1
1 = doctor's office
1
2 = bank
1
3 = fire station
1
4 = police station
1
6 = post office
1
7 = office
1
8 = research facility
1
9 = law firm
Educational:
1
0 = unspecified education
1
1 = primary school
1
2 = secondary school
1
3 = college
Factory and industry
1
0 = unspecified factory and industry
1
1 = factory
Institutional
1
0 = unspecified institution
1
1 = hospital
1
2 = long-term care facility (e.g., nursing home, hospice)
1
3 = rehabilitation clinic
1
4 = organizational association
1
5 = prison
Commerce
1
0 = unspecified commerce
1
1 = retail store
1
2 = food store
1
3 = auto repair shop
1
4 = shopping center
1
5 = gas station
Halls of residence
1
0 = unspecified residence hall
1
1 = private residence
1
2 = hotel or motel
1
3 = student housing
1
4 = guesthouse
Warehouse
1
0 = unspecified warehouse
Utility and miscellaneous
1
0 = unspecified service and miscellaneous
Vehicular
1
0 = unspecified vehicle
1
1 = passenger or transport vehicles
1
2 = aircraft
1
3 = bus
1
4 = ferry
1
5 = ship or boat
1
6 = train
1
7 = motorcycle
Outdoor
1
0 = unspecified outdoor
1486
Reference Manual
15 Public Spot
Code = Venue type codeVenue group
1
1 = municipal Wi-Fi network (wireless mesh network)
1
2 = city park
1
3 = rest area
1
4 = traffic control
1
5 = bus stop
1
6 = kiosk
ANQP profiles
Using this table you manage the profile lists for ANQP. ANQP profiles offers you the ability to group certain ANQP
elements and to independently assign logical WLAN interfaces in the table Interfaces. These elements include, for
example, information about your OIs, domains, roaming partners and their authentication methods. Some of the elements
are located in other profile lists.
In order to edit the entries in the table ANQP profiles, click on the button Add.... The entries in the edit window have
the following meaning:
1
Name: Assign a name for the ANQP 2.0 profile here. This name will appear later in the interfaces table in the selection
for ANQP profiles.
1
Beacon OUI: Organizationally Unique Identifier, abbreviated as OUI, simplified as OI. As the hotspot operator, you
enter the OI of the roaming partner with whom you have agreed a contract. If you are the hotspot operator as well
as the service provider, enter the OI of your roaming consortium or your own OI. A roaming consortium consists of
a group of service providers which have entered into mutual agreements regarding roaming. In order to get an OI,
this type of consortium – as well as an individual service provider – must register with IEEE.
1487
Reference Manual
15 Public Spot
It is possible to specify up to 3 parallel OIs, in case you, as the operator, have roaming agreements with several
partners. Multiple OIs can be provided in a comma-separated list, such as 00105E,00017D,00501A.
5
This device transmits the specified OI(s) in its beacons. If a device should transmit more than 3 OIs, these
can be configured under Additional OUI. However, additional OIs are not transferred to a station until after
the GAS request. They are not immediately visible to the stations!
1
Additional OUI: Enter the OI(s) that the device also sends to a station after a GAS request. Multiple OIs can be
provided in a comma-separated list, such as 00105E,00017D,00501A.
1
Domain name list: Enter one or more domains that are available to you as a hotspot operator. Multiple domain
names are separated by a comma separated list, such as
providerX.org,provx-mobile.com,wifi.mnc410.provX.com. For subdomains it is sufficient
to specify only the highest qualified domain name. If a user configured a home provider on his device, e.g.,
providerX.org, this domain is also assigned to access points with the domain name wi-fi.providerX.org. When searching
for suitable hotspots, a station always prefers a hotspot from his home provider in order to avoid possible roaming
costs.
1
NAI realm list: Select an NAI realm profile from the list. You specify profiles for NAI realms in the configuration
menu by clicking the button NAI realms.
1
Cellular list: Select the cellular network identity from the list. You set the identities for cellular networks – similar
to profiles – in the configuration menu using the button Cellular network information list.
1
Network authentication type list: Select an authentication profile from the list. You specify profiles for network
authentication in the configuration menu by clicking the button Network authentication types.
Additionally, using the telnet console or setup menu, you have the option to also display the type of available IP addresses,
which they can obtain from the network after a successful authentication. You can access the relevant parameters
IPv4-Addr-Type and IPv6-Addr-Type via the telnet path Setup > IEEE802.11u > ANQP-General.
NAI realms
Using this table you manage the profile lists for the NAI realms. With these lists you have the ability to group certain
ANQP elements. These include the realms of the hotspot operator and its roaming partners, as well as the associated
authentication methods and parameters. Stations use the information stored in this list to determine whether they have
the hotspot operator or one of its roaming partners have valid credentials.
In order to edit the entries in the table NAI realms, click on the button Add.... The entries in the edit window have the
following meaning:
1
Name: Assign a name for the NAI realm profile, such as the name of the service provider or service to which the NAI
realm belongs. This name will appear later in the ANQP profile in the selection for NAI realm list.
1
NAI realm: Enter the realm for the Wi-Fi network. The identification of the NAI realm consists of the username and
a domain, which can be extended using regular expressions. The syntax for an NAI realm is defined in IETF RFC 2486
and, in the simplest case, is <username>@<realm>, for user746@providerX.org, and therefore
the corresponding realm is providerX.org.
1
EAP method: Select a language for the NAI realm from the list. EAP stands for the authentication profile (Extensible
Authentication Protocol), followed by the corresponding authentication method Possible values include:
1488
Reference Manual
15 Public Spot
EAP-TLS: Authentication using Transport Layer Security (TLS). Select this setting when authentication via the
relevant NAI realm is performed by a digital certificate that the user has to install.
2
2
EAP-SIM: Authentication via the Subscriber Identity Module (SIM). Select this setting when authentication via
the relevant NAI realm is performed by the GSM Subscriber Identity Module (SIM card) of the station.
2
EAP-TTLS: Authentication via Tunneled Transport Layer Security (TTLS). Select this setting when authentication
via the relevant NAI real is performed using a username and password. For security reasons, the connection is
tunneled for this method.
2
EAP-AKA: Authentication using Authentication and Key Agreement (AKA). Select this setting when authentication
via the relevant NAI realm is performed by the UMTS Subscriber Identity Module (USIM card) of the station.
2
None: Select this setting when the relevant NAI realm does not require authentication.
1
Authentication parameters:
In the window that opens when you click the Select button, select the appropriate authentication parameters for
the EAP method, such as EAP-TTLS NonEAPAuth.MSCHAPV2,Credential.UserPass or for EAP-TLS
Credentials.Certificate. Possible values include:
Table 21: Overview of possible authentication parameters
CommentSub-parametersParameters
Identifies the protocol that the realm requires for phase 2
authentication:
NonEAPAuth.
Password Authentication ProtocolPAP
Challenge Handshake Authentication Protocol, original CHAP
implementation, specified in RFC 1994
CHAP
Implementation of Microsoft CHAP V1, specified in RFC 2433MSCHAP
Implementation of Microsoft CHAP V2, specified in RFC 2759MSCHAPV2
Describes the type of authentication that the realm accepts:Credentials.
SIM cardSIM
USIM cardUSIM
NFC chipNFCSecure
Hardware tokenHWToken*
Software tokenSoftToken*
Digital certificateCertificate
1489
Reference Manual
15 Public Spot
CommentSub-parametersParameters
Username and passwordUserPass
No credentials requiredNone
TunnelEAPCredentials.*
SIM cardSIM*
USIM cardUSIM*
NFC chipNFCSecure*
Hardware tokenHWToken*
Software tokenSoftToken*
Digital certificateCertificate*
Username and passwordUserPass*
Anonymous loginAnonymous*
*) The specific parameter or sub-parameter is reserved for future uses within the framework of Passpoint™ certification,
but currently is not in use.
Cellular network information list
Using this table you manage the identity lists for cellular networks. With these lists you have the ability to group certain
ANQP elements. These include the network and country codes of the hotspot operator and its roaming partners. Based
on the information stored here, stations with SIM or USIM cards use this list to determine if the hotspot operator belongs
to their cellular network company or has a roaming agreement with their cellular network company.
In order to edit the entries in the table Cellular network information list, click on the button Add.... The entries in
the edit window have the following meaning:
1
Name: Assign a name for the cellular network identity, such as an abbreviation of the network operator in combination
with the cellular network standard used. This name will appear later in the ANQP profile in the selection for Cellular
list.
1
Country code (MCC): Enter the Mobile Country Code (MCC) of the hotspot operator or its roaming partners, consisting
of 2 or 3 characters, e.g., 262 for Germany.
1
Network code (MNC): Enter the Mobile Network Code (MNC) of the hotspot operator or its roaming partners,
consisting of 2 or 3 characters.
Network authentication types
Using this table, you manage addresses to which the device forwards stations for an additional authentication step after
the station has been successfully authenticated by the hotspot operator or any of its roaming partners. Only one forwarding
entry is allowed for each authentication type.
1490
Reference Manual
15 Public Spot
5
Please remember to set the ASRA bit in the Interfaces table if you set up an additional authentication step.
In order to edit the entries in the table Network authentication types, click on the button Add.... The entries in the
edit window have the following meaning:
1
Name: Assign a name for the table entry, for example, Accept Terms & Conditions. This name will
appear later in the ANQP profile in the selection for Network auth. type list.
1
Authentication type: Choose the context from the list, which applies before forwarding. Possible values include:
2
Accept terms & conditions: An additional authentication step is set up that requires the user to
accept the terms of use.
2
Online enrollment: An additional authentication step is set up that requires the user to register online
first.
2
HTTP redirection: An additional authentication step is set up to which the user is forwarded via HTTP.
2
DNS redirection: An additional authentication step is set up to which the user is forwarded via DNS.
1
Redirect URL: Enter the address to which the device forwards stations for additional authentication.
Configuring Hotspot 2.0
Hotspot 2.0 profiles
Using this table you manage the profile lists for the Hotspot 2.0. Hotspot 2.0 profiles offers you the ability to group
certain ANQP elements (from the Hotspot 2.0 specification) and to independently assign logical WLAN interfaces in the
table Interfaces. These include, for example, the operator-friendly name, the connection capabilities, operating class
and WAN metrics. Some of the elements are located in other profile lists.
In order to edit the entries in the table Hotspot 2.0 profiles, click on the button Add.... The entries in the edit window
have the following meaning:
1
Name: Assign a name for the Hotspot 2.0 profile here. This name will appear later in the interfaces table in the
selection for the Hotspot 2.0 profile.
1
Operator name list: Select the profile of a hotspot operator from the list. You specify profiles for hotspot operators
in the configuration menu by clicking the Operator list.
1491
Reference Manual
15 Public Spot
1
Connection capabilities:
Click the Select button and enter the connection capabilities for each service in the window that opens. Before
joining a network, stations use the information stored in this list to determine whether your hotspot even allows the
required services (e.g., Internet access, SSH, VPN). For this reason, the fewest possible entries should be entered with
the status "unknown". Possible status values for each of these services are "closed" (-C), "Open" (-O) or "unknown"
(-U):
2
ICMP: Specify whether to allow the exchange of information and error messages via ICMP.
2
TCP-FTP: Specify whether to allow file transfers via FTP.
2
TCP-SSH: Specify whether to allow encrypted connections via SSH.
2
TCP-HTTP: Specify whether to allow Internet connections via HTTP/HTTPS.
2
TCP-TLS: Specify whether to allow encrypted connections via TLS.
2
TCP-PPTP: Specify whether to allow the tunneling of VPN connections via PPTP.
2
TCP-VOIP: Specify whether to allow Internet telephony via VoIP (TCP).
2
UDP-IPSEC-500: Specify whether to allow IPSec via UDP and port 500.
2
UDP-VOIP: Specify whether to allow Internet telephony via VoIP (UDP).
2
UDP-IPSEC-4500: Specify whether to allow IPSec via UDP and port 4500.
2
ESP: Specify whether to allow ESP (Encapsulating Security Payload) for IPSec.
If you do not know if a service is available and its ports are open or closed on your network, or you consciously do
not want to make any entry for the status, select a -U setting.
5
Using this dialog, you do not define permissions! The stations only use the entries to determine whether to
join a network via your device. You configure specific access permissions for your network with other device
functions, such as the firewall/QoS.
1
Operating class: Enter the code for the global operating class of the access point. Using the operating class, you
inform a station on which frequency bands and channels your access point is available. Example:
2
81: Operation at 2.4 GHz with channels 1-13
2
116: Operation at 40 MHz with channels 36 and 44
Please refer to the IEEE standard 802.11-2012, Appendix E, Table E-4, for the operating class that corresponds to
your device: Global operating classes, available at
standards.ieee.org
.
1492
Reference Manual
15 Public Spot
Operator list
Using this table you manage the plain text name of the hotspot operator. An entry in this table offers you the ability to
send a user-friendly operator name to the stations, which they can then display instead of the realms. However, whether
they actually do that depends on their implementation.
In order to edit the entries in the table Operator list, click on the button Add.... The entries in the edit window have
the following meaning:
1
Name: Assign a name for the entry, such as an index number or combination of operator-name and language.
1
Language: Select a language for the hotspot operator from the list.
1
Operator name: Enter the plain text name of the hotspot operator.
XML interface
In order to be able to cover a wide range of Public Spot scenarios, the default authentication method of name and
password is not sufficient by itself. Access and accounting models using key cards, dongles or prepaid credit cards often
require additional access data, which the Public Spot in this form would be unable to manage.
The implemented XML interface connects the Public Spot and an external gateway. It directs the user data only to the
gateway that handles the authentication and accounting, and it only sends information about the duration and limits
of the user access to the Public Spot.
In this case, the Public Spot only performs the following tasks:
1
Forward the user requests
1
Restrict unauthorized access attempts
1
Accept gateway commands to start and stop a session
1
Accounting for sessions, if applicable
Since it is not realistic to implement all existing, and at times very specific scenarios with the associated gateway
commands on the Public Spot, the XML interface was designed to be flexible and multi-purpose.
1493
Reference Manual
15 Public Spot
Function
The communication between the XML interface and external gateway is processed as follows:
1. The user connects to the Public Spot's WLAN and sends an HTTP request to the Public Spot.
2. The Public Spot forwards the login procedure's HTTP request to the external hotspot gateway. The external hotspot
gateway is located either in a freely accessible network provided by the Public Spot, or its address is included in the
list of free hosts.
The Public Spot forwards the MAC address of the requesting Public Spot client to the external gateway. To implement
this, navigate to Public-Spot-Module > Page-Table, set the Type to "Redirect" and suffix the URL with the
parameter ?myvar=%m.
Example: http://192.168.1.1/?myvar=%m
In this case, myvar is a freely selectable variable. The variable %m is vital here, as the Public Spot replaces this
with the client's MAC address when forwarding the request.
3. The hotspot gateway checks the user's credentials and, if applicable, it can contact further systems to charging to
credit card, for example.
4. The hotspot gateway sends an XML file with the user data to the Public Spot's XML interface. The external hotspot
gateway contacts the device with the Public Spot XML interface using the URL
http://<Device-URL>/xmlauth.
The Public Spot's XML interface analyses this file and initiates the corresponding actions. In the case of a login
request, the XML interface inserts the user and the corresponding MAC address into the list of logged-on Public Spot
users. In the case of a logout request, the XML interface removes the user from this list again. At the same time, the
XML interface confirms the request by sending a corresponding XML file to the hotspot gateway.
In order for the Public Spot to be able to process the instructions in the XML file, a special administrator must be set
up on the device who has the function right "Public-Spot -XML-interface". This hotspot gateway logs in to the Public
Spot with this admin account.
While the user is logged in to the Public Spot, the XML interface and hotspot gateway can exchange status information
about the current session in the form of XML files.
If the user has exhausted his online quota, the hotspot gateway will send a stop command to the XML interface,
and then the Public Spot locks further access for that user. The XML interface also confirms that the login is blocked
by sending the corresponding XML file to the hotspot gateway.
1494
Reference Manual
15 Public Spot
5. If the additional use of a RADIUS server is enabled, the hotspot gateway optionally creates a user in a RADIUS server.
6. The Public Spot sends relevant data to the RADIUS server throughout the session, for example to facilitate the
accounting of the Public Spot usage. By default, the Public Spot uses its internal RADIUS server for this. If necessary,
you can configure the device running the Public Spot to conduct forwarding to an external RADIUS server.
5
Communications between the Public Spot and a hotspot gateway with the use of XML is not standardized.
Configure the hotspot gateway according to the instructions in the
Commands
section in order for the Public
Spot and hotspot gateway exchange the XML messages in the required form. XML messages are exchanged
invisibly without a graphical user interface. You can use tools such as
cURL
to test the exchange of messages.
Setting up the XML interface
The following section describes how to set up the XML interface.
5
You need to have the "Supervisor" permission in order to create another administrator account.
1. Using Management > Admin > Further administrators you create a new administrator with the function right
Public Spot XML interface.
This is the administrator account that the gateway uses to send XML files to the Public Spot XML interface.
5
The new administrator should not have any further Public Spot function rights, since they represent a potential
security risk in combination with the XML interface (e.g., if the communication between XML sender and
device is unencrypted).
2. You enable the XML interface in Public Spot > Server in the section External hotspot gateway and, if necessary,
global RADIUS authentication for your Public Spot.
3. In the section Allow access without authentication click on the button Free Networks and add a new network.
Enter the Name/IP address of the login page. In Netmask enter 255.255.255.255.
When defined as a free network, the user has direct access to the login page of the gateway without having to login
to the Public Spot first.
4. Configure the gateway so that it sends the user's session data to the Public Spot XML interface as an XML file.
For questions about configuring the gateway, please refer to the applicable service provider.
Analyzing the XML interface using cURL
The following section describes the analysis of the XML interface with the open-source software cURL.
1495
Reference Manual
15 Public Spot
Client for URL, or cURL, is a command line application use for transferring files on a network without the use of a Web
browser or FTP client. "cURL" is a component of many Linux distributions and is also available for other operating systems.
5
To analyze the XML interface using cURL, you need an administrator account with the function right "Public Spot
XML interface" for the Public Spot.
1. First download cURL and install or unpack it.
2. Start cURL with the console command curl -X POST -H "Content-Type:text/xml" -d
@filename http://user:pass@myhost/xmlauth/
The parameters have the following meaning:
@filename
Path and name of the local XML file, e.g. the login request from the
examples
.
user
Username with the function right titled "Public Spot XML interface". The XML feature does not work without
this authentication.
pass
User password.
myhost
IP address or DNS name of LANCOM with the Public Spot XML interface
3. With Telnet you can use the command trace # XML-Interface-PbSpot to activate a trace that verifies
whether XML requests were successful or error messages were received.
Commands
The XML interface can process three types of requests and responses:
1
Login
1
Logout
1
Status
An XML file can contain several requests or answers.
Login
If the external gateway sends a "Login" request in an XML file, the Public Spot activates online access for the corresponding
user. A "Login" request contains the attribute COMMAND="RADIUS_LOGIN".
If the Public Spot does not use a RADIUS server, a "login" request prompts it to store the user and the associated MAC
address directly in the internal Status table. As a result, the user is immediately authenticated in future, and there is no
need to display a login page for entering the username and password.
When you operate a RADIUS server, a 'login' request can only be successfully processed if the login data of the
corresponding user already exists on the RADIUS server.
5
The Web API in the Public Spot provides you with a convenient tool for creating new Public Spot users on the
LANCOM's internal RADIUS server. Further information about this is available in the Reference Manual under
the section "Public Spot".
The XML interface can process the following XML elements for a request:
SUB_USER_NAME
User name
1496
Reference Manual
15 Public Spot
SUB_PASSWORD
User password
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1
00-16-41-15-20-8c
The XML interface then sends the gateway a "Login" response, which can contain the following XML elements:
SUB_USER_NAME
User name
SUB_STATUS
The current user status. The following values are possible:
1
RADIUS_LOGIN_ACCEPT: Login successful
1
RADIUS_LOGIN_REJECT: Login rejected
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1
00-16-41-15-20-8c
Some examples of XML files are given below:
Login request
The external gateway sends the data for the start of a session to the Public Spot:
<?xml version="1.0" encoding="ISO-8859-1"?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE COMMAND="RADIUS_LOGIN">
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<SUB_PASSWORD>5juchb</SUB_PASSWORD>
<SUB_MAC_ADDR>00164115208c</SUB_MAC_ADDR>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
The Public Spot enables 'user2350' in the internal Status table.
Login response:
The XML interface sends a confirmation about the start of a session to the external gateway:
<?xml version="1.0" encoding="ISO-8859-1" ?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE ID="WLC-4006_PM" IP="192.168.100.2" COMMAND="USER_STATUS">
<SUB_STATUS>RADIUS_LOGIN_ACCEPT</SUB_STATUS>
<SUB_MAC_ADDR>00:16:41:15:20:8b</SUB_MAC_ADDR>
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<TXRATELIMIT>0</TXRATELIMIT>
1497
Reference Manual
15 Public Spot
<RXRATELIMIT>0</RXRATELIMIT>
<SECONDSEXPIRE>0</SECONDSEXPIRE>
<TRAFFICEXPIRE>0</TRAFFICEXPIRE>
<ACCOUNTCYCLE>0</ACCOUNTCYCLE>
<IDLETIMEOUT>0</IDLETIMEOUT>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
Logout
If the external gateway sends a "Logout" request in an XML file, the Public Spot blocks the corresponding user's online
access. A "Logout" request contains the attribute COMMAND="RADIUS_LOGOUT".
The XML interface can process the following XML elements for a request:
SUB_USER_NAME
User name
If the LANCOM receives this request and the Public Spot module discovers that this user is online with the
corresponding MAC, then this user is logged out.
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1
00-16-41-15-20-8c
TERMINATION_CAUSE
Reason for the user to log off
The XML interface then sends the gateway a "Logout" response, which can contain the following XML elements:
SUB_USER_NAME
User name
SUB_STATUS
The current user status. The following values are possible:
1
RADIUS_LOGOUT_DONE: Logout successful
1
RADIUS_LOGOUT_REJECT: Logout rejected
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1
00-16-41-15-20-8c
TERMINATION_CAUSE
Reason for blocking access
Some examples of XML files are given below:
1498
Reference Manual
15 Public Spot
Logout request
The external gateway sends the command for ending a session to the Public Spot:
<?xml version="1.0" encoding="ISO-8859-1"?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE COMMAND="RADIUS_LOGOUT">
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<SUB_PASSWORD>5juchb</SUB_PASSWORD>
<SUB_MAC_ADDR>00164115208c</SUB_MAC_ADDR>
<TERMINATION_CAUSE>Check-Out</TERMINATION_CAUSE>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
Logout response:
The XML interface sends a confirmation about the end of a session to the external gateway:
<?xml version="1.0" encoding="ISO-8859-1" ?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE ID="WLC-4006_PM" IP="192.168.100.2" COMMAND="USER_STATUS">
<SUB_STATUS>RADIUS_LOGOUT_DONE</SUB_STATUS>
<SUB_MAC_ADDR>00:16:41:15:20:8b</SUB_MAC_ADDR>
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<TERMINATION_CAUSE>User logout request</TERMINATION_CAUSE>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
Status
The external gateway queries the current status of a user from the Public Spot with a "Status" request. A "Status" request
contains the attribute COMMAND="RADIUS_Status".
The XML interface can process the following XML elements for a request:
SUB_USER_NAME
User name
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1
00-16-41-15-20-8c
The XML interface then sends the gateway a "Status" response, which can contain the following XML elements:
SUB_USER_NAME
User name
SUB_MAC_ADDR
MAC address of the user's device Possible formats include:
1
00164115208c
1
00:16:41:15:20:8c
1499
Reference Manual
15 Public Spot
1
00-16-41-15-20-8c
SUB_STATUS
The current user status. The following values are possible:
1
RADIUS_STATUS_DONE: Status request successful
1
RADIUS_STATUS_REJECT: Status request rejected, e.g. unknown user or MAC address
SESSION_TXBYTES
Current sent data volume
SESSION_RXBYTES
Current received data volume
SESSION_TXPACKETS
Number of data packets sent so far
SESSION_RXPACKETS
Number of data packets received so far
SESSION_STATE
Current status of the session
SESSION_ACTUAL_TIME
Current time
Some examples of XML files are given below:
Status request
The external gateway sends the command for a status request to the Public Spot:
<?xml version="1.0" encoding="ISO-8859-1"?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE COMMAND="RADIUS_STATUS">
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<SUB_MAC_ADDR>00164115208c</SUB_MAC_ADDR>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
Status response:
The XML interface sends a status message to the external gateway:
<?xml version="1.0" encoding="ISO-8859-1" ?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE ID="WLC-4006_PM" IP="192.168.100.2" COMMAND="USER_STATUS">
<SUB_STATUS>RADIUS_STATUS_DONE</SUB_STATUS>
<SUB_MAC_ADDR>00:16:41:15:20:8b</SUB_MAC_ADDR>
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<SESSION_ID>2</SESSION_ID>
<SESSION_TXBYTES>0</SESSION_TXBYTES>
<SESSION_RXBYTES>0</SESSION_RXBYTES>
<SESSION_TXPACKETS>0</SESSION_TXPACKETS>
<SESSION_RXPACKETS>0</SESSION_RXPACKETS>
<SESSION_STATE>Authenticated</SESSION_STATE>
1500
Reference Manual
15 Public Spot
<SESSION_ACTUAL_TIME>0</SESSION_ACTUAL_TIME>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
Interface for property management systems
If you use a property management system (PMS), certain device types and series give you the option of connecting your
Public Spot module with your PMS database via the PMS interface. If you operate a hotel, this offers you the possibility
of automatically providing your guests with access to your Public Spot when they register. This access can optionally be
free of charge or fee-based (using prepaid time credits), whereby all fees are charged to the guest's bill for their room.
The last name, room number and, optionally, an additional security ID (for example, registration number or departure
date) are used as login data.
In contrast to a voucher solution, using the PMS interface gives you the advantage of not requiring any additional
administrative steps for the setup and management of a Public Spot user account. The device creates a user account by
itself as soon as the user accesses the Public Spot and logs in with his registration data. Any future changes for this
guest (room change, departure date change, check-out, etc.), which affect registration, are retrieved autonomously from
your PMS.
The following login methods are currently supported:
1. Voucher
2. PMS login
3. PMS login and voucher
4. E-mail
5. SMS
With login method (2), the login, for example, for hotel guests, can be based on the room number and last name, while
you sell vouchers to your guests in your restaurant. Of course, even with the PMS interface enabled, you still have the
option to issue vouchers, for example, for day guests or visitors.
5
The login method is configured globally for each device, and is thus the same for all SSIDs or networks.
5
The PMS interface currently only includes support for hotel property management systems from Micros Fidelio
via TCP/IP.
5
Currently, the PMS interface is only available for the following device types and series:
LANCOM 1780 series
1
1
LANCOM 1781 series
1
LANCOM WLC-4006
1
LANCOM WLC-4006+
1
LANCOM WLC-4025
1
LANCOM WLC-4025+
1
LANCOM WLC-4100
1
LANCOM 7100 VPN
1
LANCOM 7100+ VPN
1
LANCOM 9100 VPN
1
LANCOM 9100+ VPN
Functional description
If you enable the PMS interface and provide a free or fee-based login page, the Public Spot portal page displays new
input fields, which guests can use to authenticate by entering their surname, the room number and, if applicable, a
1501
Reference Manual
15 Public Spot
further security identifier. The type of this identifier is set in the Setup menu; options include a registration number or
the guest's arrival/departure date. If you have allowed access to your hotspot as a fee-based service, a drop-down menu
additionally appears, which guests use to select the prepaid time quota or tariff/rate that they want to buy (e.g. 1 min
for EUR 0.20, or 1 hours for EUR 1). The PMS working in the background automatically charges the costs to the room
bill.
Every time a guest logs in to the Public Spot, the device initiates a comparison of the entered login data with that in the
PMS. The PMS informs the device if it detects a valid match. The device then creates a new session for the guest and
makes an entry in the corresponding accounting table (WEBconfig: Status > PMS-Interface > Accounting). The device
records all hotel guests, and the corresponding prices, who have logged on via the PMS interface, irrespective of whether
the connection is free or charged. The device then activates user access to the Internet.
A user with charged access can purchase additional time while logged on. Users who log off before the time quota
expires can resume the session at a later time by selecting the corresponding field on the login page. The device stores
the session until it becomes invalid, i.e. when the time quota is used up or when the PMS informs the device that the
guest has departed. For a new login and synchronization with the PMS, the device recognizes that there is still a valid
user account and continues using it instead of creating a new one.
If there is a change to the registration information (such as the room number), then an existing session initially remains
unaffected. Only when the current session is closed an the guest logs on to the Public Spot again is it necessary to
authenticate with the modified credentials. An exception occurs when a guest is checked-out of the PMS: In this case,
the device immediately terminates an existing session.
5
Your users should make sure that they log out properly from the Public Spot. Without a proper logout (caused
by closing the browser, disconnecting the network, switching off the device, etc.) the user is considered to be
still logged in. This can cause a problem for the user at login if you, as the Public Spot operator, have not allowed
multiple logins.
Using
Station monitoring
, you can automatically log off these users after a specified idle time. This feature is off
by default. However, for fee-based access, you absolutely should enable this. Otherwise, the device's automatic
1502
Reference Manual
15 Public Spot
internal logout will only occur after the user account has expired, i.e., when the purchased time credit has been
used up completely.
5
A temporary logout from the Public Spot does not change the expiry time of a purchased time quota. It is not
possible to "pause" a previously purchased time credit in order to restart it at a later point in time. The countdown
starts as of the purchase of the time credit regardless of the login status.
Configuring the PMS interface
Configure the PMS interface of your device in the menu Public Spot > PMS-Interface.
In this window you have the following options:
1
PMS interface activated: Enable or disable the PMS interface for the device.
1
PMS protocol: Identifies the protocol used by your property management system. Currently, only support for hotel
property management systems from Micros Fidelio is available via TCP/IP.
1
PMS server IP address: Enter the IPv4 address of your PMS server.
1
PMS port: Enter the TCP port where your PMS server is accessible.
1
Sender address: Click on the Select button, in order to configure another address where your PMS server sends its
reply messages. By default, the PMS server sends its replies back to the IP address of your device without having to
enter it here.
Possible formats for entering the address include:
2
Name of the IP network (ARF network), whose address should be used.
2
INT for the address of the first Intranet
1503
Reference Manual
15 Public Spot
2
DMZ for the address of the first DMZ
5
If an interface with the name "DMZ" already exists, the device will select that address instead.
2
LB0…LBF for one of the 16 loopback addresses or its name
5
The device always uses unmasked loopback addresses, even on masked remote stations!
2
Any IPv4 address
1
Store accounting information in flash ROM: Enable or disable whether your device stores accounting information
in regular intervals on the internal flash-ROM. By default this occurs hourly, but you can change the interval using
the setup menu. Enable this option in order to prevent a complete loss of accounting information in case of a power
outage.
5
Please note that frequent writing operations to this memory will reduce the lifetime of your device.
1
Login form: Choose the login form that will be shown as a portal page for your PMS interface. Possible values
include:
2
Free-of-charge: Choose this option if you offer your hotel guests free Internet access. Your hotel guests
will still be required to authenticate on the hotspot on the portal page with their username, room number and,
if required, an additional ID in order to prevent access to the Internet by unauthorized users.
2
Subject to charge: Choose this option if you offer your hotel guests fee-based Internet access. Your
hotel guests will be required to authenticate on the hotspot on the portal page with their username, room number
and select a tariff.
1
Allow multiple logins: Enable or disable this if you want to allow a hotel guest to use the same credentials to login
to the hotspot with multiple devices.
1
Additionally propose login via tickets: Enable or disable whether you also want to allow login with vouchers in
addition to login with the combination of username/room number.
1
Rates: If you offer fee-based Internet access, you manage the tariff rates for accounting using this table.
2
Count: Enter the rate for the time quota, for example, 1. Combined with the unit, this is the value shown in the
screenshot above, e.g., 1 hour.
2
Unit: Select the unit for the time quota from the list. Possible values include: Minutes, Hours, Days
2
Price Enter the amount charged for the time quota. Combined with the unit, this is the value shown in the
screenshot above, e.g., 50 Cent.
5
A temporary logout from the Public Spot does not change the expiry time of a purchased time quota. It is
not possible to "pause" a previously purchased time credit in order to restart it at a later point in time. The
countdown starts as of the purchase of the time credit regardless of the login status.
1
Currency: If you offer fee-based Internet access, select the currency that you use to bill the time quotas that you
offer (time quotas are set up using the tariff table). This unit is also displayed on the portal page. Please note that
this currency must match the one on the PMS server. Possible values include:
2
Cent
2
Penny
1504
Reference Manual
15 Public Spot
Advanced settings
Advanced settings for the PMS interface are made on the console or in the setup menu. An overview of all additional
parameters can be found in the
Appendix
.
15.2.5 Default and customized authentication pages
By default, your device uses pre-installed templates for the login page and all other authentication pages that your user
sees before, during and after a Public Spot session. However, you do have the option of adapting the individual web
pages to your requirements and changing the design. You need basic HTML knowledge of DIV containers and cascading
style sheets (CSS), in order to effectively change the structure and layout of the individual pages.
The following flow-chart shows an overview and interaction of all available authentication pages on your device:
Possible pages
The Welcome and Login pages are displayed to users when they access the Internet or the Public Spot for the first time.
The welcome page has a higher priority than the login page and is often used for cosmetic reasons only: Some hotspot
providers like to welcome their users on a separate welcome page in order to present, for example, information about
local offers or instructions for registration, while others prefer to provide the fastest possible access to the Internet.
Alternatively, some providers use the welcome page to display customized terms of use, which users have to accept
1505
Reference Manual
15 Public Spot
before they can go to the start page with the login form (e.g., "Login with name and password") or access the Internet
("Login after agreement").
This has nothing to do with the Terms of use page. This is displayed on the login page as an additional link if you
selected login via e-mail or SMS, and if you also require confirmation of the terms of use.
5
The pre-installed default pages on your device do not include a welcome page or the terms of use. If you invoke
one of these pages without loading the corresponding template onto your device, your users will automatically
be redirected to the login page (missing welcome page) or an error message will be displayed (missing terms of
use).
After the user has logged in with his login data, the device checks that the information is correct and displays either an
Error page, which sends the users back to the login page, or shows the Start page. This page verifies the successful
login and redirects the user after a few seconds to the Internet page that the user originally requested. Additionally, a
small popup window is opened that holds the Status page. This page shows the user the current information about his
session (e.g., time used so far, sent/received data volumes, and validity period for his account). It also offers a link to
close the session and stop accounting. If a user clicks on this link, the user is sent to the Logoff page, which confirms
the successful logout from the Public Spot.
The remaining Help and No-proxy pages are isolated pages not related to the remaining login process.
1
The No-proxy page is displayed whenever a user tries to connect via HTTP on port 8080 instead of port 80. This port
is typically used in Intranets for an HTTP proxy. Since this proxy is configured with a static IP address in the browser
settings, but these can not be configured via DHCP, the user would not be able to reach this proxy in any case. The
purpose of this page is just to instruct the user to disable the proxy before the user can proceed.
1
The Help page is only a placeholder in order to represent specific information (e.g., details about the login or where
to get vouchers). The set of default pages built into the device does not contain a help page.
The Voucher page is not one of the authentication pages: This is the graphic template for printing the vouchers. By
uploading your own template, you can print tickets with the corporate design of your own company.
Pre-installed default pages
As mentioned previously, your device contains a set of pre-installed pages on delivery, which you can use to setup an
operational Public Spot. There are pages for
1
HTTP redirection,
1
Login/logout function,
1
Status Information.
They were deliberately designed to be simple, not to use any fancy features like dynamic HTML, and just present the
necessary elements as-is. By only using the absolutely necessary elements, the correct display in any browser and any
size of screen can be assured.
As the operator of a hotspot you may want to design more sophisticated pages or display a more neutral page without
the manufacturer's logo. For that reason, the Public Spot module offers you the possibility to replace all or some of the
default pages with your own design. This can be done either by using HTTP redirection or templates that you upload to
the device and that the device processes like an intelligent HTML pre-processor. The templates can be directly loaded in
the flash storage, which makes it possible to dispense with an external HTTP server (see chapter
User-defined pages via
HTTP redirect
).
Customizing the standard pages
As an alternative to installing complete user-defined Web pages, the device provides the option of customizing the
pre-installed default pages to a certain extent. This includes for example the input of a login text that is displayed to
your users in the registration form, or replacing the header image (logo). In this way, you can quickly deploy a customized
Public Spot without having to deal in-depth with the subject of the Web page authoring.
1506
Reference Manual
15 Public Spot
Customized text on the login page
The Public Spot module gives you the option to specify customized text, which appears on the login page inside the box
of the registration form. Do this by executing the following steps.
1. In LANconfig, open the configuration dialog for the device.
2. Navigate to the dialog Public Spot > Authentication and enter the text that you want your Public Spot users to
see in theCustomization section. You can enter an HTML string with max. 254 characters composed of:
[Space][0-9][A-Z[a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*
LANconfig automatically transforms umlauts. To enter umlauts, you must use their HTML equivalents (e.g. &uuml;
for ü). You can also use HTML tags to structure and format the text. Example:
Herzlich Willkommen!<br/><i>Bitte f&uuml;llen Sie das Formular aus.</i>)
3. Click on OK to load the login text into the device.
Once the configuration has been written successfully, the new login text appears the next time the Public Spot page is
called.
Custom header images for variable screen widths
A component of the pre-installed pages in the device is a header image (logo), which is displayed to your users above
the login form for the Public Spot. You can change this header image as you please, for example to reflect the application
environment or your corporate design. There is no need for an external Web server; you can simply upload the image
directly into the device via the file management in WEBconfig or the configuration management in LANconfig.
A special feature of the header image is that it is available in the device as two possible variants: One version is for large
screens or browser windows with a horizontal resolution exceeding 800 px (normal monitors, laptops, tablet PCs, etc.),
1507
Reference Manual
15 Public Spot
and one is a small picture for screens with a lower horizontal resolution (PDAs, mobile phones, etc.). This allows you to
provide header images for different target groups and to provide them a login page that is appropriate for their device.
Figure 14: Login page for large screens
Figure 15: Login page for small screens
The available resolutions are set by the CSS file of the device. The pre-installed default graphics allow for 800x150 px
for the large screen and 258x52 px for the small screen. The file type must be either JPG, GIF, or PNG.
To upload a new header image to the device either as a large or small version, follow the steps below.
1. Start LANconfig and highlight the device.
2. In the menu bar, click on Device > Configuration management > Upload certificate or file. The Upload
certificate dialog opens.
3. Set the File type to All files and select the Certificate type that you want to upload.
1
Public Spot - Header image of pages: Certificate type for large screens
1
Public Spot - Header image box: Certificate type for small screens
1508
Reference Manual
15 Public Spot
4. Choose your custom header image and click on Open. LANconfig then starts the file upload.
After uploading successfully, the new header image appears the next time the Public Spot page is called.
5
You can check that the large and small header images are displayed by your Public Spot by setting your browser
window width to >800 px and then reducing the width of the window. The CSS technology automatically switches
between the large and small pictures.
Configuration of user-defined pages
If you would like to replace the pre-installed pages with your own webpages, you can either store them directly on the
device or on an external HTTP server. Sophisticated HTML pages may require more storage space than the space available
on the device. There are additional advantages when using websites from an external server:
1
Changes can be applied centrally. This reduces the effort required to change the login pages when using several
devices.
1
The server can dynamically provide the pages whose appearance is influenced by the information that the device
provides. This information is discussed in more detail in the following chapters.
The storage location for the templates is entered in LANconfig in Public Spot > Server > Page table > <Name of the
template> > Page address (URL). There are currently three protocols available for the URL:
1
http://…: Fetch the page via HTTP from an external server. TCP-port overrides and user/password specifications
are possible.
1
https://…: Similar to HTTP, but use HTTP over SSL for an encrypted connection.
1
file://…: Retrieve the template from the given file in the device’s local file system.
You can use any file. Some file names are reserved for this purpose:
Table 22: Overview of the reserved file names for template pages
Page designationLocal URL on your device
Welcome…file://pbspot_template_welcome
Login...file://pbspot_template_login
Error...file://pbspot_template_error
Start…file://pbspot_template_start
Status…file://pbspot_template_status
Logoff...file://pbspot_template_logoff
Help...file://pbspot_template_help
No proxyfile://pbspot_template_noproxy
Voucher…*file://pbspot_template_voucher
Terms of use...file://pbspot_template_agb
*Template for printing vouchers, no authentication page
5
By uploading user-defined webpages, only the webpages that are pre-installed on the device are replaced, but
not overwritten. They can be rolled back to the device's proprietary default pages at any time by deleting the
local URL.
5
To provide the highest possible compatibility with earlier display devices and web browsers, you should avoid
using frames, if possible. Also, specialized content such as JavaScript or plug-in elements can lead to an erroneous
display.
1509
Reference Manual
15 Public Spot
URL placeholder (template variables)
The URLs specified in the page table do not need to be absolute strings. You have the option to integrate template
variables in the address which are then filled-out with parameters from a Public Spot session when the device requests
the pages from the server. Placeholders have a form similar to C format strings, e.g., a percent sign immediately followed
by a single, lowercase character. The following placeholders are defined:
%a
Inserts the device’s IP address. The placeholder only returns a value if the Request type in the Page table
is set to Template.
5
Note that this placeholder cannot generate a reachable address if the device itself is located behind
another router with activated NAT.
%e
Inserts the device serial number.
%i
Inserts the NAS port ID. In this context, "NAS" stands for "Network Access Server". This variable contains the
interface of the device that the client used to login. For a WLC or router without WLAN this corresponds to a
physical interface, such as LAN-1, or, for a standalone access point, it is the SSID.
%l
Inserts the device host name.
%m
Inserts the MAC address of the client as a hexadecimal string of length 12. The individual bytes are separated
by colons.
%n
Inserts the name of the device the way it is configured in the setup menu under Name.
%o
Inserts the URL of the Internet page which the user initially requested. After successful authentication, the
device forwards the user to this URL.
%s
If the client is connected to the device via a WLAN interface, this placeholder will insert the WLAN SSID used
in the network that the client is connected to. This feature is particularly interesting when MultiSSID is used,
since this gives the server the opportunity to display different pages based on the SSID. If the client is connected
via another access point that connects to the device via a Point-2-Point connection, the SSID of the first WLAN
will be inserted. If the client is connect via Ethernet, the placeholder remains empty.
%t
Inserts the routing tag which is appended to the client's data packets.
%v
If the requesting client is assigned an individual VLAN ID, this variable contains the source VLAN ID.
%0-9
Inserts a single number between 0 and 9.
%%
Inserts a single percent character.
In order to be able to use variables for a template, add the parameters to the Page Address (URL) in the page table.
In the following URLs the variable %i is replaced with LAN-1 as described in the sample above:
Example:http://192.168.1.1/welcome.php?nas=%i
1510
Reference Manual
15 Public Spot
Example:http://192.168.1.1/%i_welcome.html
User-defined pages via HTTP redirect
If you implement user-defined pages with redirection (request type: redirect), your device transforms it as follows:
Whenever your device must send the respective page to a client, it will expand the URL according to the rules given in
the previous chapter and will send an HTTP 307 (temporary redirect) response to the device, with this URL as the new
location.
Redirects are particularly meaningful if you use a welcome page and all authentications should be performed on one
external gateway. In this case, the clients can be immediately redirected to this gateway. This feature is often used with
the external device controller.
User-defined pages via page templates
The device can alternatively act as a client and use the extended URL to download a user-defined page via an HTTP
connection. The internal pre-processor takes of the processing of the page and subsequently sends the result to the
Public Spot user. This pre-processor makes it possible to process session-specific data, although the server has a static
page available. The URL syntax understood by the device’s built-in HTTP client is the syntax recognized by web browsers.
However, only a subset of what is recognized by browsers is supported:
1
The user authentication is performed using the form user:password@host/...
1
The device is incapable of automatically resolving non-fatal HTTP errors such as redirects. Make sure that an access
to this page will return the page directly.
Usage of symbolic names for the server’s host instead of plain IP addresses is supported, given that DNS is properly
configured. In many aspects, this mechanism can be considered like a proxy, which fetches HTML pages and then sends
them to the client. The biggest difference is that the URL of the pages is determined by the device and not by the client
of the Public Spot user.
Auto-fallback
For every entry in the page table, it is possible to individually define whether a fallback should be used or not. This
fallback feature is only meaningful if a page is defined as a template (request type: template), and not as a redirect
(request type: redirect). While fetching a page via HTTP, various errors can appear:
1
The DNS lookup for a host name may fail.
1
The TCP/HTTP connection to the server may fail.
1
The HTTP server may respond with an error code (e.g. 404 if an invalid URL was given).
By default, the device passes this type of error on to the user so that the user can start a new request or inform the
provider of the Public Spot. Alternatively, the configuration of a fallback feature can ensure that the hotspot continues
to function by using the default pages instead. You enable the fallback feature in LANconfig using the setting Fallback
to implemented page.
Passed HTTP attributes
As mentioned above, in some respects the device may be seen as an HTTP proxy that fetches login and status pages for
the client. HTTP proxies are obliged to keep certain HTTP attributes intact while forwarding a client request:
1
The device forwards cookies between the client and the server. Client cookie values can also be sent transparently
to the server and the server can set cookies on the client. Using cookies is necessary if the files that are sent from
the server have ASP scripts, since ASP stores the session ID in a cookie.
1
The device will forward the User-Agent value provided by the client. This allows a server to deliver different
pages, based on the browser and system platform on the client side. PDAs and mobile phones for example call for
web pages optimised for their small displays.
1
The device inserts an X-Forwarded-For line into the HTTP request to report the device’s IP address.
1
WEBconfig generally attempts to use a tag named Accept-Languages provided by client browsers to match
the request to one of the languages provided by its internal message tables (currently, only German and English).
1511
Reference Manual
15 Public Spot
The selected language is communicated to the server via another Accept-Languages tag, in the hope that
the server will provide a page in the appropriate language. When the server delivers the page, the device will check
for a Language tag in the server’s response to see if the server was actually capable of delivering a page in the
requested language. If not, it will adapt the strings used in template expansion (see next section) to the actual
language of the page.
Page template syntax
After the device receives the page from the server, it performs some transformations to the page template before sending
it to the client. These transformations replace pre-defined HTML tag placeholders with data belonging to the client’s
current session (e.g. the current resource consumption in the status page). An HTML page delivered by the server could
therefore better be described as a template for an actual HTML page displayed in the client’s browser. HTML syntax was
chosen for the placeholders to allow editing of page templates without interfering with syntax sensitive HTML editors.
A set of sample page templates is available from LANCOM Systems. They are not meant to be used in productive systems,
but instead to illustrate the use of page templates, and provide a starting point for your own creations. In total, three
placeholder tags are defined:
1
<pblink identifier>text </pblink>
Marks text as a clickable link to an identifier, typically to link to another page. Note that </pblink>is just an alias
for </a>, since this symmetrical definition causes less trouble with HTML syntax checkers. For example, the following
fragment defines a link to the help page:
Please click <pblink helplink>here</pblink>for help.
1
<pbelem identifier>
Insert the item specified by identifier at this place. For example, the following line inserts the user's time credit:
Session will be ended in <pbelem sesstimeout>.
1
<pbcond identifier(s)>code</pbcond>
Only insert code into the page if all the identifiers are TRUE, i.e. numeric values are not equal to zero and string
values are not empty. Note that the current implementation does not allow nested conditionals. Continuing from
the previous example, the session timeout is only displayed if there is a time limit (a session without timeout internally
has a session timeout of zero):
<pbcond sesstimeout>Session will be terminated in <pbelem sesstimeout>seconds.</pbcond>
Page template identifiers
The following identifiers are currently defined.
5
Please note that not all identifiers are available for all printouts! Not all identifiers are available on all pages.
APADDR
Valid for:<pbelem>
This identifier contains the Public Spot’s IP address, as seen from the client’s perspective. Can be used for
user-defined login forms when the LOGINFORM element is not used.
HELPLINK
Valid for:<pbelem>
This identifier contains the URL to the help page provided by the device.
LOGINERRORMSG
Valid for:<pbelem>
This identifier returns the error message from LCOS in the case of a failed authentication. It is only valid when
used on the error page.
1512
Reference Manual
15 Public Spot
4
To retrieve the error message from the RADIUS server in the event of a failed authentication, use the
identifier SERVERMSG.
LOGINFORM
Valid for:<pbelem>
This identifier refers to the HTML form for entering the user’s name and password.
LOGINLINK
Valid for:<pbelem>
This identifier contains the URL to the login page provided by the device.
LOGOFFLINK
Valid for:<pbelem>
This identifier contains the URL to the logout page provided by the device.
ORIGLINK
Valid for:<pbelem><pblink><pbcond>
This identifier contains the URL originally requested by the user prior to the authentication process. If it is
unknown, this value is empty.
REDIRURL
Valid for:<pbelem><pblink><pbcond>
This identifier holds a possible redirection URL contained in the RADIUS server’s authentication response (if
there was one). It is only defined for the error and start page.
RXBYTES
Valid for:<pbelem>
This identifier contains the amount of data so far received by the device from the client in this session, expressed
in bytes. It is zero for a station that is not logged in.
RXTXBYTES
Valid for:<pbelem>
This identifier contains the amount of data received by the device from the client so far, or sent to the client
in this session, expressed in bytes. This means that it is the sum of TXBYTES and RXBYTES.
SERVERMSG
Valid for:<pbelem><pbcond>
This identifier holds the reply message contained in the RADIUS server’s authentication response (if there was
one). Only applicable for the error and start pages. In the case of a failed authentication, this identifier contains
the error message from the RADIUS server.
4
To retrieve the error message from the LCOS server in the event of a failed authentication, use the
identifier LOGINERRORMSG.
SESSIONSTATUS
Valid for:<pbelem>
This identifier contains a textual representation of the current status of the client relative to the device (whether
authenticated or not).
SESSIONTIME
Valid for:<pbelem>
This identifier contains the time that has passed since the login on the Public Spot.
1513
Reference Manual
15 Public Spot
SESSTIMEOUT
Valid for:<pbelem><pbcond>
This identifier contains the remaining time for the current session. After this time, the device ends the current
session automatically. This identifier is zero for a session with no time limit.
STATUSLINK
Valid for:<pbelem><pbcond>
This identifier contains the URL to the logout page provided by the device. A reference that opens a new
browser window is automatically generated within the <pblink> element.
TXBYTES
Valid for:<pbelem>
This identifier contains the amount of data transmitted by the device to the client so far in this session.
USERID
Valid for:<pbelem>
This identifier contains the user ID with which the current session was started. The identifier is not specified
if the client is not (yet) logged in.
VOLLIMIT
Valid for:<pbelem><pbcond>
This identifier contains the amount of data, expressed in bytes, that the client is still allowed to transfer before
the device terminates the current session. This identifier is zero for a session with no data limit.
Graphics in user-defined pages
All but the simplest web pages contain images, which are fetched by the client’s browser independent of the HTML page
itself. The graphic files for the pre-installed page are also stored on the device. The device automatically adapts the
necessary permissions so that even unauthorized clients have access to the images without problems. However, every
access to the referenced (device-external) images for user-defined pages are treated like a normal Internet access, and
would automatically send the user back to the welcome or start page.
In order to avoid this behavior, you should make sure that the servers where the graphics are stored are included in the
free servers. Free servers are addresses that have unlimited access, and are therefore also accessible by unauthenticated
clients, and are not billed by the accounting feature in the same way as the rest of the data traffic.
The chapter
Login-free servers and networks
contains additional information about configuring free servers. Note that
if a user-defined page is defined as a redirect, this of course has to be defined as a free IP address.
15.3 Access to the Public Spot
15.3.1 Requirements for logging in
1
Device with network adapter
1
Operating systems supporting the TCP/IP protocol (automatic IP-address retrieval by DHCP active)
1
Web browser (supporting JavaScript and Frames)
1
Direct Internet access (use of proxy deactivated)
1
WLAN access information (network name, encryption information)
1
Valid user data (user identifier and password)
1514
Reference Manual
15 Public Spot
Information for WLAN access
A maximum of two pieces of information are required to access the WLAN:
1
The network name of the WLAN (SSID)
If the Public Spot's base stations are configured for operation as a closed network, the user must know the exact
name of the wireless LAN, its SSID.
1
Wireless LAN encryption
Although it is possible to provide guest access via encrypted connections using, for example, WPA, Public Spots are
not generally operated with WLAN encryption. Protection is provided in this case using authentication with a username
and password. Data security when transmitting data on the Public Spot must be provided by the end user (e.g., using
a VPN client).
Information for LAN access
If the IP addresses on your network are automatically assigned (for example, via DHCP), your users only need:
1
a LAN socket that connects to the Public Spot.
1
a LAN cable to connect their LAN adapter to the LAN socket.
Information for authentication
The user needs to have the following information to hand when logging in:
1
User identifier
1
Password
1
MAC address
If you set the authentication mode for a Public Spot at the base station to "MAC+User+Password", you, as the
operator, must know the MAC addresses of the end devices employed by your users. An end device automatically
and continuously transmits its MAC address when communicating with a base station. The user does not have to
manually enter this information when logging in, but instead it is communicated just once to the operator before
attempting to login.
15.3.2 Logging in to the Public Spot
1. Log in to the WLAN of the Public Spot (for WLAN connections) or connect to the network using an Ethernet cable
(for LAN connections).
The different types of mobile devices and WLAN adapters offer various ways of entering the settings required for
accessing the WLAN. Many devices require the network name (SSID) of the WLAN to be entered into the configuration
program for the WLAN adapter. Some other products also provide an overview of all base stations in the vicinity,
from which the user simply chooses the one they want to use.
Depending on the configuration, the user receives the necessary settings for the LAN-adapter connection either
automatically from the network or a connected DHCP server, or from the network administrator.
2. Start your Web browser.
1515
Reference Manual
15 Public Spot
As soon as the Web browser attempts to access any Internet site, the Public Spot automatically intervenes and
presents the login page.
5
Depending on the firmware version, the actual login page may vary from the one shown here. However it
looks, the login page will always present the input fields for user ID and password.
3. Enter the complete user ID and password in the corresponding fields and confirm your entries with Login.
5
To login, you should use a Web browser with JavaScript support enabled to ensure that session status
information can be displayed in a popup window.
If the login to the Public Spot is successful, an additional window pops up with the main information about the
current session. This window is also used for the login. This window should be left open throughout the session (e.g.,
it can be minimized).
15.3.3 Session information
The window with session information is automatically updated at regular intervals. Along with the status and current
user ID, the information displayed includes the connection time and the volume of transferred data.
If the session-information window is not open, you can open it by entering the following in the address line in the
browser:
http://<IP address of the Public Spot>/authen/status/
15.3.4 Logging out of the Public Spot
The session information window can be used to logout from the Public Spot. Simply click on the word here in the bottom
line of text in the window.
If the session-information window is not open, you can enter the following into the address line in the browser:
http://<IP address of the Public Spot>/authen/logout
The Public Spot operator can supply you with the <Public Spot's IP address> upon request.
1516
Reference Manual
15 Public Spot
5
The operator can set up the Public Spot to automatically logoff users if they cannot be reached for 60 seconds.
In case of doubt, please ask the Public Spot operator if automatic logoff (Station monitoring) is activated.
15.3.5 Advice and help
The following sections present solutions to the most common problems that may occur when operating a Public Spot.
The Public Spot login page is not displayed
1
The Internet access must be set up so that it is directed via the network adapter and not via a dial-up networking
connection. To check this, take a look at the connection settings for your Web browser. If you use Microsoft Internet
Explorer, you must disable the dial-up configurations in Tools > Internet Options > Connectionsentered there.
1
Internet access must be direct, i.e. without going via a proxy server. In Microsoft Internet Explorer, you can disable
the use of a proxy server in the menu Tools > Internet Options > Connections > LAN-Settings....
1
If you are making the connection with a WLAN adapter: Ensure that your network adapter can in fact find the Public
Spot. Your WLAN adapter gives you the option of searching for an access point.
1
If you are making the connection with a WLAN adapter: Check if your network adapter has all of the necessary
settings to access the Public Spot network:
2
You probably have to enter the network name for the WLAN.
2
When working with an encrypted Public Spots, you are also required to enter the corresponding WPA or WEP
key.
1
Check that your network adapter is set up for automatic retrieval of an IP address (DHCP). Your device should not
have a fixed IP address.
5
If your network adapter is set up with a fixed IP address, adjusting it for automatic retrieval by DHCP may cause
important configuration information to be lost. Ensure that you note all of the values listed in the network settings
(IP address, standard gateway, DNS server, etc.).
Login not working
1
Ensure that you enter the user data correctly and in full. Ensure that you use the correct capitalization for all entries.
1
Is the CAPS-LOCK key activated on your device? This causes the capitalization to be reversed. Deactivate the CAPS-LOCK
key and repeat the entry of your login data.
1
The Public Spot operator may be checking more than just the user ID and password, but also the MAC address
(physical address) of your network adapter as well. In this case, ensure that the Public Spot operator is informed of
your correct MAC address.
It is no longer possible to login
If the Public Spot breaks off communications after a number of login attempts have failed, you should deactivate your
WLAN adapter for at least 60 seconds (or your entire device) or disconnect the LAN adapter from the network, and then
try again.
The session information window is not being displayed
To display the session-information window, enter the following line into the address line of your Web browser:
http://<IP address of the Public Spot>/authen/status
The Public Spot operator can supply you with the <Public Spot's IP address> upon request.
The Public Spot requests a new login for no reason (WLAN)
When moving into the signal coverage area of another access point (roaming), it is necessary to login again. If you are
located in the overlap area between two access points, you may even experience a change of connection between the
1517
Reference Manual
15 Public Spot
two access points at regular intervals. The task of the roaming secret is to allow Public Spot sessions to be passed between
access points without the user having to login again.
1
LANconfig: Public Spot > Users > Roaming Secret
15.4 Tutorials for setting up and using Public Spots
The following tutorials describe examples of how the Public Spot option can be implemented.
15.4.1 Virtualization and guest access via WLAN controller with VLAN
Many companies wish to offer Internet access to their visitors via WLAN. In larger installations the required settings
apply to multiple access points, and these can be programmed centrally in the WLAN controller.
Objectives
1
Wireless LAN infrastructure available to internal employees and guests
1
Shared physical components (cables, switches, access points)
1
Separation of networks with VLAN and ARF
1
Break-out of data streams to certain target networks:
2
Guests: Internet only
2
Internal employees: Internet, all local devices and services
1
Guests login to the WLAN with a Web form.
1
Internal employees use WLAN encryption for authentication.
Establish
1
Management of the access points is handled by the LANCOM WLC.
1
The LANCOM WLC serves as the DHCP server for the WLAN clients in the guest network.
1
The guest network is provided with Internet access via the LANCOM WLC (e.g. separate DSL access or Internet access
via the company DMZ).
1
The wired infrastructure is based on managed VLAN-capable switches:
2
The VLAN management of access points is handled by the LANCOM WLC.
2
The VLAN management of the switches is handled separately by the switch configuration.
1
The access points operate within the internal VLANs.
1518
Reference Manual
15 Public Spot
Wireless LAN configuration of the WLAN controllers
During the configuration of the WLAN, the necessary WLAN networks are defined and, along with the physical WLAN
settings, are assigned to the access points managed by the controller.
1. Create a logical WLAN for guests and one for the internal employees:
1
The WLAN with the SSID GUESTS uses the VLAN ID 100 (VLAN operating mode Tagged) and uses no
encryption.
1
The WLAN with the SSID INTERNAL receives no VLAN ID (VLAN operating mode untagged, i.e. packets are
transferred in the Ethernet without a VLAN tag) and uses WPA encryption, e.g. 802 11i (WPA)-PSK.
1
LANconfig: WLAN Controller > Profiles > Logical WLAN networks (SSIDs)
5
If you set the VLAN mode to untagged, LANconfig will gray-out the VLAN ID input field in the add/edit
dialog shown above. However, the corresponding table Logical WLAN networks (SSIDs) still displays the
assigned VLAN as a value in the grayed-out box. This entry is only of internal significance, as the acceptable
range is between 2 and 4094. Ultimately it is the VLAN operating mode which is decisive: If this is set to
untagged, then a VLAN ID is not transmitted under any circumstances.
2. Create a set of physical parameters for the access points.
The management VLAN ID is set to 1, which serves to activate the VLAN function (but without a separate management
VLAN for the device; the management data traffic is transmitted untagged).
1519
Reference Manual
15 Public Spot
1
LANconfig: WLAN Controller > Profiles > Physical WLAN parameters
3. Create a WLAN profile that you can assign to the access points.
The two logical WLAN networks and the set of physical parameters defined earlier are collected into this WLAN
profile.
1
LANconfig: WLAN Controller > Profiles > WLAN profiles
4. Assign this WLAN profile to the access points managed by the controller.
Do this by entering each access point with its MAC address into the access point table. Alternatively you can use the
Default button to create a default profile, which applies to all access points.
1
LANconfig: WLAN Controller > AP Config. > Access point table
Configuring the switch (LANCOM ES-2126+)
In this section we describe the configuration of the switch using the LANCOM ES-2126+ as an example.
1520
Reference Manual
15 Public Spot
1. Set the VLAN mode to Tagged, as the access points handle the assignment of VLAN tags.
2. Set the group names of the VLANs.
To differentiate between the VLANs in the switch, two groups are used. The internal network for the employees is
mapped to the default group (default), and a dedicated group (guests) is set up for the guests. The Groups use the
corresponding VLAN IDs that you entered into the controller when configuring the WLANs.
The default VLAN is valid on all ports and remains untagged, i.e., the VLAN tags are removed from outgoing data
packets for this group by the switch.
1521
Reference Manual
15 Public Spot
The guests' VLAN group uses the VLAN ID "100" and is valid only for the ports connected to the WLAN controller
and access points (ports 10 to 16 in our example). The switch does not remove tags of outgoing data packets.
3. Set the port VLAN ID (PVID) for all ports to "1".
This assigns all ports to the internal network so that the switch assigns the VLAN ID "1" to all untagged incoming
data packets on these ports before forwarding them.
Configuring the switch (LANCOM GS-2326P)
In this section we describe the configuration of the switch using the LANCOM GS-2326P as an example.
1. Under Configuration > VLAN > VLAN-Membership, create an additional VLAN group for the guest network.
To differentiate between the VLANs in the switch, two groups are used. The internal network for the employees is
mapped to the group default, and that for the guests is mapped to the group guests.
1
The VLAN group for the internal employees uses the default VLAN ID 1. This VLAN ID used for internal
administration applies on all ports and is operated untagged, i.e. all untagged incoming data packets are given
1522
Reference Manual
15 Public Spot
the VLAN ID 1 for internal routing, and this is removed again from outgoing data packets (see also "PVID" in the
next step).
1
The VLAN group for the guests uses the VLAN ID 100, which you entered earlier when configuring the WLAN
in the controller. This ID applies only to the ports which the WLAN controller and the access points are connected
to (in this example: Port 10 to 16, green checkmarks for Port members). The switch does not remove tags from
outgoing data packets. i.e. all tagged incoming packets with VLAN ID 100 retain this tag and are routed only to
the ports that are members of the corresponding group.
2. Under Configuration > VLAN > Ports, set the Port type for all ports to C-port. See the documentation about your
switch for details about this setting.
3. Configure the Egress rule for each port.
1
All ports except port 10 to 16 are given the Access rule. As a result, these ports forward only tagged packets
and all others are dropped.
1
The ports 10 to 16 are given the rule Hybrid. As a result, these ports forward both untagged and tagged packets.
5
Ensure that the PVID (port VLAN ID) for each port is set to a value of 1. The PVID is the VLAN ID that a port
assigns to incoming data packets which do not already have a VLAN tag; Therefore, the PVID corresponds
to the VLAN ID of the default group.
4. OPTIONAL: If you wish to allow access to the guest network via Ethernet, go to Configuration > VLAN > Ports
and, for example, set the PVID to 100 for ports 17 to 20 and, under Configuration > VLAN > VLAN-Membership,
assign these ports to the group Guests. All untagged incoming data packets arriving at these ports are given
VLAN ID 100.
5
Note that these data packets can only leave the switch via the ports of the guest network.
1523
Reference Manual
15 Public Spot
Configuring the IP networks in the WLAN controller
To separate the data streams on layer 3, two different IP networks are employed (ARF – Advanced Routing and Forwarding).
1. For the internal network, set the INTRANET to the address 192.168.1.1.
This IP network uses the VLAN ID 0. This assigns all untagged data packets to this network (the VLAN module in
the controller itself must be activated for this). The interface tag 1 is used for the subsequent break-out of data in
the virtual router.
1
LANconfig: TCP/IP > General > IP networks
2. For guests, create a new IP network with the address 192.168.100.1.
This network uses the VLAN ID 100. In this way, all data packets with this ID are assigned to the guest network.
Here, too, the interface tag 10 is used later by the virtual router.
1
LANconfig: TCP/IP > General > IP networks
3. Enable the DHCP server for both IP networks.
1
LANconfig: TCP/IP > General > IP networks
1524
Reference Manual
15 Public Spot
With these settings, the WLAN clients of the internal employees and guests are assigned to the appropriate networks.
Configuring Public Spot access accounts
The Public Spot allows you to provide a strictly controlled point of access to your wireless LAN. Authentication is performed
by requesting user information via a web interface. If necessary, you can can set a time limit for the access.
1. You should activate authentication for network access by name and password.
1
LANconfig: Public Spot > Authentication > Authentication for network access
2. Activate user authentication for the controller's interface that is connected to the switch.
1525
Reference Manual
15 Public Spot
1
LANconfig: Public Spot > Server > Interfaces
3. Restrict access to the Public Spot.
You restrict use of the Public Spot to data packets from this virtual LAN by entering the VLAN ID of "100" for the
guest network into VLAN table. Other data packets from other VLANs will be forwarded to the Public Spot without
a login. Note that access to WEBconfig via the Public Spot interface is restricted to the authentication pages only
(see
Limit configuration access
).
5
If the interface is not restricted to the VLAN ID, the controller will no longer be reachable at the specified
physical Ethernet port!
1
LANconfig: Public Spot > Server > VLAN table
4. Enable the option to clean up the user table so that your device automatically deletes entries that are no longer
needed.
1
LANconfig: RADIUS server > General > Clear user lists automatically
Configuring the internal RADIUS server for Public Spot operation
As of LCOS version 7.70, the Wizard stores the Public Spot access accounts in the user database of the internal RADIUS
server. In order to use Public Spot access accounts, you must configure the RADIUS server and the Public Spot module
to use the RADIUS server.
1. Enable the RADIUS server by entering the authentication and accounting ports so that you can use the user database
on the internal RADIUS server.
Use the authentication port 1,812 and the accounting port 1,813.
1526
Reference Manual
15 Public Spot
1
LANconfig: RADIUS server > General > RADIUS service
2. Create an entry in the authentication server list of the Public Spot for the internal RADIUS server under Name, so
that the Public Spot has the address of the RADIUS server and can authenticate Public Spot access attempts on the
internal RADIUS server of the LANCOM device.
Enter the IP address of the device as the authentication and accounting server where the RADIUS server was enabled.
Also use the authentication and accounting port settings from the RADIUS server (1,812 and 1,813).
5
If the Public Spot and the RADIUS server are provided by the same device, enter the device's internal loopback
address (127.0.0.1) here.
1
LANconfig: Public Spot > Users > Authentication servers
Configuring Internet access for the guest network
1. In order to provide Internet access for guest network users, there is a wizard to set up access to a provider network.
2. Limit access to the provider network.
In order for this access to be available to users of the guest network only, set the routing tag "10" for the corresponding
route. This ensures that only data packets from the IP network "GUEST" with the interface tag "10" are transmitted
1527
Reference Manual
15 Public Spot
to the provider's network. The different routing tag values ensure that data cannot be routed between the guest
network and the internal network.
1
LANconfig: IP router > Routing > Routing table
3. Optional: If necessary, use Device > Configuration Management > Upload certificate or file in LANconfig to
upload an HTML template and an image as a template to the device for output of the voucher.
The image can be a GIF, JPEG or PNG file of max. 64 KB in size.
15.4.2 Virtualization and guest access via WLAN controller without VLAN
Overlay network: Separating networks for access points without using VLAN
In many cases, networks in a shared physical infrastructure are separated by using VLANs. However, this method assumes
that the switches operated in the network are VLAN-capable and that these are configured for VLAN operations.
Consequently, the administrator has to rollout the VLAN configuration for the whole network.
WLAN controllers enable you to separate the networks while minimizing the use of VLANs. The access points use a
CAPWAP data tunnel to direct the payload from the WLAN clients straight to the controller, which then assigns the data
to the corresponding VLANs. In this situation, VLAN configuration is only required for the controller and a single, central
switch. All of the other switches in this example work without a VLAN configuration.
5
With this configuration, you reduce the VLAN to the core of the network structure (illustrated with a blue
background). What's more, only 3 of the switch ports in use require a VLAN configuration.
Example application: Overlay network
1528
Reference Manual
15 Public Spot
The diagram shows a sample application with the following components:
1
The network consists of two segments, each with its own (not necessarily VLAN-capable) switch.
1
Each segment contains several access points, each of which is connected to one of the switches.
1
Each access point provides two SSIDs for the WLAN clients in two different user groups, shown in the diagram in
green and orange.
1
Each user group has access to its own dedicated server that is separated from other user group. The servers can only
be accessed via the corresponding VLANs, i.e. through the access ports configured on the switch.
1
A single WLAN controller manages all of the access points in the network.
1
A central, VLAN-capable switch connects the switches in each segment, the servers for each group, and the WLAN
controller.
The aim of the configuration: A WLAN client that associates with an SSID is to have access to its "own" server, regardless
of which access point is being used and regardless of the segment in which the client is located.
5
The following description assumes a working basic configuration of the WLAN controller. The configuration of
the VLAN switch is not part of this description.
Configuring the WLAN settings
1. For each SSID, create an entry in the list of logical networks. This entry requires a suitable name and the corresponding
SSID.Connect the SSID to a WLC tunnel, for example the first SSID to "WLC-TUNNEL-1" and the second to
"WLC-TUNNEL-2 '. Set the VLAN mode to 'tagged', set the VLAN ID '10' for the first logical network and the VLAN
ID '20' for the second logical network. In LANconfig you find these settings under Configuration > WLAN
Controller > Profiles > Logical WLAN networks (SSIDs).
Logical WLAN networks for overlay networks
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your access points, such
as the country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. For this profile
in the physical WLAN parameters, enable the option to turn on the VLAN module on the access points. Set the
1529
Reference Manual
15 Public Spot
operating mode for the management VLAN in the access points to 'Untagged'. In LANconfig you find these settings
under Configuration > WLAN Controller > Profiles > Physical WLAN parameters.
Physical WLAN parameters for overlay networks
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find these settings under Configuration >
WLAN Controller > Profiles > WLAN profiles.
WLAN profiles for overlay networks
4. For each managed access point, create an entry in the access point table with a suitable name and the associated
MAC address. Assign the WLAN profile created previously to this access point. In LANconfig you find these settings
under Configuration > WLAN Controller > AP config. > Access point table.
Access point table for overlay networks
1530
Reference Manual
15 Public Spot
Configuring the interfaces on the WLC
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Make sure that the other Ethernet
ports are not assigned to the same LAN interface. In LANconfig you find these settings under Configuration >
Interfaces > LAN > Ethernet ports.
Ethernet setting for overlay networks
6. Assign the logical LAN interface 'LAN-1' and the WLC tunnels 'WLC-tunnel-1' and 'WLC-tunnel-2' to the bridge-group
'BRG-1'. Make sure that the other LAN ports are not assigned to the same bridge group. In LANconfig you find these
settings under Configuration > Interfaces > LAN > Port table.
Port settings for overlay networks
5
By default, the LAN interfaces and WLC tunnels do not belong to a bridge group. By assigning the LAN
interface 'LAN-1' and the two WLC tunnels 'WLC-Tunnel-1' and 'WLC-Tunnel-2' to the bridge group 'BRG-1',
the device transmits all data packets between LAN-1 and the WLC tunnels via the bridge.
1531
Reference Manual
15 Public Spot
7. The WLAN controller can optionally act as a DHCP server for the access points. To set this up, activate the DHCP
server for the 'INTRANET'. In LANconfig you find these settings under Configuration > TCP/IP > DHCP > DHCP
networks.
DHCP settings for overlay networks
WLAN controller with Public Spot
This scenario is based on the first scenario (overlay network) and enhances it to include specific settings for user
authentication.
The configuration of a Public Spot can be greatly simplified if the payload data sent from the WLAN to the controller is
routed through a WLC tunnel. A Public Spot can, for example, provide guests with Internet access in parallel with, but
separated from, an internal wireless LAN.
In this example, the employees of a company have access to a private WLAN (SSID), while the guests use a Public Spot
to access the Internet. In all areas of the building, the access points provide two SSIDs, 'COMPANY' and 'GUESTS'.
Example application: WLAN controller with Public Spot
The aim of the configuration: A WLAN client that associates with the internal SSID should have access to all internal
resources and the Internet via the central gateway. The access points break-out the payload data from the internal clients
locally and pass it on directly to the LAN. The guests' WLAN clients associate with the Public Spot. The access points
send the payload data from the guest clients through a WLC tunnel directly to the WLAN controller, which uses a separate
WAN interface for Internet access.
1. The internal WLAN and the guest WLAN each require an entry to be created in the list of logical networks, each with
a suitable name and the corresponding SSID. Link the SSID for internal use with the 'LAN at AP', and the SSID for
guests with (for example) 'WLC-TUNNEL-1'. Disable encryption for the guest network SSID so that the guests' WLAN
1532
Reference Manual
15 Public Spot
clients can associate with the Public Spot. You should also prevent inter-station traffic for this SSID. In LANconfig
you find this setting under Configuration > WLAN Controller > Profiles > Logical WLAN networks (SSIDs).
Logical WLAN networks for internal use
Logical WLAN networks for guest access accounts
1533
Reference Manual
15 Public Spot
2. Create an entry in the list of physical WLAN parameters with the appropriate settings for your access points, such
as the country 'Europe' with the channels 1, 6 and 11 in 802.11b/g/n and 802.11a/n in mixed mode. In LANconfig
you find this setting under Configuration > WLAN Controller > Profiles > Physical WLAN parameters.
Physical WLAN parameters for Public Spot APs
3. Create a WLAN profile and give it a suitable name. Then assign the logical WLAN networks and the physical WLAN
parameters created previously to this WLAN profile. In LANconfig you find this setting under Configuration > WLAN
Controller > Profiles > WLAN profiles.
WLAN profiles for Public Spot APs
4. For each managed access point, create an entry in the access point table with a suitable name and the associated
MAC address. Assign the WLAN profile created previously to this access point. In LANconfig you find this setting
under Configuration > WLAN Controller > AP config. > Access point table.
1534
Reference Manual
15 Public Spot
Access point table for Public Spot APs
5. Assign a separate logical LAN interface, e.g. 'LAN-1', to each physical Ethernet port. Set the 4th Ethernet port to the
logical interface 'DSL-1'. The WLAN controller will use this LAN interface for the guest network Internet access. In
LANconfig you find this setting under Configuration > Interfaces > LAN > Ethernet ports.
Ethernet settings for Public Spot APs
6. Verify that the logical LAN interface 'WLC-tunnel-1' is not allocated to a bridge group. This ensures that the other
LAN interfaces do not transmit any data to the Public Spot. In LANconfig you find this setting under Configuration >
Interfaces > LAN > Port table.
Port settings for Public Spot APs
1535
Reference Manual
15 Public Spot
7. For the guest Internet access, create an entry in the list of DSL remote sites with the hold time '9999' and the
pre-defined layer 'DHCPOE '. This example assumes that Internet access is provided by a router with DHCP server.
In LANconfig you find this setting under Configuration > Communications > Remote sites > Remote sites.
Remote site for Internet access
8. For internal users, create the IP network 'INTRANET' with (for example) the IP address '192.168.1.100' and the
interface tag '1'. For the guest access, create the IP network 'GUEST-ACCESS' with (for example) the IP address of
'192.168.200.1' and the interface tag '2'. The virtual router in the WLAN controller uses the interface tags to separate
the routes for the two networks. In LANconfig you find this setting under Configuration > TCP/IP > General > IP
networks.
IP network for internal use
IP network for guest access
9. The WLAN controller can act as a DHCP server for access points and the associated WLAN clients. To set this up,
activate the DHCP server for the 'INTRANET' and the 'GUEST-ACCESS'. In LANconfig you find this setting under
Configuration > TCP/IP > DHCP > DHCP networks.
1536
Reference Manual
15 Public Spot
5
Activation of the DHCP server is obligatory for the guest network and optional for the internal network. There
are other ways of realizing a DHCP server for the internal network.
DHCP network for guest access
10. Create a new default route in the routing table to direct the data from the guest network to the Internet connection
used by the WLAN controller. Select the routing tag '2' and the router 'Internet'. Also activate the option 'Masking
intranet and DMZ (default)'. In LANconfig you find this setting under Configuration > IP router > Routing >
Routing table.
Routing entry for Internet access
11. Activate the Public Spot user authentication for the logical LAN interface 'WLC-Tunnel-1'. In LANconfig you find this
setting under Configuration > Public Spot > Server > Interfaces.
Activation of user authentication for the WLC tunnel
1537
Reference Manual
15 Public Spot
12. The final step is to enable authentication via the Public Spot for the WLAN controller. In LANconfig you find this
setting under Configuration > Public Spot > Authentication.
Activation of authentication via Public Spot
In addition to configuring the WLAN controller, you must also configure the Public Spot either to use the internal
user list or to use a RADIUS server, according to your needs.
15.4.3 Setting up an external RADIUS server for user administration
Some applications user data is not stored on the device, but on an external, centralized RADIUS server. In this case, the
Public Spot must communicate with the external RADIUS server to check the user data.
5
Please note that specific functions (such as the Public Spot wizards in WEBconfig) are not available to you if you
use an external RADIUS server for user administration!
5
The following instructions assume that you know the IP address of a functional RADIUS server in the network.
The following configuration steps are used to set up a Public Spot that will be used with an external RADIUS server:
1. Follow the steps in the section
Manual Installation
.
Among other things, the exact time on the device is necessary for the proper control of time-limited access.
5
If authentication with an additional check of the physical address (MAC address) is enabled, the Public Spot
transmits the MAC address of the end device to the RADIUS server. In this manner the Public Spot does not
see whether the MAC address was actually checked or not. For MAC address checks to work without problem,
the RADIUS server must be configured accordingly.
2. Enter the settings for the RADIUS server.
1
LANconfig: Public Spot > Users > Authentication servers
When configuring a Public Spot, user registration data can be forwarded to one or more RADIUS servers. These
servers are configured under Public Spot > Users > Authentication servers. The registration data that individual
1538
Reference Manual
15 Public Spot
RADIUS servers require from the clients is not important to the device that provides the Public Spot, since this data
is transparently passed on to the RADIUS server.
5
IP addresses specified here must be static. The Public Spot must be able to contact the specified destination
addresses. For IP addresses outside of your own network, a router that has contact to the destination network
must be specified as a gateway in the DHCP settings for the Public Spot. You have to define this gateway as
the default route in the routing table.
5
In order for the RADIUS server to record the connection data, the information on the accounting server must
be specified in full. As an alternative to using a RADIUS accounting server, the connection information from
the Public Spot can also be output by the SYSLOG function.
3. That's it!
Your Public Spot is now ready for operation. All users with a valid account on the RADIUS server can use the Web
interface to login to the Public Spot.
15.4.4 Internal and external RADIUS servers combined
Some companies use an external RADIUS server to authenticate users with IEEE801.1x. For applications with a WLAN
controller and multiple access points, the access points initially address the WLAN controller as their RADIUS server. You
define how the RADIUS requests are forwarded to the external RADIUS server on the WLAN controller.
5
The settings described below are only necessary if you are operating an external RADIUS server on your device
in addition to the Public Spot in the external RADIUS server.
A Public Spot providing guest-access accounts requires the following settings:
1
Authentication requests from internal employees are to be forwarded to an external RADIUS server.
1
The authentication requests for Public Spot access accounts are to be handled by the internal RADIUS server.
Realm tagging for RADIUS forwarding
Authentication requests from the two user groups are to be handled separately. The WLAN controller uses what are
known as "realms" to differentiate between these two groups. The purpose of realms is to address domains within which
user accounts are valid. The WLAN controller can transmit the realms with authentication requests to the RADIUS server.
Alternatively, the RADIUS server can change the realms in the user names for the purpose of RADIUS forwarding:
1
The value defined for "Standard realm" replaces an existing realm of an incoming request if no forwarding is defined
for that existing realm.
1
The value defined under "Empty realm" is only used by the RADIUS server if the incoming user name still does not
have a realm.
1539
Reference Manual
15 Public Spot
An entry in the forwarding table causes all authentication requests with a certain realm to be forwarded to a RADIUS
server. If no matching entry exists in the forwarding table, the request is refused.
5
If the WLAN controller checks the realm and finds that it is empty, it always checks the authentication request
with the internal RADIUS database.
The following flow diagram illustrates the method used by the RADIUS server to process realms:
Using different realm tags allows different RADIUS servers to be targeted with requests. The way in which LANCOM's
RADIUS server makes decisions for the two requests is shown in the diagram:
1. Because the user names for guest access accounts are generated automatically, they are suffixed with an appropriate
realm, such as "PSpot". Because the forwarding table does not contain this entry and the standard realm is empty,
the WLAN controller forwards all authentication requests with this realm to the internal RADIUS server.
2. To limit the amount of work required for the configuration, internal users are listed without a realm. The RADIUS
server in the LANCOM can automatically replace an empty realm with another realm in order to identify internal
users. In this example, the empty realm is replaced by the domain of the company "company.eu". The information
specified in the forwarding table allows all authentication requests with this realm to be forwarded to the external
RADIUS server.
Configuring RADIUS forwarding
The following configuration steps allow you to specify the different manners in which internal users and guests are
processed.
1. In the Public Spot, adapt the pattern of user names such that a unique realm can be suffixed.
For example, if the pattern is "user%n@PSpot", the Public Spot generates usernames with the format
"user12345@PSpot".
1
LANconfig:Public Spot > Wizard > Add user wizard
1540
Reference Manual
15 Public Spot
2. In the WLAN controller's RADIUS server, define an "empty realm" (e.g., "COMPANY.EU").
This realm is attached to all user names which request authentication from the WLAN controller and which do not
already have a realm. In this application, the internal users have no realm defined. In order to prevent the WLAN
controller's RADIUS server from attaching a realm, you must leave the "Default realm" field blank.
1
LANconfig:RADIUS Server > Forwarding > Forwarding server
3. In order for the WLAN controller to forward authentication requests from internal users to the external RADIUS
server, suitable entries must be made in the forwarding settings.
1541
Reference Manual
15 Public Spot
All incoming RADIUS requests which have the realm "COMPANY.EU" will be forwarded to the specified IP address.
4. Authentication requests from Public Spot users have the realm "@PSpot" and are received by the WLAN Controller.
With no forwarding defined for this realm, the usernames are automatically checked with the internal RADIUS
database. Because the Public Spot access accounts created with the Wizard are stored in this database, these requests
can be authenticated as required.
15.4.5 Checking WLAN clients with RADIUS (MAC filter)
To use RADIUS to only authenticate specific WLAN clients and grant them WLAN access based on their MAC address,
an external RADIUS server can be used, as can the internal RADIUS user database of the LANCOM WLAN controller.
Enter the MAC addresses in the RADIUS database using LANconfig, and enable all authentication methods. For Name/MAC
address and Password select the corresponding MAC address in the format "AABBCC-DDEEFF".
1
LANconfig: RADIUS server > General > User database
15.4.6 Setting up an external SYSLOG server
Depending on the use case, storage of the usage data is required for the operation of a Public Spot. This data can be
stored to a SYSLOG server, for example. Some SYSLOG servers are available as free software.
1542
Reference Manual
15 Public Spot
To save user data from a Public Spot by means of SYSLOG, the external SYSLOG server has to be configured in the
respective Public Spot. Once this is done, messages are sent for logging to the SYSLOG server whenever Public Spot user
accounts are created or deleted, and at the beginning and end of Public Spot sessions. The message issued at the end
of a session—with the source "Login" and the priority "Information"—also includes information on the transferred data
volumes and the IP address used.
5
Further information on the configuration of SYSLOG is to be found in the LCOS Reference Manual. You can find
legal information about this topic in the LANCOM techpaper "Public Spot" which is available at
www.lancom-systems.de/en/publications/products
.
Configuring an external SYSLOG server
Your device is capable of logging the creation and deletion of Public Spot users, as well as their login and logout activities.
You can also transfer this internally stored information to an external SYSLOG server. The following steps show you how
you can set up logging with a program installed on an external SYSLOG server (in this example, "Kiwi").
1. Start LANconfig and open the configuration dialog for your device.
2. Change to the dialog Log & Trace > General and open the table SYSLOG servers.
3. Add a new entry Specifiy the IP address of the computer where the SYSLOG client is installed (e.g.,
192.168.10.237), and enter the Source (Login, Accounting) and the Priority (Information).
4. Close the dialog and store the configuration on your device.
5. Start the analysis program on your SYSLOG server (e.g., "Kiwi"). As soon as the program has started, it logs the
creation and deletion of Public Spot accounts and also the user logins and logouts.
1543
Reference Manual
15 Public Spot
15.5 Appendix
15.5.1 Commonly transmitted RADIUS attributes
The RADIUS client module was implemented on the basis of RFCs no. 2865 and no. 2866.
These specifications define various attributes, some of which are an absolute necessity and some of which are optional.
The following overview shows which attributes are transmitted/processed in messages between RADIUS servers and
base stations.
Messages to/from the authentication server
Transferred attributes
As previously mentioned, your device transmits far more than just the username and password in a RADIUS request.
RADIUS servers might choose to completely ignore these additional attributes, or only use a subset of these attributes.
Many of these attributes are used for access to the server using dial-in, and are defined as standard attributes in the
RADIUS RFCs. However, some important information for hotspot operation can not be represented with standard
attributes. For this reason LANCOM has chosen to provide these values as vendor-specific attributes, marked with
LANCOM’s enterprise ID (2356).
Overview of the RADIUS attributes transmitted by the device to the authentication server
1
User name
The name entered by the user.
2
User-Password
The password entered by the user.
4
NAS-IP-Address
IP address of your device
6
Service-Type Id 1
Type of service that the user requested. The value 1 stands for Login.
8
Framed-IP-Address
IP address that was assigned to the client
26
Vendor 2356(LCS) ID 2
MAC address of the client if authentication using the MAC address is enabled. In contrast to the
Calling-Station-Id, this value is transmitted as a 6-byte binary string. This attribute only exists for the login
mode Authenticate with name, password and MAC address.
30
Called-Station-Id
MAC address of your device
1544
Reference Manual
15 Public Spot
31
Calling-Station-Id
MAC address of the client The address is given byte-wise in hexadecimal notation with separators
(nn:nn:nn:nn:nn:nn).
32
NAS-identifier
Name of your device, if configured.
61
NAS-Port-Type
Type of physical port over which a user had requested authentication.
1
ID 19 denotes clients from WLAN
1
ID 15 denotes clients from Ethernet
87
NAS-Port-Id
Description of the interface over which the client is connected to your device. This can be a physical as well
as a logical interface, such as LAN-1, WLAN-1-5 or WLC-TUNNEL-27.
5
Consider that more than one client may be connected to one interface at a time, so that, unlike dial-in
servers, port numbers are not unique for clients.
Processed attributes
Your device evaluates the authentication response of a RADIUS server for attributes that it may possibly process further.
Most attributes however only have a meaning if the authentication response was positive, so that they influence the
subsequent session:
Overview of the RADIUS attributes processed by the device
18
Reply-Message
An arbitrary string from the RADIUS server that may transport either a login failure reason or a user welcome
message. This message may be integrated into user-defined start or error pages via the SEVERMSG element.
25
Class
An arbitrary octet string that may contain data provided by the authentication/accounting backend. Whenever
the device sends RADIUS accounting requests, they will contain this attribute as-is. Within an authentication
response, this attribute can occur multiple times in order, for example, to transmit a string that is longer than
255 bytes. The device processes all occurrences in accounting requests in the order they appeared in the
authentication response.
26
Vendor 2356(LCS) ID 1
Trafficlimit
Defines the data volume in bytes after which the device automatically ends the session. This value is useful
for volume-limited accounts. If this attribute is missing in the authentication response, it is assumed that no
volume limit applies. A traffic limit of 0 is interpreted as an account which is principally valid, however with
a used-up volume budget. The device does not start a session in this case.
1545
Reference Manual
15 Public Spot
26
Vendor 2356(LCS) ID 3
LCS-Redirection-URL
This can contain any URL that is offered as an additional link on the start page. This can be the start page of
the user or a page with additional information about the user account.
26
Vendor 2356(LCS) ID 5
LCS-Account-End
Defines an absolute point in time (measured in seconds since January 1, 1970 0:00:00) after which the account
becomes invalid. If this attribute is missing, an unlimited account is assumed. The device does not start a
session if its internal clock has not been set, or the given point in time is in the past.
26
Vendor 2356(LCS) ID 8
LCS-Public Spot-Username
Contains the name of a Public Spot user for auto-login. Auto-login refers to the table of MAC authenticated
users who are automatically assigned usernames by the server.
26
Vendor 2356(LCS) ID 8
LCS-TxRateLimit
Defines the maximum downstream rate in kbps. This restriction may be combined with the corresponding
Public Spot function.
26
Vendor 2356(LCS) ID 9
LCS-RxRateLimit
Defines the maximum upstream rate in kbps. This restriction may be combined with the corresponding Public
Spot function.
27
Session-Timeout
Defines an optional maximum duration of the session, measured in seconds. If this attribute is missing in the
response, an unlimited account is assumed. A Session timeout of zero seconds is interpreted as an account
which is principally valid, however with a used-up time budget. The device does not start a session in this
case.
28
Idle timeout
Defines a time period in seconds after which the device will terminate the session if no packets were received
from the client. This value overwrites in the locally defined idle timeout under Public Spot > Server > Idle
timeout.
64
Tunnel-Type
Defines the tunneling protocol which will be used for the session.
65
Tunnel-Medium-Type
Defines the transport medium over which the tunneled session will be established.
1546
Reference Manual
15 Public Spot
81
Tunnel-Private-Group-ID
Defines the group ID if the session is tunneled.
85
Acct-Interim-Interval
Defines the amount of time between subsequent RADIUS accounting updates. This value is only evaluated if
the RADIUS client does not have a local accounting interval defined, i.e. if you have not set an Accounting
update cycle for the Public Spot module.
5
Note that the LCS-Account-End and Session-Timeout attributes are mutually exclusive, and it therefore does not
make sense to include both in the response. If both attributes are included in a response, the attribute that
appears as the last one in the attribute list will define the session’s time limit.
Messages to/from the accounting server
Transferred attributes
The set of RADIUS attributes transmitted to a RADIUS server in an accounting request is similar to the set of attributes
transmitted in an authentication request. However, additional attributes specific to accounting will be added. The
following attributes are present in all RADIUS accounting requests:
Overview of the RADIUS attributes transmitted by the device to the accounting server
1
User name
Name of the account that was used for authentication.
4
NAS-IP-Address
IP address of your device
8
Framed-IP-Address
IP address that was assigned to the client
25
Class
All class attributes that the RADIUS authentication server sent in its authentication response.
30
Called-Station-Id
MAC address of your device
31
Calling-Station-Id
MAC address of the client The address is given byte-wise in hexadecimal notation with separators
(nn:nn:nn:nn:nn:nn).
32
NAS-identifier
Name of your device, if configured.
1547
Reference Manual
15 Public Spot
40
Acct-Status-Type
Request type which signals the start or stop of accounting, or an interim update. Please refer to the section
Request types
for further information.
44
Acct-Session-Id
A series of characters that uniquely identify the client. It consists of the MAC address of the network adapter,
the login timestamp (measured in seconds since January 1, 1970 0:00:00), and the session counter that your
device manages locally.
61
NAS-Port-Type
Type of physical port over which a user had requested authentication.
1
ID 19 denotes clients from WLAN
1
ID 15 denotes clients from Ethernet
87
NAS-Port-Id
Description of the interface over which the client is connected to your device. This can be a physical as well
as a logical interface, such as LAN-1, WLAN-1-5 or WLC-TUNNEL-27.
5
Consider that more than one client may be connected to one interface at a time, so that, unlike dial-in
servers, port numbers are not unique for clients.
In the case of an accounting stop request or an interim update, the request contains the following additional attribute:
42
Acct-Input-Octets
The sum of all data bytes received from the client in this session, modulo 2
32
.
43
Acct-Output-Octets
The sum of all data bytes sent to the client in this session, modulo 2
32
.
46
Acct-Session-Time
The total duration of the client's session in seconds.
5
If the session was ended due to an idle timeout, this value is reduced by the idle time.
47
Acct-Input-Packets
The number of data packets that your device received from the client during the session.
48
Acct-Output-Packets
The number of data packets that your device sent to the client during the session.
49
Acct-Terminate-Cause
1548
Reference Manual
15 Public Spot
The reason for termination or the end of the accounting session. This is sent if Acct-Status-Type has the
value Start or Stop.
52
Acct-Input-Gigawords
The upper 32 bits of the sum of all data bytes received from the client during this session.
53
Acct-Output-Gigawords
The upper 32 bits of the sum of all data bytes sent to the client during this session.
55
Event-Timestamp
The elapsed time since this accounting request was submitted by the device, measured in seconds since
January 1, 1970 0:00:00. This attribute is only present if your device’s real time clock contains a valid value.
5
Note that the RADIUS accounting only starts accounting after a client successfully logs in, i.e. the time needed
for authentication is not recorded. Using
Traffic-Limit-Option
you can limit the data traffic during the authentication
phase. The final accounting stop request also contains the termination cause attribute (49). An overview of these
attributes can be found in the LANCOM "Public Spot: Implementation Guide".
Processed attributes
Your device currently does not process any attributes in responses sent by a RADIUS accounting server.
15.5.2 RADIUS attributes transmitted via WISPr
If you enable WISPr and you use an external RADIUS server, the Public Spot transmits the attributes (access request):
1
Location ID
1
Location name
1
Logoff URL
These attributes are subset of the values configured in the previous section. The provider or roaming broker can use
them to identify the location of the client for accounting purposes. Vendor Specific Attributes (VSA) are used with the
IANA Private Enterprise Number (PEN) 14122.
The Public Spot processes the attributes (access accept) from an external RADIUS server:
1
Redirection URL: URL to which a client should be redirected after login. This function is not supported by all smart
clients.
1
Bandwidth max up: Maximum uplink bandwidth available to the client.
1
Bandwidth max down: Maximum downlink bandwidth available to the client.
1
Session terminate time: Time when the client should be automatically de-authenticated. According to ISO 8601,
the format is YYYY-MM-DDThh:mm:ssTZD. If "TZD" is not entered, the client is de-authenticated according
to the local time on the Public Spot.
1
Session terminate end of day: The value of this attribute can be either 0 or 1. It indicates whether the client is
de-authenticated on the Public Spot at the end of the accounting day.
For accounting purposes, the Public Spot uses the following attributes:
1
Location ID
1
Location name
1549
Reference Manual
15 Public Spot
15.5.3 Expert settings for the PMS interface
In addition to the settings that LANconfig provides for the PMS interface, you have the possibility of configuring additional
parameters in the setup menu. On one hand, these parameters encompass values that the device needs for internal
synchronization with your PMS system, and that are normally not modified. On the other hand, you also find extended
settings in the setup menu that you can use to increase the performance scope of the PMS interface, for example, by
offering free access to an otherwise charged Public Spot access for your guests with VIP status.
The following pages offer you an overview of all parameters for the PMS interface that are not configured over LANconfig.
Accounting
In this menu you configure the transfer of accounting information from your device to your PMS.
Telnet path:
Setup > PMS-Interface
Clean-up accounting table period
Using this entry you configure the interval that the device uses to clean up expired sessions from the internal accounting
table in the status menu. If the value is 0, automatic clean-up is disabled.
Telnet path:
Setup > PMS-Interface > Accounting
Possible values:
0 to 4294967295 seconds
Default:
60
Save to flash ROM period
Using this entry you configure the interval that the device uses to store collected accounting information to the internal
flash ROM.
5
Please note that frequent writing operations to this memory will reduce the lifetime of your device.
Telnet path:
Setup > PMS-Interface > Accounting
Possible values:
0 to 4294967295 seconds
Default:
15
Update accounting table period
Using this entry you configure the interval that the device uses to update the internal accounting table in the status
menu. If the value is 0, the update is disabled and the status table does not display any values.
Telnet path:
Setup > PMS-Interface > Accounting
1550
Reference Manual
15 Public Spot
Possible values:
0 to 4294967295 seconds
Default:
15
Login form
In this menu you make specific settings for the PMS for the login/portal pages which are displayed to your guests in case
of unauthorized access attempts on the hotspot.
Telnet path:
Setup > PMS-Interface
Free VIP status
In this table, you locally manage the VIP categories from your PMS.
Telnet path:
Setup > PMS-Interface > Login-Form
Status
Enter the VIP category from your PMS for the members that you want to provide with free Internet access.
For example, if you set up three VIP statuses (VIP1, VIP2, VIP3) for your PMS server, but you only want to offer hotel
guests in category VIP2 free Internet access, enter the corresponding ID here.
Telnet path:
Setup > PMS-Interface > Login-Form > Free-Of-Charge-VIP-Status
Possible values:
String, max. 20 characters
Default:
Fidelio free additional check
Select the additional ID that a hotel guest uses – in addition to their username and room number – to authenticate on
the Public Spot if you offer free Internet access. If you select No-Check, the device does not check for an additional
ID.
Telnet path:
Setup > PMS-Interface > Login-Form
Possible values:
none
Reservation number
Arrival date
Departure date
First name
1551
Reference Manual
15 Public Spot
Profile number
Default:
none
Fidelio free VIP additional check
Select the additional ID used by a VIP – in addition to their username and room number – to authenticate on the Public
Spot if you offer your VIPs free Internet access. If you select No-Check, the device does not check for an additional
ID.
Telnet path:
Setup > PMS-Interface > Login-Form
Possible values:
none
Reservation number
Arrival date
Departure date
First name
Profile number
Default:
none
Fidelio charge additional check
Select the additional ID used by a hotel guest – in addition to their username and room number – to authenticate on
the Public Spot if you offer fee-based Internet access. If you select No-Check, the device does not check for an
additional ID.
Telnet path:
Setup > PMS-Interface > Login-Form
Possible values:
none
Reservation number
Arrival date
Departure date
First name
Profile number
Default:
Reservation number
PMS login form
Choose the login page to be displayed by the portal page for your PMS interface.
1552
Reference Manual
15 Public Spot
Telnet path:
Setup > PMS-Interface > Login-Form
Possible values:
1
Free-of-charge: Choose this option if you offer your hotel guests free Internet access. Your hotel
guests will still be required to authenticate on the hotspot on the portal page with their username, room
number and, if required, an additional ID in order to prevent access to the Internet by unauthorized users.
1
Subject to charge: Choose this option if you offer your hotel guests fee-based Internet access.
Your hotel guests will be required to authenticate on the hotspot on the portal page with their username,
room number and select a tariff.
1
free-VIP: Select this setting, if you want to offer your otherwise fee-based Internet access free of
charge to VIPs. Although your VIPs see the login screen for fee-based access, they will not be billed any
fees.
Default:
Free-of-charge
PublicSpot login form
Enable or disable whether the portal page displays the Public Spot's own login screen. If you disable this setting, Public
Spot users that use a combination of username and password as credentials (e.g., predefined or users with vouchers)
can no longer login to the device.
Telnet path:
Setup > PMS-Interface > Login-Form
Possible values:
No
Yes
Default:
No
Guest name case sensitive
Enable or disable whether the device checks the last name for capitalization (case sensitively) against the name of the
guest in the PMS database during login. If this setting is enabled, the guest's Public Spot access is rejected if the spelling
and capitalization of his name does not match that transferred by the hotel.
Telnet path:
Setup > PMS-Interface
Possible values:
No
Yes
Default:
Yes
Separator
Using this entry you configure the separator that your PMS uses to transfer data records to an API. The Micros Fidelio
specification, e.g., uses the pipe symbol by default (|, hex 7C).
1553
Reference Manual
15 Public Spot
5
You should not change this value if at all possible. An incorrect separator can lead to your PMS being unable to
read the transmitted data records, and the PMS interface not working!
Telnet path:
Setup > PMS-Interface
Possible values:
String, max. 1 characters
Default:
|
Character set
Choose the character used by the PMS to transmit your guests' surnames to the device.
Telnet path:
Setup > PMS-Interface
Possible values:
CP850
W1252
Default:
CP850
15.6 Addition(s) to LCOS 8.84
15.6.1 Any phone number format for Smart Ticket
As of LCOS 8.84, users of Smart Ticket who opt to receive login credentials via SMS can enter their phone number in any
format (0049.../+49..., etc.). The device removes any leading zeros or '+' character automatically and saves the phone
number in the RADIUS user table in a standard format (49...).
15.6.2 Sending login data via a GSM-capable device (Smart Ticket)
As of LCOS 8.84, you can activate the option Login data will be sent via SMS (text message)
1
and make direct use of a device's own 3G/4G WWAN module, or
1
the 3G/4G WWAN module of another device
instead of using an external E-Mail2SMS gateway.
Configuring SMS authentication
The settings for transmitting the login credentials as an SMS text message to the phone number specified by the user
are adjusted in the dialog Public Spot > SMS. The choices available to you vary according to the device type:
1
The credentials are sent as an SMS text message via the 3G/4G WWAN module in this device,
1
The credentials are sent as an SMS text message via the 3G/4G WWAN module in another device,
1
The access credentials are sent as an e-mail to an external E-Mail2SMS gateway, which then converts the e-mail to
SMS.
1554
Reference Manual
15 Public Spot
The following steps show you how to correctly configure the different variants of SMS authentication.
5
In order to send login data as a text message via a 3G/4G WWAN-capable device, the internal SMS module of
this device must be set up under Log & Trace > SMS messages (see
Basic configuration of the SMS module
on page 1947).
5
SMS transmission is suitable for installations with a maximum throughput of 10 SMS per minute.
5
In order to successfully send access credentials as an e-mail, you must set up a valid SMTP account under Log
& Trace > SMTP account and Log & Trace > SMTP options.
In addition, you can specify individual text blocks used by the device to send the login credentials; see
Customizing text
message content
on page 1563. By default, the device inserts predefined text modules; for an overview of these see
Standard texts for e-mail sender, subject and body
on page 1564.
1. Start LANconfig and open the configuration dialog for the device.
2. Change the view to Public Spot > Authentication.
3. Change the login mode to Login data will be sent by SMS.
4. Navigate to the menu item Public Spot > SMS.
5. Specify how the device sends SMS text messages.
1
In order to send the login credentials as an SMS text message via the internal 3G/4G WWAN module, select Send
SMS via internal GSM modem and then continue with the next main step in the configuration.
1
In order to send the login credentials as an SMS text message via the 3G/4G WWAN module of another device,
you first carry out the steps in section
Operating devices with the 3G/4G WWAN module as an SMS gateway
on
page 1556 and then continue with the next main step in the configuration.
1
In order to send the login credentials to an external E-Mail2SMS gateway, select the setting Send SMS via
external e-mail gateway and then continue with the next main step in the configuration.
a) Under Gateway e-mail address you enter the IP address or the hostname of the gateway server, which converts
the e-mail into SMS. If the provider expects to find the mobile phone number in the local part of the e-mail, you
can use the variable $PSpotUserMobileNo.
b) Under Sender e-mail address enter the return address that your Public Spot users will see when the SMS is
delivered, e.g. support@providerX.org.
6. Under Max. messages send you enter the maximum number of SMS text messages that the Public Spot module
may send per hour to users authenticating via SMS. Lower the value to reduce the number of new users per hour.
1555
Reference Manual
15 Public Spot
7. Under Max.requests per MAC you specify how many different sets of credentials the device can provide to a MAC
address within one day.
8. Under Country codes you enter the international code numbers that the Public Spot will accept when sending data
via SMS.
Country codes can be entered directly or with a prefixed double-zero, for example for Germany 49 or 0049.
5
This table acts as a whitelist. You must define country codes in order for the login data to be delivered.
9. You can write the configuration back to the device.
Operating devices with the 3G/4G WWAN module as an SMS gateway
When using Public Spot authentication via SMS (Smart Ticket), you have the option of sending access credentials via the
3G/4G WWAN module in a further device instead of using an external E-Mail2SMS gateway. To use this option, you must
store the address and the access credentials for the 3G/4G device on the device that provides the Public Spot. In order
to send the SMS, the Public Spot module logs on to the other device and uses a URL to initiate the transmission of the
text message via the 3G/4G-WWAN module or SMS module in the other device.
This option is available on devices both with or without their own 3G/4G WWAN module. These options allow you to
chain multiple devices together and to set up your own transmitting device if you operate multiple Public Spots or use
a device without a 3G/4G WWAN module.
1. Start LANconfig and set up the SMS module on the 3G/4G device that is to serve as an SMS gateway (see
Basic
configuration of the SMS module
on page 1947). You also have to create an administrator without access rights (None)
with the sole function right Send SMS.
2. Open the configuration dialog for the device that provides the Public Spot.
3. Navigate to the menu item Public Spot > SMS.
4. Activate the settings Send SMS via a GSM-enabled device and Send SMS from another device.
5. Enter the user name and password for the administrator on the other 3G/4G device under User name and password.
6. In the field Device IP, enter the IP address where the Public Spot is to reach the other 3G/4G device.
1556
Reference Manual
15 Public Spot
Additions to the Setup menu
Send SMS
This parameter specifies how the device sends SMS text messages. The choices available to you vary according to the
device type.
5
In order to successfully send access credentials as a text message via a 3G/4G WWAN-enabled device, the device's
internal SMS module must be set up under Setup > SMS.
5
SMS transmission is suitable for installations with a maximum throughput of 10 SMS per minute.
5
In order to successfully send access credentials as an e-mail, you must set up a valid SMTP account under Setup >
Mail.
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Possible values:
1
Send directly: The credentials are sent as an SMS text message via the 3G/4G WWAN module in this
device
1
HTTP2SMS: The credentials are sent as an SMS text message via the 3G/4G WWAN module in another
device
When registering with the Public Spot via SMS, you have the option of sending the access credentials via
another LANCOM device equipped with a 3G/4G WWAN module. To use this option, you must store the
address and the access data for the other device on the device that provides the Public Spot. In order to
send the SMS, the Public Spot module logs on to the other device and uses a URL to initiate the transmission
of the text message via the 3G/4G WWAN module in the other device.
5
Make sure that the SMS module on the other device is correctly configured and that you create
an administrator account without any permissions (none) and the sole function right Send SMS.
1
SMS gateway: The access credentials are sent as an e-mail to an external E-Mail2SMS gateway, which
then converts the e-mail to SMS
Default:
No
HTTP user name
This parameter is used to specify the user name used by your device to authenticate at the other LANCOM device (see
parameter
2.24.41.2.16
).
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Possible values:
Any string, max. 150 characters from
[0-9][A-Z][a-z]@{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
1557
Reference Manual
15 Public Spot
Default:
HTTP password
This parameter is used to specify the password for the user name used by your device to authenticate at the other
LANCOM device (see parameter
2.24.41.2.16
).
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Possible values:
Any string, max. 150 characters from
[0-9][A-Z][a-z]@{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
HTTP gateway address
This parameter specifies the IP address of the other LANCOM device, which is being used to send text messages (see
parameter
2.24.41.2.15
).
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Possible values:
Valid IPv4/IPv6 IP address, max. 15 characters
Default:
15.6.3 Terms of use when authenticating with name, password (and MAC address)
With LCOS 8.84, the requirement for the user to agree to the terms and conditions of use, as previously used for Smart
Ticket authentication, is now additionally available with the login modes Authenticate with name and password and
Authenticate with name, password and MAC address. In this way, users who receive a voucher can also be required
to confirm the terms and conditions of use before they can access the network via Public Spot.
1558
Reference Manual
15 Public Spot
In LANconfig you can enable or disable the confirmation of terms for the various login modes in the dialog Public Spot >
Authentication under User has to accept the terms of use.
Additions to the Setup menu
User must accept GTC
By enabling this parameter, certain modes of authentication require the user to authenticate and also acknowledge the
general terms and conditions of use. In this case, the Public Spot login page displays an additional option, which prompts
the user to accept the terms of use before registering and/or authenticating. Users who explicitly do not agree to these
terms and conditions cannot login to the Public Spot.
The following login modes can be combined with an acknowledgment of the terms and conditions:
1
User+password
1
MAC+user+password
1
E-mail
1
E-mail2SMS
5
Remember to upload your custom page template to the device before you request a confirmation of the terms
and conditions of use.
Telnet path:
Setup > Public-Spot-Module
Possible values:
No
Yes
Default:
No
15.6.4 Advanced configuration of user templates with LANconfig
As of LCOS 8.84, you can
1559
Reference Manual
15 Public Spot
1
configure user templates for self-sufficient user registration via e-mail/SMS—also known as Smart Ticket—as well
as
1
manage the max. concurrent logins table for the Create Public Spot account wizard
directly in LANconfig under Public Spot > Wizard.
Setting default values for the Public Spot wizard
The following section describes how you define default values for the New user wizard (setup wizard Create Public
Spot account) to meet your needs. Public Spot administrators can select the values defined here (e.g. for validity periods,
bandwidth profiles, etc.) from selection lists when they are setting up new users and printing out vouchers.
4
Exceptions to this are the values for User name pattern and Password length shown in the dialog below, which
only serve as default values for the device.
1. Start LANconfig and open the configuration dialog for the device.
2. Change the view to Public Spot > Wizard.
3. In Default validity periods, define which default validity periods for user accounts and vouchers are to be available
by default.
The new-user wizard takes the shortest validity period as the default.
4. Under Max. concurrent logins you select the maximum number of devices that have access to the user account
simultaneously.
1560
Reference Manual
15 Public Spot
The value 0 stands for 'unlimited'. Whether or not it is generally possible for a user to login with the multiple devices
at the same time is determined by the Public Spot administrator with a separate setting in the wizard when creating
a new user.
5. In User name pattern you specify the pattern used by the new user wizard to create usernames.
You can enter up to 19 characters, whereby the wizard will automatically create a unique number for every user if
you enter "%n". The default description user%n will be shown later on the voucher, for example, as user12345.
6. Using Password length you specify the length of the passwords that the new user wizard generates for Public Spot
access.
The default is 6 characters. If you would like to have longer passwords, keep in mind that guests can make mistakes
when entering them, which can cause unnecessary problems and complaints.
7. Optional: Under Bandwidth profiles you set the uplink and downlink limits for each Public Spot user.
Learn more about this setting under
Manage bandwidth profiles
.
8. Public Spot via WLAN only: Using Public Spot SSIDs you specify the names of the Public Spot networks taken by
default when you create new user accounts using the Create Public Spot account wizard.
The Create Public Spot account wizard automatically marks the specified network names as SSID selected when
creating a new Public Spot user. If you employ an access point, WLAN controller or WLAN router, you can select
several network names as default values in order to give users access to various different WLANs (e.g., for WLANs
in the hotel lobby, the conference room, and floors where their rooms are located). When creating a new user and
subsequently printing the voucher, these SSIDs are also printed out on the voucher.
Using the arrow buttons, you can change the order in which the SSIDs are displayed. In this way, the most popular
SSIDs can be placed at the top of the list.
That's it! This concludes the configuration of the default values for the Public Spot wizard.
Setting default values for the user templates
The following section describes how you adjust the default values for the User templates to meet your needs. The device
uses the values set here as defaults when creating new users in Smart Ticket and when users login after confirming the
terms and conditions. If you have so opted to send the login credentials via e-mail/SMS or you have activated the login
after confirming the terms and conditions, each new user account is equipped with the permissions and constraints as
defined by the user template.
1. Start LANconfig and open the configuration dialog for the device.
1561
Reference Manual
15 Public Spot
2. Change the view to Public Spot > Wizard.
3. Complete the input fields in the section User template according to your preferences:
1
Expiry type: Using this entry you define how an automatically created Public Spot user account expires. You
can specify whether the validity period of a user account is absolute (e.g. expires on a set date) and/or relative
(elapsed time since the first successful login). If you select both values, the expiry time depends on which case
occurs first.
1
Relative expiry: Using this entry you define the relative expiry time of an automatically created user account
(in seconds). The Expiry-type that you chose must include relative in order for this setting to work. The
validity of the account terminates after the time period specified in this field from the time of the first successful
login of the user.
1
Absolute expiry: Using this entry you define the absolute expiry time of an automatically created user account
(in days). The Expiry type that you chose must include absolute in order for this setting to work. The validity
of the account terminates at the time specified in this field, calculated from the day of the creation of the account.
1
Multiple login: This entry allows you to generally allow or prohibit users with an automatically created account
to login to the Public Spot using the same credentials with multiple devices at the same time. The number of
devices that can be logged on simultaneously is specified using the drop-down list Maximum number.
1
Maximum number: Using this entry you set the maximum number of devices which can concurrently login to
an automatically created account. The value 0 stands for "unlimited". In order for this setting to work, the
parameter Multiple login must be enabled.
1
Time budget: Using this entry you define the time budget which automatically created users are assigned. A
value of 0 disables the function.
1
Volume budget: Using this entry you define the volume budget which automatically created users are assigned.
A value of 0 disables the function.
1
Comment: Using this entry you specify a comment or informational text which the RADIUS server adds to an
automatically created user account.
4. Optional: If necessary, change the User name pattern and the Password length. In the authentication modes
mentioned above, the device uses the relevant
New user wizard default values
to automatically generate a user
name and a password.
5. You can write the configuration back to the device.
1562
Reference Manual
15 Public Spot
15.6.5 Multi-lingual login and text messaging
As of LCOS 8.84, you can store selected texts in multiple languages. The following texts are now managed in language
tables:
1
The individual text on the login page (Login text; available in LANconfig under Public Spot > Authentication)
1
The standard text for e-mail sender, subject and content as used for user registration via e-mail/SMS (E-mail name
of sender, E-mail subject, E-mail body; available in LANconfig under Public Spot > E-mail/SMS)
The language tables complement the
template pages in various languages
and work on the same principle; the language
selected by the device depends on the language set in the browser. Unless you specify custom text for e-mail sender,subject
and content for a language, the Public Spot module uses the device's own standard texts in English (see
Standard texts
for e-mail sender, subject and body
on page 1564). No standard texts have been implemented for the login text; in this
case, the device refers to the individual login text in English (if available).
Customizing text message content
By default, the device uses predefined text modules as the content of the e-mails or SMS text messages. An overview of
these standard texts is available under
Standard texts for e-mail sender, subject and body
on page 1564. You can also
define your own texts.
4
If you do not specify any text for a language, the device automatically enters the internal default text.
1. Start LANconfig and open the configuration dialog for the device.
2. Depending on the selected authentication method, switch to the view Public Spot > E-mail or SMS.
3. Using the button Name of sender, enter a customized sender name for the e-mails or SMS text messages sent in
the various languages, e.g. Provider X.
4. Use the E-mail subject button to enter a subject line for the e-mails sent in the various languages by the Public
Spot module. Special control characters are available for this, described in more detail in the section
Variables and
control characters
on page 1563.
5. Use the E-mail body or Message body button to enter the content of the e-mails or SMS text messages sent in
the various languages by the Public Spot module. Variables and special control characters are available for this,
described in more detail in the section
Variables and control characters
on page 1563.
6. Now write the configuration back to the device.
Variables and control characters
The message texts used for the Smart Ticket function can be customized with the use of variables and control characters.
The variables are automatically populated with values when the Public Spot module sends the e-mail to the user or the
SMS gateway.
Variables
The following variables are available in the input field E-mail body:
$PSpotPasswd
Placeholder for user-specific password for the Public Spot access.
$PSpotLogoutLink
Placeholder for the logout URL of the Public Spot in the form http://<IP address of the
Public Spot>/authen/logout. This URL allows users to logout of the Public Spot if, after a
successful login, the session window (which also contains this link) was blocked by the browser or closed by
the Public Spot user.
1563
Reference Manual
15 Public Spot
Control characters
The following control characters may also be used in the text entered into the fields E-mail subject and E-mail body:
\n
CRLF (carriage return, line feed)
\t
Tabulator
\<ASCII>
ASCII code of the corresponding character
5
If the e-mail2SMS provider requires a variable which contains a backslash ("\"), you have to prefix this with
another "\". This prevents the transformation of the "\" by LCOS.
Standard texts for e-mail sender, subject and body
If in the dialog Public Spot > E-mail/SMS you do not specify customized texts for a certain language, the device
generates the e-mail by using the standard texts stored in the LCOS. The language used depends on the language setting
of the browser used by the user for registration. If the device contains no internal texts to a particular language, the
device uses the English version.
Table 23: Overview of the internal standard texts for authentication via e-mail/SMS
E-mail bodyE-mail subjectName of sender
Your password for the LANCOM Public Spot:
$PSpotPasswd $PSpotLogoutLink
Your login credentials for
the Public Spot
Public SpotDeutsch
Your password for the LANCOM Public Spot:
$PSpotPasswd $PSpotLogoutLink
Your Public Spot accountPublic SpotEnglish
Additions to the Setup menu
Name
This table is used to manage the different language variants for the sender names used by the Public Spot module in
the e-mails containing the login credentials. If you do not specify any text for a language, the device automatically enters
the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication
Language
This parameter shows the language variant for the sender name.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Real-Name
Content
This parameter sets the sender name for the selected language.
1564
Reference Manual
15 Public Spot
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Real-Name
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Body
This table is used to manage the different language variants for the message text used by the Public Spot module for
sending the login credentials via e-mail. If you do not specify any text for a language, the device automatically enters
the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication
Language
This parameter shows the language variant for the message text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Body
Content
This parameter specifies the message text for the selected language. You can make use of a variety of variables and
control characters. The variables are automatically populated with values when the Public Spot module sends the e-mail
to the user.
The following variables are available:
$PSpotPasswd
Placeholder for user-specific password for the Public Spot access.
$PSpotLogoutLink
Placeholder for the logout URL of the Public Spot in the form http://<IP address of the
Public Spot>/authen/logout. This URL allows users to logout of the Public Spot if, after a
successful login, the session window (which also contains this link) was blocked by the browser or closed by
the Public Spot user.
The following control characters are available:
\n
CRLF (carriage return, line feed)
\t
Tabulator
\<ASCII>
ASCII code of the corresponding character
1565
Reference Manual
15 Public Spot
5
If the e-mail2SMS provider requires a variable which contains a backslash ("\"), you have to prefix this with
another "\". This prevents the transformation of the "\" by LCOS.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Body
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Subject
This table is used to manage the different language variants for the subject line used by the Public Spot module in the
e-mails containing the login credentials. If you do not specify any text for a language, the device automatically enters
the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication
Language
This parameter shows the language variant for the subject line.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Subject
Content
This parameter specifies the subject line for the selected language. You can make use of the following control characters.
\n
CRLF (carriage return, line feed)
\t
Tabulator
\<ASCII>
ASCII code of the corresponding character
5
If the e-mail2SMS provider requires a variable which contains a backslash ("\"), you have to prefix this with
another "\". This prevents the transformation of the "\" by LCOS.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail-Authentication > Subject
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
1566
Reference Manual
15 Public Spot
Default:
Name
This table is used to manage the different language variants for the sender names used by the Public Spot module for
sending the login credentials via e-mail2MSM. If you do not specify any text for a language, the device automatically
enters the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Language
This parameter shows the language variant for the sender name.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Real-Name
Content
This parameter sets the sender name for the selected language.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Real-Name
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Body
This table is used to manage the different language variants for the message text used by the Public Spot module for
sending the login credentials via e-mail2MSM. If you do not specify any text for a language, the device automatically
enters the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Language
This parameter shows the language variant for the message text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Body
Content
This parameter specifies the message text for the selected language. You can make use of a variety of variables and
control characters. The variables are automatically populated with values when the Public Spot module sends the e-mail
to the SMS gateway.
1567
Reference Manual
15 Public Spot
The following variables are available:
$PSpotPasswd
Placeholder for user-specific password for the Public Spot access.
$PSpotLogoutLink
Placeholder for the logout URL of the Public Spot in the form http://<IP address of the
Public Spot>/authen/logout. This URL allows users to logout of the Public Spot if, after a
successful login, the session window (which also contains this link) was blocked by the browser or closed by
the Public Spot user.
The following control characters are available:
\n
CRLF (carriage return, line feed)
\t
Tabulator
\<ASCII>
ASCII code of the corresponding character
5
If the e-mail2SMS provider requires a variable which contains a backslash ("\"), you have to prefix this with
another "\". This prevents the transformation of the "\" by LCOS.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Body
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Subject
This table is used to manage the different language variants for the subject line used by the Public Spot module for
sending the login credentials via e-mail2MSM. If you do not specify any text for a language, the device automatically
enters the internal default text.
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > E-mail2SMS-Authentication
Language
This parameter shows the language variant for the subject line.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Subject
Content
This parameter specifies the subject line for the selected language. You can make use of the following control characters.
1568
Reference Manual
15 Public Spot
\n
CRLF (carriage return, line feed)
\t
Tabulator
\<ASCII>
ASCII code of the corresponding character
5
If the e-mail2SMS provider requires a variable which contains a backslash ("\"), you have to prefix this with
another "\". This prevents the transformation of the "\" by LCOS.
Telnet path:
Setup > Public-Spot-Module > Authentication-Module > E-mail2SMS-Authentication > Subject
Possible values:
Any string, max. 251 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
Default:
Login text
This table is used to manage the login text.
The Public Spot module gives you the option to specify customized text, which appears on the login page inside the box
of the registration form. This login text is stored in multiple languages, and the language which is issued depends on
the language settings of the user's Web browser. If you do not specify any individual login text for a language, the device
falls back to the English login text (if available).
Telnet path:
Setup > Public-Spot-Module
Language
This parameter indicates the language for the login text.
Telnet path:
Setup > Public-Spot-Module > Login-Text
Content
This parameter specifies the login text for the selected language. To type umlauts, you should use their HTML equivalents
(such as &uuml; for ü), because the text is directly embedded in the Web page. You can also use HTML tags to structure
and format the text. Example:
Welcome!<br/><i>Please fill out the form.</i>)
Telnet path:
Setup > Public-Spot-Module > Login-Text
Possible values:
Any string, max. 254 characters from
[0-9][A-Z][a-z] @{|}~!$%&'()+-,/:;<=>?[\]^_.#*`
1569
Reference Manual
15 Public Spot
Default:
15.6.6 New URL placeholders (template variables)
A Public Spot gives you the option to include variables in the URL to be sent to the templates, i.e. to control the web
pages displayed to a user.
As of LCOS 8.84, the following additional variables are available:
%c
Inserts the LAN MAC address of the LANCOM device as a hexadecimal string of length 12. The output is in
the format 'aa:bb:cc:dd:ee:ff'.
%p
Inserts the IP address of the LANCOM device into the ARF context of the respective client.
If your device is active in different IP networks, this variable enables you to specify the IP address used by the
device in same the network as the client.
%r
Inserts the client’s IP address.
15.6.7 User-dependent HTML output on the voucher
As of LCOS 8.84, you can add conditional HTML-code to the voucher page, which is only printed for specific users or
administrators. You use this by entering the tag <pbcond> and the identifier USER NAME. USER is a prefix that
must be placed before a space character and then the user name (NAME). For example, to generate HTML output
specifically for the user 'root' when printing the voucher page, you use the following syntax:
<pbcond USER root>Conditional HTML Code</pbcond>
When used in large-scale Public Spot scenarios with central administration—e.g. with a WLAN controller—this dependency
can also be used to identify the site: To do this, you create a specific Public Spot admin account on each of the relevant
access points and specify the conditional voucher text for the different administrators.
15.6.8 Show/hide the LANCOM logo and header image in the voucher
By default, a voucher issued by the device contains the 'Hotspot' header image and the logo "Powered by LANCOM".
You can disable these graphics directly in the device with the option Print header and company emblem. There is no
need to use a customized voucher template to remove these graphics. Using this option outputs a voucher containing
neutral text only.
To decide whether the device shows a header image and logo when you create a voucher, go to the dialog Public Spot >
Wizard and adjust the setting Print header and company emblem.
Additions to the Setup menu
Print logo and headerboard
By default, a voucher issued by the device contains the 'Hotspot' header image and the logo "Powered by LANCOM".
You have the option of disabling the appearance of these images directly in the device, without having to upload a
customized voucher template, which would otherwise remove these images. If you disable these images, a purely text
voucher is issued.
Telnet path:
Setup > Public-Spot-Module
1570
Reference Manual
15 Public Spot
Possible values:
No
Yes
Default:
Yes
15.6.9 Additional languages for the authentication pages
With LCOS 8.84, the Public Spot module authentication pages now support the languages French, Spanish, Italian and
Dutch (i.e. all pre-installed default pages except for the voucher page). This allows you to offer Public Spot access to a
broader range of international users. The language displayed is determined by the settings in the Web browser used to
access the Public Spot.
4
Multilingual support refers exclusively to the LCOS internal default pages. You can implement multilingual
customized template pages with an external server.
15.6.10 Special template pages for Smart Ticket
The Public Spot module up until LCOS version 8.82 used a central login page to for all authentication modes. As of LCOS
8.84, you can optionally equip the device with separate template pages for the Smart Ticket function (for self-sufficient
user registration via e-mail/SMS). Two pages have to be configured for registration via e-mail/SMS: Registration(...)
and Login(...).
1
On the registration page, users enter their personal data (e-mail address or mobile phone number) to register for the
Public Spot and to request its login data.
1
On the login page, users then enter their credentials in order to authenticate at the Public Spot.
The following table provides an overview of the related dependencies that you need to create your own page templates:
Table 24: Overview of dependencies of the SmartTicket login pages
Page template identifiersLocal URL on your devicePage designationAuthentication
mode
<regemailform>file://pbspot_template_reg_emailPrelogin (e-mail)...Login data will be
sent by e-mail
<loginemailform>file://pbspot_template_login_emailAuthentication (e-mail)...
<regsmsform>file://pbspot_template_reg_smsPrelogin (e-mail to SMS)...Login data will be
sent by SMS (text
message)
<loginsmsform>file://pbspot_template_login_smsLogin (e-mail to SMS)...
Login pages depending on the login mode
The following table provides an overview of which login page is displayed by the device in the various authentication
modes. If a login mode has no customized page template, the Public Spot module takes the default LCOS page:
Table 25: Overview of login pages of each authentication mode
Page designationAuthentication mode
–No authentication required
Welcome…No credentials required (login after agreement)
Login...Authenticate with name and password
Login...Authenticate with name, password and MAC address
1571
Reference Manual
15 Public Spot
Page designationAuthentication mode
Login data will be sent by e-mail
1
Prelogin (e-mail)...
1
Authentication (e-mail)...
Login data will be sent by SMS (text message)
1
Prelogin (e-mail to SMS)...
1
Login (e-mail to SMS)...
15.6.11 Setting up an error page in case of WAN connection failure
With regard to users who have not yet authenticated at the Public Spot, you have the option of informing them not only
of general login errors, but also of WAN connection errors. This gives potential users information about the lack of
network availability in advance. This version of the error page appears whenever the Public Spot module detects a failure
of the WAN connection.
To ensure that this error page can be displayed properly it is essential that you name a remote station, to which the
connection is monitored by the Public Spot module. To this end, enter an appropriate Remote site in the dialog Public
Spot > Server. The Select button opens up a convenient list of the remote sites that you have set up already.
5
If no remote station is named, the Public Spot module will not output connection errors on the error page. In
case of a failure of the WAN connection, unauthenticated users will instead experience a connection timeout by
their browser.
The error page must include the the identifier LOGINERRORMSG in order to display the LCOS error message about
the WAN connection failure. In the event of a WAN connection failure, the following error message is displayed:
Already authenticated users, however, always receive an error message from their browser, irrespective of the error page.
Additions to the Setup menu
WAN connection
The Public Spot module monitors the connection status of the remote station named here. If the WAN connection should
fail, a corresponding message appears on the error page shown to unauthenticated users. This gives potential users
information about the lack of network availability in advance.
If no remote station is named, the Public Spot module will not output connection errors on the error page. In case of a
failure of the WAN connection, unauthenticated users will instead experience a connection timeout by their browser.
Already authenticated users, however, always receive an error message from their browser, irrespective of the error page.
Telnet path:
Setup > Public-Spot-Module
Possible values:
Valid name of a remote station, max. 16 characters
1572
Reference Manual
15 Public Spot
Default:
15.6.12 Template caching
Custom template pages can be cached on devices with sufficiently large memory (such as Public Spot gateways). Caching
improves the performance of the Public Spot module especially for larger scenarios where the device internally caches
the templates and the HTML pages generated from them.
Caching is possible for:
1
Templates stored in the local file system
1
Templates on external HTTP(S) server(s) and available via static URLs
Templates on external servers, which are referenced by means of template variables, are not cached by the device.
Enabling template caching
You enable template caching in LANconfig by navigating to Public Spot > Server > Page table > <Name of the
template> and checking the option Cache page.
In the Setup menu, you will find the corresponding parameter under Public Spot module > Page table > Template
cache.
Flush template cache
The device automatically deletes and/or updates the templates stored in the cache once a new template file is uploaded
to the file system of your device (local storage) or upon expiry of the cache time for an HTTP(S) template (storage on an
external server). For this purpose, the device evaluates the Cache-Control header of an HTTP(S) template to
discover the maximum cache time.
5
If no cache control header is set, the page is not cached and will be discarded. When setting up your
custom templates, ensure to set an appropriate meta tag and give it a reasonable cache time (in seconds); for
example <meta http-equiv="cache-control" content="max-age=60">. The optimum
cache time depends on the scenario. There is no specific recommendation.
You can also manually delete the template cache by using an action. Do this, start the action Flush template cache in
the status menu under Public Spot.
Additions to the Status menu
Flush template cache
This action is for the manual deletion of the template cache.
1573
Reference Manual
15 Public Spot
The device automatically deletes and/or updates the templates stored in the cache once a new template file is uploaded
to the file system of your device (local storage) or upon expiry of the cache time for an HTTP(S) template (storage on an
external server). For this purpose, the device evaluates the Cache-Control header of an HTTP(S) template to
discover the maximum cache time.
Telnet path:
Setup > Public-Spot
Additions to the Setup menu
Template cache
This parameter enables the caching of Public Spot templates.
Custom template pages can be cached on devices with sufficiently large memory (such as Public Spot gateways). Caching
improves the performance of the Public Spot module especially for larger scenarios where the device internally caches
the templates and the HTML pages generated from them.
Caching is possible for:
1
Templates stored in the local file system
1
Templates on external HTTP(S) server(s) and available via static URLs
Templates on external servers, which are referenced by means of template variables, are not cached by the device.
Telnet path:
Setup > Public-Spot-Module > Page-Table
Possible values:
No
Yes
Default:
No
15.6.13 Quick link to the session information window
As of LCOS 8.84, users who are logged-in to the Public Spot can enter the short URL http://logout into the
address bar to access the session information window and to logout of the Public Spot. Users who closed the browser
window, either accidentally or on purpose, can quickly restore the page using this short URL.
Additions to the Setup menu
Print logout link
This parameter determines whether a voucher printout shows the URL for logging out from the Public Spot.
5
Iin order for the correct URL to appear on the voucher, the parameter Device host name (SNMP ID 2.24.22)
must contain the value logout.
Telnet path:
Setup > Public-Spot-Module
Possible values:
No
Yes
1574
Reference Manual
15 Public Spot
Default:
Yes
15.7 Addition(s) to LCOS 9.00
15.7.1 Number format for Smart Ticket
Starting with version 9.00, LCOS checks the entered phone number for invalid characters. Only numbers between 0 and
9 are allowed. The user must enter 5 to 15 numbers (excluding the country code).
15.7.2 Viewing Public Spot clients
LANmonitor can optionally display detailed information about the clients associated with the Public Spot.
1. Open the menu item Public Spot > Clients.
2. Double-click on Active to display the active clients, or on Inactive to display inactive clients.
3. Double-click on a client to retrieve detailed information about it.
15.7.3 Displaying advertising to Public Spot users
You can optionally display advertising to Public Spot users at configurable time intervals. The Public Spot shows the
advertisement in the normal browser window of the user and not using a pop-up, since all modern browsers normally
block pop-ups. In the Public Spot station table, a client can have one of three states:
1
Authenticated: The client is logged on and can surf in Internet.
1
Unauthenticated: The client is not logged on and cannot surf in Internet.
1
Advertisement: The next time a client calls a URL, it is redirected to an advertisement URL.
You have the option to exclude certain networks and user agents from the display of advertisements by means of a
whitelist.
1. In the device configuration, select the menu branch Public Spot > Server and click on Advertisement settings.
1575
Reference Manual
15 Public Spot
2. Enable the Show advertisements checkbox.
You can now change the interval between advertisement displays, and also other settings.
3. Under Interval you specify the time in minutes after which the Public Spot reroutes a user to an advertisement URL.
With an interval of 0 forwarding occurs directly after login.
4. Click on Advertisement URLs to add an advertisement URL. If you add multiple URLs, the Public Spot displays them
in sequence after the specified interval.
5. Optional: Click on User agent white list to add user agents, which the Public Spot excludes from the display of
advertisements.
6. Optional: Click on Free networks to add networks, which the Public Spot excludes from the display of advertisements.
This can be used in various ways, for example to enter the automatic search URLs used by the browser, e.g.
*.google.com. Typically, a browser sends keyboard input at the address bar to a search engine; by setting the
exception, the advertisement page does not responding to this.
5
Login-free networks are generally ad-free networks. There is no need to explicitly include these networks
into the whitelist.
7. Close all dialog windows by clicking on OK.
Public Spot users will be redirected to an advertisement URL after the specified time interval unless they are using a
whitelisted user agent or they are located in a free network.
The timing of the advertisements refers to the session time of the active Public Spot clients. If a client stop sending data
for a certain time, then the interval before the Public Spot displays advertising again will be delayed by this time.
Additions to the Setup menu
Advertisement
This menu gives you the option to enable or disable advertising pop-ups, and to edit these.
SNMP ID:
2.24.43
Telnet path:
Setup > Public-Spot-Module
Active
This menu switches the advertisements on or off.
SNMP ID:
2.24.43.1
1576
Reference Manual
15 Public Spot
Telnet path:
Setup > Public-Spot-Module > Advertisement
Possible values:
No
Yes
Default:
No
Interval
This item allows you to specify the interval after which the Public Spot redirects a user to an advertisement URL.
SNMP ID:
2.24.43.2
Telnet path:
Setup > Public-Spot-Module > Advertisement
Possible values:
0 … 65535 Minutes
Default:
10
Special values:
0
Redirection takes place directly after signing on.
URL
This item is used to enter the advertisement URLs. If multiple URLs are entered, the Public Spot displays them in sequence
after the specified interval.
SNMP ID:
2.24.43.3
Telnet path:
Setup > Public-Spot-Module > Advertisement
Possible values:
Max. 150 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
1577
Reference Manual
15 Public Spot
Contents
This parameter specifies the advertisement URL(s).
SNMP ID:
2.24.43.3.1
Telnet path:
Setup > Public-Spot-Module > Advertisement > URL
Possible values:
Max. 150 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
User-Agent-White-List
This item is used to add user agents which the Public Spot excludes from advertising.
SNMP ID:
2.24.43.4
Telnet path:
Setup > Public-Spot-Module > Advertisement
Possible values:
Max. 150 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
User-Agent
Name of the user agent you included in the white list.
SNMP ID:
2.24.43.4.1
Telnet path:
Setup > Public-Spot-Module > Advertisement > User-Agent-White-List
Possible values:
Max. 150 characters from #[A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_. `
Default:
empty
1578
Reference Manual
15 Public Spot
Process-WISPr-Redirect-URL
If the access-accept message from the RADIUS server contains the attribute 'WISPr-Redirection-URL', the Public Spot
client is redirected to this URL after successful authentication. This scenario behaves in the same way as if the RADIUS
server were to return 'LCS-Advertisement-URL=any' and 'LCS-Advertisement-Interval=0'. There is no need to set the
Operating switch. The attribute 'WISPr-Redirection-URL' is sufficient. This configuration is useful if, after authentication
(e.g. by MAC authentication), a client is to be redirected to a page just once.
SNMP ID:
2.24.43.5
Telnet path:
Setup > Public-Spot-Module > Advertisement
Possible values:
No
Yes
Default:
No
Free networks
This item is used to add networks which the Public Spot excludes from advertising.
SNMP ID:
2.24.43.6
Telnet path:
Setup > Public-Spot-Module > Advertisement
Host name
Enter the IP address of the additional server or network that your Public Spot users are to be given advertisement-free
access to.
Alternatively, you have the option of entering a domain name (with or without a wildcard "*"). Wildcards can be used,
for example, to allow advertisement-free access to all of the subdomains of a particular domain. The entry
*.google.com allows the addresses mail.google.com, and maps.google.com, etc.
SNMP ID:
2.24.43.6.1
Telnet path:
Setup > Public-Spot-Module > Advertisement > Free-Networks
1579
Reference Manual
15 Public Spot
Possible values:
Max. 64 characters from [A-Z][0-9][a-z]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Mask
Enter the netmask of the additional server or network that your Public Spot users are to be given advertisement-free
access to.
If you wish to authorize a domain or just a single workstation with the address named earlier, set 255.255.255.255
as the netmask here. If you wish to authorize a whole IP network, specify the corresponding netmask. If you do not set
a netmask (value 0.0.0.0), the device ignores the table entry.
SNMP ID:
2.24.43.6.2
Telnet path:
Setup > Public-Spot-Module > Advertisement > Free-Networks
Possible values:
Max. 15 characters from [0-9].
Default:
0.0.0.0
Extensions to the RADIUS attributes
The Public Spot additionally evaluates the following vendor-specific RADIUS attributes in the Access Accept of the RADIUS
authentication server.
4
The Advertisement enabled switch does not have to be set. It is sufficient if the attribute is present in the
RADIUS message.
26
Vendor 2356(LCS) ID 13
LCS-Advertisement-URL
Specifies a comma-separated list of advertisement URLs.
26
Vendor 2356(LCS) ID 14
LCS-Advertisement-Interval
Specifies the interval in minutes after which the Public Spot reroutes a user to an advertisement URL. With
an interval of 0 forwarding occurs directly after login.
15.7.4 Additional attributes for the XML interface
With LCOS 9.00 the scope of the attributes that are available for creating a new user via the XML interface has been
extended. The attributes below mostly correspond to the parameters which are also configurable over the RADIUS user
table.
1580
Reference Manual
15 Public Spot
The XML interface can now process the following XML elements in the login request:
VLAN_ID (optional)
Custom VLAN ID assigned by the device to the Public Spot user upon login. After authentication by the RADIUS
server, the individual VLAN ID overwrites a global VLAN ID that a user would otherwise obtain from the XML
interface.
The value 0 disables use of a VLAN.
PROVIDER (occasionally required)
Name of the RADIUS server used by the Public Spot for user authentication and accounting. If you do not
specify a RADIUS server, the Public Spot uses the server configured globally for the module.
This XML element is mandatory if you
1
have configured multiple RADIUS servers for the Public Spot module.
1
want to use the XML interface without RADIUS authentication but with RADIUS accounting.
Specifying this XML element is otherwise optional.
5
The referenced RADIUS server must be present in the configuration.
TXRATELIMIT (optional)
Maximum bandwidth (in kbps) provided to the Public Spot user for the uplink.
RXRATELIMIT (optional)
Maximum bandwidth (in kbps) provided to the Public Spot user for the downlink.
SECONDSEXPIRE (optional)
The maximum online time for a user account in seconds. The user can use this duration of access time until
a relative or absolute expiry time (if set) is reached.
The value 0 switches off the monitoring of the time budget.
TRAFFICEXPIRE (optional)
Maximum data volume for a user account in bytes. The user can use this data volume until a relative or
absolute expiry time (if set) is reached.
The value 0 switches off the monitoring of the data volume.
15.7.5 Dynamic change of a user session via the XML interface
If a Public Spot user has to authenticate only and no further changes are required throughout the login, then the parameter
RADIUS_LOGIN will meet your needs. On the other hand, if you need to change the attributes of an ongoing session
for a Public Spot user, you have the option of using RADIUS_CoA. To implement a change, your external hotspot
gateway sends a RADIUS-CoA-Request to the Public Spot, which directly transfers the changes in it to the
Station table under Status > Public-Spot.
One application for CoA messages is the automatic throttling of bandwidth: If a Public Spot user has consumed his/her
volume budget, an external hotspot gateway is able to throttle the user's bandwidth by evaluating the accounting data
and sending a CoA message to the Public Spot.
The XML messages for negotiations between the hotspot gateway and the Public Spot appear as follows:
1581
Reference Manual
15 Public Spot
RADIUS-CoA-Request
The external gateway sends the data with the session change to the Public Spot. The Public Spot then changes
the session data in the station table for the authenticated user 'user2350'.
<?xml version="1.0" encoding="ISO-8859-1"?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE COMMAND="RADIUS_COA_REQUEST">
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<SUB_PASSWORD>5juchb</SUB_PASSWORD>
<SUB_MAC_ADDR>00164115208c</SUB_MAC_ADDR>
<TXRATELIMIT>100</TXRATELIMIT>
<RXRATELIMIT>100</RXRATELIMIT>
<SECONDSEXPIRE>3600</SECONDSEXPIRE>
<TRAFFICEXPIRE>10000000</TRAFFICEXPIRE>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
In the example above, the user is assigned a session duration of 3,600 seconds, a transferable data volume
of 10,000,000 bytes, and a transmit and receive bandwidth of 100 kbps.
RADIUS-CoA-Response:
The XML interface sens a confirmation to the external hotspot gateway that the session data was changed:
<?xml version="1.0" encoding="ISO-8859-1" ?>
<PUBLICSPOTXMLINTERFACE>
<ACCESS_CUBE ID="WLC_PM" IP="192.168.100.2" COMMAND="USER_STATUS">
<SUB_STATUS>RADIUS_COA_ACCEPT</SUB_STATUS>
<SUB_MAC_ADDR>00:16:41:15:20:8b</SUB_MAC_ADDR>
<SUB_USER_NAME>user2350</SUB_USER_NAME>
<TXRATELIMIT>100</TXRATELIMIT>
<RXRATELIMIT>100</RXRATELIMIT>
<SECONDSEXPIRE>3600</SECONDSEXPIRE>
<TRAFFICEXPIRE>10000000</TRAFFICEXPIRE>
<ACCOUNTCYCLE>0</ACCOUNTCYCLE>
<IDLETIMEOUT>0</IDLETIMEOUT>
</ACCESS_CUBE>
</PUBLICSPOTXMLINTERFACE>
In case of throttling, the change to the user session always affects the quota that is still available to the user. For instance,
if the user was logged on for one hour already, then a change of the time quota to six hours means that just five hours
remain. If the time quota is less than the time the user is already logged on, the Public Spot logs out the user and sends
a logout message to the hotspot gateway.
15.8 Addition(s) to LCOS 9.10
15.8.1 Restricting administrators to voucher output only
If in LCOS you have created an administrator who is restricted to the function rights of the Public Spot Wizard (create
account) only, then this administrator now has access only to the input mask of the add user wizard. The navigation
toolbar in WEBconfig remains concealed.
Wizard for creating and managing users
Using the setup wizard Create Public Spot account you can use WEBconfig to create temporary accesses to the Public
Spot network with just a few clicks of the mouse. In the simplest case, you only need to enter the duration of access,
the wizard assigns the username and password automatically and stores the credentials in the user database of the
1582
Reference Manual
15 Public Spot
internal RADIUS server. The user receives a printed, personalized voucher, which the user can immediately use to login
to the Public Spot network for the specified period.
Alternatively, a stock of vouchers can be created and printed out to speed up the voucher issue at peak times or to allow
employees without access to the device to issue vouchers. In this case the Public Spot account is created with an online
time duration that starts when the user logs in for the first time. You also set a maximum validity period for the access.
After this time, the Public Spot automatically deletes the access account, even if the online time was not used up yet.
The setup wizard Manage Public Spot account displays all registered Public-Spot access accounts in a table on a web
page. This gives you an overview of your most important user data, as well as a user-friendly way to extend or reduce
the validity of an access account with a single click, or even delete user accounts completely. In addition, the administrator
can call up information about the user account using the wizard, such as the password in cleartext, the authentication
status, the IP address, the sent/received data volume or any restrictions that apply to the user account.
If several administrators are involved with the management of Public Spot accounts, you have the option of restricting
the accounts that are displayed to those created by the respective administrator. As a result, the overview table only
displays those accounts that were created by the administrator who is currently logged-on.
5
This restriction has no effect if an administrator account has a full name that is a part of the other administrator
account names. "PSpot_Admin" for example sees the entries made by "PSpot_Admin1" and "PSpot_Admin2".
"PSpot_Admin" acts as a super-admin in this scenario. All other administrators ("PSpot_AdminX"), however, do
not see the entries made by the others.
Setting up limited administrator rights for Public Spot managers
It is possible to allow employees to create and manage user accounts even though they do not have access rights to the
device configuration. This is done by setting up a limited administrator, who only has the right to use the
Public Spot
Wizard
. This tutorial describes the steps and the necessary access rights and privileges to do this in LANconfig.
The rights to use the Public Spot Wizards are configurable separately from one another, so it is possible to restrict a
limited administrator to any single Wizard. In the case of the Public Spot setup wizard, the restricted administrator
logging in to WEBconfig is automatically forwarded to the corresponding input mask.
1. In LANconfig, open the configuration dialog for the device you want to add a Public Spot administrator to.
The Public Spot option has to be enabled on this device.
2. Navigate to the item Management > Admin. In the section Device configuration, click Further administrators
and then click Add.
To allow an existing user to perform Public Spot management, you instead select the user's entry in the table and
click on Change.
3. You activate the profile by checking the Entry active box.
4. Assign a descriptive name in the field Administrator.
1583
Reference Manual
15 Public Spot
5. Enter a Password and repeat it as a check.
6. Set the Access rights to None.
7. In the section Function rights enable the options Public Spot wizard (add user), and Public Spot wizard
(manage user) for the Public Spot setup wizard.
4
The function right Public Spot XML interface is not required by a Public Spot administrator. The right is
only relevant if you use the XML interface and should not be combined with the function rights described
above for security reasons.
8. Save the new or modified administrator profile by clicking on OK.
If you have granted the feature rights to several Wizards, the limited administrator can navigate between these using
the navigation bar in WEBconfig.
If you have set the function right for the Public Spot Wizard (create user) only, then a limited administrator can only
navigate within this Wizard, and the navigation bar is hidden. In this case it is not possible to logout of WEBconfig
manually. For security reasons, this means that the lifetime of the WEBconfig session is very short. In case of inactivity,
the device automatically logs out the limited administrator.
4
For technical reasons, the Create Public Spot Account wizard does not update automatically after use of the
Create and CSV export button. A limited administrator who wishes to set up additional users and print vouchers
must invoke the Wizard again (e.g. via a URL or by refreshing the web page if the navigation bar is hidden).
15.8.2 Specify volume budget on vouchers
LCOS9.10 now enables you to use the placeholder tag <pbelem vollimit> in the voucher template, so as to
inform Public Spot users of the data volume assigned to them.
VOLLIMIT
Valid for:<pbelem><pbcond>
This identifier contains the amount of data, expressed in bytes, that the client is still allowed to transfer before
the device terminates the current session. This identifier is zero for a session with no data limit.
1584
Reference Manual
15 Public Spot
15.8.3 XML interface: Enhanced VLAN handling
As of LCOS version 9.10, you have the option to communicate the user's source VLAN to the Public Spot via an external
gateway, and to forward the VLAN-ID dependent authentication to an external RADIUS server.
SOURCE_VLAN (optional, only in conjunction with authentication by RADIUS server)
The VLAN ID of the network from which a Public Spot user attempts to login (source VLAN). The Public Spot
forwards the source VLAN in its access request to the internal or external RADIUS server. The Public Spot uses
the RADIUS attribute 81 (tunnel-private-group-ID) together with the RADIUS attributes 64 (tunnel-type)
and 65 (tunnel-medium-type). The RADIUS server uses the source VLAN to decide whether to accept or
decline the access request from the Public Spot.
If the RADIUS server accepts the request, it returns an access-accept with the RADIUS attributes mentioned
above to the Public Spot. The Public Spot then saves the source VLAN for the client and its station list and
allows the user to access the Public Spot network.
4
Use the source VLAN in conjunction with the setup parameter
2.24.47
. This prevents Public Spot users
in VLAN-separated Public Spot networks/SSIDs from authenticating once at the RADIUS server and
then accessing all of the managed Public Spot networks/SSIDs.
4
The SOURCE_VLAN should not be confused with the VLAN_ID. The VLAN_ID is not sent to
the RADIUS server. However, the Public Spot uses it to assign a VLAN ID provided by the gateway to
a successfully authenticated user.
For internal checking, the Public Spot stores the source VLAN to its station table as soon as the external RADIUS server
has accepted the authentication request. If a user then switches to a different Public Spot network/SSID with a VLAN-ID
which is different to that stored, then the Public Spot sets the user to "unauthenticated" and displays the login page
again at the next opportunity.
Additions to the Setup menu
Check origin VLAN
Use this parameter to specify whether the VLAN ID of the network where a user is authenticated is used by the XML
interface to verify user requests. This is relevant, for example, in scenarios where several Public Spot SSIDs are separated
by means of VLAN and a one-time authentication at one of these SSIDs should not automatically entitle the user to
access the other SSIDs.
4
The parameter requires that you have also enabled the setup parameters 2.24.40.1 (the XML interface itself)
and 2.24.40.2 (authentication by the XML interface via an internal or an external RADIUS server) .
SNMP ID:
2.24.47
Telnet path:
Setup > Public-Spot-Module
Possible values:
No
The Public Spot does not take the VLAN ID into account when verifying users. A one-time authentication
entitles a user to access all of the SSIDs managed by the Public Spot. As long as the user account is
valid, authentication is automatic.
1585
Reference Manual
15 Public Spot
Yes
The Public Spot takes the VLAN ID into account when verifying users. The Public Spot stores the VLAN
ID to the column of the same name in the station table, assuming that the authentication by the RADIUS
server was successful. This VLAN ID is the value for SOURCE_VLAN in the login request from the
external gateway. If the Public Spot user moves to a network with a different VLAN ID, the Public Spot
updates their station-table entry to “unauthenticated” and prompts the user to authenticate at the
RADIUS server again. In this case, the user receives the sign-in page to authenticate again.
5
To learn more about the request and response types, as well as the SOURCE_VLAN element,
refer to the Reference Manual.
Default:
No
VLANs
This parameter optionally defines a list of VLAN IDs which control the approved site(s) that are available to the
corresponding host name. Only users who have the VLAN ID stored in the station table are able to access this host
without having to authenticate. Use this parameter, for example, in application scenarios where Public Spot networks/SSIDs
are separated by VLAN and you wish to set different access restrictions for different user groups.
SNMP ID:
2.24.31.3
Telnet path:
Setup > Public-Spot-Module > Free-Networks > VLans
Possible values:
Default:
empty
Comma-separated list, max. 16 characters from [0-9],
Special values:
empty
, 0
Access to the host entered here is possible from all VLANs.
Messages to and from the authentication server
Transferred attributes
As previously mentioned, your device transmits far more than just the username and password in a RADIUS request.
RADIUS servers might choose to completely ignore these additional attributes, or only use a subset of these attributes.
Many of these attributes are used for access to the server using dial-in, and are defined as standard attributes in the
RADIUS RFCs. However, some important information for hotspot operation can not be represented with standard
attributes. These additional attributes are manufacturer-specific with the manufacturer code 2356 (LANCOM Systems
GmbH).
1586
Reference Manual
15 Public Spot
Table 26: Overview of the RADIUS attributes transmitted by the device to the authentication server
Possible values in LCOSMeaningNameID
The name entered by the user.User name1
The password entered by the user.User-Password2
<IPv4 address of the device>IP address of your deviceNAS-IP-Address4
Type of service that the user requested. The value “1” stands
for Login.
Service-Type6
<IP address of the client>Specifies the IP address that is assigned to the client.Framed-IP-Address8
<nn:nn:nn:nn:nn:nn>MAC address of your deviceCalled-Station-Id30
<nn:nn:nn:nn:nn:nn>MAC address of the client The address is given byte-wise in
hexadecimal notation with separators.
Calling-Station-Id31
<Device-Name>Name of your device, if configured.NAS identifier32
Type of physical port over which a user had requested
authentication.
NAS-Port-Type61
1
ID 19 denotes clients
from WLAN.
1
ID 15 denotes clients
from Ethernet.
For exampleDescription of the interface over which the client is connected
to your device. This may be a physical and a logical interface.
NAS-Port-Id87
1
LAN-1
4
Consider that more than one client may be connected
to one interface at a time, so that, unlike dial-in
servers, port numbers are not unique for clients.
1
WLAN-1-5
1
WLC-TUNNEL-27
Processed attributes
Your device evaluates the authentication response of a RADIUS server for attributes that it may possibly process further.
Most attributes however only have a meaning if the authentication response was positive, so that they influence the
subsequent session:
Table 27: Overview of the supported RADIUS attributes
Possible values in LCOSMeaningNameID
An arbitrary string from the RADIUS server that may
transport either a login failure reason or a user welcome
Reply-Message18
message. This message may be integrated into user-defined
start or error pages via the SEVERMSG element.
An arbitrary octet string that may contain data provided by
the authentication/accounting backend. Whenever the
Class25
device sends RADIUS accounting requests, they will contain
this attribute as-is. Within an authentication response, this
attribute can occur multiple times in order, for example, to
transmit a string that is longer than 255 bytes. The device
processes all occurrences in accounting requests in the order
they appeared in the authentication response.
Defines the data volume in bytes after which the device
automatically ends the session. This value is useful for
Vendor 2356, Id 1
LCS-Traffic-Limit
26
volume-limited accounts. If this attribute is missing in the
authentication response, it is assumed that no volume limit
applies. A traffic limit of 0 is interpreted as an account which
is principally valid, however with a used-up volume budget.
The device does not start a session in this case.
1587
Reference Manual
15 Public Spot
Possible values in LCOSMeaningNameID
This can contain any URL that is offered as an additional
link on the start page. This can be the start page of the user
Vendor 2356, Id 3
LCS-Redirection-URL
26
or a page with additional information about the user
account.
Defines an absolute point in time (measured in seconds
since January 1, 1970 0:00:00) after which the account
Vendor 2356, Id 5
LCS-Account-End
26
becomes invalid. If this attribute is missing, an unlimited
account is assumed. The device does not start a session if
its internal clock has not been set, or the given point in time
is in the past.
Contains the name of a Public Spot user for auto-login.
Auto-login refers to the table of MAC authenticated users
who are automatically assigned usernames by the server.
Vendor 2356, Id 7
LCS-Public-Spot-Username
26
Defines the maximum downstream rate in kbps. This
restriction may be combined with the corresponding Public
Spot function.
Vendor 2356, Id 8
LCS-TxRateLimit
26
Defines the maximum upstream rate in kbps. This restriction
may be combined with the corresponding Public Spot
function.
Vendor 2356, Id 9
LCS-RxRateLimit
26
Specifies a comma-separated list of advertisement URLs.Vendor 2356, Id 13
LCS-Advertisement-URL
26
Specifies the interval in minutes after which the Public Spot
reroutes a user to an advertisement URL. With an interval
of 0 forwarding occurs directly after login.
Vendor 2356, Id 14
LCS-Advertisement-Interval
26
Defines an optional maximum duration of the session,
measured in seconds. If this attribute is missing in the
Session-Timeout27
response, an unlimited account is assumed. A Session
timeout of zero seconds is interpreted as an account which
is principally valid, however with a used-up time budget.
The device does not start a session in this case.
Defines a time period in seconds after which the device will
terminate the session if no packets were received from the
Idle timeout28
client. This value may possibly overwrite the idle timeout
that is defined locally under Public Spot > Server > Idle
timeout.
Defines the tunneling protocol which will be used for the
session.
Tunnel-Type64
Defines the transport medium over which the tunneled
session will be established.
Tunnel-Medium-Type65
Defines the group ID if the session is tunneled.Tunnel-Private-Group-ID81
Defines the amount of time between subsequent RADIUS
accounting updates. This value is only evaluated if the
Acct-Interim-Interval85
RADIUS client does not have a local accounting interval
defined, i.e. if you have not set an Accounting update
cycle for the Public Spot module.
4
Note that the LCS-Account-End and Session-Timeout attributes are mutually exclusive, and it therefore does not
make sense to include both in the response. If both attributes are included in a response, the attribute that
appears as the last one in the attribute list will define the session’s time limit.
1588
Reference Manual
15 Public Spot
15.8.4 "Small header image": Optimized display for 19" devices
As of LCOS version 9.10, 19-inch devices also have a login page with a customizable header image for narrow screens.
This improves the way the Public Spot appears on mobile devices.
15.8.5 New button "Manage user wizard"
As of LCOS version 9.10 you have the option in the Setup Wizard Create Public Spot account to display the additional
button Manage user wizard.
The button Manage User Wizard button takes you to the Manage Public Spot Account Setup Wizard.
5
You have the option to either show or hide this button. It is displayed by default.
Additions to the Setup menu
Hide-User-Management-Button
This parameter gives you the option to hide the Manage user wizard button in the Setup Wizard.
SNMP ID:
2.24.19.20
Telnet path:
Setup > Public-Spot-Module > Add-User-Wizard
Possible values:
Yes
The Create Public Spot account Setup Wizard hides the Manage user wizard button.
No
The Setup Wizard displays the Manage user button.
Default:
No
15.8.6 Only show user accounts generated by the currently logged-on administrator
As of LCOS version 9.10, the Setup Wizard Manage Public Spot account gives you have the option to hide accounts
that were created by other administrators.
1589
Reference Manual
15 Public Spot
If several administrators are involved with the management of Public Spot accounts, you have the option of restricting
the accounts that are displayed to those created by the respective administrator. As a result, the overview table only
displays those accounts that were created by the administrator who is currently logged-on.
5
This restriction has no effect if an administrator account has a full name that is a part of the other administrator
account names. "PSpot_Admin" for example sees the entries made by "PSpot_Admin1" and "PSpot_Admin2".
"PSpot_Admin" acts as a super-admin in this scenario. All other administrators ("PSpot_AdminX"), however, do
not see the entries made by the others.
Additions to the Setup menu
show-all-users-admin-independent
This entry allows you to display only those user accounts in the Setup Wizard that were created by the currently logged-in
administrator.
SNMP ID:
2.24.44.11
Telnet path:
Setup > Public-Spot-Module > Manage-User-Wizard
Possible values:
Yes
The Setup Wizard displays all Public Spot accounts.
No
The Setup Wizard only displays the Public Spot accounts created by the currently logged-on administrator.
Default:
Yes
15.8.7 Evaluation of DHCP option 82 in RADIUS and Public Spot
As of LCOS version 9.10, RADIUS client and Public Spot devices evaluate the DHCP option 82.
AP-specific login to a central Public Spot
A central WLC manages a Public Spot in a distributed infrastructure. Accordingly, the configuration of the Public Spot
(Public Spot SSID, security standards) is identical on all of the participating APs. This allows a Public Spot provider to
offer an identical Public Spot at all of the different locations.
After receiving a voucher, customers would have access to this Public Spot at any branch. In order to limit access to the
branch where the customer has received the voucher, the AP transmits its own identifier in addition to the user name
and password. This identifier enables the voucher to be associated with this AP. To transfer the identifier, the AP attaches
the circuit ID (DHCP option 82) to the DHCP requests. These DHCP packets pass through the central Public Spot, which
checks the identifier based on the entries in the RADIUS user table.
The Public Spot only allows a request if the voucher in the RADIUS user table is associated with this AP. Customers who
have received a voucher at branch A cannot login to the same Public Spot at branch B, since the two APs transmit
different identifiers.
1590
Reference Manual
15 Public Spot
The AP identifier is configured as the circuit ID for the corresponding interface under Interfaces > Snooping > DHCP
snooping.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface used by the Public Spot user to authenticate. If a WLAN-SSID is involved,
then this is the corresponding BSSID.
1
%c: Inserts the name of the interface used by the Public Spot user to authenticate.
1
%n: Inserts the name of the AP as specified under Management > General.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if a WLAN client is used for the authentication. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the AP, to be found for example under Management > General.
On the WLC, you configure this identifier in the RADIUS user table under RADIUS server > General > User table.
As the “Called station”, you add the ID of the AP that should enable access by means of the corresponding voucher.
1591
Reference Manual
15 Public Spot
When setting up new Public Spot users, the Public Spot Setup Wizard automatically uses the ID of the device if this is
configured under Public Spot > Wizard > Circuit IDs.
When you create a new Public Spot account, the setup wizard checks to see whether this table contains an entry for the
logged-in administrator. If this is the case, the setup wizard inserts the circuit ID into the RADIUS user table as the
“called station”.
Additions to the Setup menu
Circuit-IDs
When a user authenticates at a Public Spot, the circuit ID configured in this table is an additional identifier sent by the
AP to the WLC along with the user name and password.
When you create a new Public Spot account, the Public Spot setup wizard checks to see whether this table contains an
entry for the logged-in administrator. If this is the case, the setup wizard inserts the circuit ID into the RADIUS user table
as the “called station”.
SNMP ID:
2.24.48
Telnet path:
Setup > Public Spot
Administrator
Contains the name of the administrator who is entitled to assign this circuit ID.
SNMP ID:
2.24.48.1
Telnet path:
Setup > Public-Spot > Circuit-IDs
Possible values:
Max. 16 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/;<=>?[\]^_.`
Default:
empty
Circuit ID
Contains the circuit ID sent by the AP to the WLC as an additional identifier along with the user name and password
when a user authenticates at a Public Spot.
1592
Reference Manual
15 Public Spot
SNMP ID:
2.24.48.2
Telnet path:
Setup > Public-Spot > Circuit-IDs
Possible values:
Max. 64 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
15.8.8 Additions to the Status menu
Max. no. users
This entry indicates the maximum number of users that may be authenticated with the Public Spot at the same time.
SNMP ID:
1.44.11
Telnet path:
Status > Public-Spot
PbSpot authenticated users
This entry displays the number of Public Spot users who are currently authenticated via the Public Spot itself.
SNMP ID:
1.44.12
Telnet path:
Status > Public-Spot
PMS authenticated users
This entry displays the number of Public Spot users who are currently authenticated via the PMS interface.
SNMP ID:
1.44.13
Telnet path:
Status > Public-Spot
1593
Reference Manual
15 Public Spot
Local configured users
This entry indicates how many Public Spot users are currently setup locally on the device.
SNMP ID:
1.44.14
Telnet path:
Status > Public-Spot
15.8.9 Additions to the Setup menu
Password input set
This setting specifies the character set used by the Create Public Spot Account wizard to create passwords for new
users.
SNMP ID:
2.24.19.18
Telnet path:
Setup > Public-Spot-Module > Add-User-Wizard
Possible values:
Character+digits
Characters
Digits
Hide CSV export
This parameter determines whether or not to display the button for exporting information to a CSV file in the Wizard for
creating new Public Spot accounts.
SNMP ID:
2.24.19.19
Telnet path:
Setup > Public-Spot-Module > Add-User-Wizard
Possible values:
No
Yes
Default:
No
1594
Reference Manual
15 Public Spot
16 Voice over IP (VoIP)
16.1 Introduction
The term Voice over IP (VoIP) refers to voice communications over computer networks based on the Internet protocol
(IP). The core idea is to provide the functions of traditional telephony via cost-effective and wide-spread networking
structures such as the Internet. VoIP itself is not a standard, rather it is a collective term for the various technologies
(equipment, protocols, voice encoding, etc.) which make voice communications in IP networks possible.
Different terminology is used for telephony over a network (LAN or Internet) The terms "Voice over IP" or "IP telephony"
are used as synonyms, although in actual fact they have different meanings.
1
Strictly speaking, "Voice over IP" is merely a term for the technology of transmitting calls across data networks in
real-time using the IP protocol (Internet protocol). The term is also used when the technology is implemented only
in the provider's core networks, in what is known as the backbone
1
The term "IP telephony" is used when the VoIP technology is also used in the terminal equipment, so that the call
subscriber uses the IP network for telephony.
1
"Internet telephony" is also used to describe telephony using VoIP over the Internet in general.
In the following, "Voice over IP" is usually used even to refer to IP telephony in accordance with general custom.
There are four basic types of terminal equipment that can be used for VoIP telephony:
1
With software running on the PC, known as a "softphone".
1
With an IP or VoIP telephone that is connected directly to the local network.
1
With a conventional telephone that is connected to the local network by an adapter (analog telephone adapter,
ATA).
1
Via a VoIP gateway that converts telephone calls from telephones (analog and ISDN) to VoIP and can then communicate
between the two "telephone worlds" like a PBX.
There is a basic difference between a VoIP connection being established between two pieces of terminal equipment that
are connected directly to the data network (PC or IP telephone) and the situation where a subscriber in the land-line or
mobile telephone network requires the conversion of the signaling, numbers and voice data. To differentiate the various
connection variants, a device in the LAN has become known as a "PC", and a device in the land-line network has become
known as a "phone".
16.1.1 PC-to-PC communication
With this application, the terminal equipment has to be integrated directly into the user's LAN. Examples are a PC, an
IP telephone or a telephone that is connected to the LAN using an ATA.
Different software solutions are available for the PC, known as "softphones". Note that some of these programs can
only communicate with users of the same software and not with softphones from other manufacturers. Communication
is usually free of charge within the Internet. A current example is Skype, which uses its own protocol.
16.1.2 PC-to-phone and phone-to-PC communication
In this case, the call data has to be transmitted from the Internet to the landline network, usually using what are known
as VoIP gateways. In general, these gateways are provided by providers and are subject to a fee.
1595
Reference Manual
16 Voice over IP (VoIP)
VoIP routers offer another option that can switch VoIP calls to an ISDN line. Examples are different LANCOM VoIP Router
types with an SIP gateway and ISDN interfaces. When the calls are transferred to the landline network, the usual telephone
operator fees are charged.
So that the subscriber can even be called on a PC, he or she needs a VoIP telephone number that is usually provided by
a provider.
VoIP providers usually only provide individual numbers and not complete number ranges with a switchboard number
and extension numbers. This is why the numbers that are provided by public providers are not attractive to many business
customers. When the LANCOM VoIP Router is used with a SIP gateway, previously-used numbers can be maintained;
the functions of VoIP telephony can also be used.
16.2 VoIP implementation in the LANCOM VoIP Router
The main task of the VoIP implementation in the LANCOM VoIP Router is to connect telephone calls from different local
interfaces (LAN, WLAN, ISDN) to the WAN connections that can be accessed by the router. This enables switching between
the local interfaces (local call) as well as between WAN interfaces.
The basis for the implementation and switching is the SIP protocol. The calls over all interfaces are converted into SIP
by the interface converter (this mainly concerns the ISDN interfaces). The ISDN-ISDN bridge function is a special case
that is activated when ISDN protocols cannot be mapped in SIP, which is why a bit-transparent connection is created
between an ISDN-TE (external ISDN connection) and an ISDN-NT (internal ISDN connection).
Furthermore, the bit-transparent connection is usually used for calls between multiple local ISDN interfaces to achieve
the highest possible compatibility and quality.
16.2.1 Example Applications
Voice over IP solutions offers advantages across a broad spectrum of applications, starting with small companies and
extending to large corporations with extensive networks of subsidiaries. In the following section, we will demonstrate
a number of examples.
5
Detailed information about configuration is available in the chapter 'Configuration of VoIP functions'.
Supplementing existing ISDN PBXs
VoIP functions can be conveniently added in to existing telephone structures by using a LANCOM VoIP Router. The
LANCOM VoIP Router is simply connected between the public ISDN connection (e.g. ISDN NTBA) and the ISDN PBX.
VOIP Router
Analog FAX
PC / Softphone
SIP Phone
PC / Softphone
INTERNET
SIP Server
SIP Phone
ISDN
NTBA
ISDN Phone
ISDN
ISDN Phone
ISDN
PBX
Telephone calls over the PBX and its ISDN telephones remain possible just as before; the telephones remain available
under the familiar telephone numbers. This application additionally offers the following options:
1
In addition to the ISDN telephones, VoIP telephones or VoIP softphones can be included in the telephone infrastructure.
VoIP subscribers in the internal LAN are also able to call external ISDN subscribers.
1
The ISDN telephones continue to function, and additionally they can call all of the internal VoIP telephones and
softphones in the LAN.
1
Calls to external SIP subscribers who use the same Internet provider are often available at no cost.
1596
Reference Manual
16 Voice over IP (VoIP)
1
With the appropriate connection to a public SIP provider, any other SIP subscriber worldwide can be called, irrespective
of the provider network. As an alternative to a direct ISDN connection, ISDN network subscribers can also be reached
over a diversion via the SIP provider. The costs depend on the provider's particular tariff models. Frequently,
long-distance and overseas calls via an SIP provider are significantly cheaper than the traditional telephone connection.
In this constellation, the LANCOM VoIP Router takes over the switching of the calls. The device can be individually
configured, for example, to use the access codes to decide upon the switching of a call either via the ISDN interface, or
via the Internet as a VoIP call.
Connecting subsidiaries or home offices to the headquarters
Many subsidiaries or home offices already have a connection to the network at headquarters over VPN. These connections
are normally limited to conventional data transmission. By using VoIP, internal company calls can be made for free over
the existing VPN connection and— thanks to the VPN encryption —these calls are secured against eavesdropping.
With a LANCOM VoIP Router located in the branch or home office, the two worlds of traditional and VoIP telephony can
be united in a single telephone: A VoIP telephone or an existing ISDN telephone can be used for free telephone calls via
VPN to the headquarters, or to make standard calls via ISDN.
VoIP Router
Analog Phone
POTS
PSTN
INTERNET
VoIP Router
SIP Phone
PC PC
PC / Softphone
PBX
SIP Phone
SIP PhoneSIP Phone
Branch office Main office
The advantages of a telephone connection to headquarters:
1
The configuration of telephone functions can be carried out centrally in the VoIP PBX at headquarters.
1
Subscribers at their branch or home offices connect with the central PBX.
1
Calls within the company network are free.
1
Outgoing calls are automatically directed to the optimal line for cost optimization.
VoIP for companies through SIP trunking
One of the biggest hurdles for companies that fully migrate to VoIP is to maintain the existing telephone numbers. Normal
provider SIP accounts come with a telephone number for the transition to the landline telephone network, but generally
these numbers are selected from a pool of numbers available to the provider. However, for companies with a large
number of telephone subscribers and numbers, it is of decisive importance that existing telephone and extension numbers
are maintained after migrating to VoIP.
With the SIP trunking function, entire ranges of telephone numbers made up of external numbers and their associated
extensions can be mapped by LANCOM VoIP Routers over a single connection to a SIP provider, assuming that the
provider also supports Direct Dialing In (DDI) and can provide multiple connections simultaneously. Generally speaking,
SIP providers that offer SIP trunking can acquire the existing telephone numbers from the former telecomms provider.
Connecting local ISDN lines with a remote SIP gateway
Companies with nation-wide and internationally distributed sites are often interconnected with VPN already. A LANCOM
VoIP Router can be used not only to connect the SIP and ISDN telephones at a branch office to the SIP-PBX at headquarters;
it can also integrate local ISDN networks into corporate communications with help of the "SIP Gateway" function.
The SIP gateway is active for outgoing and incoming calls.
1
A company headquarters in New York can, for example, use a LANCOM VoIP Router with SIP gateway located at the
Los Angeles branch office to telephone with customers and suppliers located in Los Angeles at local rates ("local
break-out").
1597
Reference Manual
16 Voice over IP (VoIP)
1
For improved availability to customers located abroad, the New York headquarters can, for example, use a LANCOM
VoIP Router with SIP gateway located at their sales office in Italy. Customers can then reach support or service
numbers via a standard national telephone number. Calls from the local ISDN network are received and directed
within the company network to the responsible employee. Call routing can be used which identifies the customer's
calling number and automatically selects the appropriate connection to be used for forwarding the call.
VoIP Router
INTERNET
VoIP Router
PC
L ocal PSTN
PBX
SIP Phone SIP Phone
SIP Phone
Branch office
Main office
Advantages of the SIP gateway:
1
The local ISDN connection at any site is available for use by any of the offices throughout the entire company.
1
National and international long-distance calls can be mapped to local or regional calls, so saving costs.
1
Automatic routing of incoming calls to the responsible employee.
Connecting sites without a SIP PBX
Companies with widely disperse offices and without their own SIP PBX can also take advantage of VoIP site-to-site
connectivity. In this "Peer-to-Peer" scenario, a LANCOM VoIP Router has been implemented at both locations.
VoIP Router
Analog FAX
PSTN
ISDN Phone
ISDN
VoIP Router
INTERNET
Analog Phone
POTS
PC / Softphone
SIP Phone
Analog PBXISDN PBX
PC / Softphone
PC / Softphone
SIP Phone
Along with data transfer via VPN, it is also possible to use VoIP functions between the two locations.
The advantages of peer-to-peer site-to-site connectivity
1
ISDN PBXs at different locations can form a common internal telephone network.
1
An SIP PBX is not necessary.
1
Calls within the company network are at no charge.
1
Outgoing calls are automatically directed to the optimal line for cost optimization.
1
Incoming calls can be switched directly to the appropriate employee at a different location.
16.2.2 The central position of the LANCOM VoIP Router
LANCOM VoIP Router take up a central position in the switching of telephone calls between internal and external
subscribers over the different channels of communication. Depending on the model and equipment, the devices
interconnect the following communication participants and channels into a common telephone infrastructure.
1. Internal VoIP terminal devices connected to LAN, WLAN and DMZ, such as SIP telephones and SIP softphones
2. The internal ISDN infrastructure with ISDN PBX and ISDN telephones
3. Analog terminal devices, internally connected either into the ISDN network via a PBX with a/b ports, or alternatively
into the VoIP network over an ATA (Analog Telephone Adapter).
4. External SIP providers and all of the external subscribers attainable via them
5. Upstream SIP PBXs with all of the internal and external subscribers attainable through it
1598
Reference Manual
16 Voice over IP (VoIP)
6. The external ISDN world via ISDN NTBA or upstream ISDN PBX, and all of the external subscribers available via the
land-line network
SIP Phone
PC / Softphone
ISDN Phone
ISDN
ISDN PBX
Analog FAX
Analog Phone
POTS
SIP PBX
ISDN Phone
ISDN
Analog Phone
POTS
SIP Server
VoIP Router
S
I
P
u
s
e
r
s
a
n
a
l
o
g
/
I
S
D
N
l
i
n
e
u
s
e
r
s
I
S
D
N
a
n
a
l
o
g
S
I
P
l
i
n
e
S
I
P
P
B
X
u
s
e
r
s
Users and lines
Telephony subscribers in internal areas can take part in voice communications and, in the LANCOM VoIP environment,
are referred to as "users". The LANCOM differentiates between:
1
ISDN users
Devices connected over the ISDN network, including ISDN and analog devices connected to an upstream ISDN PBX.
When connecting downstream PBXs to point-to-point lines, the number of possible ISDN subscribers is determined
by the length of the extension number (DDI). In this case, all of the telephones and terminal equipment connected
to the PBX can be mapped with a single ISDN user entry.
1
SIP users
SIP terminal devices connected over LAN, WLAN and DMZ and analog devices connected with an ATA.
The external paths of communication available to the users are known as "lines". The LANCOM differentiates between
the following lines:
1
ISDN
A connection to an ISDN NTBA over the TE interface. The NT interface can additionally be used to connect ISDN
terminal devices directly or via a downstream ISDN PBX.
1
SIP lines
There are three different types of SIP line:
2
A "Single account" line acts like a normal SIP account with a single telephone number. The internal users can all
make use this account for making SIP calls, although only one call can be conducted at a time.
Depending on the provider services, these lines can be used to reach subscribers in the provider networks, subscribers
in other SIP networks (partner networks), or even land-line subscribers. Your own availability at your own telephone
number or even solely with an SIP name over the Internet also differs from provider to provider.
2
A "trunk" line acts like an extended SIP account with a main external telephone number and multiple extension
numbers. Internal users use this account in parallel and several calls can be made simultaneously (until the
maximum available bandwidth is exhausted).
2
As a "SIP gateway" line, the LANCOM VoIP Router provides a remote SIP PBX with a transition to the local ISDN
network. The SIP gateway is registered at the SIP PBX with a single number, although several calls can be
conducted at once (until the maximum available bandwidth is exhausted). The connection between the SIP PBX
and the LANCOM VoIP Router is normally established over a VPN connection.
1599
Reference Manual
16 Voice over IP (VoIP)
1
SIP PBXs
Connections to upstream SIP PBXs. These lines are generally connections to large PBXs in the network at headquarters
which can be reached via a VPN connection.
5
The precise number of users and lines available varies between models and software options.
16.3 Call switching: Call routing
All calls between internal subscribers and subscribers who can be reached over external lines are handled as SIP calls
by the LANCOM—even if the connection is between two ISDN subscribers.
The call router in the LANCOM VoIP Router switches the call. The switching relies mainly on the information in two tables:
1
For telephone numbers arriving at the call router, rules in the call-routing table are able to alter these numbers if
needed and can decide which line to use for a call.
1
The table for the locally registered user provides information about which terminal device is available at which internal
telephone number.
The bandwidth reservation, QoS settings and firewall settings that are necessary for reliable transmission of voice data
are carried out automatically by the LANCOM.
1
When establishing a connection, the LANCOM checks (under consideration of the permitted codecs) which maximum
bandwidth will potentially be required.
2
This bandwidth is then automatically reserved by the QoS module upon initiation of the connection.
2
If negotiation shows that the maximum bandwidth is not available, the connection will not be made.
2
If negotiations between the terminal devices can agree upon a codec with lower bandwidth requirements, then
the reserved bandwidth will be lowered accordingly.
1
All packets from ISDN users are given a DiffServ marking by the LANCOM (with SIP users, the QoS marking is usually
handled by the telephones or softphones).
2
SIP packets for signaling are marked as CS1.
2
RTP packets are marked as EF.
The ports required for the transmissions are activated automatically.
16.3.1 SIP proxy and SIP gateway
The tasks involved in switching calls between the different lines of SIP and ISDN subscribers are handled by two functions
in the LANCOM VoIP Router.
1
SIP proxy
A SIP proxy handles the switching between callers.
1
SIP gateway
The SIP gateway handles the conversion between IP-based telephony that uses the SIP protocol and other (telephone)
networks, for example the ISDN network.
16.3.2 User registration at the SIP proxy
A LANCOM VoIP Router represents the central exchange for SIP calls between different subscribers who wish to
communicate over different types of line. The task of switching in the LANCOM are handled by the SIP proxy. A telephone
signals the SIP proxy that it needs to establish a connection, and the SIP proxy uses certain rules to decide which line is
1600
Reference Manual
16 Voice over IP (VoIP)
to be used for the connection. Conversely, incoming calls are assigned to a certain terminal device by the SIP proxy
according to its rules.
For terminal devices to be able to take part in this switching, they must be registered with the SIP proxy. Where the
registration is limited to call switching by the LANCOM, we refer to "local registration".
If other exchanges are involved, e.g. an SIP PBX at another location, then we refer to an upstream registration. In this
case, the LANCOM accepts the request for registration and forwards it upstream. In this instance, the LANCOM is
described as "transparent proxy".
VoIP Router
SIP Phone
ISDN PBX
INTERNET
local regist ration upst ream regist ration
SIP-Proxy
The great advantage with this two-stage registration comes to bear in the backup event: If the connection to an upstream
SIP PBX is not available, the SIP proxy can handle the user who is registered upstream as a local user and can then direct
the calls over alternative lines.
Registration at the LANCOM VoIP Router (local registration)
For local registration at the LANCOM, it is initially sufficient for the user to send a valid VoIP domain to the SIP proxy.
The internal VoIP domains of the LANCOM VoIP Router are valid, as are all domains entered in a SIP line.
1
For SIP terminal devices in the LAN (SIP telephone or SIP softphone), the domain is entered in the configuration.
There is no need for an entry as a SIP user in the configuration of the LANCOM. This variant is known as "automatic
registration".
1
The domain cannot be entered into ISDN terminal equipment; instead, ISDN users have to be registered in the
LANCOM configuration with a corresponding entry as an ISDN user .
1
To prevent unknown subscribers from registering, authentication at the SIP proxy can be set as a prerequisite to local
registration (local authentication). In this case, an entry as a SIP or ISDN user in the LANCOM configuration is essential.
5
Automatic registration without entering a password is restricted to the SIP users in the LAN. SIP users in the
WAN require an appropriate user entry and authentication by password.
Registration at an upstream SIP PBX (upstream registration)
Generally, authentication by user and password is always required for registration at a SIP PBX. There are two possible
ways of transmitting the authentication data to the SIP PBX:
1
All SIP and ISDN users at the LANCOM VoIP Router end use the same shared access information. In this case, only
the VoIP domain for the SIP PBX and the appropriate user ID are entered into the SIP terminal device. For ISDN users,
the VoIP domain of the SIP PBX is entered into the LANCOM as an ISDN user. The SIP proxy recognizes the request
for registration at the upstream SIP PBX if the domain communicated from the client agrees with a domain entered
into the SIP PBX line. The proxy then forwards the registration data together with the shared password to the SIP
PBX.
VoIP Router
SIP Phone
ISDN PBX
INTERNET
VoIP domain of the SIP PBX
VoIP domain of the SIP PBX plus
shared password for the SIP PBX line
Shared password
VoIP domain of the SIP PBX
Shared password
VoIP domain of the SIP PBX
Shared password
1
If SIP or ISDN users at the LANCOM VoIP Router are entered into the SIP PBX with different passwords, then the
users have to enter their individual passwords upon registration. Consequently, each SIP or ISDN user has an entry
1601
Reference Manual
16 Voice over IP (VoIP)
into the LANCOM with the individual passwords, which are also entered into the SIP terminal devices. Users with
shared and individual passwords can be managed in parallel.
VoIP Router
SIP Phone
ISDN PBX
INTERNET
VoIP domain of the SIP PBX plus
shared password for the SIP PBX line
Individual password
VoIP domain of the SIP PBX
Individual password
VoIP domain of the SIP PBX
Individual password
VoIP domain of the SIP PBX plus
shared password for the SIP PBX line
Particular aspects for ISDN users
Integrating ISDN terminal equipment into the LANCOM VoIP environment and the necessary steps for configuration
depend upon the application at hand and, if applicable, upon the options available with a PBX. The main questions to
be answered by the user are as follows:
1
Can ISDN terminal devices telephone internally with SIP users?
1
Are ISDN terminal devices available externally over SIP lines?
1
Can ISDN terminal devices telephone externally over SIP lines?
To answer these questions, we differentiate between the following constellations:
1
If ISDN terminal equipment can be reached over an ISDN TE interface on the LANCOM, it is described as "upstream".
From the perspective of the LANCOM, the ISDN terminal devices are on an external line. This ISDN terminal equipment
is normally not classified as being for local users, and so no entries for ISDN users are necessary.
ISDN terminal equipment at an upstream ISDN PBX...
2
can make internal calls to SIP users if the corresponding telephone numbers are configured as internal MSNs in
the ISDN PBX.
2
can receive internal calls from SIP users if the internal MSNs of the ISDN equipment are output to the ISDN line
by the call-routing table, for example over a standard route.
2
can only make calls over SIP lines if the PBX is able to output certain call numbers over its internal ISDN bus.
Otherwise, all calls not matching with its internal MSNs would be forwarded by the ISDN PBX to the public
telephone network.
2
can only receive calls from an upstream SIP PBX if entered into the LANCOM as an ISDN user and registered as
such with the SIP PBX.
1
If ISDN terminal equipment can be reached over an ISDN NT interface on the LANCOM, it is described as "downstream".
For the LANCOM, this is then a local subscriber that can be reached via the list of registered users. As ISDN terminal
equipment cannot send domain information to register at the LANCOM, it must be entered as an ISDN user so that
it can be recognized by the VoIP system.
ISDN terminal equipment at a downstream ISDN PBX...
2
can make internal calls to SIP users by entering the character for an outside line as required by the PBX and then
dialing the SIP user's internal number. The PBX then forwards the call to the SIP user's internal number—without
the outside-line access code—over its external ISDN bus to the LANCOM.
2
can receive internal calls from SIP users as long as the entry for the ISDN user contains the correct allocation of
the internal number to the appropriate MSN. The LANCOM takes a call to the ISDN user's internal number,
translates it to the MSN, and outputs it to the allocated ISDN bus. The PBX receives the MSN as if it were an
external call and forwards it to the corresponding ISDN terminal equipment.
2
can conduct incoming and outgoing calls over SIP and ISDN just like SIP users. Again, the outside-line code may
be necessary for outgoing calls.
Dynamic ISDN users at point-to-point connections
When connecting downstream PBXs to a point-to-point interface of the LANCOM VoIP Router, the number of possible
ISDN terminal devices is only limited by the length of the extension number. With three-figure extension numbers, almost
1000 terminal devices can be connected, all of which can be managed as ISDN users in the LANCOM VoIP Router.
1602
Reference Manual
16 Voice over IP (VoIP)
Through an ISDN user entry with a # character as a placeholder for the telephone numbers, all ISDN terminal devices
with their respective extension numbers can be set up as dynamic ISDN users.
5
User entries that use # characters to map user groups cannot be used for registration at an upstream PBX. This
registration always demands a specific entry for the individual ISDN user.
16.3.3 Number translation at network transitions
LANCOM VoIP Router switch calls between different telephone networks, e.g. the ISDN network, various SIP provider
networks, and the internal telephone network. These networks generally have different ranges of numbers or even
completely different conventions for addressing subscribers. Whereas the traditional land-line network uses numerical
characters with country code and area access codes, the world of SIP allows alphanumerical names along with domain
information.
The transition between these zones must guarantee the correct translation of "telephone numbers" so that the intended
subscriber can be reached. For example, when a call from the land-line network arrives at a public MSN, the requested
telephone number has to be translated to the ISDN user's internal number. This act of translation is known as "mapping".
Mapping incorporates not only the called number, which represents the destination, but the calling number for the
source as well.
S
I
P
-
u
s
e
r
s
S
I
P
-
P
r
o
v
i
d
e
r
S
I
P
P
B
X
I
S
D
N
-
N
e
n
s
u
e
r
s
I
S
D
N
-
a
n
a
l
o
g
u
s
e
r
s
SIP Phone
PC / Softphone
ISDN Phone
ISDN
ISDN PBX
Analog FAX
Analog Phone
POTS
ISDN PBX
ISDN Phone
ISDN
Analog Phone
POTS
SIP Server
VoIP Router
Mapping the destination tele -
phone number
1) external MSN from the ISDN
network
2) internal telephone number
of the ISDN user
3) Mapping the source
telephone number
4) internal telephone number
on the SIP user
1
2
3 4
Depending on the application at hand, both the called and the calling numbers have to be modified so that a return call
can be made to the source number.
Call number translation at the transition to outside lines is primarily implemented by mapping entries in the ISDN and
SIP lines and by rules in the call-routing table.
16.3.4 The Call Manager
The Call Manager has the central task of allocating the calls waiting to be switched to a certain line or to a certain user.
The Call Manager makes this allocation by using the call-routing table and the list of registered users. The calls are
switched in the following steps:
1
Processing of called numbers (Calling Party ID)
First of all there is a check to see whether a numeric or alphanumeric number is available. Typical dialing separators
such as "()-/" and <blank> are removed. A leading "+" is left in place. In this case, the number is still treated as a
numeric number. If the check reveals any other alphanumerical character, the number is treated as alphanumeric
and remains unchanged.
1
Resolving the call in the call routing table
1603
Reference Manual
16 Voice over IP (VoIP)
After processing the Called Party ID, the call is passed over to the call-routing table. Entries in the call-routing table
consist of sets of conditions and instructions. The entries—with the exception of the default routes—are searched
through and the first one that satisfies all of the conditions is executed.
1
Resolution of the call with tables of local subscribers
If no entry is found in the call-routing table, then the Call Manager searches through the list of local subscribers.
Call routing considers all of the users known to the call router (registered SIP users, configured ISDN users). If an
entry is found that agrees with the called number and that has the matching destination domain, then the call is
delivered to the corresponding subscriber.
If there is no local subscriber with matching number and destination domain, then the following cycle searches for
an agreement between the number of the local subscriber and the called number; the destination domain is ignored.
1
Resolution of the call with default entries in the call-routing table
If the preceding cycles referring to the call-routing table and lists of local subscribers remain unsuccessful, then the
waiting call is checked once again with the call-routing table. This pass only takes the default routes into account,
however. The numbers and destination domains entered into the default routes are ignored. Only the source filters
are processed, assuming that the default routes has these filters.
5
Specific examples of call-routing procedures can be found in the configuration examples described.
16.3.5 Making telephone calls with the LANCOM VoIP Router
Using the LANCOM VoIP Router opens up a variety of new possibilities for making telephone calls. Depending on the
constellation of terminal equipment implemented (e.g. SIP or ISDN telephones, SIP or ISDN PBX systems) and, depending
on the configuration for call routing in the LANCOM VoIP Router, certain information is critical for understanding the
establishment of connections.
Automatic outside line access
Using the LANCOM VoIP Router and the enhancement with VoIP functionality within your telephone structure is designed
to support the users' telephone behavior with the greatest possible convenience. One of the core aspects of this is the
use of "spontaneous" or "automatic" outside line access, a feature that is familiar to users of standard PBX systems.
1
Most PBX systems are configured in such a way that the telephone subscribers must dial a "0" before the desired
telephone number in order to gain access to an outside line - that is, to carry out a telephone conversation via a
public telephone network.
Without the "0" prefix, the number dialed is considered to be an internal number from another extension line on the
private PBX.
1
If "automatic outside line access" is set up, all numbers dialed are directed over the public telephone network. In
this case, internal telephone calls to other extensions are not possible or only possible when a special symbol is
dialed before the number.
When the telephone structure is extended with a LANCOM VoIP Router, a variety of new possibilities become available
for connecting telephone terminal equipment. This includes the existing analog or ISDN telephones (where necessary,
connected to the respective PBX) or VoIP terminal equipment such as SIP telephones or PCs with VoIP software.
As a new and central building block in the telephone structure, the LANCOM VoIP Router assumes many of the PBX
tasks for connected terminal equipment. As such, you can also set up the automatic outside line access for the terminal
equipment connected to the LANCOM VoIP Router directly for the ISDN or SIP subscriber groups, thereby adapting it to
existing telephone behavior.
1
When automatic outside line access is turned off, subscribers must dial a "0" before the desired number in order to
carry out a telephone conversation via a public telephone network.
All calls without a "0" preceding the number will be treated as calls to internal extensions within the private telephone
network.
1604
Reference Manual
16 Voice over IP (VoIP)
1
If automatic outside line access is turned on, all numbers dialed will be directed over a public telephone network.
For telephone calls to internal extensions, a special symbol or a specific number combination must be dialed before
the number. With the standard settings, when automatic outside line access is enabled, a star * is activated as the
identification symbol for an internal number. This setting can be adjusted to match the character that you are familiar
with.
5
If you operate the LANCOM VoIP Router on the extension line of a PBX, it is recommended that outside line
access for the router be configured in the same way as for the PBX so that the behavior remains the same
from the user's perspective.
1
Example of a downstream PBX
A LANCOM VoIP Router is switched between the ISDN outside line and the existing ISDN PBX. In the PBX, automatic
outside line access is enabled, the call router settings for the LANCOM VoIP Router decide whether or not a "0" must
be dialed for outside line access for the connected ISDN and SIP subscribers.
INTERNET
ISDN
VoIP Router
PC with Softphone
SIP-Telephone
PBX
ISDN Phone
ISDN
ISDN Phone
ISDN
Downstream ISDN PBX: Automatic
outside line access enabled
5
If the LANCOM VoIP Router in this constellation is not available, for example, due to a power outage, the ISDN
connection for the downstream ISDN PBX is automatically "bridged" to the external ISDN connection (when
life-line support is enabled). For a LANCOM VoIP Router without automatic outside line access, the ISDN
subscribers should not dial a "0" before the number while the life-line support is active.
1
Example of an upstream PBX
A LANCOM VoIP Router is connected to an ISDN PBX extension line. In the LANCOM VoIP Router, automatic outside
line access is enabled, the settings for the upstream PBX decide whether or not a "0" must be dialed for outside line
access for the connected ISDN and SIP subscribers.
PC with Softphone
SIP-Telephone
PBX
ISDN Phone
ISDN
INTERNET
VOIP Router
ISDN Phone
ISDN
ISDN
VoIP Router without ISDN NT interface: Automatic
outside line access enabled
Upstream ISDN PBX
Dialing various numbering areas
When dialing other parties, the following numbering areas are available for use:
1
Internal numbers are comparable to the extension line numbers for traditional PBX systems ("extension"). Subscribers
can reach each other directly using these internal numbers without having to go through a public telephone network.
The internal numbers must be unique for all subscribers within the private telephone network, this also includes any
other PBX systems that may be connected!
The internal subscribers can be reached by simply dialing the internal number without a "0" preceding it.
5
Depending on the settings for automatic outside line access, a special preceding dialing signal may be
required.
1605
Reference Manual
16 Voice over IP (VoIP)
1
Via local telephone numbers you can reach external parties who are in the same local telephone network as the
LANCOM VoIP Router, i.e. users with the same area code as the public line for the LANCOM VoIP Router.
In decentralized locations that extend beyond city or state boundaries, the physical location of the device is decisive,
even if a central PBX is located at a different location. Therefore, for a LANCOM VoIP Router in London, all telephone
subscribers in the local telephone network for London can be reached using local numbers, even if a SIP PBX connected
via VPN can be reached in Manchester.
5
Depending on the settings for automatic outside line access, a "0" prefix may be required.
1
The national and international numbers behave in the same way as local numbers; here, the physical location
of the devices is decisive for the assignment of corresponding access codes. Therefore, a LANCOM VoIP Router in
Austria belongs to the national telephone network in Austria, even if there is a VPN connection to the SIP PBX at the
headquarters in Germany.
5
Depending on the settings for automatic outside line access, a "0" prefix may be required.
Special numbers
Certain special numbers (emergency numbers, toll-free or particularly expensive service numbers) can be subjected to
special treatment by the call router.
1
For example, this ensures that emergency numbers for the police or fire department are always secured, even if the
subscribers do not dial the correct preceding dialing signal for outside line access.
With the standard settings, the emergency numbers "110" and "112" are configured in such a way that they can be
dialed correctly with or without the preceding "0".
1
For toll-free numbers such as "0800", a direct connection via ISDN is usually selected in order to use the toll-free
land-line to land-line connection.
Dialing using specific lines
With the LANCOM VoIP Router, other lines, in addition to the previously existing ISDN exchange lines, can be defined
for voice communication, i.e. to a SIP PBX connected via VPN or to a public SIP provider via the Internet. Each time a
connection is established, the call router decides which of the existing lines is to be used for the call based on
pre-determined rules.
As an alternative to the automatic selection by the call router, you can direct individual calls to a certain line, for example
when you want to call a party purposely via ISDN and not via the SIP PBX at the headquarters. For this purpose, the call
router assigns specific code numbers to existing lines, such as "98" for ISDN or "97" for a SIP provider. The targeted call
via this line is then initiated with the corresponding identifier:
1
The call with "020 123456" is assigned to a corresponding line by the call router, e.g. via the SIP PBX at the
headquarters.
1
However, the call with "98 020 123456" is made directly via the ISDN connection by the call router.
16.3.6 Call hold, transfer call, connect call
LANCOM VoIP Routers support various services which are familiar to users of the ISDN network:
1
With call hold the user can place an active call into a wait state. In this state, the user can for example make a call
to another person.
1
With transfer call, the user can switch to and fro between two connections. The user is only connected with one
caller at a time, while the other caller is put on hold.
1
With connect call the user switches an active call over to another call which is on hold. The two callers are then
connected and the user is no longer involved in the call.
1606
Reference Manual
16 Voice over IP (VoIP)
The services call hold, transfer call and connect call are available to all local SIP, ISDN and analog users, and also to
subscribers at an upstream SIP PBX; however, they can only be initiated by a SIP user.
16.3.7 Transfer of DTMF tones
ISDN telephone networks introduced the possibility of transmitting information on which button was pushed on the
telephone using DTMF tones (Dual Tone Multiple Frequency). With the help of DTMF tones, the telephone user can
communicate with voice mailboxes and computer telephony systems, for example.
In VoIP applications, special mechanisms are required to assume the DTMF tone function. If, for example, during a
telephone call, a button is pressed on a VoIP telephone or a VoIP softphone, this should trigger the same action as a
call with an ISDN telephone.
Generally, DTMF tones are transmitted in VoIP applications in one of two ways:
1
In-band describes the transmission of the DTMF tones in the same data stream in which the voice data are transferred.
However, this procedure is relatively unreliable because the DTMF tones in the IP datastream can easily be mistaken
for voice data, particularly when using compression codecs.
1
Out-of-band describes the transmission of the DTMF tones in a stream that runs parallel to the actual voice data.
Two standards are generally used for out-of-band transmission:
2
SIP INFO (RFC 2976)
2
RC 2833 (RTP payload for DTMF digits)
Both variations can wrap information, e.g. on buttons pressed, their tone frequency and the length of time the button
was pressed into the signaling datastream. In addition, events that should be transmitted with DTMF tones can also
be transmitted in cleartext in the SIP data.
DTMF signaling configuration
When configuring DTMF signaling, the type of transmission to be used for the DTMF tones must be set:
LANconfig: VoIP Call Manager / Extended
1607
Reference Manual
16 Voice over IP (VoIP)
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
16.3.8 Transfer toll information to the internal ISDN buses
LANCOM VoIP Routers support two variants of the AOC (Advice Of Charge) service:
1
AOC-D refers to the transmission of charge information during the call.
1
AOC-E refers to the transmission of charge information at the end of the call.
LANCOM VoIP Routers transmit charge information from both types of AOC service between internal and external busses.
AOC-D charge information can be converted into a metering pulse for analog users at the internal analog interfaces if
the corresponding option has been activated.
16.3.9 Supporting digital calls
LANCOM VoIP Routers support digital calls, e.g. when using Group 4 fax machines or when using ISDN terminal equipment
for dialing in to particular networks. To direct these calls over an ISDN interface of the LANCOM VoIP Router, destination
numbers can be given special prefixes.
16.4 Configuration of VoIP parameters
Changes with LCOS 7.6:
1
Entry of the following parameter for SIP, ISDN and analog users:
2
CLIR
1
Entry of the following parameters for SIP providers and SIP-PBX lines:
2
Local port number
2
(Re-) registration
2
Line monitoring
2
Monitoring interval
2
Trusted
2
Privacy method
1
Entry of the following parameters for analog lines:
2
Caller-ID signaling
2
Caller-ID transmission requirements
1608
Reference Manual
16 Voice over IP (VoIP)
16.4.1 General settings
LANconfig: VoiP Call Manager / General
1
Voice Call Manager (VCM) activated
Switches the Voice Call Manager between active / not active
1
Domain
Name of the domain in which the connected telephones and the LANCOM Wireless Router are operated.
2
Terminal devices working in the same domain register as local subscribers at the LANCOM Wireless Router and
make use of the SIP proxy.
2
Terminal devices working with the other domain of an active SIP PBX line register themselves as subscribers at
an upstream PBX.
1
Create a SYSLOG message for each call
Each time a call is made with the LANCOM VoIP Router a SYSLOG message is created.
5
Please note that to use this function, the appropriate SYSLOG settings have to be made.
1
Send an e-mail for each call
Each time a call is made with the LANCOM VoIP Router an e-mail is sent to the defined address.
1609
Reference Manual
16 Voice over IP (VoIP)
5
Please note that to use this function, an SMTP account must have been set up.
16.4.2 Configuration of users
Local users are the terminal equipment/telephones that are connected to the LANCOM VoIP Router. There is a difference
between:
1
SIP users: Users who are connected to the LAN by means of a SIP telephone. For the user configuration, it does not
matter whether the LAN is connected directly to LANCOM, or whether it is connected via a VPN (over the Internet).
1
ISDN users: Users who are connected by ISDN. They use the SIP gateway to telephone using the VoIP function.
1
Analog users: Users who are connected via analog interfaces. They use the SIP gateway to telephone using the VoIP
function.
General settings for all SIP users
LANconfig: VoiP Call Manager / Users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
1
Force local authentication
The SIP proxy usually accepts a registration from all SIP users who register themselves with a valid domain. If local
authentication is forced, only those subscribers who are saved in one of the user tables with relevant access information
can register with the SIP proxy.
5
Automatic registration without entering a password is restricted to the SIP users in the LAN. SIP users from
the WAN as well as ISDN and analog users must always be authenticated by a user entry with password.
1610
Reference Manual
16 Voice over IP (VoIP)
SIP users
Depending on the model, different numbers of SIP users can be created. You cannot create more than the maximum
number of users permitted; similarly, duplicate names or called numbers are not permitted.
5
The domain that is used by the SIP subscriber is usually configured in the terminal equipment itself.
LANconfig: VoiP Call Manager / Users / SIP users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / SIP users
The following parameters can be used to define a SIP user:
1
Number/Name
Telephone number of the SIP telephone or name of the user (SIP URI).
1
Auth-Name
Name for authentication at the SIP proxy, and also to any upstream SIP PBX when the user's domain is the same as
the domain of a SIP PBX line. This name is required if registration is mandatory (e.g. when logging in to an upstream
SIP PBX or when "Force local authentication" is set for local users).
1
Secret
Password for authentication to the SIP proxy, and also to any upstream SIP PBX, when the user's domain is the same
as the domain of a SIP PBX line. It is possible for users to log in to the local SIP proxy without authentication ("Force
local authentication" is deactivated for SIP users) and where applicable to an upstream SIP PBX using a shared
password ("Standard password" on the SIP PBX line).
1
Device type
Type of device connected.
1
CLIR
Switches the transmission of the calling-line identifier on/off.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry
1611
Reference Manual
16 Voice over IP (VoIP)
General settings for all ISDN users
LANconfig: VoiP Call Manager / Users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
1
Generate dial tone
The dial tone determines the noise an ISDN user hears after lifting up the receiver. The "internal dial tone" is the
same as the tone that a user hears at a PBX without spontaneous outside-line access (three short tones followed by
a pause). The "external dial tone" is thus the same as the tone that indicates an external line when the receiver is
lifted (constant tone without any interruptions). If necessary, adapt the dial tone for the users with spontaneous
outside-line access to simulate the behavior of a standard outside line.
ISDN interfaces
For users who are connected by an ISDN line, the interface that is used is configured globally. An ISDN T interface
(external) or even an ISDN TE interface (internal) can be configured. The latter is the case if users of an upstream PBX
are to be managed as local users.
LANconfig: VoiP Call Manager / Users / ISDN interfaces
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / Interfaces
1
ISDN interface
1612
Reference Manual
16 Voice over IP (VoIP)
Interface to which the ISDN subscribers are connected.
1
Entry active
Interface is active / not active.
1
Comment
Comment on the ISDN interface
ISDN users
LANconfig: VoiP Call Manager / Users / ISDN users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / ISDN users
1
Number/Name
Internal number of the ISDN telephone or name of the user (SIP URI).
5
By using the # character as a placeholder, entire groups of numbers (e.g. when using extension numbers at
a point-to-point connection) can be addressed via a single entry. With the number '#' and the DDI '#', for
example, extension numbers can be converted into internal telephone numbers without making any changes.
With the call number '3#' and the DDI '#', for example, an incoming call for extension '55' is forwarded to
the internal number '355', and for outgoing calls from the internal number '377', the extension number '77'
will be used.
5
User entries that use # characters to map user groups cannot be used for registration at an upstream PBX.
This registration always demands a specific entry for the individual ISDN user.
1
Ifc
ISDN interface that should be used to establish the connection.
1
MSN/DDI
Internal MSN that is used for this user on the internal ISDN bus.
2
MSN: Number of the telephone connection if it is a point-to-multipoint connection.
2
DDI (Direct Dialing in): Telephone extension number if the connection is configured as a point-to-point line.
1613
Reference Manual
16 Voice over IP (VoIP)
5
By using the # character as a placeholder, entire groups of call numbers, e.g. when using extension numbers,
can be addressed via a single entry.
5
User entries that use # characters to map user groups cannot be used for registration at an upstream PBX.
This registration always demands a specific entry for the individual ISDN user.
1
Auth-Name
Name for authentication at any upstream SIP PBX when the user's domain is the same as the domain of a SIP PBX
line.
1
Display name
Name for display on the telephone being called.
1
Secret
Password for authentication as a SIP user at any upstream SIP PBX when the user's domain is the same as the domain
of a SIP PBX line. It is possible for ISDN users to log in to an upstream SIP PBX using a shared password ("Standard
password" on the SIP PBX line).
1
Domain
Domain of an upstream SIP PBX when the ISDN user is to be logged in as a SIP user. The domain must be configured
for a SIP PBX line in order for upstream login to be performed.
1
Device type
Type of device connected.
1
DialCompl
En-block dial detection.
1
CLIR
Switches the transmission of the calling-line identifier on/off.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry.
1614
Reference Manual
16 Voice over IP (VoIP)
General settings for all analog users
LANconfig: VoiP Call Manager / Users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
1
Generate dial tone
The dial tone determines the noise an analog user hears after lifting up the receiver. The "internal dial tone" is the
same as the tone that a user hears at a PBX without spontaneous outside-line access (three short tones followed by
a pause). The "external dial tone" is thus the same as the tone that indicates an external line when the receiver is
lifted (constant tone without any interruptions). If necessary, adapt the dial tone for the users with spontaneous
outside-line access to simulate the behavior of a standard outside line.
Analog interfaces
The internal analog interfaces (a/b ports) require configuration if they are to be used by local users (connection of terminal
equipment).
LANconfig: VoiP Call Manager / Users / Analog interfaces
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / Interfaces
1
Interface
An internal interface to which the analog subscribers are connected.
1615
Reference Manual
16 Voice over IP (VoIP)
1
Entry active
Interface is active / not active.
1
Comment
Comment about analog interface
Analog users
LANconfig: VoiP Call Manager / Users / Analog users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / Analog users
1
Number/Name
Internal number of the analog telephone or name of the user (SIP URI).
1
Auth-Name
Name for authentication at any upstream SIP PBX when the user's domain is the same as the domain of a SIP PBX
line.
1
Display name
Name for display on the telephone being called.
1
Secret
Password for authentication as a SIP user to any upstream SIP PBX when the analog user's domain is the same as
the domain of a SIP PBX line. It is possible for ISDN users to log in to an upstream SIP PBX using a shared password
("Standard password" on the SIP PBX line).
1
Ifc
Analog interface that should be used to establish the connection.
1
CLIR
Switches the transmission of the calling-line identifier on/off.
1
Metering pulse
The metering pulse is used in analog telephone networks to inform callers of the costs of their calls. With appropriate
terminal equipment (e.g. telephone with charge display), the metering pulse is filtered out from the overall signal
and this information is converted to display the call charge.
1616
Reference Manual
16 Voice over IP (VoIP)
5
This option allows the metering pulse to be passed on to the analog user/equipment. It is possible for charge
information from the ISDN telephone network to be transferred to an ISDN line and converted into an analog
metering pulse.
1
Domain
Domain of an upstream SIP PBX when the analog user is to be logged in as a SIP user. The domain must be configured
for a SIP PBX line in order for upstream login to be performed.
1
Device type
Type of device connected.
5
The type determines whether an analog connection should be converted into SIP T.38, where applicable.
Selecting "Fax" or "Telephone/Fax" activates fax signal recognition that could result in an impairment of the
connection quality for telephones. Therefore please select the corresponding type of device connected in
order to ensure optimum quality.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry
General settings for all SIP, ISDN and analog users
LANconfig: VoiP Call Manager / Users
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
1
Dial end detection after
1617
Reference Manual
16 Voice over IP (VoIP)
When dialing from an ISDN telephone, this time period is waited until the called number is considered as complete
and sent to the call router.
Special values: With a dial delay of '0', a '#' has to be entered at the end of the called number. Entering the '#'
character after the called number manually reduces the dial delay.
User settings
The following parameters are available for configuring user settings in the LANCOM:
LANconfig: VoiP Call Manager / Users / User settings
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Users / Extensions
1
Entry active
Activates or deactivates the entry.
1
Internal telephone number
The call forwarding applies to this telephone number or SIP-ID.
5
Call forwarding can be set up for all local users (SIP, ISDN or analog).
1
Enabling user control via keypad or DTMF
This activates or deactivates the option for users to configure their settings via the telephone.
1
Busy on busy
Prevents a second call from being connected to a terminal device, irrespective of whether CW (call-waiting indication)
is active on the device or not; i.e. there is no "call waiting" signal. The second caller hears an engaged tone. This
also applies where an internal telephone number supports multiple logins and just one of the possible terminal
devices is already in use.
1
Call-forwarding unconditional (CFU)
Activates or deactivates the immediate forwarding of calls (CFU).
1
to number
Target for immediate unconditional call forwarding
1
Call-forwarding on busy (CFB)
Activates or deactivates call forwarding on busy.
1618
Reference Manual
16 Voice over IP (VoIP)
1
to number
Target for call forwarding on busy.
1
Call forwarding, no reply (CFNR)
Activates or deactivates the delayed forwarding of call (after waiting for no reply).
1
to number
Target for call forwarding no reply.
1
Delay
Wait time for call forwarding on no reply. After this time period the call is forwarded to the target number if the
subscriber does not pick up the phone.
16.4.3 Line configuration
SIP provider line
The device uses these lines to register with other SIP remote stations (usually SIP providers or remote gateways at SIP
PBXs). The connection is made either over the Internet or a VPN tunnel.
LANconfig: VoIP Call Manager / Lines / SIP lines
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / SIP provider
1
Name
Name of the line; may not be identical to another line that is configured in the device.
1
Mode
This selection determines the operating mode of the SIP line.
Possible values:
2
Single account mode: Externally, the line behaves like a typical SIP account with a single public number. The
number is registered with the service provider, the registration is refreshed at regular intervals (when
(re-)registration has been activated for this SIP provider line). For outgoing calls, the calling-line number is replaced
(masked) by the registered number. Incoming calls are sent to the configured internal target number. The maximum
1619
Reference Manual
16 Voice over IP (VoIP)
number of simultaneous connections is either set by the provider or it depends on the available bandwidth and
the codecs being used.
Table for number translation:
SIP number sent from the lineSIP number incoming to the lineSingle account
The number registered at the provider (User ID)“From:”Outgoing call
User ID“To:”Incoming call
2
Trunk mode: Externally, the line acts like an extended SIP account with a main external telephone number and
multiple extension numbers. The SIP ID is registered as the main external number with the service provider and
the registration is refreshed at regular intervals (when (re-)registration has been activated for this SIP provider
line). For outgoing calls, the switchboard number acts as a prefix placed in front of each calling number (sender;
SIP: “From:”) . For incoming calls, the prefix is removed from the target number (SIP: “To:”). The remaining digits
are used as the internal extension number. In case of error (prefix not found, target equals prefix) the call is
forwarded to the internal target number as configured. The maximum number of connections at any one time is
limited only by the available bandwidth.
Table for number translation:
SIP number sent from the lineSIP number incoming to the lineTrunk
Switchboard number (User-ID) + “From:”“From:”Outgoing call
“To:” As internal extensionSwitchboard number (User-ID) + “To:”Incoming call
2
Gateway mode: Externally the line behaves like a typical SIP account with a single public number, the SIP ID. The
number (SIP ID) is registered with the service provider and the registration is refreshed at regular intervals (when
(re-)registration has been activated for this SIP provider line). For outgoing calls, the calling-line number (sender)
is replaced (masked) by the registered number (SIP ID in SIP: “From:”) and transmitted in a separate field (SIP:
“Contact:”) . For incoming calls the dialed number (target) is not modified. The maximum number of connections
at any one time is limited only by the available bandwidth.
Table for number translation:
SIP number sent from the lineSIP number incoming to the lineGateway
The number registered at the provider (User ID)“From:”Outgoing call
“Contact:”“From:”
“To:”“To:”Incoming call
2
Link mode: Externally, the line behaves like a typical SIP account with a single public number (SIP ID). The number
is registered with the service provider, the registration is refreshed at regular intervals (when (re-)registration has
been activated for this SIP provider line). For outgoing calls, the calling-line number (sender; SIP: "From:") is not
“From:”) is not modified. For incoming calls, the dialed number (target; SIP: “To:”) is not modified. The maximum
number of connections at any one time is limited only by the available bandwidth.
Table for number translation:
SIP number sent from the lineSIP number incoming to the lineLink
“From:”“From:”Outgoing call
“To:”“To:”Incoming call
1
Domain
SIP domain/realm of the upstream device. Provided the remote device supports DNS service records for SIP, this
setting is sufficient to determine the proxy, outbound proxy, port and registrar automatically. This is generally the
case for typical SIP provider services.
1620
Reference Manual
16 Voice over IP (VoIP)
1
Rtg tag
Routing tag for selecting a certain route in the routing table for connections to this SIP provider.
1
Port
TCP/UDP port that the SIP provider uses as the target port for SIP packets.
5
This port has to be activated in the firewall for the connection to work.
1
User ID
Telephone number of the SIP account or name of the user (SIP URI).
5
For a SIP trunking account, the switchboard number is entered here. For incoming calls, any numerals after
the switchboard number are interpreted as extension numbers (DDI) and these are passed to the call router.
For outgoing calls, DDI numbers received from the call router are combined with the switchboard number.
This access data is used to register the line (single account, trunk, link, gateway), but not the individual local
users with their individual registration details. If individual users (SIP, ISDN, analog) are to register with an
upstream device using the data stored there or on the terminal device, then the line type "SIP PBX line"
should be selected.
1
Auth-Name
Name for authentication to the upstream SIP device (provider/SIP PBX).
5
This access data is used to register the line (single account, trunk, link, gateway), but not the individual local
users with their individual registration details. If individual users (SIP, ISDN, analog) are to register with an
upstream device using the data stored there or on the terminal device, then the line type "SIP PBX line"
should be selected.
1
Display name
Name for display on the telephone being called.
5
Normally this value should not be set as incoming calls have a display name set by the SIP provider, and
outgoing calls are set with the local client or call source (which may be overwritten by the user settings for
display name, if applicable). This settings is often used to transmit additional information (such as the original
calling number when calls are forwarded) that may be useful for the person called. In the case of single-line
SIP accounts, some providers require an entry that is identical to the display name defined in the registration
details, or the SIP ID (e.g. T-Online). This access data is used to register the line (single account, trunk, link,
gateway), but not the individual local users with their individual registration details. If individual users (SIP,
ISDN, analog) are to register with an upstream device using the data stored there or on the terminal device,
then the line type "SIP PBX line" should be selected.
1
Secret
The password for authentication at the SIP registrar and SIP proxy at the provider. For lines without (re-)registration,
the password may be omitted under certain circumstances.
5
This access data is used to register the line (single account, trunk, link, gateway), but not the individual local
users with their individual registration details. If individual users (SIP, ISDN, analog) are to register with an
upstream device using the data stored there or on the terminal device, then the line type "SIP PBX line"
should be selected.
1
Registrar
The SIP registrar is the point at the SIP provider that accepts the login with the authentication data for this account.
5
This field can remain empty unless the SIP provider specifies otherwise. The registrar is then determined by
sending DNS SRV requests to the configured SIP domain/realm (this is often not the case for SIP services in
a corporate network/VPN, i.e. the value must be explicitly set).
1
Outb-proxy
1621
Reference Manual
16 Voice over IP (VoIP)
The SIP provider's outbound proxy accepts all SIP signaling originating from the LANCOM device for the duration of
the connection.
5
This field can remain empty unless the SIP provider specifies otherwise. The outbound proxy is then determined
by sending DNS SRV requests to the configured SIP domain/realm (this is often not the case for SIP services
in a corporate network/VPN, i.e. the value must be explicitly set).
1
Cln prefix
The call prefix is a number placed in front of the caller number (CLI; SIP "From:") for all incoming calls on this SIP
provider line in order to generate unique telephone numbers for return calls.
For example; a number can be added, which the call router analyzes (and subsequently removes) to select the line
to be used for the return call.
1
Number/Name
The effect of this field depends upon the mode set for the line:
2
If the line is set to "Single account" mode, all incoming calls on this line with this number as the target (SIP:
"To:") and transferred to the call router.
2
If the mode is set to "Trunk", the target number is determined by removing the trunk's switchboard number. If
an error occurs, the call will be supplemented with the number entered in this field (SIP: "To:") and transferred
to the call router.
2
If mode is set to "Gateway" or "Link" the value entered in this field has no effect.
1
Codecs
While the connection is being established, the terminal equipment negotiates the codecs that are to be used for
voice-data compression. Use the codec filter to restrict the codecs that are permitted and to permit only certain
codecs.
5
If no common the codecs can be agreed upon, no connection is made.
1
Codec order
This parameter influences the order in which the codecs are presented during connection establishment.
1
Refer
Call switching (connect call) between two remote subscribers can be handled by the device itself (media proxy) or it
can be passed on to the exchange at the provider if both subscribers can be reached on this SIP provider line (otherwise
the media proxy in the LANCOM device assumes responsibility for switching the media streams, for example when
connecting between two SIP providers).
5
An overview of the main SIP providers supporting this function is available in the Support area of our Internet
site.
1
Local port number
This is the port used by the LANCOM proxy to communicate with the provider.
5
If line (re-)registration is deactivated, the local port has to be defined with a fixed value, and this also has
to be entered at the provider end as the destination port (e.g. when using an unregistered trunk in the
company VPN). This ensures that both ends can send SIP signaling.
1
(Re-) registration
This activates the (repeated) registration of the SIP provider line. Registration can also be used for line monitoring.
5
To use (re-) registration, the line monitoring method must correspondingly be set to "Register" or "Automatic".
Registration is repeated after the monitoring interval has expired. If the provider's SIP registrar suggests a
different interval, the suggested value is used automatically.
1
Line monitoring
1622
Reference Manual
16 Voice over IP (VoIP)
Specifies the line monitoring method. Line monitoring checks if a SIP provider line is available. The Call Router can
make use of the monitoring status to initiate a change to a backup line. The monitoring method sets the way in
which the status is checked.
Possible values:
2
Auto: The method is set automatically.
2
Disabled: No monitoring; the line is always reported as being available. This setting does not allow the actual
line availability to be monitored.
2
Register: Monitoring by means of register requests during the registration process. This setting also requires
"(Re-)registration" to be activated for this line.
2
Options: Monitoring via Options Requests. This involves regular polling of the remote station. Depending on the
response the line is considered to be available or unavailable. This setting is well suited for e. g. lines without
registration.
1
Monitoring interval
The monitoring interval in seconds. This value affects the line monitoring with register request and also the option
request. The monitoring interval must be set to at least 60 seconds. This defines the time period that passes before
the monitoring method is used again. If (re-) registration is activated, the monitoring interval is also used as the time
interval before the next registration.
5
If the remote station responds to an option request with a different suggested value for the monitoring
interval, this is accepted and subsequently applied.
1
Trusted
Specifies the remote station on this line (provider) as "Trusted Area". In this trusted area, the caller ID is not concealed
from the caller, even if this is requested by the settings on the line (CLIR) or in the device. In the event of a connection
over a trusted line, the Caller ID is first transmitted in accordance with the selected privacy policy and is only removed
in the final exchange before the remote subscriber. This means, for example, that Caller ID can be used for billing
purposes within the trusted area. This function is interesting for providers using a VoIP router to extend their own
managed networks all the way to the connection for the VoIP equipment.
5
Please note that not all providers support this function.
1
Privacy method
Specifies the method used for transmitting the caller ID in the separate SIP-header field.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry.
SIP mapping
The entries made under SIP mapping establish a series of rules for number translation to SIP lines in the trunk or gateway
mode.
1
A SIP line in trunk mode is used for mediating between internal numbers and the range of telephone numbers offered
by a SIP account.
2
For incoming calls, the destination number (called party ID) is modified. The internal number is used if the called
party ID matches with the external telephone number.
2
For outgoing calls, the calling party ID is modified. The external number is used if the calling party ID matches
with the internal telephone number.
1623
Reference Manual
16 Voice over IP (VoIP)
5
For SIP mapping on trunk lines, only the extension (DDI) is mapped. The extension is interpreted as those
numerals which follow the switchboard number (SIP ID or SIP line).
ISDN
SIP ACCOUNT
with Trunking
Voip Router
SIP-Telephone
ISDN Phone
ISDN
LAN
Called Party ID
Calling Party ID
SIP mapping
1
For a SIP line in gateway mode, the telephone number plan of the upstream SIP PBX is adapted to the internal
numbers in the call router.
2
For incoming calls (from the SIP line), the calling party ID is modified. The internal number is used if the calling
party ID matches with the external telephone number.
2
For outgoing calls (to the upstream PBX), the destination number (called party ID) is modified. The external
number is used if the called party ID matches with the internal telephone number.
5
For SIP mapping to gateway lines, the full telephone number is mapped. Depending on the configuration,
the call number arriving at the ISDN interface can be subjected to further mapping (ISDN mapping).
ISDN
LAN
VOIP Router
ISDN Phone
ISDN
SIP-Telephone
SIP mapping
Calling Party ID
Called Party ID
SIP PBX
LANconfig: VoIP Call Manager / Lines / SIP mapping
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / SIP provider / Mapping
1
Trunk/gateway name
Name of the line which is the target of the call number mapping.
1
Comment
Comment about this rule.
1
External number / name
Call number within the range of those used by the SIP trunk account or upstream SIP PBX.
1624
Reference Manual
16 Voice over IP (VoIP)
1
Length of called number
This value defines the number of numerals required for a called number to be regarded as complete. It only applies
to SIP gateway lines with entries that end in a # symbol.
For an outgoing call, the external called number generated from this entry is automatically regarded as complete
according to the defined number of numerals, and then forwarded. This process speeds up the dialing process.
Alternatively, the called number is regarded as complete when:
2
The user concludes the dialed number with a # symbol, or
2
a precisely matching entry was found in the SIP mapping table without a # symbol, or
2
the wait time expires.
5
Setting the length of called number to '0' deactivates premature dialing from the length of called number.
1
Internal destination number
Called number inside the range of the LANCOM VoIP Router.
5
Using the # symbol as a placeholder allows blocks of numbers to be captured by one rule.
SIP PBX line
These lines are used to configure connections to upstream SIP PBXs, which are usually connected via VPN.
LANconfig: VoIP Call Manager / Lines / SIP PBX lines
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / SIP PBX
1
Name
Name of the line; may not be identical to another line that is configured in the device.
1
Domain
SIP domain/realm of the upstream SIP PBX.
1
Rtg tag
Routing tag for selecting a certain route in the routing table for connections to this SIP PBX.
1
Port
TCP/UDP port of the upstream SIP PBX to which the LANCOM device sends the SIP packets.
1625
Reference Manual
16 Voice over IP (VoIP)
5
This port has to be activated in the firewall for the connection to work.
1
Secret
Shared password for registering with the SIP PBX. This password is only required (a) when SIP subscribers have to
log in to the PBX who have not been set up as SIP users with their own access data in the SIP user list or (b) when
local SIP authentication is not forced. This means that SIP users can register with the LANCOM device without a
password and can log in to the upstream SIP PBX with a shared password if the SIP user's domain is the same as
the domain of a SIP PBX line.
1
Registrar
The SIP registrar is the point that accepts the login with the configured authentication data for this account in the
SIP PBX.
1
Cln prefix
The call prefix is a number placed in front of the caller number (CLI; SIP "From:") for all incoming calls on this SIP
PBX line in order to generate unique telephone numbers for return calls.
For example; a number can be added, which the call router analyzes (and subsequently removes) to select the line
to be used for the return call.
1
Line prefix
With outgoing calls using this line, this prefix is placed in front of the calling number to create a complete telephone
number that is valid for this line. With incoming calls this prefix is removed, if present.
1
Codecs
While the connection is being established, the terminal equipment concerned negotiate which codecs are to be used
to compress the voice data. Use the codec filter to restrict the codecs that are permitted and to permit only certain
codecs.
5
If no common the codecs can be agreed upon, no connection is made.
1
Codec order
This parameter influences the order in which the codecs are presented during connection establishment.
1
Local port number
This is the port used by the LANCOM proxy to communicate with the upstream SIP PBX.
5
If line (re-)registration is deactivated, the local port has to be defined with a fixed value, and this also has
to be entered into the SIP PBX to ensure that both ends can send SIP signaling.
1
(Re-) registration
This activates the (repeated) registration of the SIP PBX line. Registration can also be used for line monitoring.
5
To use (re-) registration, the line monitoring method must correspondingly be set to "Register" or "Automatic".
Registration is repeated after the monitoring interval has expired. If the SIP registrar in the SIP PBX suggests
a different interval, the suggested value is used automatically.
1
Line monitoring
Specifies the line monitoring method. Line monitoring checks if a SIP PBX line is available. The Call Router can make
use of the monitoring status to initiate a change to a backup line. The monitoring method sets the way in which the
status is checked.
1
Monitoring interval
The monitoring interval in seconds. This value affects the line monitoring with register request and also the option
request. The monitoring interval must be set to at least 60 seconds. This defines the time period that passes before
1626
Reference Manual
16 Voice over IP (VoIP)
the monitoring method is used again. If (re-) registration is activated, the monitoring interval is also used as the time
interval before the next registration.
5
If the remote station responds to an option request with a different suggested value for the monitoring
interval, this is accepted and subsequently applied.
1
Trusted
Specifies the remote station on this line (provider) as "Trusted Area". In this trusted area, the caller ID is not concealed
from the caller, even if this is requested by the settings on the line (CLIR) or in the device. In the event of a connection
over a trusted line, the Caller ID is first transmitted in accordance with the selected privacy policy and is only removed
in the final exchange before the remote subscriber. This means, for example, that Caller ID can be used for billing
purposes within the trusted area. This function is interesting for providers using a VoIP router to extend their own
managed networks all the way to the connection for the VoIP equipment.
5
Please note that not all providers support this function.
1
Privacy method
Specifies the method used for transmitting the caller information in the separate SIP field.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry.
ISDN lines
LANconfig: VoIP Call Manager / Lines / ISDN lines
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / ISDN
1
Switching name/CO
Name of the line; may not be identical to another line that is configured in the device.
1
ISDN/S0 bus, Ifc
ISDN interface(s) with which the LANCOM Wireless Router is connected to the ISDN network. The line entered here
are usually configured as ISDN-TE.
1
Domain name, Domain
Domain in which the calls from/to the ISDN line are managed in LANCOM's SIP world.
1
Call prefix, Cln-Prefix
With incoming calls using this line, this prefix is placed in front of the calling number so that the correct line is
automatically selected for a return call.
1
Entry active, Active
Line is active / not active.
1
Comment
1627
Reference Manual
16 Voice over IP (VoIP)
Comment on the line
ISDN mapping
ISDN mapping assigns external ISDN telephone numbers (MSN or DDI) to the telephone numbers that are used internally.
LANconfig: VoIP Call Manager / Lines / ISDN mapping
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / ISDN / Mapping
1
MSN/DDI
External telephone number of the connection in the ISDN network.
For incoming calls that are directed to this number, the corresponding internal telephone number is entered as the
destination number. For outgoing calls, this number is transmitted as the caller's number, unless this has been
suppressed.
2
MSN: Number of the telephone connection
2
DDI (Direct Dialing in): Telephone extension number if the connection is configured as a point-to-point line.
5
By using the # character as a placeholder, entire groups of call numbers, e.g. when using extension numbers,
can be addressed via a single entry.
1
ISDN/S0 bus, Ifc
ISDN interface(s) used for connecting terminal devices to the LANCOM Wireless Router. These line have to be
configured as ISDN-NT.
1
Telephone number/SIP name, Number/Name
Internal telephone number of the ISDN telephone or name of the user (SIP URL).
For incoming calls, this is the SIP name or internal telephone number of the telephone to which the call from this
interface is switched with the corresponding MSN/DDI. For outgoing calls, the SIP name is replaced by the MSN/DDI
of the corresponding entry.
5
By using the # character as a placeholder, entire groups of call numbers, e.g. when using extension numbers,
can be addressed via a single entry.
1
Hide your telephone number from the person called, CLIR
The display of your telephone number is suppressed so the person called cannot see it.
1
Entry active, Active
External telephone number is active / not active.
1
Comment
Comment on the external telephone number.
1628
Reference Manual
16 Voice over IP (VoIP)
Analog line
LANconfig: VoIP Call Manager / Lines / Analog lines
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Lines / Analog
1
Name
Name of the line; may not be identical to another line that is configured in the device.
1
Domain
The analog line's domain name used for addressing in SIP.
1
Cln prefix
The call prefix is a number placed in front of the caller number (CLI; SIP "From:") for all incoming calls on this analog
line in order to generate unique telephone numbers for return calls.
For example; a number can be added, which the call router analyzes (and subsequently removes) to select the line
to be used for the return call.
1
Number/Name
Internal number/SIP URI that each call on this analog line is given as call destination. This number can differ from
the telco's actual call number for the analog connection (mapping).
5
Here you can, for example, enter the telephone number for a group that is to receive incoming calls. This
allows you to flexibly control which telephones ring for incoming calls, or to transfer calls to a mobile phone
number or answering machine after a certain time.
1
Active
Activates or deactivates the entry.
1
Comment
Comment on this entry.
1
Caller-ID signaling
Providers of analog telephone connections support various services including Caller ID transmission, i.e. the caller's
number is shown in the display of the telephone being called. This service is also known as Calling Line Identification
Presentation (CLIP). Depending on the country and provider, two different methods of modulation are used to transfer
the caller ID over the analog line (FSK or DTMF).
1
Caller-ID transmission requirements
Apart from selecting the modulation method, different countries and providers also have different time delays in the
signaling of the Caller ID over analog lines The telephone being called expects the Caller ID at a certain time, and
so providers should set up their systems accordingly.
Possible values:
2
Default: This setting causes the standard value for the country where the device is operated to be taken.
2
During ringing: The Caller ID is transmitted while the phone is ringing, between the first and second ring.
1629
Reference Manual
16 Voice over IP (VoIP)
2
RP AS: Transmission of the Caller ID is not connected with the ringing but is transferred via a special "alarm
signal". This alarm signal is a ringing impulse (Ringing Pulse Alerting Signal, RP-AS). The Caller ID can be transferred
after the ringing impulse.
2
Line reversal: Transmission of the Caller ID is not connected with the ringing but is transferred via a special "alarm
signal". The alarm signal is sent by a brief reversal of polarity in the line (line reversal). The Caller ID can be
transferred after the line reversal.
16.5 Call Manager Configuration
The Call Manager manages and connects the various subscribers and lines described above with one other. The Call
Manager's main task is to determine the correct target subscriber for each call and to select a suitable line for this
subscriber. To be able to meet this task, the Call Manager mainly uses two table areas:
1
The call routing table
1
The tables of local subscribers
As the Call Manager usually switches between internal and external telephone networks with different number ranges,
the Call Manager often has to change the numbers that are called, and this is known as number translation.
5
In the world of VoIP telephony, both numbers and names (such as "anyone@company.com") can be used.
Although the following description refers to telephone numbers, this also includes telephone names unless
specified otherwise.
The procedure known from internal extension lines is used, whereby connections to external subscribers start with a
preceding "0". The Call Manager processes calls to and from all registered subscribers and lines.
16.5.1 Process of call routing
The calls are switched in the following steps:
1
Processing the calling number (Calling Party ID)
First of all there is a check to see whether a numeric or alphanumeric number is available. Typical dialing separators
such as "()-/" and <blank> are removed. A leading "+" is left in place. In this case, the number is still treated as a
numeric number. If the check reveals any other alphanumerical character, the number is treated as alphanumeric
and remains unchanged.
1
Resolving the call in the call routing table
After processing the Called Party ID, the call is passed over to the call-routing table. The entries in the call routing
table consist of records of conditions and instructions. The entries are searched through and the first one that satisfies
all of the conditions is executed.
1
Resolution of the call with tables of local subscribers
If no entry is found in the call-routing table, then the Call Manager searches through the list of local subscribers. If
an entry is found here matching the number that is called, and that also has the appropriate destination domain,
then the call is delivered to the corresponding subscriber.
If no local subscriber is found for whom the number and destination domain match, another pass is made where it
suffices for the telephone number of the local subscriber to match the called number; the destination domain is not
considered.
1
Resolution of the call with default entries in the call-routing table
If the previous passes through the call routing table and the lists with the local subscribers were unsuccessful, the
call is checked again in the call routing table. This pass only takes the default routes into account, however. It does
not include the numbers and destination domains that were entered in the default routes. Only the source filters are
processed, assuming that the default routes has these filters.
1630
Reference Manual
16 Voice over IP (VoIP)
5
The procedure described here only considers the call numbers as processed by the Call Router. Mapping to
the ISDN or SIP line can also alter the number.
16.5.2 Handling the calling party ID
The configuration options for the call router offer numerous options for manipulating the telephone numbers that are
used to establish the connection. The call router usually connects different "telephone worlds" (internal and external,
SIP and ISDN) that use completely different telephone number ranges. So that the subscribers can communicate successfully
with each other, the telephone numbers at the interfaces have to be configured in such a way that, on the one hand,
the required subscriber is reached via the correct line and, on the other hand, a return call (automatically upon "engaged",
where applicable) can be placed successfully. To enable this return call, the calling number (calling party ID) has to be
after the processing by the Call Manager, directly before it is delivered to the relevant subscriber.
Handling outgoing calls
The telephone numbers of outgoing calls are converted depending on the line that is used:
1
SIP lines
The treatment of the calling-party ID on SIP lines depends upon the line's operating mode:
2
Single account: In the case of an outgoing call over a SIP line, the calling party ID is converted to the number
that was entered for the SIP line (SIP ID).
2
Trunk and gateway: Please observe the information in section .
1
SIP PBX lines
In the case of an outgoing call over a SIP PBX line, the subscriber is registered at the upstream SIP PBX and is part
of the telephone number range there. This is why the calling party ID—which represents the internal telephone
number or "extension" of the subscriber in this case—is passed unchanged to the SIP PBX line.
1
ISDN lines
In the case of an outgoing call over an ISDN point-to-multipoint connection, the calling party ID is converted to the
MSN that is entered for the subscriber (or the internal telephone number) in the ISDN mapping table.
If this does not contain an entry for the number that is currently calling, no calling party ID is sent. Similarly, no
calling party ID is sent if CLIR (Calling Line Identifier Restriction) is activated.
Handling incoming calls
The telephone numbers of incoming calls are converted differently depending on the SIP or ISDN subscriber criteria and
whether automatic outside line access is active or not.
The calling party ID is changed depending on the following parameters:
1
The prefix ("call prefix" or "Cln-Prefix") that is stored for the line (default: <blank>).
1
The prefix for internal connections with destination ISDN users ("internal ISDN prefix" or "Intern-Cln-Prefix" - default:
'99').
1
The prefix for internal connections with destination SIP users ("internal SIP prefix" or "Intern-Cln-Prefix" - default:
'99').
1
The prefix for external connections with destination ISDN users ("external ISDN prefix" or "Extern-Cln-Prefix" - default:
<blank>).
1
The prefix for external connections with destination SIP users ("external SIP prefix" or "Extern-Cln-Prefix" - default:
<blank>).
The activation of automatic outside line access is taken into account by configuring the prefixes appropriately:
1
If automatic outside line access is activated, the internal prefixes are typically set to the dial character that is used
to reach the internal subscriber, usually '99' or '*'.
1
Without automatic outside line access, the external prefixes are typically set to '0'.
1631
Reference Manual
16 Voice over IP (VoIP)
The calling party ID is only extended if the incoming call has a calling party ID. If the calling party ID is blank, no prefix
is attached.
It is changed as follows:
1
With internal connections, the internal subscriber prefix (SIP or ISDN) is placed in front of the calling party ID.
1
With external connections, depending on the (line) call prefix, the following decision is made:
2
(Line) call prefix blank: The external subscriber prefix (SIP or ISDN) is placed in front of the calling party ID.
2
(Line) call prefix not blank: The internal subscriber prefix (SIP or ISDN) and the (line) call prefix is placed in front
the calling party ID.
5
A call is regarded as external if it comes from a "line". If this line is a SIP PBX line, then the call is only external
if the incoming calling party ID is preceded by a "0".
16.5.3 Call-routing table parameters
LANconfig: VoiP Call Manager / Call router
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Call router
An entry in the call routing table consists of:
1
Conditions that have to be met so that the entry is "considered" appropriate. This includes:
2
Information about which subscriber is to be called; called number/name (Called Party ID), called domain (if
appropriate).
2
Information about the calling subscriber; calling number/name, calling domain, source line through which the
call enters LANCOM VoIP Router.
1
Instructions regarding the procedure for the call:
2
How is the telephone number converted and changed for further processing?
2
Which line should used to place the call (destination line)?
1632
Reference Manual
16 Voice over IP (VoIP)
2
Which backup lines should be used if the destination line is not available?
The entries are searched row by row; the first suitable entry is performed. This is why the special entries should be
configured first of all, then the general entries.
If an entry is found in the call routing table with the destination line "RESTART", then the complete pass starts again
with the new, converted called party ID. The entry for the source line (calling line) is deleted for the next pass.
Both the call routing table and the local subscriber table can contain and process alphanumeric names where this makes
sense.
1
Active entry/default route, active
The routing entry can be activated, deactivated, or marked as a default entry. All calls that can be resolved using the
first passes but not using the call routing table or local subscriber table are then automatically resolved using these
default entries. You can use any destination name and destination domain; only the source filters that are set are
considered
1
Priority of the entry, Prio
The Call Manager sorts all entries with the same priority automatically, so that the table can be processed through
logically from top to bottom. With some entries, however, the sequence of the entries has to be specified (for the
telephone number translation, for example). The entries with the highest priority are automatically sorted to the top.
1
Called number/name, Called ID
The called party name or destination telephone number (without domain information) that is called.
The # character is used as a placeholder for any character strings. All characters in front of the # are removed, the
remaining characters are used in the "Number/name" field instead of the # character to further establish the connection.
Example: The call routing table contains entry '00049#' as the called number/name and '00#' as the number/name.
For all calls with a preceding '0' for outside-line access and the complete dialing code for Germany, only the leading
'0' for the outside-line access and the leading '0' for the local area dialing code are retained as the number/name;
the country ID is removed. So '00049 2405 123456' becomes '0 02405 123456'.
Independently of this, an alphanumeric number can also be specified.
1
Number/name, Dest-ID
This telephone number is used to continue with establishing the connection. If no connection can be established
using this telephone number and the corresponding line, then the backup telephone numbers with their associated
lines are used
At least one of "Number/name", "1st backup no." or "2nd backup no." has to be filled in. They are evaluated in this
sequence. A blank field is skipped.
1
Line, Dest-Line
The connection is established using the destination line. Normal destination lines can be:
2
ISDN
2
All defined SIP lines.
The following special functions can be entered as a destination line:
2
REJECT highlights a blocked telephone number.
2
USER forwards the call to local SIP or ISDN subscribers.
2
RESTART starts a new pass through the call routing table with the previously formed "number/name". The former
"source line" is deleted.
5
This field has to be completed, otherwise the entry is not used.
1
2. Number, Dest-ID-2
1633
Reference Manual
16 Voice over IP (VoIP)
This telephone number is used to establish the connection further if nothing is entered in "number/name" or the
corresponding "line" is not available. If no connection can be established using this telephone number and the
corresponding line, then the third telephone number and the third line is used.
1
2. Line, Dest-Line-2
The connection is established using this line if the second number is used to establish the connection. The same lines
can be dialed as for "line".
1
3. Number, Dest-ID-3
Similar to the second number.
1
3. Line, Dest-Line-3
Similar to the second line.
1
Called domain, Cld Domain
This entry filters the called domain, the "Called Party Domain". The call router entry is only considered to match if
the Called Party Domain for the call matches the domain that is entered here. If nothing is specified, any destination
domain is accepted.
The following can be entered as called domains:
2
ISDN
2
The internal VoIP domain of LANCOM Wireless Router.
2
All domains entered for the SIP and SIP-PBX lines.
1
Calling number/name, Calling ID
This entry filters the calling number/name, the "calling party ID". It is specified as an internal number or as a national
or international telephone number. The domain is not specified. No "0" or other character for a line ID is prefixed;
the ID is used as if it comes from the line or from internal telephone calls.
The call router entry is only evaluated as matching if the Calling Party ID for the call matches the number that is
entered here. After "#", any characters can be accepted. If nothing is specified here, any Calling Party ID is accepted.
The following special functions can be entered as a calling number:
2
LOCAL restricts to internal telephone numbers (without a leading "0").
2
EMPTY can be used for Calling Party IDs that are not specified.
1
Calling domain, Cln Domain
This entry filters the calling domain. The call router entry is only considered to match if the Calling Domain for the
call matches the domain that is entered here. If nothing is specified, each calling domain is accepted.
The following can be entered as calling domains:
2
ISDN
2
The internal VoIP domain of LANCOM Wireless Router.
2
All domains entered for the SIP and SIP-PBX lines.
SIP telephones usually have several line keys, for which different domains can be configured. With this filter, telephone
calls are handled depending on the selection that is made using different line keys.
1
Source line, Src-Line
This entry filters the source line. The call router entry is only considered to match if the source line for the call matches
the line that is entered here. If nothing is specified, any calling line is accepted.
The following can be entered as the source line:
2
USER.ISDN for calls from a local ISDN subscriber
2
USER.SIP for calls from a local SIP subscriber
2
USER# for calls from a local subscriber in general
1634
Reference Manual
16 Voice over IP (VoIP)
2
All ISDN, SIP and SIP-PBX lines that are entered.
1
Comment
Comment on the current routing entry
Hunt-group functions
The following parameters are available in the LANCOM for configuring hunt-group functions:
LANconfigVoIP Call Manager / Call router / Hunt groups
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / Groups
1
Entry active
Activates or deactivates the entry.
2
Default: Active
1
Internal telephone number
The hunt group is available under this telephone number or SIP-ID.
2
Possible values: Maximum 64 alphanumerical characters.
5
The names of hunt groups may not coincide with the names of users (SIP, ISDN, analog).
1
Comment
Comment on the defined entry (64 characters)
1
Members
Comma-separated list of the members of the hunt group. Members can be users, hunt groups or external telephone
numbers, and so there is no limit on scaling.
2
Possible members: Users, hunt groups, external telephone numbers
2
Possible values: Maximum 128 alphanumerical characters.
5
A hunt group may not contain itself or any parents in the hierarchical system—recursion through user entries
is not possible. However, loops to parents in the structure can be set up via the .
1
Forwarding method
Set the type of call distribution:
2
Simultaneous: The call is signaled to all group members at once. If a member picks up the call within the
call-forwarding time, the call is no longer signaled to other group members. If nobody accepts the call within
the forwarding time, then the call is switched to its forwarding target.
2
Sequential: The call is directed to one member of the group after the other. If a group member does not accept
the call within the forwarding time, then the call is switched to the next member of the group. If nobody in the
group accepts the call within the forwarding time, then the call is switched to its forwarding target.
1635
Reference Manual
16 Voice over IP (VoIP)
1
Forwarding time
If an incoming call is not picked up by a group member within the forwarding time, then the call is forwarded
according to the distribution method selected:
2
In case of simultaneous call distribution, the call is forwarded to the forwarding target.
2
In case of sequential call distribution, the call is forwarded to the next group member in line. If the group member
is the last one, then the call is redirected to its forwarding target.
2
Possible values: Max. 255 seconds.
2
Default: 0 seconds
2
Significant values: 0 seconds. The call is forwarded immediately to the forwarding target (temporarily jumps a
hunt group in a hierarchy).
5
If all members of the group are busy or unavailable, then the call is redirected to the forwarding target
without waiting for the forwarding-time to expire.
1
Forwarding target
If none of the group members accepts the call within the forwarding time, then the call is switched to the forwarding
target entered here. Forwarding targets can be users, hunt groups or external telephone numbers. Only one forwarding
target can be entered.
2
Possible targets: Users, hunt groups, external telephone numbers
2
Possible values: Maximum 64 alphanumerical characters.
5
If no forwarding target is defined, then the call is rejected as soon as the member list has been worked
through, or if all members are busy or unavailable.
The forwarding target only becomes active once the group's forwarding time has expired or if no members are
available. Here, too, redirection to a higher level of the hunt-group structure is possible, unlike with the entry.
1636
Reference Manual
16 Voice over IP (VoIP)
16.5.4 Codecs
LANconfig: VoiP Call Manager / Codecs
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General / ISDN gateway codecs
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General / Analog gateway codecs
1
ISDN gateway
During connection establishment, the ISDN terminal devices negotiate which codecs are to be used to compress the
voice data. Use the codec filter to restrict the codecs that are permitted and to permit only certain codecs.
1
Analog gateway
Use the codec filter to restrict the codecs that are permitted for analog terminal equipment and to permit only certain
codecs.
1
DTMF signaling
2
SIP info: Transmits the DTMF tones according to the SIP info standard
2
Events (RFC 2833): Transmits the events in cleartext according to the RFC 2833 standard
2
Tones (RFC 2833): Transmits the tones according to the RFC 2833 standard
2
Events&tones (RFC 2833): Transmits the events in cleartext and tones according to the RFC 2833 standard
5
The DTMF signaling settings must match the SIP provider requirements. Defective DTMF signaling settings
could make it impossible to establish a connection via the SIP provider.
1637
Reference Manual
16 Voice over IP (VoIP)
16.5.5 Extended settings
LANconfig: VoiP Call Manager / Extended
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General / ISDN gateway codecs
1
Echo canceling from SIP to ISDN
Activates the echo canceling of remote echoes. With an echo that is too strong, subscribers can hear their own voices
after a short delay. Activating this option reduces the ISDN echo at the SIP > ISDN gateway.
1
Prefix from internal to SIP user
This prefix is added to the calling party ID, if available, for an incoming, internal call if the call is directed to a SIP
user.
5
A call is regarded as external if it comes from a "line". If this line is a SIP PBX line, then the call is only external
if the incoming calling party ID is preceded by a "0". All other calls are regarded as internal.
For more information about handling the calling party ID, see .
1
Prefix from external to SIP user
This prefix is added to the calling party ID, if available, for an incoming, external call if the call is directed to a SIP
user.
1
Prefix from internal to ISDN user
This prefix is added to the calling party ID, if available, for an incoming, internal call if the call is directed to an ISDN
user. If a line prefix is defined, this is placed in front of the whole of the called number.
1
Prefix from external to ISDN user
This prefix is added to the calling party ID, if available, for an incoming, external call if the call is directed to an
ISDN user. If a line prefix is defined, this is placed in front of the whole of the called number.
1638
Reference Manual
16 Voice over IP (VoIP)
1
Prefix from internal to analog user
This prefix is added to the calling party ID, if available, for an incoming, internal call if the call is directed to a analog
user. If a line prefix is defined, this is placed in front of the whole of the called number.
1
Prefix from external to analog user
This prefix is added to the calling party ID, if available, for an incoming, external call if the call is directed to a analog
user. If a line prefix is defined, this is placed in front of the whole of the called number.
1
Prefer outgoing packets
Depending on the audio codec that is used for SIP calls, sufficient bandwidth through the firewall is reserved (provided
sufficient bandwidth is available). To control the firewall, you can configure how the remaining data packets that
do not belong to the SIP data stream are handled.
2
PMTU reduction
The subscribers of the data connection are informed that they should only send data packets up to a certain length
(Path Maximum Transmission Unit, PMTU).
2
Fragmentation
The LANCOM Wireless Router reduces the data packets by fragmenting them to the required length.
2
No change
The length of the data packets is not changed by the VoIP operation.
For more information, see the description of PMTU and fragmenting with regard to quality of service.
1
Prefer incoming packets
Similar to the outgoing data packets, you configure how non-VoIP data packets are handled when bandwidth is
reserved for SIP data.
2
PMTU reduction
The subscribers of the data connection are informed that they should only send data packets up to a certain length
(Path Maximum Transmission Unit, PMTU).
2
No change
The length of the data packets is not changed by the VoIP operation.
1
Reduced packet size
This parameter specifies the packet size that should be used for PMTU adjustment or fragmentation while the SIP
data have priority.
16.6 PBX functions for LANCOM VoIP Router
LANCOM VoIP Routers can provide small companies or subsidiaries with all of the functions of a classical private branch
exchange (PBX).
1
Telephony functions such as call hold, swap, connect or transfer
1
Hunt group function with flexible call distribution and cascading of hunt groups
1
Multiple logins to use various telephones under one telephone number
5
Please note that the extent to which features such as connect call and automatic call transfer (redirection) are
supported by SIP providers can differ enormously. It is impossible to guarantee that this function will work
properly with all combinations of SIP devices and SIP providers. We recommend that you use LANCOM VP-100
and LANCOM Advanced VoIP Client terminal equipment.
1639
Reference Manual
16 Voice over IP (VoIP)
16.6.1 Connect and forward call
The integration of SIP telephones and VoIP routers into existing telephone structures means that we have to take a fresh
look at familiar functions such as transferring calls. Call transfer means that a call that has already been placed (routed)
is redirected to a new destination either spontaneously by the user (connect call) or by automatic call forwarding set up
in advance. SIP-based VoIP telephony uses processes which are fundamentally different to technologies used until now.
For example, ISDN and analog terminal devices require a telephone exchange that usually has to continue to manage
the connection after transfer. SIP telephones can transfer calls without any need of a telephone exchange: The devices
make a connection over the shortest possible route and the call router stops its management function immediately after
the connection has been established. The SIP exchange is also able to handle signaling over SIP and the actual data
transfer over RTP in different ways.
Due to the differences arising from the various types of terminal device, the easiest way to understand call transfer in a
LANCOM VoIP Router is to consider different scenarios and to explain the terminology.
Active and passive transfer
When looking at the technical details, it is important to consider the end from which call transfer is initiated. "Local"
users are all SIP, ISDN or analog users who are accessible via the LANCOM VoIP Router in their own LAN. "External"
users are those accessible via a line (SIP account, SIP trunk, SIP PBX, ISDN or analog).
1
Active: A local subscriber initiates call transfer
1
Passive: An external subscriber initiates call transfer
Call transfer with and without consulting
A subscriber transferring a call can either directly hand over an active call to a third subscriber (unattended call transfer),
or a separate call can be made to a third subscriber to communicate the call and then transfer it (attended call transfer).
Charges for calls when transferring to external users
The transfer of a call from an external caller to a third party who is also external carries the risk that charges will arise
for the ongoing call, even though the initiating subscriber has ended the call.
The LANCOM VoIP Router's job during call transfer
Irrespective of the terminal devices involved in the call transfer, a LANCOM VoIP Router can take over a variety of tasks:
1
Passthrough: Both subscribers in the call transfer are on the same side of the connection, e.g. transfer from a local
to a local subscriber.
1
Delegate: The call transfer is not handled by the LANCOM VoIP Router itself but by an upstream exchange, e.g. in a
VoIP PBX that is accessible via a PBX line.
1
Switching: The LANCOM VoIP Router handles the signaling and the data transfer between subscribers.
Active forwarding to local users
1. An external user A makes a call to an internal user B (SIP, ISDN or analog).
2. B makes an additional call to a local user C. These two users can call each other directly, and so the LANCOM VoIP
Router only handles the signaling via SIP; the data transfer via RTP takes the shortest possible route.
3. The local user B then transfers the call (with consultation) to C.
1640
Reference Manual
16 Voice over IP (VoIP)
4. The LANCOM VoIP Router manages the call transfer.
A
B
C
SIP
ISDN
Analog
B
SIP
ISDN
Analog
SIP
ISDN
Analog
SIP
ISDN
Analog
Phone
Phone
Phone
Phone
C
A
D
VOIP Router
Local External
5
In case of SIP at the external subscriber, this requires that Transfer in SIP (re-invites) is fully supported.
Active transfer to external SIP users
1. An external SIP user A makes a call to an internal user B (SIP, ISDN or analog).
2. B makes an additional call to an external user D.
3. If the two external SIP users A and D can be accessed over the same SIP line, the LANCOM VoIP Router delegates
the management of the call transfer to the upstream provider.
A
B
C
SIP
ISDN
Analog
B
SIP
Phone
PhonePhone
Phone
C
A
D
VOIP Router
Local External
SIP
Identical SIP
PBX line
5
Requires that the VoIP PBX fully supports Transfers in SIP (re-invites).
Active transfer to external ISDN or analog users
In some cases upstream exchanges do not support the delegation of call-transfer functions to external ISDN or analog
users, often due to the unclear situation about who carries the call charges. For this reason, call transfer between external
subscribers is always handled by the LANCOM VoIP Router.
1. An external subscriber A (external SIP, ISDN or analog) calls an internal user B (SIP, ISDN or analog).
2. B makes a further call to an external subscriber D (ISDN or analog).
3. The local user B then transfers the call (with consultation) to A.
4. If the two external users A and D use different protocols (SIP, ISDN or analog) then the LANCOM VoIP Router handles
the management and conversion of the data.
1641
Reference Manual
16 Voice over IP (VoIP)
5. If both external users A and D use SIP the LANCOM VoIP Router cannot enable the call transfer.
A
B
C
SIP
ISDN
Analog
B
Phone
PhonePhone
Phone
C
A
D
VOIP Router
Local External
ISDN
Analog
ISDN
Analog
5
Requires that the VoIP PBX fully supports Transfers in SIP (re-invites).
Passive forwarding between local users
1. An internal user B (SIP, ISDN or analog) calls an external user A (at a SIP PBX line).
2. A makes an additional call to a local user C.
3. The external user A then transfers the call to C.
4. The LANCOM VoIP Router manages the call transfer. If the connected subscribers B and C are internal users, the
LANCOM VoIP Router controls the SIP data for signaling only and enables RTP-based data transfer over the shortest
possible route directly between the SIP users.
A
B
C
SIP
ISDN
Analog
B
Phone
PhonePhone
Phone
C
A
D
VOIP Router
Local External
SIP PBX
SIP
ISDN
Analog
5
Requires that the VoIP PBX fully supports Transfers in SIP (re-invites).
Passive transfer from local to external users
1. An external user A (at a SIP PBX line) makes a call to an internal user B (SIP, ISDN or analog).
2. A makes an additional call to an external user D (who is also a subscriber to the same SIP PBX line as A).
3. The external user A then transfers the call from B to D. To do this, the LANCOM VoIP Router has to open an external
connection to D.
1642
Reference Manual
16 Voice over IP (VoIP)
5
The LANCOM VoIP Router can only establish this connection if D can be accessed over the same SIP PBX line as
A, i.e. if external call forwarding is permitted.
A
B
C
SIP
ISDN
Analog
B
Phone
PhonePhone
Phone
C
A
D
VOIP Router
Local External
SIP PBX
SIP PBX
5
Requires that the VoIP PBX fully supports Transfers in SIP (re-invites).
16.6.2 Spontaneous call management by the user
Functions for spontaneous call management
Calls can be managed on an individual basis and the LANCOM VoIP Router supports the services known from the ISDN
network:
1
With call hold the user can place an active call into a wait state. In this state, the user can for example make a call
to another person.
1
Establishing an additional call while a call is on hold is referred to as consulting. This call can be ended again and
the conversation with the call on hold continued.
1
With transfer call, the user can switch to and fro between two connections. The user is only connected with one
caller at a time, while the other caller is put on hold.
1
With call swap the user switches an active call over to another call which is on hold. The two callers are then connected
and the user is no longer involved in the call. A subscriber transferring a call can either directly hand over an active
call to a third subscriber (unattended call transfer), or a separate call can be made to a third subscriber to communicate
the call and then transfer it (attended call transfer).
Using spontaneous call management with various telephones
SIP telephones and SIP softphones generally feature special keys or menu entries to manage calls. Depending on the
model or program, different terms may be used the the functions are as follows:
1
HOLD: Places an active call into a wait mode or swaps between two active calls. On ISDN and analog telephones
this function is often referred to as the F-key/Flash/Call hold. Flash function (F key).
1
HANG UP: End the current call.
1
SWAP: Swap between two active calls (depending on the ISDN telephone, this may be initiated by a display-menu
entry, a special key, or the "F" key).
1
CONNECT: Initiates the call's transfer (can be triggered by "hanging-up" with an active call and a call on hold)*.
These functions can be used to manage calls as follows:
AnalogISDNSIPHolding/consulting and continuing with calls
RHOLD or FHOLDTo place a call on hold, press the Flash/Call hold key (or 'F' on analog phones).
1643
Reference Manual
16 Voice over IP (VoIP)
AnalogISDNSIPHolding/consulting and continuing with calls
The caller can no longer hear you and you can initiate a second call by dialing a telephone
number (consulting).
F 2HOLD or FHOLDTo continue with a call which is on hold, press the Flash/Call hold key again (or 'F 2').
HANG UPHANG UPHANG UPIf the consultation call has not yet been picked up, you can stop the consulting by hanging
up the handset on a SIP or ISDN telephone*.
You can stop the consultation call with the appropriate menu function of the telephone
(e.g. 'Cancel') or 'F 1' (analog).*
AnalogISDNSIPSwap call
RHOLD or FHOLDTo open a second line during a call, first press the Flash/Call hold key (or 'F' on analog
phones).
The other caller can no longer hear you.
123456789123456789123456789Dial the number for the second caller while the first call is on hold.
If you cannot reach the second caller, you can return to the call which is on hold by
pressing the hold key (or 'R').
F 2SWAPHOLDAs soon as two simultaneous connections are open, you can use the hold key (or swap
key for ISDN phones, 'R' and '2' for analog phones) to swap to-and-fro between the two
connections.
You will be connected to one of the other callers; the other caller is placed on hold.
F 1END orEND or
HANG UP*
To end an active call, hang up the handset on SIP or ISDN telephones, and on analog
phones press 'R 1'.
HANG UP*
The call which is on hold is not automatically reactivated, but it will be signaled (ringing
phone) for a period of 15 seconds.
AnalogISDNSIPCall transfer, consult
RHOLD or FHOLDTo open a second line during a call, first press the Flash/Call hold key (or 'F' on analog
phones).
The other caller can no longer hear you.
123456789123456789123456789Dial the number for the second caller while the first call is on hold.
If you cannot reach the second caller, you can return to the call which is on hold by
pressing the hold key.
R 4 or HANG
UP
CONNECT or
HANG UP*
CONNECT or
HANG UP*
As soon as you have established two simultaneous connections you can connect the two
callers with the connect key (or 'R' and '4' on analog phones) or by hanging up the
handset.*
Optionally you can switch between the two lines as often as you like before transferring.
Call transfer always connects the active call and the call on hold.
HANG UP
123456789
HANG UP
123456789
HANG UP
123456789
You have no more active calls. You can either hang up or make a new call.
AnalogISDNSIPCall transfer, blind
HOLDHOLDHOLDTo open a second line during a call, first press the Flash/Call hold key.
The other caller can no longer hear you.
123456789123456789123456789Dial the number for the second caller while the first call is on hold.
R 4 or HANG
UP
CONNECT or
HANG UP*
CONNECT or
HANG UP*
Press the connect key (or 'R' and '4' on analog phones) or hang-up the handset before
the second connection has been established.*
The two callers will now be connected "in the background".
1644
Reference Manual
16 Voice over IP (VoIP)
AnalogISDNSIPCall transfer, blind
HANG UP
123456789
HANG UP
123456789
HANG UP
123456789
You have no more active calls. You can either hang up or make a new call.
5
*In some cases, SIP or ISDN telephones can be configured so that hanging-up the handset either causes the
consultation or active call or be terminated, or a call transfer is triggered ("Connect").
16.6.3 Configure permanent call forwarding
Along with spontaneous call transfers as controlled by a subscriber during a call, it is often useful to set up a permanent
call forwarding ("redirect calls"). For example, a call should be forwarded when a line is busy, if there is no answer within
a certain period, or in case of absence (e.g. vacation).
There are two possibilities for configuring permanent call forwarding.
1
Via the telephone or terminal device itself with the aid of control characters
1
In the configuration of the LANCOM VoIP Router by means of the management tools (LANconfig, WEBconfig or
telnet)
5
If permanent call forwarding is activated by both methods, then the behavior of the call forwarding follows the
last respective action.
Triggering call forwarding
The following events can be used as a trigger or condition of the permanently configured call transfers:
1
CFU, call-forwarding unconditional
1
CFB, call forwarding on busy
1
Delayed call forwarding, CFNR (call forwarding no reply); CFNA (call forwarding no answer)
1
No call transfer
All types of call forwarding can be used in parallel with your own target telephone numbers. If multiple call-forwarding
conditions are active, the following priority applies:
1. CFU
2. CFB
3. CFNR
If, for example, call forwarding on busy is activated and a corresponding target number has been defined, then the call
will be forwarded to this target before referring to a target as defined for forwarding on busy.
5
If the incoming call has already been forwarded from another telephone number, then forwarding will not take
place again, so as to avoid endless call-forwarding queues.
Configuring user settings in the LANconfig see
Configuring user settings with the telephone with character strings
For the configuration of user settings with the telephone, the various technologies (SIP, ISDN, analog) each offer specific
possibilities. With ISDN telephones, call forwarding can be controlled by the functional protocol in the ISDN signaling
or via so-called keypads (character stings). For analog telephones the same character strings are transferred by DTMF.
The SIP protocol provides another option with its REFER method that is supported by most SIP phones and SIP softphones.
However, call forwarding can only be controlled by the terminal device. To enable a uniform behavior for users in mixed
infrastructures, the LANCOM VoIP Router offer an additional variant of call forwarding for SIP phones, as is presented
here in comparison with ISDN and analog telephones.
1645
Reference Manual
16 Voice over IP (VoIP)
AnalogISDNSIPImmediate call forwarding
*21*TargetNo#*21*TargetNo*MSN#*21*TargetNo#Switch on and define target for call forwarding
#21##21#*MSN#21#Switch off
#22##22*MSN##22#Switch off temporarily, maintain call-forwarding target
*22#*22*MSN#*22#Switch on again, maintain defined call-forwarding
target
AnalogISDNSIPCall forwarding on busy
*67*TargetNo#*67*TargetNo*MSN#*67*TargetNo#Switch on and define target for call forwarding
#67##67*MSN##67#Switch off
AnalogISDNSIPCall-forwarding on no reply
*61*TargetNo#*61*TargetNo*MSN#*61*TargetNo#Switch on and define target for call forwarding
#61##61*MSN##61#Switch off
Please note the following when using character stings to configure call forwarding:
1. Some ISDN telephones feature special keys or menu entries to configure call forwarding, and these can be used as
an alternative to the listed character strings. Refer to the documentation from the corresponding manufacturers.
16.6.4 Fax via T.38 – Fax over IP (FoIP)
The migration of telephone infrastructure towards VoIP also increases the demand for fax devices to communicate over
VoIP. Even in the age of e-mail, fax transmissions continue to be highly important in legal respects as legally binding
documents such as contracts and invoices can be far more easily handled by fax than with the alternative of e-mails with
digital signature. The integration of fax devices into VoIP infrastructure can be implemented in two ways:
1
Fax messages are transmitted via landline just like a conventional fax.
1
The transmission takes place over an Internet connection. Options for this are as follows:
2
The fax signals are transmitted like voice data over a VoIP connection, referred to as "fax over VoIP". Fax
transmission should only make use of the G.711 codec for compression, as other codecs are inferior at converting
fax tones, which are designed for analog networks, into digital VoIP data. Due to the highly sensitive nature of
fax connections, this method can only be used with high-quality connections, whereby the transmission speed
is sub-optimal.
2
For example, with the "store-and-forward" principle (ITU-T.37), fax messages are passed from the fax machine
to a gateway that stores and converts the fax document. In a second step the fax is transmitted to the destination
for conversion back into a fax format. Alternatively fax messages can be sent by e-mail (fax-to-mail and mail-to-fax).
Solutions of this type may not meet the legal requirements mentioned above, due to the fact that there is no
direct connection between transmitter and receiver.
2
With "real-time routing" of fax messages, on the other hand, a direct connection is established between the two
fax machines and all data is transferred in real time. The fax machines are connected virtually over the Internet.
Communication between the two fax machines follows the ITU-T.38 standard for converting standard fax signals.
This variant is also known as Fax over IP (FoIP). The fax messages are not transferred as acoustic signals via VoIP,
but rather in a special protocol, the IFP (Internet Facsimile Protocol), that embeds the signals in UDP/TCP packets.
To enable fax transmissions with T.38, either the fax machines themselves have to support the T.38 standard, or they
must be interconnected over the Internet via fax gateways. LANCOM VoIP Routers and LANCOM Routers with the
LANCOM VoIP Advanced Option or LANCOM VoIP Basic Option support the T.38 standard and are thus suitable for
operation as fax gateways in VoIP infrastructure.
The fax machines are connected to the LANCOM VoIP Routers by means of a suitable interface. The fax gateway in the
LANCOM VoIP Router handles the conversion of the signals for transmission and reception of fax messages:
1646
Reference Manual
16 Voice over IP (VoIP)
1
Demodulation of incoming T.30 fax signals
1
Conversion of T.30 fax signals into T.38 IFP packets
1
Transmission of IFP packets between transmitting and receiving gateways
1
Conversion of T.38 IFP packets into T.30 fax signals
1
Modulation of T.30 fax signals and transmission to the fax machine
With the device type "fax" or "telephone/fax" is selected in the analog or ISDN user settings the LANCOM VoIP Router
automatically recognizes a fax for transmission and it attempts to transmit via F.38/FoIP. If the remote site does not
support this method, the LANCOM VoIP Router automatically uses the fax over VoIP-version using G.711 compression.
5
Successful transmission of fax via FoIP requires that the VoIP infrastructure also supports the T.38 standard. For
example, where a public SIP provider is involved, this provider also has to offer T.38 support.
16.6.5 Hunt groups with call distribution
Introduction
Calls are normally intended for an individual or their telephone number. Occasionally it is not important to speak to a
particular individual, but to anybody in a certain department or with a certain function. In this case, telephone infrastructure
collects multiple users into hunt groups where they can all be reached under a single shared telephone number. The
group call function can then follow certain rules to distribute or forward incoming calls to the call group.
Call distribution
A hunt group consists of two or more users, or even other hunt groups, as potential destinations for an incoming call.
Hunt groups are comparable to local users and have their own number and, as such, they can be used as a target number
in the call router.
Incoming calls can be distributed by a variety of methods, allowing different scenarios to be realized.
1
Calls are signaled to all group members at the same time (simultaneous)
1
Calls are signaled to one member of the group after the other, in a set order (sequential)
Along with the members of the hunt group and distribution method, also to be defined are a call-forwarding time and
and call-forwarding target, all of which control the call-distribution procedure. The forwarding time determines the time
period during which the dialed user can answer a signaled call. The forwarding target defines where the call is to be
forwarded to (user, group, internal or external call number) for the case that none of the group members picks up the
call within the forwarding time—if no forwarding target is defined, then the call is rejected.
Cascading of hunt groups
The defined hunt groups can themselves be members of a higher-level hunt group, just as hunt groups can be entered
as the forwarding target for a higher-level hunt group. These options enable the establishment of a cascaded hunt-group
structure which can form highly complex scenarios by using a multitude of branches. These branches represent the hunt
groups and the end points are the users themselves. The following rules apply to structures of this type:
1
If a hunt group is used as a member, then this lower-level hunting group causes a new "branch" in the structure to
open up when that member receives a call.
1
When a lower-level hunt group opens, certain parameters that have been defined, e.g. forwarding time, etc., apply.
1
This branch from the lower-level group only remains open for as long as the member in the upper-level hunt group
is being signaled according to the settings. If the next member in the upper-level hunt group is reached, then the
entire branch along with all of its other sub-branches is closed. The system does not wait until all possible combinations
along the branch have been tried out. It is thus possible that there are members defined in a lower-level hunt group
who cannot be reached because of settings in the upper-level groups.
1
If a member of a hunt group picks up the call, all open branches are closed and all attempts to reach forwarding
targets are stopped.
1647
Reference Manual
16 Voice over IP (VoIP)
1
If a call remains unanswered after signaling all of the members of an (upper or lower-level) hunt group, then the call
is passed on the the call-forwarding target. This means that any call-forwarding times which may be running in the
upper-level hunt groups are ended. In this case the call "jumps" out of the hunt-group structure and is given a new
target.
Example: The following hunt groups have been defined:
Forwarding targetForwarding timeForwarding
method
MembersCommentGroup telephone
number
ext. Telephone
number
10Simultaneous200, 300, 400Entire company100
10010Simultaneous201 to 209Service Dept.200
20010Sequential301 to 309Marketing Dept.300
10015Sequential409Sales Dept.400
40010Sequential411, 412, 413, 414,
415
Sales Europe group410
40030Sequential421, 422, 410Sales America group420
40030Sequential431, 432, 410Sales Asia group430
Each department or group has users who use the final digits in the telephone number, i.e. 411 to 419 for the Sales
Europe staff and 409 for the Sales team secretary. Only the group call numbers are communicated externally because
all staff members tend to travel frequently on business. The purpose of the hunt-group structure is to connect each
customer with a competent staff member in the shortest possible time.
An incoming call directed to the telephone number 420 for a Sales America team member is handled as follows:
1. The call is signaled to the users 421 and 422 in this group for 30 seconds each. If there is no answer, then the hunt
group 410 is activated for 30 seconds—a member of the Sales Europe team should take care of the customer when
Sales America no team members are available.
2. In the Sales Europe team, the call are distributed to each number for 10 seconds. The hunt group has five members,
but with a forwarding time of just 10 seconds, not all of the users can be signaled: The branch is only opened for a
maximum of 30 seconds by the upper-level group, in this case 420. This is a way of limiting the maximum waiting
time for a customer. If the first three signaled members of the lower-level group 410 do not answer, then the call
jumps back to the upper-level hunt group 420.
3. There is still nobody available in the upper-level hunt group 420, and so the call is directed to the call-forwarding
target 400.
4. Hunt group 400 directs the call to the team secretary 409. If here nobody answers for 15 seconds then the
call-forwarding target 100 is used, which addresses the entire company.
5. Hunt group 100 calls all of the numbers in the hunt groups 200, 300 and 400 simultaneously. If even then nobody
answers within 10 seconds, then the hunt group forwards the call to an external telephone number, for example a
24/7 call center.
Configuring hunt-group functions , see
16.6.6 Multi-login
For subscribers using multiple terminal devices, e.g. a softphone on PC and a "normal" telephone on the desktop, multiple
SIP, ISDN or analog telephones all using the same internal telephone number can log on to the LANCOM VoIP Router.
Multi-login telephones behave like a single user in a hunt group with 'simultaneous' call distribution:
1. Incoming calls are signaled simultaneously at all telephones with this internal number.
2. As soon as a call is picked up at one of the telephones, signaling at the other devices stops.
3. Other incoming calls are signaled at all telephones. If one of the telephones is 'busy', then the entire multi-login
group is taken to be 'busy'.
1648
Reference Manual
16 Voice over IP (VoIP)
4. Outgoing calls can be made from every telephone without limitation.
5. For a multi-login group only one call forwarding setting (call redirection) can be configured. This applies to all
telephones and can be set from any telephone.
To use multi-login, multiple telephones can be set to have the same internal telephone number.
16.7 VoIP media proxy – Optimized management for SIP connections
When connecting or forwarding calls between remote subscribers over different SIP lines, the SIP proxy in the LANCOM
VoIP Router attempts to connect the two callers by means of a REFER or a Re-INVITE. The two external subscribers are
not always able to reach one another directly and so the connection may fail. This is because the SIP providers do not
make the necessary adaptations, e.g. translation of the target IP addresses. To improve performance in these situations,
the SIP proxy in the LANCOM VoIP Routers has been additionally equipped with a media proxy.
The media proxy helps to establish connections and forward calls between subscribers who are reachable over different
types of telephone line (e.g. SIP PBX line and SIP provider line). The media streams, generally RTP connections, remain
unchanged. The media proxy changes the ports and IP addresses in the data packets and it adapts special media end
points to the corresponding target networks (ARF networks, interface and IP address).
16.7.1 Multiple media streams in one SIP connection
The SIP protocol can negotiate multiple data streams in a session, e.g. separate media streams for audio and video. Each
stream is handled separately. A data stream initially terminates at the media proxy and continues from the "other side".
This provides the data stream with end points at the LAN and WAN sides of the media proxy.
All of the connection information in the direction of the SIP provider can be maintained and all of the necessary changes
to IP addresses, ports, etc., are handled by the media proxy.
Receiver
The data streams are all fed through the firewall individually, which enables a differentiated control of the QoS settings,
among other things.
Connection management by the media proxy enables all subscribers to be connected to one another, whatever type of
line they are using. This makes it possible to connect between SIP, ISDN and analog subscribers, something that a pure
1649
Reference Manual
16 Voice over IP (VoIP)
SIP connection is not capable of. Furthermore, the monitoring of individual media streams in the firewall allows certain
types of application to be permitted or prevented depending on the connection's end point.
remote Subscriber
to A
from A
remote B
from A
to A
new Subsr. B
to A
from A
from A
to A
SIP PBX
SIP Proxy
Connected
Media Proxy
Local A
from B
to C
to B
from C
16.7.2 Management of media streams in case of an upstream SIP PBX
Even for two subscribers in the same network behind the LANCOM VoIP Router, when connected to an upstream SIP
PBX the media proxy generates data streams with separate media end points on the LAN side and on the WAN side
(towards the SIP PBX).
to B
from B
from A
to A
to B
from B
from A
to A
Local A
Local B
SIP PBX
SIP Proxy
Connected
Media Proxy
In this case it is not necessary to pass the media streams through the upstream PBX, so the SIP signaling helps the
LANCOM VoIP Router to make a new decision on the path to be taken by the connection data. Using the end points in
the media proxy the data streams can be connected directly, making a diversion via the SIP PBX unnecessary.
This decision is also made again in the media proxy if a local and an external subscriber are connected in such a way
that, ultimately, two local subscribers are connected to one another. The media proxy re-assigns the end points when
making the connection, so enabling the direct transmission of the data streams between the local participants.
16.7.3 Managing the media streams in the firewall
The media streams are monitored in the firewall as a matter of principle. A firewall rule is generated for each media
stream (audio, video). This rule opens a connection for the corresponding IP addresses and ports for each side (LAN-WAN)
and carries out a translation according to the IP-port relationships as specified by the media proxy.
16.7.4 Automatic QoS rules for media streams
The QoS mechanism in the firewall reserves the maximum possible amount of connection bandwidth as agreed during
the SDP negotiation (SDP, Session Description Protocol) and the packets are prioritized accordingly.
16.7.5 Handling subscribers using different codecs
When connecting different subscribers, the situation can arise where the codecs available to the subscribers do not
match together—there are no common codecs due to the SDP negotiation.
The following situations are to be observed here:
1650
Reference Manual
16 Voice over IP (VoIP)
1
Connections with different media streams, e.g. a video-telephone call (audio + video) and a traditional telephone
call (audio only): This connection will be rejected with the message "Codec mismatch".
1
Similar media types (audio-audio, video-video) with codecs that do not match: This connection will be rejected with
the message "Codec mismatch".
The media proxy can only connect different subscribers if the media type and the codec type match.
16.8 SIP-ID as switchboard number with trunk lines
Until now, SIP trunk lines were given the SIP ID as the switchboard number, which was adapted to suit the telephone
number. However, this method is not supported by all trunk-line suppliers.
For this reason LCOS 7.52 and later provides the SIP mapping table that, like ISDN mapping, explicitly defines how
telephone numbers are to be processed.
0123456789# -> #
This allows the extension numbers of the trunk to be translated 1:1 to the internal telephone numbers.
5
If you have until now used a trunk with automatic switchboard-number translation and you update to LCOS
7.52, then it is imperative that you make a corresponding entry in the SIP mapping table.
16.9 Switching at the SIP provider
When switching external SIP connections, the Call Router in the LANCOM VoIP Router generally manages the connection
for the full duration of the call. This means that the Call Router retains control over a call even when two external
subscribers have been connected to one another and the local subscriber on the LANCOM VoIP Router side has ended
the call. In this case, the LANCOM VoIP Router takes up bandwidth for connecting the two external subscribers.
If the connections to the two external subscribers both run via the same SIP provider, an alternative is available whereby
call switching is transferred to the provider. The LANCOM VoIP Router no longer takes up the bandwidth.
LANconfig: VoIP-Call-Manager / Lines / SIP lines
WEBconfig: Setup / Voice-Call-Manager / Lines / SIP-Provider / Lines
1
Activate switching at provider (Refer-forwarding)
With this option activated, a REFER is forwarded to the provider when two external lines are connected, and the
provider then handles the call transfer. The advantage of this is that the LANCOM VoIP Router no longer requires
the bandwidth.
2
Possible values: On, off
2
Default: Off
1651
Reference Manual
16 Voice over IP (VoIP)
5
Switching at the provider will only work if both connections are routed via the same provider line.
16.10 Handling canonical telephone numbers
Canonical telephone numbers (familiar from mobile phones and starting with '+') were formerly automatically reformatted
into standard telephone numbers. '+' was converted to '00'.
As of LCOS 7.52 automatic conversion can be disabled and canonical numbers can be processed directly in the call-routing
table. For example, a dedicated line can be defined for canonical numbers.
1
WebConfig: Setup/ Voice-Call-Manager/ General
1
Convert-Canonicals
Activates or deactivates the conversion of canonical numbers into standard telephone numbers.
2
Possible values: Yes, No
2
Default: Yes
16.11 Processing Destination Domains
As the VoIP implementation in the LANCOM VoIP Router handles all calls as SIP calls, telephone numbers and SIP
subscribers contain domain information. Furthermore, SIP numbers can also contain alphanumeric characters.
The SIP domains are used in LCOS as follows:
1
When SIP subscribers register at upstream PBXs or at the LANCOM VoIP Router itself.
1652
Reference Manual
16 Voice over IP (VoIP)
1
When SIP subscribers establish a connection.
LCOS supports the following defined domains:
1
ISDN for the ISDN interfaces
1
All domains that are entered for the lines
16.11.1 Registration at upstream exchanges
Local SIP subscribers can only register using the domains that are known. The subscribers authenticate themselves at
the local LANCOM VoIP Router with their user name and password. This excludes domains that correspond to an upstream
SIP PBX. These registrations are authenticated in the upstream SIP PBX.
If a subscriber tries to register with an unknown domain, then this may be accepted as a local registration.
16.11.2 Switching internal calls
For internal connections, internal numbers are generally assigned unambiguously. However, SIP telephones, for example,
can register with several "lines", such as '1011@provider.com' and '1011@isdn.com', so that a line can be assigned
specifically to the required connection.
With internal switching, an attempt is made to find a subscriber whose number and domain match. Only if this was not
successful is the call placed using the destination number only. The domain remains unchanged.
For example, calls that are incoming via ISDN (from <calling pty id>@isdn) are switched to subscriber 1011 (to 1011@isdn).
The call to the SIP telephone is displayed on the ISDN line key. If there is no such subscriber with such a domain, then
the call is delivered to the first known subscriber '1011'.
16.12 ISDN interface configuration
LANCOM VoIP Router routers feature several ISDN interfaces with which they can be connected to ISDN exchange lines,
or with which ISDN terminal equipment can be connected to them.
1
ISDN TE interface ("external ISDN connection"): An ISDN interface in TE mode for connection to the ISDN bus of an
upstream ISDN PBX or to an ISDN NTBA. This ISDN interface can be used for backup connections over ISDN or as a
dial-in interface for remote sites.
1
ISDN NT interface ("internal ISDN connection"): With its ISDN interface in NT mode, the LANCOM VoIP Router itself
provides an internal ISDN bus. This ISDN interface can be used to connect ISDN PBXs or ISDN telephones.
The factory settings have the ISDN interfaces marked with  set to TE mode and the ISDN interfaces marked with  set
to NT mode. These ISDN settings can be altered according to your requirements:
1
Multiple TE interfaces provide, for example, up to eight B channels as a backup or for dial-in.
1
With multiple NT interfaces, for example, a downstream ISDN PBX can be provided with up to eight B channels.
Depending on the combination of ISDN interfaces in TE and NT mode, the hardware must be set up with the functions
for bus termination, life-line support and power relay, and the software must be set up with the appropriate protocol.
The setting for the protocol allows for the type of ISDN connection to be used (point-to-multipoint or point-to-point).
16.12.1 Point-to-multipoint and point-to-point connections
LANCOM VoIP Routers support point-to-multipoint and point-to-point connections:
1
Point-to-multipoint connection (point-to-multipoint): Up to 8 ISDN terminal devices can be connected to this type of
connection. Terminal equipment can include ISDN telephones and ISDN PBXs, which can be used for connecting yet
more equipment. As an alternative, a LANCOM VoIP Router can be connected to a point-to-multipoint connection.
1
Point-to-point connection (point-to-point): This type of device is suitable for the connection of one ISDN device only,
generally an ISDN PBX. As an alternative, a LANCOM VoIP Router can be connected to a point-to-point connection.
1653
Reference Manual
16 Voice over IP (VoIP)
To connect a LANCOM VoIP Router, the interface that is used is set up for the type of line in use.
Equipment connected to an ISDN connection can be addressed in two ways:
1
The devices are addressed with a multiple subscriber number (MSN) that is linked to the ISDN connection and cannot
be influenced.
1
Terminal devices are addressed via a Direct Dialing In-Number (DDI). However, only the switchboard number is
associated with the telephone line; the extension numbers that address the individual terminal devices can be chosen
at will and are merely suffixes to the switchboard number. The switchboard number, extension and area selection
code (not including the leading zero) can be at the most 11 characters long.
5
The terms "point-to-multipoint connection" and "point-to-point connection" are used in many countries to
describe the technical implementation of point-to-multipoint with MSN and point-to-point with DDI. Other
countries may use different types of connection and other combinations of protocol and call-number type, or
even different names. Please refer to your telephone network operator for the technical specifications of your
ISDN connection.
16.12.2 Bus termination, life-line support and power relay
The hardware function modes of the ISDN interfaces are set by DIP switches on the underside of the LANCOM VoIP
Router.
1
Bus termination is obligatory with an ISDN interface in NT mode.
Bus termination is generally deactivated for ISDN interfaces in TE mode. If the LANCOM VoIP Router is the last device
at a longer ISDN bus and this itself is not terminated, it may be advantageous to activate the bus termination for an
ISDN interface in TE mode.
5
The supplied adapter must be used if a connection is to be made to an ISDN interface which is set differently
to its default settings. This adapter serves to cross-over the contacts in the ISDN interface. Not using the
adapter can cause damage to both the LANCOM VoIP Router and to the devices connected with it!
1
If life-line support is activated, the interfaces ISDN 1 and ISDN 2 are bridged if the device is unavailable due to a
power outage or if the ISDN 2 interface is switched off (default: on). The life-line support is used when the device is
connected to an external ISDN line over a TE interface with the simultaneous operation of ISDN terminal devices at
the internal ISDN connection of an NT interface. If bridged, the ISDN devices can then use the external ISDN bus
directly.
To activate life-line support, all four DIP switches (3 to 6) must be up; to deactivate, all four DIP switches must be
down.
5
Life-line support is to be deactivated when both ISDN interfaces are to be operated in the same mode, i.e.
as two TE or two NT interfaces. The interfaces are not to be bridged in case of power failure when being
operated in this manner!
1
The ISDN power relay means that the bus voltage of an external ISDN bus at ISDN 1 is switched through to the
terminal equipment connected to another ISDN bus. As a consequence, ISDN equipment operated at the internal
ISDN bus of the LANCOM VoIP Router can be operated without its own power supply.
5
Be sure to deactivate the ISDN power relay if both ISDN interfaces are to be operated in TE mode, such as when
both ISDN interfaces are connected to an ISDN NTBA, for example. A power relay in this situation would result
in a short-circuit which would damage the device and the ISDN NTBAs!
5
Further information about settings for life-line support and ISDN power relay can be found in the user manual
for your LANCOM VoIP Router.
1654
Reference Manual
16 Voice over IP (VoIP)
16.12.3 Protocol setting
Parameters for the ISDN interfaces are entered into LANconfig in the configuration area 'Interfaces' on the 'WAN' tab.
Under WEBconfig, Telnet or SSH client you will find the settings for the ISDN interface parameters under
Setup/Interfaces/WAN.
Select the protocol for each ISDN interface according to its application and the ISDN connection type: Point-to-multipoint
and point-to-point connections can be used in various combinations at a LANCOM VoIP Router. The following options
are available:
1
Automatic for automatic selection of the operating mode (only in TE mode)
1
DSS1 TE (Euro ISDN) for connection to a point-to-multipoint ISDN bus.
1
DSS1 TE point-to-point for connection to a point-to-point ISDN bus.
1
1TR6 TE (German ISDN) for connection an ISDN bus which uses this protocol (in Germany only).
1
DSS1 NT (Euro ISDN) to provide point-to-multipoint ISDN interfaces
1
DSS1 NT reverse to provide point-to-multipoint interfaces while maintaining the ISDN timing of the connected ISDN
line, please refer to
1
DSS1 NT (point-to-point) to provide point-to-point ISDN interfaces
1
DSS1 NT point-to-point reverse to provide point-to-point interfaces while maintaining the ISDN timing of the
connected ISDN line, please refer to
1
DSS1 timing to maintain the ISDN timing of the connected ISDN line, please refer to
1
Off
5
NT mode operation always has to be set manually.
5
If an ISDN device is attached to an ISDN interface that is set to auto and is not recognized properly, set the
required protocol manually.
16.12.4 ISDN connection timing
To ensure trouble-free transmission, all of the components in the ISDN system (LANCOM VoIP Router, upstream and
downstream ISDN PBXs and ISDN terminal devices) have to use the same ISDN timing. In the LANCOM VoIP Router, an
ISDN interface in TE mode can take on the timing of the ISDN line. The TE interface enables the device itself to behave
like a terminal device. In NT mode, the LANCOM VoIP Router can pass on the on this timing over the ISDN interfaces to
any connected terminal equipment or downstream ISDN PBXs. The NT interface enables the device itself to behave like
an exchange.
There are various ISDN interface settings to define the ISDN interface which is to supply the LANCOM VoIP Router with
the ISDN timing to be passed on to the devices at the NT interfaces.
1
Automatic: If no interface has been manually selected for the timing, the device automatically searches for a TE
interface that is supplying a timing. To ensure that the timing is synchronous, the TE connectors constantly try to
keep the connection activated. This ensures that the timing continues to be supplied even if one of multiple TE lines
should be shut off. If none of the TE connectors supply a timing, then the timing system runs "freely" and uses the
internal timing of the LANCOM VoIP Router.
1
DSS1 timing: This setting takes on the ISDN timing from the connection for use by the LANCOM VoIP Router and
further devices connected over the NT interface. In this way, the timing can be switched through in parallel to an
existing ISDN PBX at a point-to-point connection. Apart from passing on the ISDN timing, the interface is not active.
1
DSS1 NT reverse or DSS1 NT point-to-point reverse: When all ISDN interfaces are operated in NT mode, the
timing system runs "freely" because there is no TE interface to take on the ISDN timing. If in this case the ISDN
connections are connected, for example, to an ISDN PBX which is being supplied with ISDN timing from another
source, then interference to the transmission may arise because the timing of the LANCOM VoIP Router is not
synchronous to that of the PBX. In such cases, the reverse setting allows the ISDN timing to be taken from an NT-mode
interface, so ensuring that the LANCOM VoIP Router runs synchronously with the overall system.
1655
Reference Manual
16 Voice over IP (VoIP)
16.13 Configuration examples
16.13.1 VoIP telephony for stand-alone use
This example shows how to configure a LANCOM which is used as a central device for Internet connectivity and VoIP
telephony at a new site.
VOIP Router
ISDN
INTERNET
server
SIP-Telephone
PC with Softphone
PC PC
SIP provider with the following
account information
Domain: sipprovider.com
Telephone number: 0123 -456 789
ISDN connection
MSN 1: 0123 -555 555 1
MSN 2: 0123 -555 555 2
VoIP telephone
Internal number ‘12’
VoIP softphone
Internal number ‘11’
Destination
1
Internal telephony with SIP telephones and SIP softphones.
1
Access to internal terminal equipment via the MSNs.
1
External telephony via the SIP provider with backup over ISDN.
1
Calls to emergency and special numbers via ISDN.
Requirements
1
LANCOM connected to the LAN and WAN, an ISDN TE interface is linked to the ISDN NTBA. The Internet connection
has been set up.
1
A dialing plan with a unique internal telephone number for all terminal equipment to be connected, here, for example,
the number '11' for the VoIP softphone and the number '12' for the VoIP telephone.
1
A SIP provider account.
Using the information during configuration
The following table provides a summary of the information required for configuration and where it can be entered. SIP
terminal equipment parameters can be entered using the SIP telephone keypad, the corresponding configuration software,
or the softphone configuration menu.
SIP terminal equipmentLANCOM
44Internal VoIP domain
44Internal numbers
4External SIP telephone number
4Access information for SIP account
4External ISDN telephone numbers (MSNs)
4Country and local area code
Configuring the LANCOM
When configuring the LANCOM, the following steps must be carried out:
1
Set up the line to the SIP provider
1
Enabling the ISDN interface and assigning MSNs to the internal numbers
1656
Reference Manual
16 Voice over IP (VoIP)
5
In this example, it is not necessary to configure SIP users: The SIP users are registered at the LANCOM with the
settings created in the terminal equipment (softphone and VoIP telephone).
Detailed instructions on configuring the LANCOM:
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP phone
system', 'ISDN phone system' and 'ISDN users'.
2. Enter a unique domain for the local VoIP domain which describes the local VoIP range for the site (e.g.
'mycompany.internal'.)
3. Configure the line leading to the SIP provider, for example with the name 'SIPPROVIDER' with the following values:
1
Internal standard number: All calls that come in through the SIP provider are forwarded to this internal number.
Enter an internal number from your dialing plan here, e.g. '11'.
1
SIP domain/realm: You received this domain from your SIP provider; it is usually entered in the format
'sipdomain.tld' without the part that designates a specific server.
1
Registrar (FQDN / IP) (optional):
1
Outbound proxy (optional)
5
The server description is generally not required; the DNS query for the SIP domain returns this information.
Enter a server designation here only if your provider has informed you of the corresponding addresses.
1
SIP ID / user: Enter the SIP number with local area code here, providing that the SIP provider does not require
any other information.
1
Display name (optional): The display name is only required if the SIP provider verifies this during registration. If
you enter a display name here, then this name will be displayed at the remote site. If the field remains empty,
then the display name for the corresponding internal user is transmitted.
1
Authentication name (optional): Special authentication names are not supported by all SIP providers. In many
cases, the authentication name is the same as the SIP ID or the user name. Complete this field only if your SIP
provider has issued you a special authentication name.
1
Password: Enter the password for SIP access here.
5
This description applies to a "user-defined configuration". If you select a special SIP provider from the
list, then some of the parameters will be pre-configured automatically.
4. Configure an ISDN line for VoIP telephony use. For every MSN on your ISDN connection, make an assignment to an
internal number within your telephone number plan during ISDN mapping.
1
MSN 1 '555 555 1' / internal number '11'
1
MSN 2 '555 555 2' / internal number '12'
1657
Reference Manual
16 Voice over IP (VoIP)
5. Enter the local and national area code for the device's location. Using this information, the Voice Call Manager can
decide whether or not outgoing calls are local calls, national or international long distance calls.
6. Based upon the entries made so far, the LANconfig creates a suggestion for the call routing table which you can
adapt to fit your requirements as follows:
5
The # sign is a placeholder for any character string. The entry '0#' is therefore suitable for all numbers dialed
that have at least one '0' preceding them.
This suggested call routing table would place all external calls over the ISDN line. The SIP line is set up as a backup for
international and national long distance calls and local calls that are not in the list of special or emergency numbers.
In order to channel calls to special destinations, such as international and national long distance calls, over the SIP
provider, double-click on the corresponding entry in the table and switch the line used from 'ISDN' to 'SIPPROVIDER'.
Don't forget to switch the backup line from SIP to ISDN, if necessary!
1658
Reference Manual
16 Voice over IP (VoIP)
After being adapted for international and national long distance, the call routing table should appear as follows:
Configuring the VoIP terminal equipment
Enter the registration information for the first SIP user in the softphone (example for LANCOM Advanced VPN Client).
Defining the SIP account in the LANCOM Advanced VPN Client to register at the LANCOM
VoIP Router or at a PBX
Enter the registration information for the first SIP user in the LANCOM Advanced VPN Client.
1. On the ' SIP accounts' tab, use the Add button to create a new SIP account.
2. For the provider setting, leave the entry as 'Custom' and activate the new account.
1. For the 'User ID' enter the internal telephone number to be used by LANCOM Advanced VPN Client for taking calls
and, optionally, enter a name for your phone under 'Description'; this name will be displayed on the other phone at
the other end of the connection.
1659
Reference Manual
16 Voice over IP (VoIP)
2. With the button Details, open the dialog for the advanced settings and enter the following data:
1. As the 'SIP proxy' and 'Registrar', enter the internal VoIP domain for your LANCOM VoIP Router (default: 'internal')
if this also acts as the DNS server for the client; if not, enter the LAN IP address.
1
'Realm' is always the internal VoIP domain.
5
With this information, the LANCOM Advanced VPN Client can register locally at a LANCOM VoIP Router and
use the telephone lines defined there.
2. If the LANCOM Advanced VPN Client is to registering not only with the LANCOM VoIP Router locally, but an upstream
SIP PBX (e.g. at Headquarters) as well, then enter under 'SIP proxy', 'Registrar' and, under 'Realm', enter the VoIP
domain of the SIP PBX at Headquarters. On the LANCOM VoIP Router, an appropriate SIP-PBX line has to be configured
with the same domain, and the router has to be the DNS server for the LANCOM Advanced VPN Client.
1660
Reference Manual
16 Voice over IP (VoIP)
1. Enter the SIP-account user name and password for logging in to the SIP PBX.
1. You can check if the registration was successful by looking at the list of recent messages (via button or menu).
5
On the tab 'Location' enter your international country code and local code, each without their leading zero(s),
and enter the national and international prefixes (e.g. '0' and '00'). The field 'Public line access prefix' is for the
character your PBX or LANCOM VoIP Router uses to access an outside line (e.g. '0' or '*').
Enter the registration data for the second SIP user in the VoIP telephone (example for Snom 190).
1661
Reference Manual
16 Voice over IP (VoIP)
1. From the Setup menu, select one of the possible lines, e.g. 'Line 2'.
1. Enter the following values:
1
Registrar: Internal VoIP domain for the LANCOM.
1
Account: Internal number for the user.
1
Displayname: Name of the user as it is to be displayed at the remote site.
5
If you use another softphone or VoIP telephone, please consult the documentation for this device for
information on configuring the software.
Call routing procedure on outgoing calls
On outgoing calls, the Call Manager first searches the call routing table from top to bottom. If the Call Router cannot
find a matching entry there, it uses the list of registered users:
Destination linemapping, number
in use
correct usercorrect call
route
dialsUser
Internal11VoIP softphoneNone11VoIP telephone
ISDN0241#: 0241 555
555
0#0 555 555VoIP telephone
SIP provider0#: 0123 666 66600#0 0123 666 666VoIP telephone
1. The Call Router cannot find a an entry that corresponds to '11' in the call routing table. Now it searches the list of
registered users and finds the internal SIP user there.
For call routing, not just the users configured in the LANCOM, but all of the users that are actually registered on the Call
Router are used. The SIP users can register themselves as long as they are not entered in the in the LANCOM. The entry
for the internal VoIP domain on the LANCOM is sufficient for registration, assuming that local authentication is not
required.
1. The entry in the call routing table depicted above matches the number dialed. The call router removes the '0'
outside-line access prefix, completes the area code for the local telephone network and completes the call to '0241
555 555' using the ISDN line.
1662
Reference Manual
16 Voice over IP (VoIP)
The area code for the local telephone network is added on because calls via SIP providers usually require the area code
to be dialed.
1. The entry in the call routing table is suitable here. The call router removes the '0' prefix for access to the outside
line and completes the call to '0123 555 555' via the SIP line. If the SIP line is not available, then the call is made
over the ISDN line.
Call routing procedure on incoming calls
For incoming calls, the telephone network exchange removes the prefix from the number dialed (destination number).
Therefore, the LANCOM only receives the number itself, which may be treated differently depending on the source:
1
Numbers from the ISDN network are translated with the ISDN mapping table to the internal number which is entered
for the receiving MSN.
1
Calls from a SIP network are converted to the internal destination number that is entered for the respective SIP line.
With the altered number, the Call Manager begins to search the call routing table from top to bottom. If the Call Router
cannot find a matching entry there, the call is forwarded directly to the internal number:
Destination
line
correct call
route
number in useAssigned viaCall router
receives
Remote site dials
InternalNone11internal destination
number for SIP line
456 7890 123 456 789
InternalNone11ISDN mapping555 555 10 123 555 555 1
InternalNone12ISDN mapping555 555 20 123 555 555 2
16.13.2 Using VoIP telephony to extend the upstream ISDN PBX
This example shows how to configure a LANCOM when an upstream ISDN PBX is enhanced with VoIP telephony capability.
Until now, the MSNs '11' to '13' for the ISDN connection have been used for two ISDN telephones and one analog fax.
5
The PBX is configured so that subscribers dial '0' to access an outside line.
The LANCOM is operated on an ISDN PBX extension line.
VOIP Router
ISDN
INTERNET
SIP-Telephone
PC with Softphone
PC PC
SIP provider with the following
account information
Domain: sipprovider.com
Telephone number: 0123 -456 789
ISDN connection
MSN 1: 0123 -555 555 1 to 0123 -555 555 9
VoIP telephone
Internal number ‘15’
VoIP softphone
Internal number ‘14’
ISDN PBX
ISDN Phone
ISDN
FAXISDN Phone
ISDN
ISDN telephones
Internal numbers ‘11’ and ‘12’
Analog fax
Internal number ‘13’
Destination
1
Internal telephony with ISDN and SIP telephones and SIP softphones.
1
External telephony with VoIP terminal equipment via the SIP provider with backup over ISDN.
1
External telephony with ISDN terminal equipment in the PBX. Depending on the functionality of the ISDN PBX, ISDN
terminal equipment can also use the SIP lines in the LANCOM VoIP Router.
1
Accessing internal terminal equipment (ISDN and SIP) via the MSNs.
1
Calls to emergency and special numbers via ISDN.
1663
Reference Manual
16 Voice over IP (VoIP)
Requirements
1
LANCOM connected to the LAN and WAN, an ISDN TE interface is linked to the extension interface on the ISDN PBX.
The Internet connection has been set up.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected. In
general, the numbers used are predetermined by the PBX, which often only allows certain number ranges.
1
A SIP provider account.
Using the information during configuration
Dialing plans with ISDN PBX systems.
When crossing from the ISDN network to the internal subscribers, the ISDN PBX converts the external MSNs to internal
MSNs. When operating a LANCOM VoIP Router at the extension interface of the ISDN PBX, there is another conversion
of the internal MSNs to the internal numbers of the VoIP range. For reasons of clarity, we recommend using congruent
internal MSNs/numbers for terminal equipment for all connections.
The following table provides a summary of the information required for configuration and where it can be entered. SIP
terminal equipment parameters can be entered using the SIP telephone keypad, the corresponding configuration software,
or the softphone configuration menu.
ISDN terminal
equipment
ISDN PBXSIP terminal
equipment
LANCOM
44Internal VoIP domain
4444Internal numbers
4External SIP telephone number
4Access information for SIP account
4External ISDN telephone numbers
(MSNs)
4Country and local area code
Configuring the LANCOM
When configuring the LANCOM, the following steps must be carried out:
1
Set up the line to the SIP provider
1
Enabling the ISDN interface and assigning internal MSNs in the PBX to the internal numbers of the LANCOM VoIP
Router
1
Adapt the call routing table
5
In this example, it is not necessary to configure SIP or ISDN users:
1
The SIP users are registered at the LANCOM with the settings created in the terminal equipment (softphone and VoIP
telephone).
2
The ISDN devices can be reached via a corresponding entry in the call routing table.
Detailed instructions on configuring the LANCOM:
1664
Reference Manual
16 Voice over IP (VoIP)
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP phone
system', 'ISDN phone system' and 'ISDN users'.
1. Configure the device as described in the preceding examples:
1
Unique local VoIP domains
1
one line to a SIP provider
1
ISDN line
2. Adapt the suggested call routing table in order to direct calls to special numbers automatically over the SIP provider's
line. The following example shows the entry for international calls.
1665
Reference Manual
16 Voice over IP (VoIP)
1. After being adapted, the call routing table should appear as follows:
Therefore, for every long distance call, the '0' preceding the number is removed, the call is made via the SIP provider.
2. For all ISDN calls, however, the '0' may not be removed from the destination number because the upstream ISDN
PBX requires the '0' to access an outside line! Therefore, adapt the destination number for all entries with the target
line 'ISDN'.
After being adapted, the call routing table should appear as follows:
3. In order to allow the ISDN subscribers to be contacted internally by the VoIP users, a standard route is also set up
which directs all calls that have not yet been resolved to the ISDN line without changing the numbers.
After being adapted, the call routing table should appear as follows:
1666
Reference Manual
16 Voice over IP (VoIP)
5
This call routing table is only valid for PBX systems in which the subscribers have to dial '0' to access an
outside line. If the PBX uses another mechanism for accessing an outside line, then the table must be adapted
accordingly.
Configuring the VoIP terminal equipment
The VoIP terminal equipment is configured as described in the preceding examples with internal VoIP domains and
internal numbers for the local site.
Configuring ISDN PBX
When configuring the PBX, external MSNs are assigned to internal MSNs. For every VoIP terminal device, a free internal
MSN is linked to an external MSN.
External and internal calls from ISDN terminal devices into VoIP telephony
First, the ISDN terminal devices forward the desired destination number to the ISDN PBX when the call is being established.
If the number is an internal number/MSN, then the PBX directs the call to the internal ISDN bus. The SIP terminal
equipment connected to the LANCOM can therefore only be reached via an internal call when the PBX knows the internal
number for the VoIP user.
If your PBX is able to direct external numbers to the internal ISDN bus, then the ISDN terminal devices can also use the
lines configured in the LANCOM, such as the SIP provider line, for outgoing external calls.
Configuring the ISDN terminal equipment
Configuring the ISDN terminal equipment is generally limited to entering the internal MSN used in the PBX.
Call routing procedure on outgoing calls
Destination linemapping,
number in use
correct usercorrect call routedialsUser
Internal14VoIP softphoneNone14VoIP telephone
ISDN#: 11# (Standard)11VoIP telephone
Internal14VoIP softphone14ISDN telephone 1. PBX
ISDN00241#: 0 555 5550#0 555 555VoIP telephone
ISDN outside line555 5550 555 555ISDN telephone 1. PBX
SIP provider0#: 0123 666 66600#0 0123 666 666VoIP telephone
1. Internal call between two VoIP terminal devices.
2. Internal call from VoIP to ISDN. In the first pass (without the standard routes), the number '11' does not match any
of the routes. Similarly, no matching entry can be found in the list of registered users. In the second pass, the standard
route meets '#' (entry in the call routing table depicted above) and directs the call to the ISDN line unchanged.
The PBX receives the call on its internal ISDN bus, recognizes the called number as an internal MSN and again
forwards the call to the internal ISDN bus to which the respective ISDN terminal device is connected.
3. Internal call from ISDN to VoIP. The ISDN PBX recognizes the destination number '14' as an internal MSN and directs
the call to the corresponding internal ISDN bus. The Call Router receives the call to '14', does not find a matching
entry in the call routing table but does find an entry in the list of registered users.
4. External call from the VoIP into the local telephone network. The entry in the call routing table depicted above
matches the number dialed. The Call Router completes the area code for the local telephone network and sends the
call out to the ISDN line. Only now does the SIP PBX removes the '0' outside-line access prefix and completes the
call to '0241 555 555' via the ISDN outside line.
1667
Reference Manual
16 Voice over IP (VoIP)
5. External call from ISDN into the local telephone network. The ISDN PBX recognizes the destination number as an
external destination, removes the '0' outside-line access prefix and completes the call to '555 555' via the ISDN
outside line.
6. External call from VoIP into the national telephone network. The entry fits in the call routing table here. The call
router removes the '0' prefix for access to the outside line and completes the call to '0123 555 555' via the SIP line.
If the SIP line is not available, then the call is made over the ISDN line. In this case, the '0' is not removed from the
destination number in order to gain access to an outside line through the PBX.
Call routing procedure on incoming calls
Destination
line
correct call
route
number in useAssigned viaCall router
receives
Remote site dials
ISDNNone11internal destination
number for SIP line
456 7890 123 456 789
Internal11ISDN PBX0 123 555 555 1
InternalNone14140 123 555 555 4 1. ISDN PBX
2. List of local users
1. The incoming call for the SIP line number is directed to the Call Router along with the internal destination number
that has been configured. The Call Router cannot find a matching entry in the call routing table, but it can find a
registered user with the matching internal number. Since the user is an ISDN user, the Call Router directs the call to
the ISDN line. The PBX receives the number '11' and can determine this call to be an internal call for the connected
ISDN telephone.
2. The incoming calls to the MSNs for the connected ISDN terminal equipment can be assigned directly by the PBX
itself, the Call Router is not involved here.
3. The PBX directs incoming calls to the MSNs for the connected VoIP terminal equipment to the internal ISDN bus with
the internal MSN. The Call Router receives these calls as if they were internal calls and forwards them to the appropriate
user since no corresponding entry can be found in the call routing table here either.
16.13.3 Using VoIP telephony to extend the downstream ISDN PBX
This example shows how to configure a LANCOM when a downstream ISDN PBX is enhanced with VoIP telephony
capability. Until now, the MSNs '11' to '13' for the ISDN connection have been used for two ISDN telephones and one
analog fax. The LANCOM will now be switched between the public ISDN connection and the ISDN PBX.
5
The PBX is configured to allow subscribers to receive immediate access to an outside line when they pick up the
receiver.
This ISDN PBX is operated as a downstream PBX on the ISDN NT interface of the LANCOM.
VOIP Router
ISDN
INTERNET
SIP-Telephone
PC with Softphone
PC PC
SIP provider with the following
account information
Domain: sipprovider.com
Telephone number: 0123 -456 789
ISDN connection
MSN 1: 0123 -555 555 1 to 0123 -555 555 9
VoIP telephone
Internal number ‘15’
VoIP softphone
Internal number ‘14’
ISDN PBX
ISDN Phone
ISDN
FAXISDN Phone
ISDN
ISDN telephones
Internal numbers ‘11’ and ‘12’
Analog fax
Internal number ‘13’
Destination
1
Internal telephony with ISDN and SIP telephones and SIP softphones.
1
External telephony with ISDN and SIP terminal equipment over ISDN.
1668
Reference Manual
16 Voice over IP (VoIP)
1
Accessing internal terminal equipment (ISDN and SIP) via the MSNs.
Requirements
1
LANCOM connected to the LAN and WAN, an ISDN NT interface is linked to the outside exchange line on the ISDN
PBX. The Internet connection has been set up.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected. In
general, the numbers used are predetermined by the PBX, which often only allows certain number ranges.
1
A SIP provider account.
Using the information during configuration
Dialing plans with ISDN PBX systems.
When crossing from the ISDN network to the internal subscribers, the ISDN PBX converts the external MSNs to internal
MSNs. When operating a LANCOM VoIP Router at the extension interface of the ISDN PBX, there is another conversion
of the internal MSNs to the internal numbers of the VoIP range. For reasons of clarity, we recommend using congruent
internal MSNs/numbers for terminal equipment for all connections.
The following table provides a summary of the information required for configuration and where it can be entered. SIP
terminal equipment parameters can be entered using the SIP telephone keypad, the corresponding configuration software,
or the softphone configuration menu.
ISDN terminal
equipment
ISDN PBXSIP terminal
equipment
LANCOM
44Internal VoIP domain
4444Internal numbers
4External SIP telephone number
4Access information for SIP account
4External ISDN telephone numbers
(MSNs)
4Country and local area code
Configuring the LANCOM
When configuring the LANCOM, the following steps must be carried out:
1
Set up the line to the SIP provider
1
Enabling the ISDN interface and assigning MSNs to the internal numbers in the LANCOM VoIP Router
1
Creating ISDN users
1
Adapt the call routing table
Detailed instructions on configuring the LANCOM:
1669
Reference Manual
16 Voice over IP (VoIP)
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP provider',
'ISDN phone system' and 'ISDN users'.
1. Configure the device as described in the preceding examples:
1
Unique local VoIP domains
1
one line to a SIP provider
2. Enable the external ISDN outside line and the internal ISDN bus in order to use the VoIP functionality. Enter all
external MSNs for the ISDN outside line in the ISDN mapping table with their assignment to the internal numbers
in the VoIP range.
3. Enter all connected ISDN terminal devices as ISDN users with the following values:
1
Telephone number / SIP name: This number will be assigned to the ISDN terminal device as an "internal number".
The telephone structure will remain clear if you use the same internal number for a terminal device here as it
uses in its own ISDN environment.
1
MSN/DDI: Enter the external MSNs for the ISDN outside line here; this will also be assigned to the terminal device
by the ISDN PBX.
4. Enable spontaneous outside line access for ISDN and SIP users in order to keep the subscribers' telephone behavior
as consistent as possible.
5. The call routing table suggested by the setup wizard automatically allows spontaneous outside line access for ISDN
and SIP users and .
Routes for spontaneous outside line access
Entering the source line 'USER' is not visible in the screenshot. Using this filter, the route will only be in effect for calls
that originate from a local user. The destination line 'RESTART' prompts a new pass through the call routing table,
whereby the source line is deleted. Due to the missing source line, the route does not match this call during the second
pass.
1670
Reference Manual
16 Voice over IP (VoIP)
1
As a result of both of these routes, any stars '*' that might have preceded the numbers are removed before each call
from a local user. For all other calls from local users, the number is preceded with a '0', as it is automatically assumed
that the user is trying to establish an outside connection.
The other routes are used to carry out international and national long distance calls as well as local calls as standard
over the ISDN line. The Call Router removes the preceding zeros from the number again and sends the call out to
the ISDN line.
In order to channel calls to special destinations, such as international and national long distance calls, over the SIP
provider and not over ISDN, double-click on the corresponding entry in the table and switch the line used form 'ISDN'
to 'SIPPROVIDER'. Don't forget to switch the backup line from SIP to ISDN, if necessary!
5
This call routing table is only valid for PBX systems that forward the special character star '*' for internal calls
on their external ISDN bus. If the PBX processes this character in a different manner, then the table must be
adapted accordingly.
Configuring the VoIP terminal equipment
The VoIP terminal equipment is configured as described in the preceding examples with internal VoIP domains and
internal numbers for the local site.
Configuring ISDN PBX
When configuring the PBX, external MSNs are assigned to internal MSNs. For every VoIP terminal device, a free internal
MSN is linked to an external MSN. The internal number for the SIP user can be used as an external MSN for the VoIP
terminal equipment in the PBX.
1671
Reference Manual
16 Voice over IP (VoIP)
Configuring the ISDN terminal equipment
Configuring the ISDN terminal equipment is generally limited to entering the internal MSN used in the PBX.
Call routing procedure on outgoing calls
Destination linemapping,
number in use
correct usercorrect call routedialsUser
Internal#: 14VoIP softphone*#*14VoIP telephone
ISDN#: 11ISDN users*#*11VoIP telephone
1. Internal call between two VoIP terminal devices. On the first pass, only the star is removed from the number, the
source line is deleted. During the second pass, no other route matches this call but the Call Router finds a matching
entry for a SIP user in the list of registered users and can complete the call.
2. Internal call from VoIP to ISDN. On the first pass, the star is removed from the number again, the source line is
deleted. During the second pass, no other route matches this call but the Call Router finds a matching entry for an
ISDN user in the list of registered users and establishes the call via the ISDN interface configured for this user. The
destination number is replaced by the MSN entered for this user '555 555 1' . The PBX receives the call to '555 555
1' on its external ISDN bus and again determines that this is an external MSN and can channel the call to the
corresponding ISDN telephone.
Call routing procedure on incoming calls
Destination
line
correct call
route
number in useAssigned viaCall router
receives
Remote site dials
ISDN NT11555 555 10 123 555 555 1 1. ISDN mapping table
2. List of local ISDN
users
1. The incoming call via the number to the MSNs for the connected ISDN terminal equipment is converted into an
internal number by the ISDN mapping table and passed on to the Call Router. The Call Router cannot find a matching
entry in the call routing table, but it can find a registered user with the matching internal number. Since the user is
an ISDN user, the Call Router directs the call to the ISDN line with the MSN entered for this user, '555 555 1'. The
PBX receives the call to '555 555 1' on its external ISDN bus and again determines that this is an external MSN and
can channel the call to the corresponding ISDN telephone.
16.13.4 Using VoIP telephony to supplement existing ISDN telephones
This example shows how to configure a LANCOM when the ISDN telephones used unit now are to be enhanced with
VoIP telephony. The external MSNs '555 555 1' and '555 555 2' on the ISDN bus at the NTBA were used for two ISDN
telephones until now. The LANCOM will now be switched between the public ISDN connection and the internal ISDN
bus connected to the ISDN telephones.
VOIP Router
ISDN
INTERNET
SIP-Telephone
PC with Softphone
PC PC
SIP provider with the following
account information
Domain: sipprovider.com
Telephone number: 0123 -456 789
ISDN connection
MSN 1: 0123 -555 555 1 to 0123 -555 555 9
VoIP telephone
Internal number ‘15’
VoIP softphone
Internal number ‘14’
ISDN Phone
ISDN
ISDN Phone
ISDN
ISDN telephones
Internal numbers ‘11’ and ‘12’
1672
Reference Manual
16 Voice over IP (VoIP)
Destination
1
Internal telephony with ISDN and SIP telephones and SIP softphones.
1
External telephony with ISDN and SIP terminal equipment over ISDN.
1
Accessing internal terminal equipment (ISDN and SIP) via the MSNs.
Requirements
1
LANCOM connected to LAN and WAN, an ISDN NT interface connected to the ISDN telephone, an ISDN TE interface
connected to the ISDN outside line (NTBA). The Internet connection has been set up.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected.
1
A SIP provider account.
Configuring the LANCOM
When configuring the LANCOM, the following steps must be carried out:
1
Set up the line to the SIP provider
1
Enabling the ISDN interface and assigning MSNs to the internal numbers in the LANCOM VoIP Router
1
Creating ISDN users
1
Adapt the call routing table
Detailed instructions on configuring the LANCOM:
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP provider',
'ISDN phone system' and 'ISDN users'.
1. Configure the device as described in the preceding examples:
1
Unique local VoIP domains
1
one line to a SIP provider
2. Enable the external ISDN outside line and the internal ISDN bus in order to use the VoIP functionality. Enter all
external MSNs for the ISDN outside line in the ISDN mapping table with their assignment to the internal numbers
in the VoIP range.
3. Enter all connected ISDN terminal devices as ISDN users with the following values:
1
Telephone number / SIP name: This number will be assigned to the ISDN terminal device as an "internal number".
The telephone structure will remain clear if you use the same internal number for a terminal device here as it
uses in its own ISDN environment.
1
MSN/DDI: Here, enter the external MSN of the ISDN outside line which was formerly entered into the ISDN
telephone.
1673
Reference Manual
16 Voice over IP (VoIP)
Assigning external MSNs to internal telephone numbers
In this example, the external MSNs and the internal telephones will be assigned "crossed over":
1
In the ISDN mapping table, the external MSN '555 555 1' is assigned to the internal telephone number '11', for
example. An external call to '555 555 1' will be switched by the LANCOM as a call to '11'.
1
By assigning the MSN '555 555 1' to the internal telephone number of the ISDN user '11', the call will be directed
over the internal ISDN bus of the LANCOM with the target telephone number '555 555 1'.
Because the ISDN telephone "listens" out for its own MSN, exactly as it used to before implementing the LANCOM VoIP
Router, the call is placed to the correct telephone.
Should the LANCOM VoIP Router fail due to a power outage, the life-line support and power relay over the ISDN bus, if
activated, enable the connected telephones to continue to function.
1. Enable spontaneous outside line access for ISDN and SIP users in order to keep the subscribers' telephone behavior
as consistent as possible.
2. The continued configuration and changes to the call routing table are carried out just as in the example 'Using VoIP
telephony to extend the downstream ISDN PBX'.
Configuring the VoIP terminal equipment
The VoIP terminal equipment is configured as described in the preceding examples with internal VoIP domains and
internal numbers for the local site.
Configuring the ISDN telephones
Configuring the ISDN terminal equipment is generally limited to entering the external MSN. As a rule, the MSNs were
already entered into the ISDN telephones before, and so no changes should be necessary.
16.13.5 Connecting to an upstream SIP PBX
In this example, a branch office network will be connected to the headquarters network over VPN. In addition to data
transfer, the telephone structure in the branch office is also connected to the central SIP PBX. A LANCOM VoIP Router
is used in the branch office network and a LANCOM VPN router, for example, could act as the VPN end point at the
headquarters. The telephony subscribers at the headquarters receive internal extensions from the number range '101'
to '199'; for each of the branch offices, a 10-digit block from the 200 range is reserved - in this example, '211' to '219'.
PC with Softphone
PC
SIP PBX
INTERNET
ISDN
SIP-Telephone
PC with Softphone
PC
VPN Router
VOIP Router ISDN GATEWAY
HEADOFFICE
BRANCH OFFICE
VoIP telephone
Internal number ‘211’
VoIP softphone
Internal number ‘212’
Internal numbers ‘101’ to ‘199’
Internal numbers ‘101’ to ‘199’
SIP-Telephone
Destination
1
Internal telephony between all locations.
1
External telephony from the branch office via the SIP PBX at the headquarters with backup over ISDN.
1
Calls from the branch office into the local telephone network via ISDN.
1
Calls to emergency and special numbers via ISDN.
Requirements
1
LANCOM connected to the LAN and WAN, an ISDN TE interface is linked to the ISDN NTBA.
1
The Internet connection has been set up by means of a VPN tunnel, as has the network connection between the two
locations. All terminal devices can contact each other with the IP addresses used.
1674
Reference Manual
16 Voice over IP (VoIP)
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected.
1
A SIP provider account.
Configuring the LANCOM
The following table provides a summary of the information required for configuration and where it can be entered.
Basically, all that is needed is a SIP PBX line for each location that is correspondingly setup at the remote location
SIP PBX HeadquartersSIP terminal equipment
Branch office
LANCOM Branch office
mycompany.HQmycompany.HQmycompany.BRANCH01Internal VoIP domain
44Internal SIP subscriber numbers at
the branch office
4External ISDN telephone numbers
(MSNs)
4Country and local area code
HQSIP PBX line
mycompany.HQSIP PBX domains
44SIP PBX registration password
Call route 1. Called number '2#'
2. Destination line 'LOCATION_B'
3. Destination number ''2#'
Detailed instructions on configuring the LANCOM:
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP phone
system', 'ISDN phone system' and 'ISDN users'.
1. Configure the device as described in the preceding examples:
1
ISDN line with MSN mapping
1
Area and country code for each location
2. Enter a unique domain for the local VoIP domain which describes the local VoIP range for the branch office, e.g.
'mycompany.BRANCH01' for the first branch.
3. Configure the line leading to the SIP PBX with the following values:
1
SIP PBX line name: Unique name for the line leading to the SIP PBX, e.g. 'HQ' for "Headquarters".
1675
Reference Manual
16 Voice over IP (VoIP)
1
PBX SIP domain/realm: Internal VoIP domain or SIP PBX, e.g. 'mycompany.HQ'.
1
Registrar (FQDN or IP) (optional): SIP PBX address in the headquarters network, in the event that the device
cannot be identified via DNS resolution of the VoIP domain (PBX SIP domain/realm).
5
Use the SIP PBX IP address from the private IP address range at the headquarters that can be reached
via VPN here.
1
Outbound proxy (optional): It is generally not necessary to designate the outbound proxy. Only enter a server
designation here should the SIP PBX require your corresponding addresses.
1
Shared PBX password: This password is used by all SIP users when registering at the SIP PBX.
Shared or user-dependent SIP PBX password
If registration with a shared password is not desired, then an individual password can be used for each SIP user. In this
case, each SIP user is configured with its own password in the LANCOM
1. Public PBX number: Here, enter the number at which the SIP PBX is to be be reached over the public telephone
network from the location of the LANCOM. The number is entered with the necessary prefixes, but without an
extension number. For example, if the SIP PBX is located in London and the LANCOM is in Birmingham, then the
public PBX number is '020 12345'.
2. The call routing table suggested by the setup wizard automatically allows international and national long distance
calls to be made via the SIP PBX at the headquarters.
1
In addition, a standard route is used in order to conduct calls from the LANCOM VoIP range to internal SIP PBX
numbers via the corresponding SIP PBX lines.
5
This special entry is only used during the second pass in the call routing table, after the first pass found no
corresponding entry for "normal" routes and if no matching internal number was found in the list of local
users.
Configuring the VoIP terminal equipment
The VoIP terminal equipment is configured as described in the preceding examples. However, here, the SIP PBX VoIP
domain and the internal numbers configured in the SIP PBX are used.
Automatic SIP user registration with the LANCOM and the SIP PBX.
By using the SIP PBX domain with VoIP terminal equipment, the user is registered in two ways:
1
Since registration takes place with a valid domain defined in the LANCOM, terminal devices are registered as "local
users".
1676
Reference Manual
16 Voice over IP (VoIP)
1
Since the domain that is used does not correspond to the LANCOM's own VoIP domain, a simultaneous attempt is
made at registering with the upstream SIP PBX. If the password used corresponds to the password stored in the SIP
PBX for this user, then the registration on the SIP PBX will be successful.
Configuring the SIP PBX
In the SIP PBX, all users from the branch office network are entered with their own internal number. For this purpose,
either the shared password is entered or a separate password is assigned for each user.
Call routing procedure on outgoing calls
Destination linemapping,
number in use
correct usercorrect call
route
dialsUser
Internal212VoIP softphoneNone212Branch VoIP
telephone
SIP PBX#: 199SIP subscribers at
the headquarters
#199Branch VoIP
telephone
ISDN0241#: 0241 555
555
0#0 555 555Branch VoIP
telephone
SIP PBX00#: 0123 666 66600#0 0123 666 666Branch VoIP
telephone
1. Internal call between two VoIP terminal devices at the branch office. The number dialed, '212', does not match any
of the routes listed in the call routing table. Therefore, the call router searches the local user list, finds the correct
entry there and can forward the call internally.
2. Internal call between a VoIP terminal device at the branch office and the internal subscriber '199' at the headquarters.
The number dialed, '199', does not match any of the routes listed in the call routing table during the first pass.
Similarly, no matching entry can be found in the local user list. In the second pass through the call routing table,
the standard routes are considered too. The route with the number called '#' corresponds to all calls which could
not be assigned earlier. The call to '199' is therefore carried out over the SIP PBX line.
3. External call from the branch office into the local telephone network. The number dialed, '0 555,555', matches the
route '0#' in the call routing table. The call router removes the '0' outside-line access prefix, completes the area
code for the local telephone network and completes the call to '0241 555 555' using the ISDN line.
4. External call from the branch office into a national telephone network. The number dialed, '0 0123 555 555', matches
the route '00#' in the call routing table. The call router sends the call out to the SIP PBX line unchanged. Only now
does the SIP PBX removes the '0' outside-line access prefix and completes the call to '0123 555 555' via the ISDN
outside line.
16.13.6 VoIP connectivity for locations without a SIP PBX
Companies with widely disperse offices and without their own SIP PBX can also take advantage of VoIP site-to-site
connectivity. In this "Peer-to-Peer" scenario, a LANCOM VoIP Router has been implemented at both locations.
INTERNET
ISDN
SIP-Telephone
PC with Softphone
PC
VOIP Router
VoIP telephone
Internal number ‘11’
VoIP softphone
Internal number ‘12’
VOIP Router
SIP-Telephone
PC with Softphone
PC
VoIP telephone
Internal number ‘21’
VoIP softphone
Internal number ‘22’
Location
Location
SIP PROVIDER
Destination
1
Internal telephony at and between both locations.
1
External telephony via the SIP provider with backup over ISDN.
1677
Reference Manual
16 Voice over IP (VoIP)
1
Calls to emergency and special numbers via ISDN.
Requirements
1
LANCOM connected to the LAN and WAN, an ISDN TE interface is linked to the ISDN NTBA.
1
The Internet connection has been set up by means of a VPN tunnel, as has the network connection between the two
locations. All terminal devices can contact each other with the IP addresses used.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected. For
each site, a separate number range is used; in this example, the internal numbers for location A begin with a '1' and
the internal numbers for location B begin with a '2'.
1
Each site has a SIP provider account.
Configuring the LANCOM
The following table provides a summary of the information required for configuration and where it can be entered.
Basically, all that is needed is a SIP PBX line for each location that is correspondingly setup at the remote location
SIP terminal
equipment location
B
LANCOM Location BSIP terminal
equipment location
A
LANCOM Location A
location_B.internallocation_B.internallocation_A.internallocation_A.internalInternal VoIP domain
20 to 2910 to 19Internal numbers
44External SIP telephone number
44Access information for SIP account
44External ISDN telephone numbers
(MSNs)
44Country and local area code
LOCATION_ALOCATION_BSIP PBX line
location_A.internallocation_B.internalSIP PBX domains
Call route 1. Called number
'1#'
1. Called number
'2#'
2. Destination line
'LOCATION_B'
2. Destination line
'LOCATION_A'
3.3. Destination
number ''1#'
Destination
number ''2#'
5
Although SIP PBX lines are the subject of the configuration presented here, you can still use this function even
without a PBX.
Detailed instructions on configuring the LANCOM:
1678
Reference Manual
16 Voice over IP (VoIP)
1. Under LANconfig, start the setup wizard for configuring the VoIP Call Manager. Enable the options 'SIP phone
system', 'ISDN phone system' and 'ISDN users'.
1. Configure the device as described in the preceding examples:
1
one line to a SIP provider
1
ISDN line with MSN mapping
1
Area and country code for each location
2. Enter a unique domain for the local VoIP domain which describes the local VoIP range for the site. Both sites use
different VoIP domains, e.g. 'location_A.internal' or 'location_B.internal'.
3. Configure the line leading to the SIP PBX with the following values:
1
SIP PBX line name: Unique name for the line leading to the remote site.
1
PBX SIP domain/realm: Internal VoIP domain for the remote site.
1
Registrar (FQDN or IP): Address for the LANCOM at the remote site, in the event that the device cannot be
identified via DNS resolution of the VoIP domain (PBX SIP domain/realm).
5
Use the private IP address that can be reached via VPN for the LANCOM here, not the public IP.
1
Leave the field for the shared password empty when registering to the SIP PBX.
1
Leave the field for the public PBX number empty.
4. The call routing table suggested by the setup wizard automatically allows international and national long distance
calls to be made via remote site's line, local calls are routed via ISDN.
1679
Reference Manual
16 Voice over IP (VoIP)
In addition, a standard route directs all numbers which cannot be resolved to the remote location's line.
1
5. Adapt the suggested call routing table in order to make international and national long distance calls via the SIP
provider line with backup over ISDN. When doing so, please observe that the '0' preceding the number must be
removed.
1680
Reference Manual
16 Voice over IP (VoIP)
1
After being adapted for international and national long distance, the call routing table should appear as follows:
1
In this state, all calls that cannot be resolved by the call routing table and which do not have a corresponding entry
in the local user list are automatically forwarded to the remote site.
1. If this is not desired, for example, where more than two sites are connected in this way, an additional entry can
detect only the internal calls to a particular site. For this, make a new entry (for the number range '20' to '29'
at location B) in the call routing table with the following values:
2.
2
Called number / name: e.g. '2#' for all numbers that begin with a 2.
2
Number / name: The number called is remains unchanged and is used as a destination number, i.e. here,
also '2#'.
2
Line: Enter the SIP PBX line for the remote location here, i.e. 'LOCATION_B'.
In doing so, the standard route is adjusted so that all numbers which cannot be resolved are transmitted via
ISDN.
After being adapted, the call routing table should appear as follows:
5
This entry for 'LOCATION_B' is placed well down toward the end of the call routing table so as not to
affect the more general rules. However, for interaction with the other routes, verify that only the internal
numbers for the remote site are directed to the respective line.
Configuring the VoIP terminal equipment
The VoIP terminal equipment is configured as described in the preceding examples with internal VoIP domains and
internal numbers for the local site.
1681
Reference Manual
16 Voice over IP (VoIP)
Call routing procedure on outgoing calls
For this application, most calls take place as described in the preceding examples. Internal calls between locations are
resolved as follows:
Destination linemapping,
number in use
correct usercorrect call
route
dialsUser
LOCATION_B21none2#21VoIP telephone
location A
1. Internal call between two VoIP terminal devices at locations A and B. The number dialed '21' matches the route
'2#' in the call routing table. The call router sends the call out over the line to the remote SIP PBX without changing
the number.
16.13.7 The LANCOM VoIP Router at a P2P (point-to-point) connection
Many companies use a point-to-point ISDN connection instead of the more common point-to-multipoint connection.
Point-to-point connections offer two significant advantages:
1
Because extension numbers can be used (DDI – Direct Dialing In), all terminal devices can be directly reached via a
common external switchboard number plus an extension number as a suffix.
1
A larger number of B channels can be used with the same range of telephone numbers, whereas with a
point-to-multipoint connection there are only two B channels, typically supporting up to 10 telephone numbers.
ISDN P2P connections are available either as a basic rate interface (BRI) with two B channels or as a primary rate interface
(PRI) typically with 30 B channels. LANCOM VoIP Routers support the ISDN basic rate interface only. To be able to use
more than four B channels, a P2P connection can be switched to multiple basic rate interfaces with the same range of
telephone numbers.
ISDN
VOIP Router
PC with Softphone
SIP-Telephone SIP-Telephone
INTERNET
PBX
server
FAX
ISDN P2P connection
Switchboard number: ‘0123-12345
2-digit extension numbers’
Exchange. ‘0’
ISDN extension numbers: ‘10’ to ’29’
ISDN telephones
Internal numbers ‘310’ to ‘319’
Exkursion number ISDN ‘10’ to ‘19’’
VoIP telephones and softphones
Internal numbers ‘320’ to ‘329’
Extension number ISDN ‘20’ to ‘29’
SIP PBX
3-figure extension numbers
Extension numbers for branch offices ‘3xx’
ISDN Phone
ISDN
ISDN Phone
ISDN
Objectives in implementing the LANCOM VoIP Router
1
Connecting additional SIP devices at the branch office.
1
Internal calls to users based at the headquarters and other branch offices via the SIP PBX located at the headquarters
(using VPN connection).
Requirements
1
LANCOM connected to LAN and WAN (via DSL/ADSL), ISDN-TE interface(s) are connected to the ISDN P2P connection,
ISDN-NT interface(s) are connected to an ISDN PBX.
1
The Internet connection has been set up by means of a VPN tunnel, as has the network connection between the two
locations. All terminal devices can contact each other with the IP addresses used.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected.
1682
Reference Manual
16 Voice over IP (VoIP)
Configuring the LANCOM
The configuration of the SIP client or connection to the SIP PBX as a SIP PBX line named 'HQ' has already been described
in other example applications and, here, is assumed to be familiar to you. The SIP PBX at headquarters uses the SIP
domain 'mycompany.HQ' and the branch office has the internal domain 'mycompany.BRANCH01'.
This is how the LANCOM is configured for operation at a point-to-point line:
1. The ISDN mapping table translates the DDI (extension numbers) to the internal numbers for processing as SIP calls.
CommentInternal numberISDN/S0 BusMSN/DDI
Maps DDI '0' to internal number '300'300ISDN1, ISDN20
Adds the prefix '3' to all other DDI '0' for the
internal numbers
3#ISDN1, ISDN2#
1. Both entries in this example apply to the ISDN interfaces 1 and 2, which are connected to the ISDN line. The activation
of two ISDN interfaces makes four B channels available for use. If both B channels of an ISDN interface are engaged,
there is an automatic attempt to redirect calls to another ISDN interface with free B channels.
2. Based on the ISDN user entries, the internal numbers are translated back to the DDI numbers.
CommentISDN/S0 BusMSN/DDIInternal number
Maps internal number '300' to DDI '0'. Useful
if the exchange is on the ISDN PBX.
ISDN3, ISDN40300
Removes the leading '3' from all internal
numbers beginning with '3'.
ISDN3, ISDN41#31#
1. With the second entry, all ISDN terminal devices with the ISDN extension numbers '10' to '19' are made known to
be ISDN users in the VoIP system. A single entry here suffices for all subscribers. All ISDN users then use the same
data to register at the SIP PBX.
5
ISDN users entered with the # symbol can only be reached from the SIP PBX if this does not require users to
register. For ISDN users to register, separate entries in the ISDN user list are required.
Both entries in this example apply to the ISDN interfaces 3 and 4, which are connected to the ISDN PBX. Here, too,
the four B channels of the two interfaces can be used "dynamically" for the connection between the ISDN PBX and
the LANCOM VoIP Router.
2. Routing of calls is governed by the call routing table. If you use the LANconfig Wizard, the call-routing table is preset
so that all outgoing calls from ISDN and SIP devices are conducted via the SIP PBX with the exception of local calls
and calls to service numbers, such as 0800 numbers.
16.13.8 SIP trunking
In telecommunications jargon, trunking is the process by which several lines or connections are combined into one shared
line. In the world of VoIP, SIP providers are increasingly offering products which provide the ability to make several calls
simultaneously using a single account. Together with the possibility of being able to contact SIP participants via a shared
switchboard number with individual extensions (DDIs), these types of accounts are also becoming attractive for business
customers.
There are two possible options when using a SIP account with trunking:
1
The customer retains his previous ISDN connection, along with any corresponding telephone numbers from the
telephone company, and sets up an additional account having a separate number range with a SIP provider.
1683
Reference Manual
16 Voice over IP (VoIP)
1
The customer ports the numbers used thus far from the telephone company to the SIP provider and from then on
uses the same numbers using SIP.
SIP-Telephone
INTERNET
via ADSL
SIP provider
ISDN
VOIP Router
PC with Softphone
SIP-Telephone
PBX
FAXISDN Phone
ISDN
ISDN Phone
ISDN
VoIP telephones and softphones
Internal numbers ‘20’ to ‘99’
SIP provider
Switchboard number: ‘0456-54321’
2-digit extension numbers’ exchange: ‘0’
ISDN extension numbers: ‘10’ to ‘99’
ISDN P2P connection
Switchboard number: ‘0123-12345’
2-digit extension numbers’ exchange: ‘0’
ISDN extension numbers: ‘10’ to ‘29’
ISDN telephones
Internal numbers: ‘10’ to ‘19’
In this example we will take a look at a company planning to add a SIP trunking account, with up to 100 extension
numbers, to its current ISDN point-to-point line having 20 extensions. The ISDN terminal devices with point-to-point line
extensions used thus far can be retained. All new employees are to be issued with a SIP telephone with an extension
via the SIP account.
Unique extensions are used since staff members have to be able to call each other internally. In order to migrate smoothly
towards SIP, all ISDN terminal devices are to be contactable using both extension number and switchboard number of
the SIP account. So an ISDN telephone should react in the same way for calls to '0123-12345 12' as it does for calls to
'0456-54321 12'.
With the exception of emergency calls and service numbers, such as "0800" numbers, out-going calls are generally made
using the SIP account. The signaling of SIP telephone numbers to call parties is paving the way for the medium-term
discontinuation of ISDN telephone numbers.
Objectives in implementing the LANCOM VoIP Router
1
Connection of additional SIP terminal devices
1
Internal calls between ISDN and SIP terminal devices.
1
Continuation of availability using ISDN telephone numbers used thus far.
1
Low-cost calls by using a shared SIP account.
Requirements
1
LANCOM connected to LAN and WAN (via DSL/ADSL), ISDN-TE interface(s) are connected to the ISDN P2P connection,
ISDN-NT interface(s) are connected to an ISDN PBX.
1
The Internet connection has been set up. All terminal devices can contact each other with the IP addresses used.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected.
Configuring the LANCOM
This is how the LANCOM is configured for operation at a point-to-point line:
1. The LANCOM is configured for operation at a point-to-point line by adding two simple entries in the ISDN mapping
table and in the list of ISDN users.
ISDN mapping table
CommentInternal numberISDN/S0 BusMSN/DDI
Outputs the unchanged DDI as an internal
telephone number.
#ISDN1, ISDN2#
ISDN user list
1684
Reference Manual
16 Voice over IP (VoIP)
CommentISDN/S0 BusMSN/DDIInternal number
Outputs the unchanged internal number as a
DDI.
ISDN3, ISDN4##
2. When configuring SIP clients, just the internal VoIP domain of the LANCOM VoIP Router and the associated internal
number are entered. The extension numbers previously used for the ISDN terminal devices remain unallocated.
3. A SIP provider line is created for the SIP account. The 'Trunk' option is selected as the mode for this line.
4. Routing of calls is governed by the call routing table. When using the Wizards available with LANconfig, the call
routing table is pre-configured such that all out-going calls from ISDN and SIP devices are made using the SIP trunk
account (with the exception of local calls and calls to service numbers such as the emergency services or "0800"
numbers).
Process of call routing
In this example, call routing benefits from the unique internal telephone numbers.
1
With in-coming calls, regardless of whether they are via ISDN or SIP, only the DDI is passed on to the LANCOM VoIP
Router. Since the DDI and internal numbers are the same in this example, an extension number can be used to put
through calls to locally registered SIP users or to dynamic ISDN users.
5
If the reported DDIs can not, or should not, be used directly as internal numbers, corresponding telephone
number translations are defined in the ISDN and SIP mapping tables, see and ..
1
With out-going calls, the decision as to whether calls are made using ISDN or SIP may be controlled from the call
routing table. In the default setting after using the Wizards, SIP is taken to be the normal destination line (with the
exception of local calls and special numbers). Local calls, for example, may be switched to SIP by changing an entry
in the call routing table.
5
In this case, the SIP number is displayed at the subscribers on the other side of the connection, even if the call
originates from an ISDN terminal device.
16.13.9 Remote gateway
Distributed company structures usually provide ISDN connections at branch offices to allow staff local access to the
telephone network using appropriate ISDN terminal devices.
1
A connection from the local ISDN terminal devices to a SIP PBX at the headquarters can easily be set up using a
LANCOM VoIP Router.
1
Furthermore, the "Remote Gateway“ function can be used to connect both the terminal devices and the local ISDN
connections to the central PBX. Benefits of the remote gateway:
2
The local ISDN connections are made available to all users in the company network. Calls to the local ISDN
network can be made from anywhere as local calls (even from beyond state boundaries).
2
All calls, even those made by local users into their "own" telephone network, can be made via the SIP PBX,
consequently facilitating central administration and logging.
PC with Softphone
ISDN Phone
ISDN
VOIP Router
INTERNET
SIP PBX
ISDN
ISDN telephone
Internal number ‘831’
VoIP Softphone
Internal number ‘832’
local ISDN connection in Vienna
Switchboard number ++43-1-666
Extensions ‘1’ to ‘9’
SIP PBX at the headquarters in Munich
Switchboardnumber ++49-89-12345
Extensions ‘111’ to ‘999’
1685
Reference Manual
16 Voice over IP (VoIP)
In this example we'll take a look at a company headquartered in Munich. The branch office in Vienna should be in a
position to call the headquarters using the internal numbers. "83“ numbers are taken from the headquarter's number
range and are reserved for Vienna for this purpose. The sales and support departments at the company headquarters
should also be contactable from Austria as a local, or national long-distance call from Vienna. The purchasing department
would also like to be able to contact suppliers in Austria using national long-distance calls.
Objectives in implementing the LANCOM VoIP Router
1
Internal calls to users based at the headquarters and other branch offices via the SIP PBX located at the headquarters
(using VPN connection).
1
Integration of the local ISDN interface into the telephone structure of the organization.
Requirements
1
LANCOM Connected to LAN and WAN (via DSL/ADSL), ISDN-TE interface(s) are connected to the ISDN connection,
ISDN-NT interface(s) are connected to an ISDN PBX or the ISDN terminal devices.
1
The Internet connection has been set up by means of a VPN tunnel, as has the network connection between the two
locations. All terminal devices can contact each other with the IP addresses used.
1
A dialing plan with a unique internal telephone number for each piece of terminal equipment to be connected.
Configuring the LANCOM
The following steps are involved when configuring the LANCOM VoIP Router:
1
An entry is created for each ISDN user so that the terminal equipment can register with the upstream SIP PBX.
1
For SIP clients, this registration information is entered in the VoIP telephone or the softphone.
1
The connection to the SIP PBX, as a SIP-PBX line with the name 'HQ', has already been described in other application
examples and familiarity with it is assumed from here on.
1
In addition to this connection, a further connection "Gateway“ needs to be made to the SIP PBX, which helps in
making the local ISDN connection known to the upstream SIP PBX.
1
The connection between the local ISDN connection and the remote SIP PBX is made using the entries in the call-routing
table.
This is how the LANCOM is configured for operation as a remote gateway:
1. In the ISDN mapping table, local DDIs (extension numbers) are converted to internal telephone numbers for processing
as SIP calls.
CommentInternal numberISDN/S0 BusMSN/DDI
All DDIs pending at the ISDN interfaces are
switched further without being changed.
#ISDN1, ISDN2#
1. A new entry is created in the list of SIP provider connections with the following information:
1
Name of the connection: 'GW.HQ'
1
Mode: Gateway
1
SIP domain: SIP domain of the headquarters 'mycompany.HQ'
1
SIP ID: Account name for the SIP gateway in the SIP PBX located at the headquarters
1
Authentication name and password: Registration data for the SIP gateway
2. Additional entries are created in the call-routing table to switch calls between the headquarters and the local ISDN
connection:
1686
Reference Manual
16 Voice over IP (VoIP)
CommentDestination
line
Source lineDestination
number
Called number
Forwards all in-going calls arriving at the LANCOM VoIP Router over
ISDN to the headquarters via the gateway. The DDI is preceded by
'83' so as to map correctly to the internal numbers.
GW.HQISDN83##
Forwards all in-going calls arriving at the LANCOM VoIP Router over
ISDN to the headquarters via the gateway. 555' is used as the number
for support.
GW.HQISDN5559
Forwards all out-going calls from the headquarters to the Austrian
national network to the local ISDN connection (without country code).
ISDNGW.HQ0#0043#
Forwards all other calls without change.##
Call routing procedure on outgoing calls
Destination
line
Source
line
Assigned viaCall router
sends
Call router
receives
dialsUser
InternalGW.HQ831831089-12345-831ISDN network D 1. List of local ISDN
users
GW.HQISDN8311666-1ISDN network A 1. Call routing table
2. List of local ISDN
users
GW.HQISDN5559666-9ISDN network A 1. Call routing table
ISDNGW.HQ0662-333330043-662-333330043-662-33333SIP exchange 1. Call routing table
1. Call from customer in Hamburg to staff in Vienna. The customer dials the number of the Munich headquarters using
the correct extension '089-12345-831'. Because the ISDN user is registered with the internal telephone number, the
PBX at the headquarters receives only the DDI '831' and passed it on via the SIP PBX line. The LANCOM VoIP Router
receives '831', locates a matching entry in the list of locally registered users and is able to connect the call.
2. Call from customer in Vienna to the branch office in Vienna. The customer dials the number of the branch office in
Vienna using the correct extension '666-1'.
1
The LANCOM VoIP Router receives the DDI '1' and is not able to locate a matching entry in the list of locally
registered users. Using the call-routing table, the telephone number is changed to '831' and forwarded on to
the PBX in Munich via the SIP gateway connection. The PBX recognizes the registered ISDN user with the internal
telephone number '831' and passes the call back to the LANCOM VoIP Router via the SIP PBX line.
1
The LANCOM VoIP Router then receives '831', locates a matching entry in the list of locally registered users and
is able to connect the call.
3. Call from customer in Salzburg to the support number in Vienna. The customer dials the number of the branch office
in Vienna using the correct extension '666-9'. The call is automatically put through to the internal support number
'555' using the call routing table.
4. Call from employee in Munich to customer in Salzburg. The employee dials '0043-662-33333'. The PBX in Munich
is configured such that all calls to Austria are forwarded via the SIP gateway connection to the LANCOM VoIP Router.
The call router receives the complete number, drops the country code as per the routing table having source line
'GW.HQ' and forwards the remaining number to the ISDN line.
5
Here the call number from Munich is displayed at the remote site.
1687
Reference Manual
16 Voice over IP (VoIP)
16.14 Diagnosis of VoiP connections
16.14.1 SIP traces
Trace output can be used to check the internal processes in LANCOM devices during or after configuration. A SIP trace
displays all of the SIP information which is exchanged between a LANCOM VoIP Router and a SIP provider or upstream
SIP PBX. The SIP trace is activated with the following command:
trace + sip-packet
16.14.2 Connection diagnosis with LANmonitor
LANmonitor displays a wealth of information about calls switched in the LANCOM:
1
Information about the registered users.
1
Information about the lines available.
1
Information about current calls, including the translation of telephone numbers and domains by the Call Manager.
1688
Reference Manual
16 Voice over IP (VoIP)
1
Information about the fixed and automatic QoS bandwidth reservations and settings.
1689
Reference Manual
16 Voice over IP (VoIP)
16.15 Addition(s) to LCOS 7.80
16.15.1 Global settings, DiffServ for SIP & RTP
The Voice Call Manager marks SIP and RTP packets with DiffServ CodePoints (DSCP), which enables other hardware to
recognize and prioritize these packets.
LANconfig: Voice Call Manager / Advanced
WEBconfig: LCOS menu tree / Setup / Voice Call Manager / General
1
SIP DiffServ CodePoint (DSCP)
This defines which DiffServ CodePoints (DSCP) the SIP packets (for call signaling) are to be marked with.
Possible values:
2
BE, CS-0, CS-1, CS-2, CS-3, CS-4, CS-5, CS-6, CS-7, AF-11, AF-12, AF-13, AF-21, AF-22, AF-23, AF-31, AF-32,
AF-33, AF-41, AF-42, AF-43, EF
Default:
2
CS-1
1690
Reference Manual
16 Voice over IP (VoIP)
5
The option CS-1 is actually outdated now, but it is set as the default value to ensure backwards compatibility.
Common values for modern VoIP installations are CS-3, AF-31 or AF-41. We recommend using CS-3, one of
the most widespread settings on the market.
1
RTP DiffServ CodePoint (DSCP)
This defines which DiffServ CodePoints (DSCP) the RTP packets (voice data stream) are to be marked with.
Possible values:
2
BE, CS-0, CS-1, CS-2, CS-3, CS-4, CS-5, CS-6, CS-7, AF-11, AF-12, AF-13, AF-21, AF-22, AF-23, AF-31, AF-32,
AF-33, AF-41, AF-42, AF-43, EF
Default:
2
EF
5
With DSCP set to BE or CS-0 the packets are sent unmarked. Further information about DiffServ CodePoints
is available in the Reference Manual under the section "QoS".
16.16 Addition(s) to LCOS 8.60
16.16.1 SIP ALG: Proxy for bypassing NAT in the router
The following sections provide explanations on the SIP ALG.
SIP ALG: Basics
SIP is increasingly becoming established as the basis for modern real-time communication in IP networks. Unified
Communications (UC) and collaboration, IP telephony, video streaming, camera surveillance, intercoms, paging systems,
and audio recordings increasingly rely upon SIP and RTP for switching and transmission.
The NAT (Network Address Translation) typically carried out by the access router at the edge of the LAN presents a barrier
to SIP communications. This is because of the addresses transmitted during SIP signaling and also because of the
dynamically negotiated media sessions and the UDP-based RTP connections that depend upon them.
Restrictive firewall configurations prevent communications even where client/server-side mechanisms such as STUN, ICE
and TURN are used to overcome NAT.
The SIP ALG (Application Layer Gateway) for LCOS detects SIP connections and the RTP-based media streams that they
depend upon and transforms these in line with the NAT rules in the access router.
Also, the SIP ALG monitors the bandwidths of the SIP connections and so provides QoS.
SIP ALG: Features
The SIP-ALG for LCOS has the following features:
1
No local registration: The SIP proxy does not provide registration for SIP endpoints. Instead, it mediates the
registrations directly to the approved SIP domains.
5
This means that it is impossible to set up a line backup over alternative voice lines (analog, ISDN).
1
Transparency for SIP extensions: The SIP ALG also transmits unknown, non-standard header elements to enable
the SIP messages to be communicated between terminal devices and SIP PBXs.
5
The SIP ALG determines an unambiguous destination for every SIP message. Forking (communication between
multiple devices of the same identity) is handled upstream. The SIP-ALG merely provides transparent forwarding
of these data packets.
1691
Reference Manual
16 Voice over IP (VoIP)
SIP ALG: Configuration
The following sections provide explanations for the configuration of the SIP ALG.
5
The SIP ALG is disabled in the default settings.
SIP ALG: Configuration by LANconfig
1. Start LANconfig, for example from the Windows start menu with Start > Programs > LANCOM > LANconfig.
LANconfig now automatically searches the local network for devices. As soon as LANconfig has completed its search,
it presents a list of all the devices it found, if possible with a brief description, the IP address and the status.
2. Double-click on the entry for the device on which the SIP ALG is to be configured.
LANconfig opens the Configuration Wizard and displays the current configuration of the device.
3. In the Configuration Wizard, switch to the menu SIP-ALG > General.
4. If necessary, highlight the option SIP ALG activated.
This option is already enabled in the default setting.
5. Close the configuration by clicking on OK.
Additions to the Setup menu
SIP ALG
Configure the settings for the SIP ALG here.
Telnet path:
Setup
1692
Reference Manual
16 Voice over IP (VoIP)
Operating
This setting determines whether the SIP ALG is enabled.
Telnet path:
Setup > SIP-ALG
Possible values:
Yes
No
Default:
No
Additions to the Status menu
SIP ALG
This directory contains the status information provided for the SIP ALG (application layer gateway)
Telnet path:
Status
Calls
This table shows all current calls being routed via the SIP ALG.
Telnet path:
Status > SIP-ALG
Call ID
The call ID of the call.
Telnet path:
Status > SIP-ALG > Calls
SIP destination address
The IP address of the call destination.
Telnet path:
Status > SIP-ALG > Calls
SIP source address
The IP address of the call source.
Telnet path:
Status > SIP-ALG > Calls
1693
Reference Manual
16 Voice over IP (VoIP)
SIP source port
The port used by the call source.
Telnet path:
Status > SIP-ALG > Calls
WAN address
The WAN address from which the call is made.
Telnet path:
Status > SIP-ALG > Calls
SIP WAN port
The WAN port from which the call is made.
Telnet path:
Status > SIP-ALG > Calls
RTP destination address
The destination address used by RTP.
Telnet path:
Status > SIP-ALG > Calls
RTP source port
The destination port used by RTP.
Telnet path:
Status > SIP-ALG > Calls
RTP source address
The source address used by RTP.
Telnet path:
Status > SIP-ALG > Calls
RTP source port
The source port used by RTP.
Telnet path:
Status > SIP-ALG > Calls
1694
Reference Manual
16 Voice over IP (VoIP)
RTP WAN port
The WAN port used to communicate by RTP.
Telnet path:
Status > SIP-ALG > Calls
Registrations
This table shows all current registrations.
Telnet path:
Status > SIP-ALG
SIP-ID
The SIP ID of the subscriber is the phone number of the SIP account or the user's name (SIP URI).
Telnet path:
Status > SIP-ALG > Registrations
Registrar domain
This shows the domain where the SIP ID is registered.
Telnet path:
Status > SIP-ALG > Registrations
Registrar address
The IP address which the registrar can be reached.
Telnet path:
Status > SIP-ALG > Registrations
Client address
The IP address of the SIP client.
Telnet path:
Status > SIP-ALG > Registrations
Client port
The port used by the SIP client.
Telnet path:
Status > SIP-ALG > Registrations
1695
Reference Manual
16 Voice over IP (VoIP)
WAN address
The WAN address used by this SIP ID.
Telnet path:
Status > SIP-ALG > Registrations
WAN port
The WAN port used by this SIP ID.
Telnet path:
Status > SIP-ALG > Registrations
Register method
This is the method used to establish a new connection.
Telnet path:
Status > SIP-ALG > Registrations
Possible values:
REGISTER
INVITE
OPTIONS
NOTIFY
PUBLISH
SUBSCRIBE
INFO
Expiration time
The time in seconds before re-registration is required. This value does not indicate the time remaining but the time period
negotiated during registration.
Telnet path:
Status > SIP-ALG > Registrations
Operating
This value indicates whether the SIP ALG is enabled or not.
Possible values:
Yes
No
1696
Reference Manual
16 Voice over IP (VoIP)
16.16.2 Restricting or preventing SIP registration over WAN connections
As of LCOS version 8.60 RC2, you can restrict the registration of SIP users at the Voice Call Manager over a WAN link,
or prevent this altogether. The configuration for the SIP user now includes a new parameter that controls this. You can
allow unrestricted registration over the WAN, via VPN only, or you can prohibit this altogether.
Additional security for the registration is provided by a count of the number of times that a SIP user authenticates
incorrectly. Once the counter reaches a threshold value, the device locks the SIP user's account for a certain time. During
this period the SIP user cannot log on to the Voice Call Manager. You can freely set the values for the threshold and the
duration of the lock.
Additions to the Setup menu
Access from WAN
This item determines whether and how SIP clients can register via a WAN connection.
Telnet path:
Setup > Voice-Call-Manager > Users > SIP-User > Users
Possible values:
Yes
No
VPN
Default:
No
Lock minutes
Determines for how many minutes a SIP user will be blocked after authentication has failed due to incorrect login data.
Telnet path:
Setup > Voice-Call-Manager > General > Lock-Minutes
Possible values:
0 to 255 minutes
1697
Reference Manual
16 Voice over IP (VoIP)
Special values:
0: Lock off
Default:
5
Login errors
This value specifies the number of failed attempts before a SIP user is locked for a certain time.
Telnet path:
Setup > Voice-Call-Manager > General > Login-Errors
Possible values:
0 to 255
Special values:
0: The first false login triggers the lock.
Default:
5
Additions to the Status menu
Local register
This column indicates whether the individual SIP users are registered locally, not registered, incorrectly authenticated or
blocked.
Telnet path:
Status > Voice-Call-Manager > Users > Local-register
Possible values:
Registered
Not-registered
Auth-failure
Blocked
Default:
Blank
16.17 Addition(s) to LCOS 8.62
16.17.1 Default setting for WAN registration of a SIP user
The default setting for the WAN registration of a SIP user has changed from 'yes' to 'no'.
1698
Reference Manual
16 Voice over IP (VoIP)
Additions to the menu system
Access from WAN
This item determines whether and how SIP clients can register via a WAN connection.
Telnet path:
Setup > Voice-Call-Manager > Users > SIP-User > Users
Possible values:
Yes
No
VPN
Default:
No
16.18 Addition(s) to LCOS 8.80
16.18.1 Default setting for WAN registration of a SIP user
The default setting for the WAN registration of a SIP user has changed from 'yes' to 'no'.
Additions to the menu system
Access from WAN
This item determines whether and how SIP clients can register via a WAN connection.
Telnet path:
Setup > Voice-Call-Manager > Users > SIP-User > Users
Possible values:
Yes
No
VPN
Default:
No
1699
Reference Manual
16 Voice over IP (VoIP)
17 High availability – backup solutions
17.1 High availability for networks
Networked cooperation between several offices or even between continents has become an everyday part of modern
business. The paths of communication between headquarters, subsidiaries and field workers increasingly rely upon public
infrastructures. VPN has become established as the de facto standard for cost-effective and secure enterprise
communications over the Internet.
However, many of important elements in these network structures remain susceptible to failure which could have severe
consequences for business operations:
1
The remote Internet gateway itself can fail.
1
The physical lines for the connection to the Internet or to a remote network can fail:
2
The Internet-access cable between the site and the provider could fail; after damage from construction work,
for example.
2
The DSL connection may fail, while the ISDN connection remains functional.
1
The provider's network may be disturbed or even fail.
GPRS
analog
ISDN
INTERNET
PROVIDER
HEADQUARTER
server
ACCESS POINT
server server
Branch Office
splitter
NTBA
VPN GATEWAY
VPN GATEWAY
Router
MOBILE PHONE
A
2
3
4
DSL
Internet routers and access points from LANCOM offer a range of security and backup functions that can be used for
the protection of your network from disturbance.
17.1.1 How is a network-connection disturbance detected?
The first stage in protecting a network connection from the effects of a disturbance is to detect the disturbance itself.
The following methods are available to check the connections:
1
Check the PPP connection to the provider with PPP LCP echo monitoring.
1
Check if remote stations can be contacted via name or IP address with ICMP polling (ping from end to end).
1
Check the tunnel end points with "dead peer detection" (DPD).
PPP LCP echo monitoring
The method checks the PPP connection to a certain remote site with regular LCP requests. This method is typically used
to check the connection to the Internet provider. LCP requests are directly sent to the access server.
In the PPP list, a time interval for the transmission of LCP requests to the remote site is defined for this connection.
Further, for the event that LCP replies are missed, the number of retries before the transmission of a new LCP request is
defined. Should the transmitter not receive any reply to the retries, the line is considered to have failed.
1
Time: The time entered into the PPP list must be multiplied by the factor 10 to arrive at the actual interval between
two LCP requests. Entering the time as "5" means that an LCP request will be prompted every 50 seconds.
1
Retries: If no reply to an LCP request is received then the remote site will be checked in shorter intervals. The device
then tries to reach the remote site once a second. The number of retries defines how many times these attempts are
1700
Reference Manual
17 High availability – backup solutions
repeated. Entering "5" under retries means that the LCP request will be repeated 5 times before the connection is
considered to have failed.
5
PPP LCP monitoring only checks the PPP connection path as far as the Internet provider.
LANconfig: Communication / Protocols / PPP list
WEBconfig: LCOS menu tree / Setup / WAN E PPP list
ICMP polling
Similar to LCP monitoring, ICMP polling transmits regular requests to a remote site. Ping commands are transmitted and
the answers to them are monitored. Unlike LCP monitoring, the target site for ICMP pings can be freely defined. Pinging
a router in a remote network thus provides monitoring for the entire connection and not just the section to the Internet
provider.
A ping interval is defined for the remote site in the polling table. Further, for the event that replies are missed, the number
of retries before the transmission of a new LCP request is defined. Should the transmitter not receive any reply to the
retries, the target for the ping requests is classified as unavailable.
Up to four different IP addresses can be entered for each remote site that will be checked in the remote network in
parallel. Only if all of the IP addresses are unavailable is the connection considered to have failed.
5
With the ICMP polling, an entire connection can be monitored from end to end.
1
Name of the remote site
1
IP address 1-4: IP addresses for targeting with ICMP requests to check the remote site.
5
If no IP address is entered for a remote site that can be checked with a ping, then the IP address of the DNS
server that was determined during the PPP negotiation will be checked instead.
1
Ping interval: The time entered into the polling table defines the time interval between ping requests. If the value
"0" is entered, then the standard value of 30 seconds applies.
1701
Reference Manual
17 High availability – backup solutions
1
Retries: If no reply to a ping is received then the remote site will be checked in shorter intervals. The device then
tried to reach the remote site once a second. The number of retries defines how many times these attempts are
repeated. If the value "0" is entered, then the standard value of 5 retries applies.
LANconfig: Communication / Remote sites E Polling table
WEBconfig: LCOS menu tree / Setup / WAN E Polling table
Dead peer detection (DPD)
This method of connection monitoring is used when VPN clients dial-in to a VPN gateway. This is designed to ensure
that a client is logged out if there is an interruption to the VPN connection, for example when the Internet connection
is interrupted briefly. If the line were not to be monitored, then the VPN gateway would continue to list the client as
logged-on. This would prevent the client from logging in again as, for example, the WLANmonitor prevents single serial
numbers from multiple simultaneous log-ins.
5
For the same reason, without line monitoring a user with the same "identity" (user name) would be prevented
from dialling in because the associated user would still be in the list for the logged-in client.
With dead peer detection, the gateway and client regularly exchange "keep alive" packets. If no replies are received,
the gateway will log out the client so that this identity can be registered anew once the VPN connection has been
re-established. The DPD time for VPN clients is typically set to 60 seconds.
1702
Reference Manual
17 High availability – backup solutions
The dead peer detection is set up with LANconfig in the configuration area 'VPN' on the 'General' tab in the 'Connection
list'.
LANconfig: VPN / General / Connection list
WEBconfig: LCOS menu tree / Setup / VPN E VPN-Peers
17.1.2 High-availability of lines – backup connections
If there is a disturbance to the connection with the Internet provider or to a remote network, a backup line can act as a
temporary replacement for the normal data line. This requires the existence of a second physical connection which can
be used to contact the remote site. Examples of backup lines are typically:
1
An ISDN line as a backup for DSL Internet access
1
An ISDN line as a backup for VPN network coupling
1
A modem connection (GSM or analog) as a backup for DSL or ISDN lines and VPN connections
Configuration of the backup connection
The following steps are necessary to define a backup connection:
1. The backup connection requires the appropriate WAN interface to be set up so that the remote site can be reached
via this alternative route. If, for example, the ISDN line is to serve as the backup connection, then the remote site is
set up as an ISDN remote site (along with the necessary entries in the communications layers and in the PPP list).
2. If the connection to the remote site cannot be checked with LCP requests, the monitoring of the connection should
be initiated with an entry in the polling table.
3. Assignment of the new backup connection to the remote site which is to be backed up. This entry is made in the
backup table. Dedicated entries in the routing table are not required for a backup connection. The backup connection
automatically takes over the source and target networks from the remote site that routes the data under normal
operating conditions.
A remote site can be assigned with multiple backup lines in the backup table. In the case of backup, the system
decides which backup line is to be used first:
1
The last remote site that was reached successfully
1703
Reference Manual
17 High availability – backup solutions
1
The first remote site in the list
LANconfig: Communication / Call management / Backup table
WEBconfig: LCOS menu tree / Setup / WAN E Backup table
Triggering the backup connection
The backup is triggered when the monitoring mechanisms defined for the standard connection (LCP or ICMP polling)
detect that contact to the remote site has been lost.
The backup connection will be established if:
1
The backup delay time has expired and
1
either
2
a data packet is to be transferred or
2
a hold time of 9999 seconds has been defined for the backup connection.
1704
Reference Manual
17 High availability – backup solutions
The backup delay time is set with LANconfig in the configuration area 'Communication' on the 'Call management' tab
or alternatively with Telnet under /Setup/WAN-Modul/Backup-delay-seconds.
Return to the standard connection
The router constantly tries to establish the standard connection while the backup connection is active. As soon as the
standard connection has been established, the backup connection is terminated and the line monitoring with LCP or
ICMP polling is resumed.
Only keep-alive connections return automatically!
The standard connection will only be automatically re-established after a backup event if the hold time for the connection
is configured properly:
1
A hold time of "0" means that the connection will not be actively terminated. If the connection is interrupted, it will
not be automatically established again. Only when communication is required of the connection will it be established.
1
A hold time of "9999" means that the connection is permanently kept open. If it is interrupted, then the connection
will be actively opened up again. This behavior is known as keep alive.
Set the hold time to "9999" for connections to the Internet provider (in the corresponding peer list) and backed-up VPN
connections (in the VPN connection list) to ensure that the connection is automatically re-established and resumes data
transfer after interruption.
17.1.3 High-availability of gateways – redundant gateways with VPN load balancing
Another cause of failure apart from the connection to the provider or to another network may lie with the local gateway.
Severe effects can result from the failure of a central VPN gateway that is used, for example, to connect the networks
of multiple remote locations with the central network at headquarters.
To ensure that the headquarters remains in contact, multiple VPN endpoints (generally identically configured VPN
gateways operated in parallel) can be installed. Should line polling (with dead-peer detection, ICMP line polling) indicate
a failure, then a variety of strategies (e.g. the random selection of one of the available gateways) can be used to enable
communication to a different VPN end point. At the central headquarters, the new router and the local default gateway
are propagated by dynamic routing (RIP V2).
1705
Reference Manual
17 High availability – backup solutions
To avoid the situation where the additional VPN gateways remain unused, intelligent load balancing ensures that all of
the devices share the load of incoming and outgoing connections also under normal operating conditions.
More information about redundant gateways and load balancing is available under .
17.1.4 High-availability of the Internet access – Multi-PPPoE
The third of the different basic sources of failures is the case where the gateways and connections are in order but the
provider's own network is down. Such cases are handled by setting up multiple PPoE connections at the physical interface
of a single device (Multi-PPPoE).
To define these backup solutions as alternative Internet accesses you can use, for example, the Setup Wizard to set up
two Internet access accounts one after another. The standard Internet access for normal operations should be set up
last. Consequently, the entries in the routing table will be associated with the appropriate remote site.
Additionally, an entry is made in the backup table that defines the alternative Internet access account as the backup to
the remote site at the standard provider.
More information about the definition of multiple PPPoE connections is available under .
17.1.5 Example applications
Backup DSL Internet access with ISDN internet access
INTERNET
PROVIDER
INTERNET
PROVIDER
server
HEADQUARTER
DSL
ISDN internet access
VPN GATEWAY
In this simple backup scenario, Internet access is realized via a DSL connection. An ISDN connection is defined as a
backup in case of failure of the DSL Internet access.
This backup solution can be quickly and easily set up with the help of the LANconfig Setup Wizard, for example. A further
degree of security is available by defining another Internet provider in addition to the standard provider. This solution
caters for the contingency where the provider's network fails and the problem is not caused by the DSL connection.
Backup dynamic VPN network coupling with an ISDN direct dial up connection
INTERNET
PROVIDER
VPN GATEWAY
server
HEADQUARTER
Router
Home Office
DSL
VPN
ISDN direct dial up connection
DSL
In the case that a branch office is connected to the headquarters via a VPN connection, the Internet-based VPN connection
can be backed up by a direct ISDN dial-in connection. Should the Internet connection fail at either of the two routers,
the data transmission is transferred to the ISDN link.
In this scenario we are assuming a fully configured VPN connection between the two networks.
1
A LAN-LAN coupling via ISDN is additionally set up between the two networks. Do not use the Setup Wizard to set
up this network coupling! The Wizard would change the entries in the routing table and would thus upset the function
of the VPN network connection. Set up the ISDN network coupling in both routers manually— with the appropriate
entries for the remote sites in the peer list, the PPP list and with the necessary telephone numbers and access
identifiers.
1
In the gateway at the headquarters, create an entry in the backup table that acts to backup the VPN remote site via
a directly dialled ISDN remote site.
1706
Reference Manual
17 High availability – backup solutions
1
Further, the router at the headquarters requires an entry for the monitoring of a remote device in the network at the
branch office: Typically in the form of the LAN IP address at the remote VPN gateway. This entry ensures that the
router at the headquarters can react immediately to a failure of the VPN connection.
Should there be a failure in the connection between the headquarters and branch office (on the way to the Internet
provider or at the provider itself) then the ISDN connection takes over the data transfer independent of the Internet.
Redundant VPN gateways
VPN GATEWAY
HEADQUARTER server
INTERNET
Router
Branch Office
VPN GATEWAY
VPN GATEWAY
dynamic VPN
endpoint
dynamic routing via IP RIP
DMZ
In decentralized company structures that rely on VPN for networking the various locations, the availability of the central
VPN gateway is of particular significance. The company-wide communications only remain reliable as long as these
central dial-in nodes are working properly.
With the option of configuring several "remote gateway" addresses as "dynamic VPN endpoints" for a VPN connection,
LANCOM VPN gateways offer a high level of availability by using redundant devices. This involves multiple gateways at
the headquarters being set up with identical VPN configurations. On location at the satellite sites, all of these available
gateways are entered as possible remote stations for the VPN connection. If one of the gateways is unavailable, the
remote router automatically redirects the request to one of the other routers.
To ensure that the computers in the LAN at the headquarters know which VPN gateway it to be used to reach a particular
satellite station, the outband router currently connected to the remote site is propagated via RIPv2 to the network at
the headquarters.
5
A powerful mechanism for load balancing between the VPN gateways at the headquarters is attained with the
configuration of the satellite stations to select the remote site for VPN connection on a random basis ("VPN load
balancing").
Further information to redundant gateways and "VPN Load Balancing" can be found in .
Backup a VPN gateway with an ISDN gateway and RIP
HEADQUARTER
server VPN GATEWAY
INTERNET
Home Office
DSL
ISDN direct dial up connection
VPN GATEWAY
Router
Going a step further, the VPN gateways themselves can be backed up in case of failure. This case assumes the existence
of a VPN connection between two gateways. In the event that one of the two VPN devices should fail, an ISDN connection
is to take over the data transfer; in this case via a direct dial-in connection.
Regarding the configuration of this solution, we again assume a functional VPN coupling of the two networks. The
following additional steps are required:
1
A standard ISDN network coupling that routes the same subnets as the VPN connection is set up between the two
ISDN routers. In the routing table, however, a distance is entered that is at least 1 higher than the corresponding
route in the VPN gateway.
1
The local RIP (RIP V2) has to be activated in all routers so that the VPN and ISDN routers can exchange information
about the routes with the remote sites. The higher distance of the route via the ISDN gateway is, under normal
circumstances, the poorer route.
1
It is not necessary to define a backup connection in this case as a different device should take over the data
transmission.
1707
Reference Manual
17 High availability – backup solutions
If there is a disturbance in the connection between the VPN devices, the value for the distance of the corresponding
routes changes automatically: A route which is not available is marked with a distance of 16. Consequently, the route
entered into the ISDN router automatically becomes the "better" solution and all data packets will be re-routed over the
ISDN connection. As soon as the VPN connection is re-established, the distance changes to a value below that of the
ISDN connection and the backup will be terminated as intended.
17.2 Backup Solutions and Load Balancing with VRRP
17.2.1 Introduction
For businesses in particular, the high availability of data connections presents an essential requirement of the network
components. LANCOM Systems devices provide various mechanisms for securing data transfer as a backup solution:
1
Various WAN interfaces (DSL, ISDN, UMTS) enable data transfer over a second physical medium if the primary WAN
interface is disturbed or fails.
1
In order to provide protection from failure of an Internet provider's network, different Internet access accounts can
be configured with Multi-PPoE.
1
Two or more VPN gateways in a network can share the VPN tunnels required, thus keeping data traffic alive even in
cases of temporary failure of a VPN end point.
1
VRRP can now also be used to implement a sophisticated backup system for protection against router hardware
failure. Two or more routers are installed in a network, one of which can replace the other in case of device failure.
1
In addition to normal VRRP, LANCOM devices can link the backup event triggering function to the availability of a
data connection. With this additional feature, LANCOM devices with more than one WAN interface (e.g. DSL and
ISDN interface) can be implemented flexibly in backup solutions. The backup event is triggered for example, when
the default route is no longer available via the DSL interface. The device's ISDN interface can take its place further
along in the backup chain should the the backup router also fail.
PC
PC
PC
Branch office HEADQUARTER
INTERNET
ISDN
UMTS
VPN GATEWAY
VPN GATEWAY
server
Router
Router
17.2.2 Virtual Router Redundancy Protocol
VRRP – Virtual Router Redundancy Protocol – enables multiple physical routers to appear as a single "virtual" router.
Of the existing physical routers, one is always the "master". The master is the only router that establishes a data connection
to the Internet, for example, and transfers data. The other routers only play a role when the master fails (e.g. due to a
hardware defect or because its Internet connection is no longer available). Using the VRRP protocol, which is described
in RFC 3768, they negotiate which device should assume the role of master. The new master completely takes over the
tasks that were carried out by the previous master.
Virtual and physical routers
Dynamic routing protocols such as RIP adapt the entries in dynamic routing tables when, for example, a route is no
longer available. When using VRRP, hosts in the LAN can use a static routing table even though the gateway IP address
may change, for example, when a device fails due to a defect and another device takes over its functions. VRRP uses
"virtual routers" in the routing tables so that the network users always find the right gateway nevertheless. A virtual
router is broadcasted in the network with the IP address '192.168.1.100' in the same way as a "normal" router would
1708
Reference Manual
17 High availability – backup solutions
be and takes over the function of a gateway to certain remote stations. The actual work of data transfer is carried out
by the physical routers behind the virtual router.
1
Under normal operating conditions, for example, router A with the IP address '192.168.1.1' establishes the connection
to the Internet.
1
If router A fails, then router B with the IP address '192.168.1.2' takes over the functions of router A. The network
clients do not notice this change; for them, the "virtual" router '192.168.1.100' is still the gateway.
HEADQUARTER
VPN GATEWAY server
INTERNET
UM TS
Router
Router
Router
Branch office
PC
PC
PC
10.0.0.0
DSL
Virtual router
192.168.1.100
Router A:
192.168.1.1
Router B:
192.168.1.2
Routing table
RouterNet maskIP address
Virtual router255.255.0.010.0.0.0
From a more technical standpoint, a router in a network requires a unique MAC address in addition to an IP address.
Therefore, when defining a virtual router, a virtual MAC address is defined simultaneously which the virtual router reacts
to. The virtual MAC address is formed as '00-00-54-00-01-xx', whereby 'xx' stands for the unique router ID.
In order to determine which physical router reacts to the combination of virtual IP and MAC address, priorities are used
for the physical routers. For this purpose, every physical router is assigned a priority. The router with the highest priority
takes over the functions of the virtual router as master and thus reacts to the virtual IP and MAC addresses. If two physical
routers have the same priority, then the router with the "higher" physical IP address is considered to be the master.
All physical routers report their availability on a regular basis so that, should the current master fail, the router with the
next highest priority can take over the routing function at the end of this interval at the latest. If a device determines
that it cannot complete the tasks required, it can actively log off before the end of the interval thereby triggering the
transfer of the master role to the router with the next priority.
The major advantage of virtual routers is that they enable very flexible scenarios with backup and load balancing functions
which remain virtually undetected by the LAN. Clients in the local network randomly select a DHCP server from those
available and retrieve the required address information from this server.
Address assignment via DHCP with more than one DHCP server in the LAN
Several DHCP servers can be operated parallel to each other in a LAN without disrupting one another's functionality.
Upon establishing a network connection, the DHCP clients request an IP address selecting one of the available DHCP
servers. The DHCP server receiving the request checks to determine whether the address requested is available or already
in use within the LAN before assigning the address. This check prevents address conflicts even when several DHCP servers
are in use.
For the clients, it is irrelevant which physical router subsequently establishes the data connection. Similarly, the LAN
clients do not notice when a router or WAN interface fails due to the fact that, in this case, another router steps in and
is available under the same virtual addresses as before.
Device, connection or remote station backup
A device can disconnect itself from the VRRP group, an option which indicates that the possibilities offered by VRRP are
not restricted only to the failure of a device.
VRRP only provides one backup mechanism which safeguards against device failure. In practice, however, the failure of
a physical data transfer medium (e.g. DSL, ISDN or UMTS) or the unavailability of a remote station prevent the router
from completing its tasks as planned. For this reason, the LANCOM-specific enhancements to VRRP also offer the ability
1709
Reference Manual
17 High availability – backup solutions
to define the availability of a remote station as a trigger for the backup event—regardless of whether the data connection
is denied due to device, connection or remote station problems.
For the definition of a virtual router, the IP address by which it can be accessed, its priority and its logical router ID are
required as a minimum. The router ID serves to ensure that the regular messages from the physical routers can be
assigned to the respective virtual routers.
1
The router ID can assume a value between 1 and 255. The router ID also reveals the router's virtual MAC address as
00:00:5E:00:01:router ID. The router ID 0 is not permitted.
1
The IP address for the virtual router can be chosen freely, however, it must obviously be within the local network. If
the virtual router's address is the same as the physical router's address, then the physical router is the "main master"
of the system. The main master automatically has the highest priority, that is, when it signals that it is ready for
operation, it immediately becomes the active master.
1
The priority can assume a value between 1 and 254. The values 0 and 255 have special meanings: With the priority
'0', the virtual router is not active, with '255', this virtual router is the main master.
PC
PC
Router
Router
Router
Router
Virtual Router:
192.168.1.100
Current Master:
192.168.1.1
Backup router:
192.168.1.2
Backup router:
192.168.1.3
Prio = 50
Prio = 80
Prio = 100
Annoucement of the current priority:
Once per second!
Router ID defines "standby groups“
The physical routers can be assigned to the virtual routers with the router ID that is determined when defining the virtual
router. All devices in which virtual routers are set up with the same router ID form a "standby group" in which the devices
can act as replacements for one another. There are three different examples of standby groups:
1
In a simple backup scenario, two or more routers form one standby group. A virtual router with the same router ID
and the same virtual IP address is configured in both physical routers
.
PC
PC
Virtual Router
Router
Router
Router ID=1
1
In order to perform load balancing, the same number of virtual routers with differing IDs and IPs are defined as there
are physical routers planned for the VRRP group. For example, two devices would each belong to two standby groups
PC
PC
Virtual Router
Router
Router
Router ID= 2
Router ID= 1
Virtual Router
1
It is also possible to create more complex combinations with many devices. For example, two devices can form their
own standby group with router ID 1 and two other devices can form another group with the ID 2
1710
Reference Manual
17 High availability – backup solutions
.
Router
PC
PC
Router
Router
Router
Router ID= 1
Router ID= 2
Router
Router
1
Depending on the requirements, it is also possible to selectively assign certain devices to a single group while other
devices remain members of all groups
.
PC
PC
Router
Router
Router
Router
Router
Router ID= 2
Router ID= 1s
The Priority System
With the analysis of the priorities, VRRP controls the order in which the physical routers take over the function of the
master in a VRRP group. VRRP only considers the failure of an entire device to be a trigger for the backup event.
Since numerous LANCOM devices have more than one WAN interface, the VRRP application in LCOS takes not only the
failure of a device but also interruptions to the data connection or the unavailability of a remote station as triggers for
the backup event. In order to enable the backup behavior of the LANCOM devices and the formation of backup chains,
every virtual LANCOM router is assigned two priorities: a main and a backup priority.
1
The main priority is used (propagated into the network) as long as the device is in normal operating condition (i.e.
the remote station for the standard connection is still available).
1
The backup priority is propagated when the device is in backup mode (i.e. the backup delay has expired and the
connection could not be reestablished).
1
If '0' is set as the backup priority, the router will not send any signals until the end of the backup event, i.e. the
device is not available to the VRRP router group when the remote station is not available.
Since VRRP only knows "priorities" and does not differentiate between main or backup priority, it simply analyzes the
priority that is currently being propagated by the device. The device with the currently highest priority is considered to
be master.
Normally, priorities are configured so that the main priorities of the devices in a VRRP group are larger than the backup
priorities used. However this is a general rule and not a requirement. The main priority of router A can be smaller than
the backup priority of another router B. In this case, the backup connection of device B is used before the standard
connection of router A in the backup chain.
The assignment of priorities to the various WAN interfaces can be determined from the configuration of the backup
connections in the backup table (under LANconfig in the configuration area 'Communication' on the 'Call management'
tab).
1
The main priority refers to the interface on which the standard connection is configured.
1711
Reference Manual
17 High availability – backup solutions
1
The backup priority refers to the interface on which the backup connection is configured.
PC
PC
Virtual Router
Router
Router
DSL = prio 255
ISDN = prio 30
UMTS = prio 100
Virtual Router
192.168.1.100
Router A:
192.168.1.1
Router B:
192.168.1.2
VRRP list router A:
Remote siteBackup prio:Main prio:
INTERNET DSL30255
Backup list router A:
Backup listRemote site
INTERNET ISDNINTERNET DSL
VRRP list router B:
Remote siteBackup prio:Main prio:
INTERNET UMTS0100
A master that has been activated due to the priority status will now attempt to establish a connection if this has been
configured as a keep alive connection. If the connection is set up as a normal connection with a hold time, then it will
not be established until the next packet is transmitted. If this connection fails, thereby triggering the backup event, then
the router will also log off and then propagate itself with its backup priority.
Backup chains
The use of two priorities enables the formation of flexible backup chains by which each physical router does not merely
take a single place within the chain but takes a place for every physical WAN interface:
1
The first physical router, the main router in the network, has a DSL and an ISDN interface for example, the second
router (backup router) has a DSL and a UMTS interface.
1
The first router receives the main priority '255'. Consequently, it will become the main router with the value '50' as
its backup priority.
1
The second router receives the main priority '150' and the value '100' as its backup priority.
Under normal operating conditions, data traffic is processed by the DSL interface on the first router. If the router or this
interface fails, the second router attempts (due to the next highest main priority) to establish the connection via its own
DSL interface. If this does not succeed, then both devices will propagate their backup priority. Since the second router
has the higher backup priority, the connection is established using its UMTS interface. Only when this interface is also
unable to establish a connection will the ISDN interface on the first router (with the lower backup priority) be used.
Only keep alive connections return automatically!
The standard connection will only be automatically reestablished after a backup event if the hold time for the connection
is configured properly:
1
A hold time of "0" means that the connection will not be actively terminated. If the connection is terminated or
interrupted due to interference, it will not be automatically established again. The connection will only be reestablished
when communication is required of it.
1
A hold time of "9999" means that the connection is permanently held open. If it is interrupted, then the connection
will be actively opened up again. This behavior is known as keep alive.
1712
Reference Manual
17 High availability – backup solutions
Set the hold time to "9999" for connections to the Internet provider (in the corresponding
name list) and backed-up VPN connections (in the VPN connection list) to ensure that the
connection is automatically reestablished and resumes data transfer after interruption.
Return to the VRRP group
After an adjustable amount of time (reconnect delay), a router that has logged off attempts to establish its main or
backup connection again without propagating its priority first. If the main connection was successfully established, the
backup event is terminated and the router returns to propagating its main priority. If only the backup connection was
established, then the router falls back into the normal backup event and begins propagating its backup priority again.
As soon as a device can reestablish its main connection, the router begins propagating with its main priority again and
becomes the master:
1
Devices that are in backup mode with a lower main priority than the active master can also leave backup mode and
propagate their main priority due to the fact that their backup connection is not required in this state.
1
Devices that are in backup mode with a higher main priority than the active master can remain in backup mode as
long as they are not able to establish their higher-prioritized main connection.
1
Devices that have completely logged out of the VRRP group due to the unavailability of a VRRP remote site over the
backup connection return to the normal backup mode.
Connection establishment
In order to allow coordinated connection establishment and prevent standby routers from attempting to establish
connections, connections from a router are only established when this router:
1
is the master or
1
it is in backup mode and its main connection is configured with a keep alive or
1
it has completely logged off and the timer for the renewed connection attempt (reconnect delay) expires
This simple rule allows the main connection to be configured as a keep alive connection even in standby routers. It also
makes it possible only to use connections with hold time even in the main router.
Connections are always established when all virtual routers connected to the remote site have switched to standby mode.
This either happens because another router propagates a higher priority or a LAN connection is lost.
17.2.3 Application scenarios
VRRP is normally employed for two different uses:
1
In the simple backup case with two routers, one device under normal operation establishes the connection to the
Internet. The second device is only operated in wait mode as a "standby device" and takes over the function of the
main router should it fail.
1
In the second case, two or more devices function parallel to each other as routers in the same network and distribute
the incoming data connections using static load balancing. If one of these devices fails, the other router in the group
can take over the failed device's functions.
Backup solution with VRRP
Possibly the most important application of VRRP is the provision of backup connections in which one or more routers
serve as backup for the main router. These routers can use different physical media for the Internet connection, such as
DSL in the main router and UMTS or ISDN in the backup routers. A normal backup chain thus resembles the following:
1
If the DSL connection fails , the UMTS router takes over the function.
1
If the UMTS connection fails , the ISDN router takes over the function.
1713
Reference Manual
17 High availability – backup solutions
Since almost all LANCOM devices with a DSL interface also have an ISDN interface, the main router can also take over
ISDN backup functions at the end of the backup chain—as long as the hardware does not fail completely.
INTERNET
UMTS
ISDN
Router
Router
Virtual Router
PC
PC
A
C
B
DSL
Standby router:
192.168.1.2
Main router:
192.168.1.1
Virtual router:
IP: 192.168.1.100
MAC: 00:00:5E:00:01:01
Load Balancing
With load balancing, several routers exist which can accomplish the same tasks. These routers are pronounced to be the
default gateway and evenly distributed among the computers in the LAN using the DHCP server active in every router
(see also ). If one of the routers fails, then another can take over its functions providing both routers work with VRRP.
On every router, as many virtual routers are defined as there are actual routers. The computers in the LAN are assigned
one of the virtual routers as a gateway. Using the virtual router priorities, it is now defined in which order the other
routers take over when a master fails. It is also possible to establish a backup chain using the main and backup priority
here.
Router
Router
Virtual Router
Virtual Router
PC
PC
Virtual router 1:
with active DHCP server
Virtual router 2:
with active DHCP server
Physical router A:
Main Router for standby group 1
Backup router for standby group 2
Physical router B:
Main Router for standby group 1
Backup router for standby group 2
INTERNET
Example application: Secure Internet access via two DSL/ISDN combination routers
Two load-balancing default gateways that provide security for one another are to be the basis for operating the LAN at
two DSL lines. On average, 50% of the LAN stations log in to router 1 and 50% to router 2. The failure of a router or
the non-availability of a DSL connection is compensated for by the other router, which the takes over the full load.
Under normal operational circumstances, each router handles on average 50% of users in the LAN (prio 250 for the DSL
connection). Should a router or DSL connection fail, then the load is distributed to the other router (prio 100 for the DSL
connection of the backup router). If both DSL connections fail, then the traffic is directed over the ISDN connections
(each with backup prio 50, ISDN connections not illustrated).
Notes for the configuration of the virtual router
Router BRouter A
DHCP= On (10.1.1.x)DHCP= On (10.1.1.x)
Router IP=10.1.1.1Router ID=1Router IP = 10.1.1.1Router ID = 1
Prio = 100Prio = 250
Backup prio=50Backup prio=50
Remote station = DSL-INTERNETRemote station = DSL-INTERNET
Comment: Backup router for group 1Comment: Main router for group 1
Router IP=10.1.1.2Router ID=2Router IP = 10.1.1.2Router ID = 2
Prio = 250Prio = 100
Backup prio=50Backup prio=50
Remote station = DSL-INTERNETRemote station = DSL-INTERNET
Comment: Main router for group 2Comment: Backup router for group 2
1714
Reference Manual
17 High availability – backup solutions
17.2.4 Interaction with internal services
When using VRRP virtual routers with virtual IP and MAC addresses are used which, in turn, influences the internal
services of LANCOM devices. They must behave differently depending on whether a virtual router or a physical router is
addressed. Depending on the service or protocol used, the answers to address requests must be changed or completely
denied.
ARP
The most important protocol when dealing with virtual routers is ARP (Address Resolution Protocol), which provides the
ability to match logical addresses such as IP addresses to hardware addresses such as MAC addresses. The use of virtual
and physical IP and MAC addresses means that the router's reaction to ARP requests is of great importance:
1
An ARP request to the virtual router's address may only be answered when the LANCOM is the master. This request
must be answered with the corresponding virtual MAC address. All other requests must be ignored.
1
ARP requests that list a virtual router's address as the sender address must be ignored.
1
When using proxy ARP, an ARP request must be checked in order to determine if a virtual router is associated with
the remote station through which the requested address can be reached. If so, then the request may only be answered
when the LANCOM is the master. This also applies to virtual remote stations (i.e. PPTP or VPN) when they use a
remote station that is associated with a virtual router as a physical connection.
1
ARP requests sent by the LANCOM itself are always sent with the real sender address, as long as this is not the
address of a virtual router. In this event, the virtual MAC address must be entered in the ARP request.
ICMP
When using ICMP, echo requests and replies should be differentiated from error messages. For the error messages, ICMP
redirect will require and additional inspection.
1
An ICMP echo request directed to the virtual router's address may only be answered by the LANCOM when it is the
master.
1
ICMP redirects may also be sent from virtual routers but the address of the router to which the packet was sent must
be entered as the sender address. This is to be determined from the packet's target MAC address.
1
If the LANCOM is addressed via its physical MAC address and the target of the packet is linked to a virtual router,
the address of which is connected to the receiving interface, then an ICMP redirect is returned and the sender receives
the address of the virtual router.
1
For all other error messages, it does not matter whether the virtual router's address or the real address is used as
the sender address. To simplify matters, the real address is always used.
5
With the implementation of VRRP in LANCOM, the previous option 'local routing' in the IP Router menu has
been replaced with 'Send ICMP redirects'. If this option is enabled, ICMP redirects are sent, if the option is
disabled, the packets are always forwarded.
DHCP
1
Gateway address
Although the computers in the LAN can use ICMP redirects to learn which router is the correct virtual router, it is still
advisable to designate the correct router as gateway directly during the DHCP negotiation. This allows the assigning
gateway address to be determined as follows:
2
If a gateway is explicitly defined for the interface in the DHCP module, then only this will be assigned.
2
If no explicit gateway is set, then the default route is looked up in the routing table. If the default route exists
and is connected to a virtual router which is directly linked to the interface through which the DHCP request is
received, then the virtual router's address is assigned as gateway.
2
If other remote sites are linked to virtual routers, then these will not be assigned via DHCP since there can only
be one default gateway. A host can only learn the corresponding routers via ICMP redirects.
2
Otherwise, the address corresponding to the address pool or interface (intranet or DMZ) will be assigned.
1715
Reference Manual
17 High availability – backup solutions
If more than one virtual router is connected by the default route, then the address of the router with the highest
priority will be assigned. This allows for automatic load balancing through the selection of the DHCP server by the
respective client. The DHCP server is to be activated on all routers involved in load balancing. All routers then define
many virtual routers, each with different priorities. If the client randomly selects a DHCP server from those that
answer, then it will also be randomly assigned a virtual router.
Example with two routers
LANCOM A defines the following virtual routers:
PeerB PrioPrioVirt. addressRouter ID
INTERNET5010010.0.0.11
INTERNET506010.0.0.22
and, correspondingly LANCOM B:
PeerB PrioPrioVirt. addressRouter ID
INTERNET306010.0.0.11
INTERNET3010010.0.0.22
Depending on whether it chooses LANCOM A or LANCOM B, a DHCP client will now be assigned 10.0.0.1 or 10.0.0.2
as gateway and is initially distributed on both LANCOM devices.
Using this example, it becomes clear how load balancing can be combined with backup. If LANCOM A falls into
backup mode, then LANCOM B will become the master for all clients. If LANCOM B fails, then LANCOM A will become
the master for all clients and will attempt to establish its backup. If this fails, then it is LANCOM B's turn again (this
signals the end of the backup chain).
1
Further addresses
If the DHCP server is to assign explicit addresses for certain services which the LANCOM provides, such as DNS and
NBNS server, then either the configured addresses or the real addresses are assigned to the respective interfaces.
Assigning a virtual router violates the RFC which prohibits a virtual router from offering other services (a device may
only react to a virtual address when it is also the "owner" of this address, i.e. when the address is also the real
interface address. At the same time, this means that DNS and NBNS must receive special treatment.
DNS server
Since the RFC prohibits a virtual router from offering additional services when the physical router is not the "owner" of
the virtual IP address, the LANCOM DNS server requires special treatment. The LANCOM offers two options.
1
The solution which conforms to the RFC works in the DNS forwarder. If an external IP address is entered as primary
or secondary DNS server, then forwarding to the responsible virtual router functions automatically using the ICMP
redirect treatment since the packet is simply forwarded to the virtual router.
However, if no address is entered and no connection has been made to the remote station to which the packet should
be forwarded, then the DNS forwarder checks to see if a virtual router is connected to the remote station.
2
If this is the case and the LANCOM is also the master for one of the virtual routers, then the connection is
established and the packet is forwarded to the DNS server assigned to this connection.
2
If the LANCOM is not the master for all connected routers, then the packet is forwarded to the master of the first
connected router.
5
This procedure only works when all routers behave in accordance with the RFC and use port forwarding. If
all of the routers involved are LANCOM devices, then this requirement is fulfilled.
1
With the second option, a virtual router reacts to DNS requests itself.
1716
Reference Manual
17 High availability – backup solutions
In order to enable this behavior, the option 'Internal Services' must be enabled. The LANCOM accepts the requests
to the internal services (here, for example, DNS) via the virtual addresses as if it had been addressed through
one of the physical addresses.
2
2
In the default setting (Off) the LANCOM behaves in accordance with the RFC and drops the corresponding packets.
2
The default setting is 'On'.
If a virtual router is connected to the default route when using the internal services, then this will be assigned by the
LANCOM DHCP server as the DNS server. If more than one virtual router is connected by the default route, then the
router with the highest priority will be assigned (as is the case with gateway addresses).
5
This option can only guarantee trouble-free operation if all of the routers involved are LANCOM devices.
NBNS/NetBIOS proxy
Since a NetBIOS proxy does not forward packets, the question of the virtual or physical addresses responded to is of no
significance here. However, it is important that all routers and backup routers in the VRRP group can store the same
host, group and server addresses learned from the remote site in their own database and propagate these upon connection
establishment. This is the only method of ensuring that an NBNS request can be answered in every case.
Since the NetBIOS proxy propagates all host, group and server addresses learned from the remote site, it need only be
ensured that this information is also recorded by the backup routers in their databases. Under normal circumstances,
however, this is prevented by the route verification.
Since the transfer of addresses is usually prevented by the route verification, the addresses are only accepted in VRRP
operation when all of the following requirements are fulfilled:
1
There is a WAN route to the propagated address.
1
The corresponding remote site is connected to a virtual router.
1
The corresponding address is propagated by the master of this virtual router.
1
The switch 'Internal Services' is activated.
Only when all of these requirements are fulfilled, will the respective address be accepted in the database. This ensures
that the individual router databases remain consistent and all addresses are immediately recognized when a backup
router becomes master.
The position of the 'Internal Services' switch influences the NetBIOS proxy.
1
When it is enabled, the NetBIOS proxy accepts NBNS requests that are directed to virtual routers.
1
If a virtual router is also connected to the default route, then this will be assigned by the LANCOM DHCP server as
the NBNS server.
1
If more than one virtual router is connected by the default route, then the router with the highest priority will be
assigned (as is the case with gateway addresses).
RIP
The use of VRRP has a particularly strong influence on RIP, through which information on the accessible routes and the
corresponding routers is propagated.
1
On the one hand, routers must be made known in the network to remote stations which can be reached through a
virtual router.
1
On the other hand, the routes that are propagated by the virtual routers themselves must be ignored.
1
Ultimately, the propagated information is dependent upon the interface which it is to be passed on to.
The announcement of routing information via RIP is governed by the following rules:
1
Routes are propagated on all virtual and physical interfaces and every virtual router counts as its own virtual interface.
1
If routes are currently being propagated on a physical interface (LAN/DMZ) and a route that must be propagated is
connected to a virtual router, then two cases must be differentiated:
1717
Reference Manual
17 High availability – backup solutions
When the virtual router is active on the interface, i.e. its address is in the address range of the respective interface,
then the route will not be propagated.
2
2
If the virtual router on the interface is not active, then the route will be propagated normally, i.e. the physical
interface address will be propagated as the best route.
1
If routes are propagated on a virtual router, then only the routes that are connected to this virtual router may be
propagated.
1
If routes are propagated on a WAN interface, then all routes are propagated.
1
Upon receiving a RIP packet, the sender address of the RIP packet must be taken into consideration. The routes
contained in the packet must be ignored when they are propagated by a virtual router known by the LANCOM device.
1
If the LANCOM cannot establish a connection to the remote site because all channels are occupied, then RIP propagates
the routes accessible through this remote site as "unavailable".
2
In addition, the VRRP module is notified in this case so that it can log off of the router connected to this remote
site allowing a new master to be determined.
2
Similarly, VRRP receives notification when the connection is can be re-established in order to allow the virtual
router to propagate with its main or backup priority again.
NTP
When the 'Internal Services' switch is enabled, then the LANCOM also accepts (S)NTP requests that are directed to virtual
routers since the exact address of the time source is not relevant for an NTP client.
Other services
The LANCOM only processes other services when it is addressed via its physical address.
17.2.5 VRRP in the WAN
The description of VRRP is only in regard to the LAN portion of data networks and leaves the regulation of the WAN
portion to dynamic routing protocols such as RIP. In order to enable WAN failover all the same, LANCOM VRRP provides
two alternatives.
Same IP and MAC addresses
The first possibility entails assigning all of the routers in the VRRP group on the WAN side the same MAC and the same
IP address. The routers are then connected to a commonly used DSL line, for example by a switch. In order to avoid
address conflicts, only one router may actually react to these addresses on its WAN side, which is achieved through the
use of VRRP.
Virtual Router
Router
Router
INTERNET
SWITCH
PC
PC
Pysical Router A (master.active):
WAN IP: 80.137.9.61
WAN MAC: 00-04-3E-C0-F7-18
Pysical Router B (backup.inactive):
WAN IP: 80.137.9.61
WAN MAC: 00-04-3E-C0-F7-18
1
Due to the fact that the LANCOM terminates its WAN connection when the last virtual router switches to backup
mode, this requirement is definitely fulfilled when a total of only one virtual router has been defined.
1
In the backup scenario, the necessary requirement is also fulfilled because the main connection is guaranteed to
have been terminated or else the backup router would not have become master.
Routing protocols
In the load balancing scenario, however, there are two different WAN connections online simultaneously, which is why
the use of the same MAC and IP address is not possible here. In this case, a routing protocol such as RIP, OSPF or BGP
must be used as a second option.
1718
Reference Manual
17 High availability – backup solutions
In order to accelerate the switch using RIP, which is rather slow, a LANCOM propagates to all networks that it is no
longer available before the connection is established, thereby ensuring a quick change of routing priorities.
17.2.6 Configuration
In order to configure failover or load balancing with VRRP, the following parameters can be set:
1
Activation: The switch 'VRRP activate' enables the VRRP module to be switched on or off (default = off).
1
VRRP list: In the VRRP list, up to 16 virtual routers can be defined. This table has the following fields:
2
Router ID: Unique ID for the virtual router. Values between 1 and 255 are possible. The router ID is used to
consolidate several physical routers into a single virtual router or a standby group.
2
Router IP: IP address for the virtual router.
5
All routers on which the virtual router is set up must assign this router the same IP address.
2
Main priority: The main priority of the virtual router with regard to routers with several interfaces refers to the
main interface, i.e. with routers with DSL and ISDN support to the DSL interface. Values between 0 and 255 are
permitted. The values 0 and 255 have special meanings:
'0' turns the virtual router off.
2
'255' is only accepted when the virtual router address is identical to the address of the interface that is connected
to the router. In other cases, the priority is automatically lowered.
2
Backup priority: The backup priority of the virtual router refers to the interface for which a backup connection
is configured, i.e. with routers with DSL and ISDN support to the ISDN interface. Here again, values between 0
and 255 are permitted. The values 0 and 255 also have special meanings here:
0 disables the virtual router in the backup event. Checks are conducted regularly in order to determine whether or
not the standard connection can be reestablished. The inspection interval is defined in the reconnect delay.
'255' is only accepted when the virtual router address is identical to the address of the interface that is connected
to the router. In other cases, the priority is automatically lowered.
When the backup connection cannot be established in backup mode, then the virtual router logs off completely and
attempts to reestablish the standard or backup connection in intervals defined by the reconnect delay.
2
Remote site: Name of the remote station that controls the virtual router behavior. The remote site can also be
assigned to other virtual routers.
5
Entering the remote site is optional. Linking the backup requirement to a remote site allows the use of
the LANCOM-specific enhancement to VRRP not only to secure against device failure (VRRP standard)
but also against interface failure or disruption at a remote site.
2
Comment: 64 character-long commentary describing the virtual router.
1
Reconnect delay: The reconnect delay time shows after how many minutes a virtual router that has logged off
attempts to reestablish its standard connection. The router remains logged off during this connection attempt. It is
only broadcasted with its main or backup priority after the connection has been established successfully. The default
value is 30 minutes.
1
Advert. interval: The advertising interval shows how many seconds until a virtual router is propagated again. The
default value is 1 second.
5
With a propagation time of 1 second, the routers in the VRRP group can change quickly when a device or
interface fails. An interruption of this type will usually remain undetected due to the fact that the TCP
connection is not interrupted. Other routing protocols require up to 5 minutes or longer in order to conduct
the transfer to a backup router.
1
Internal services: The Internal services check box controls how the device should behave when it is addressed via
a virtual router address.
1719
Reference Manual
17 High availability – backup solutions
In the 'On' position, the LANCOM reacts to certain services exactly as if it had been addressed via its actual
address. Naturally, this only occurs when the device itself is the master of the virtual router. The behavior of the
DHCP server changes simultaneously.
2
2
The default setting 'Off' results in behavior in accordance with the RFC, meaning means that the corresponding
packets are silently dropped.
2
The default setting is 'On'.
LANconfig: IP router / VRRP
WEBconfig: LCOS menu tree / Setup / IP router / VRRP
1720
Reference Manual
17 High availability – backup solutions
17.2.7 Status Information
The current status of the devices in the VRRP group is showed in LANmonitor as long as the VRRP module is activated:
In the device activity log, VRRP events can be viewed in chronological order.
Status information on VRRP can be found in the IP router's status menu and offers the following entries:
1
The values Rx and Tx count the VRRP packets received or sent, respectively.
1
Error counts all fatal protocol errors that are logged.
1
Drop counts all VRRP packets that are dropped, e.g. when a serious error occurred.
1721
Reference Manual
17 High availability – backup solutions
In the Virtual Router table, all active virtual routers are listed with their current status. This table has the following fields:
1
Router ID: Unique ID for the virtual router.
1
Virt. address: IP address for the virtual router.
1
Prio: Main priority for the virtual router.
1
B-Prio: Backup priority for the virtual router.
1
Remote site: Name of the remote station that controls the virtual router behavior.
1
State: State of the virtual router. The following states are possible:
2
Init: The router is currently being set up.
2
Listen: The router is currently learning which device is the master.
2
Standby: The router is the standby router.
2
Master: The router is the master.
2
Down: The router is deactivated.
2
Reconnect: The reconnect timer is running and the router is currently not propagating itself.
1
Backup: Shows if the remote station (peer) is in backup or not. If the remote station is in backup, then the device
will propagate its backup priority, otherwise it will propagate its main priority.
1
Master: Shows which of the physical routers is currently the master.
The MAC list table displays the MAC addresses for the virtual routers that are currently masters. This table has the
following fields:
1
Virt. address: IP address for the virtual router.
1
MAC address: MAC address for the virtual router.
1
Router ID: Unique ID for the virtual router.
17.3 Addition(s) to LCOS 9.10
17.3.1 High availability clustering
As of LCOS version 9.10, all devices in a defined group take on any changes to the configuration of any device within
this group.
As of LCOS version 9.10, the LANCOM WLC High Availability Clustering XL option and the LANCOM VPN
High Availability Clustering XL option enable you to collect several devices to a cluster. This applies to
the LANCOM WLAN controllers (LANCOM WLC-4025+ and LANCOM WLC-4100) and LANCOM central-site
VPN gateways (LANCOM 7100+ VPN and LANCOM 9100+ VPN). This options provides highly convenient
central management in combination with configuration synchronization (Config Sync) between all of the
clustered devices. In WLAN controller-based installations you additionally benefit from automatic load
balancing, intelligent high-availability scenarios, and the issuing of cluster certificates.
Automatic configuration synchronization (Config Sync) with the LANCOM WLC High
Availability Clustering XL option
Example application, WLAN controllers:
WLAN infrastructures have become an integral part of modern corporate networks. In the age of the "all wireless office",
the increasing demands on the availability of a WLAN solution make it essential to have a reliable backup and
high-availability solution. In WLAN infrastructures with a single WLAN controller, any failures or maintenance downtimes
(such as a firmware update) of the WLC until now caused the APs connected to it to switch to standalone operation.
Consequently, the APs in standalone mode were no longer able to access the features that are provided centrally by the
WLC such as a Public Spot, IEEE 802.1X authentication, or Layer-3 tunnels.
1722
Reference Manual
17 High availability – backup solutions
In order to avoid this and to maintain the full operation of all WLAN capabilities even if a WLC should be temporarily
unavailable, one or more redundant or backup WLCs should be employed. In the backup event, the APs automatically
switch from the temporarily unavailable WLC to a backup WLC. The backup WLC has the same configuration (e.g. AP
table or WLAN profiles) as required by the primary WLC of the APs. The initial setup of the WLCs and any subsequent
configuration changes must be carried out separately and identically on each device—an enormous effort for the
administrator. Manual maintenance of the configurations between multiple identical devices could lead to outdated or
non-synchronous configurations on the backup WLCs, which in the case of a backup event could lead to a critical state
for the entire WLAN infrastructure. The resulting troubleshooting usually turns out to be a real challenge. The users of
the WLAN clients experience a loss of productivity, which could have major consequences company-wide.
New with the LANCOM WLC High Availability Clustering XL option: This software option allows multiple WLCs to
be grouped into a highly-available cluster. In this way, configuration changes, features and enhancements made on one
WLC are automatically transferred between the other WLCs in the cluster, without having to make manual changes on
each individual device. Common parameters in a cluster (e.g. WLAN profiles, AP tables, or Public Spot settings) remain
synchronized, individual parameters (such as the IP address of the WLC) are not exchanged.
The LANCOM WLC High Availability Clustering XL option offers greatly simplified administration and huge time savings
because you only need to configure one WLC in the cluster. The WLC then transfers the changes to the other cluster
devices automatically. In the case of maintenance downtime (e.g. for a firmware update) or even the failure of a WLC,
the APs automatically connect to another WLC which, thanks to Config Sync, already has the identical configuration
without any intervention by the administrator. The result is a convenient way to high availability.
The prerequisites for a device to be a valid member of a cluster are:
1
The LANCOM WLC High Availability Clustering XL option (as of LCOS version 9.10) must be available.
1
IP communications must be available to all other devices, e.g. via LAN, WAN, or VPN.
1
It must be in the list of group members that is stored in each device.
1
A valid certificate must be available
1
It needs to authenticate itself by certificate as a member of the cluster.
Automatic configuration synchronization (Config Sync) with the LANCOM VPN High
Availability Clustering XL option
Example application, VPN:
VPN infrastructures have been a part of corporate networks for a long time now. The demands on the availability of VPN
gateways have increased sharply in recent years. Whereas VPN solutions in professional scenarios were mainly temporary
in the past, e.g. for sales representatives with VPN clients, these days home or branch offices are often permanently
1723
Reference Manual
17 High availability – backup solutions
linked to the main office via a VPN tunnel. They support voice services (VoIP), database applications, or file services, for
example. With increasing dependence on VoIP services or critical business applications, the need for reliable backup
and high-availability of the VPN solution has increased.
In order for VPN services in larger-scale critical network infrastructures to remain highly available, it is advisable that
you operate one or more backup VPN gateways in addition to the primary VPN gateway. In this case, the failure or
downtime of a central-site VPN gateway causes another device to operate as a backup. The VPN connection is automatically
established via the accessible backup central-site VPN gateway.
For this purpose the backup central-site VPN gateway needs to have the same configuration as the primary central-site
VPN gateway. In particular VPN user data and the firewall configuration must be present on both devices in order for a
user to be authenticated and the services to be provided correctly. This requires a manual setup of each individual
device—in other words, a huge amount of work for the administrator.
New with the LANCOM VPN High Availability Clustering XL option: This option allows multiple central-site VPN
gateways to be grouped into a cluster. In this way, configuration changes, features and enhancements made on one
central-site VPN gateway are automatically transferred between the cluster devices, without having to make manual
changes on each individual device. Common parameters in a cluster (e.g. VPN user database, firewall) remain synchronized,
individual parameters (such as the IP address) are not exchanged.
The prerequisites for a device to be a valid member of a cluster are:
1
The LANCOM VPN High Availability Clustering XL option (as of LCOS version 9.10) must be available.
1
IP communications must be available to all other devices, e.g. via LAN, WAN, or VPN.
1
It must be in the list of group members that is stored in each device.
1
A valid certificate must be available
1
It needs to authenticate itself by certificate as a member of the cluster.
Setting up configuration synchronization
In order for configuration synchronization to function, all of the devices to be configured need to have valid certificates.
In the interests of easy certificate distribution, you first need to configure a SCEP-CA on one of the devices.
1724
Reference Manual
17 High availability – backup solutions
1. To do this it is necessary to enable the SCEP server under Certificates > SCEP CA. If you set up the configuration
synchronization on a WLC, it is most likely that the SCEP server is already active.
2. Then you enable the SCEP client on any device that is to work with configuration synchronization (including the SCEP
CA device) under Certificates > SCEP client. If you set up the configuration synchronization on a WLC, it is most
likely that the SCEP client is already active.
3. Add a new entry for the SCEP server to the CA table.
The values for the CA table match the settings of the SCEP server from step 1 and are thus the same for all stations.
For the URL you enter http://IPADR/cgi-bin/pkiclient.exe, replacing IPADR with the IP
address of the device configured as SCEP-CA.
1725
Reference Manual
17 High availability – backup solutions
If you set up the configuration synchronization on a WLC, a corresponding entry for the WLC operation will already
be available. This entry can also be used to obtain a certificate for configuration synchronization, and in this case
there is no need to make any changes to the CA table.
4. The Certificate table in the SCEP client needs a new entry for the retrieval of a configuration synchronization
certificate. The CA distinguished name is the one you used when you created the CA table entry.
As the subject, enter each device's own IP address (e.g. /CN=IPADR /O=COMPANY/C=DE), replacing IPADR
with the IP address of the device configured as SCEP-CA.
5
In order for the configuration synchronization to function, it is absolutely necessary for the IP address of the
device to be included in the certificate's subject.
Set the Usage type to “Configuration synchronization”. Also, adjust the Key length to “2048 bits”. Set a Name of
your choice for the table entry.
1726
Reference Manual
17 High availability – backup solutions
The challenge password of the device configured as SCEP CA is located in its configuration under Certificates >
Certificate handling > General challenge password.
5. This concludes the set up of the SCEP CA and the SCEP client for the retrieval of configuration synchronization
certificates. At this time you can write the configuration back to the device in order to retrieve the certificates.
6. Now activate the configuration synchronization under Management > Synchronization with the option
Configuration synchronization module enabled. Under Cluster name you can also set a name that appears in
the LANconfig device list.
7. Under Cluster members, enter the IP addresses of all of the devices that are to be members of the cluster.
1727
Reference Manual
17 High availability – backup solutions
8. Under Menu nodes you specify the menus you want to synchronize. If you wish to explicitly exclude menu nodes
from the synchronization, set the Usage to "excluded from synchronization".
Under "Ignored rows" you can optionally specify the rows of a table that should be excluded from synchronization.
Example: The default route on VPN gateways, which should be different for each gateway. The rest of the routing
table can be synchronized by making an entry in the Menu nodes.
9. The set up of configuration synchronization is now concluded for this device. You can write the configuration back
to the device.
10. Perform steps 2 through 9 on the other devices that belong to the cluster. When configuring each SCEP client, point
to the SCEP CA of the first device, as indicated above.
11. Now start the cluster on the device that should initially distribute its configuration to the other cluster members. To
do this in LANconfig, select the appropriate entry from the device list and, in the context menu, click [Start cluster...].
12. The cluster is now in operation. You can check the state of the cluster in WEBconfig under Status > Config > Sync >
Status. Now, configuration changes made on any cluster member are synchronized to the other members.
Please note the following requirements:
1
The correct time must be set on all of the involved devices (certificate checks).
1
The IP address of each device must appear in the subject of its own certificate.
1
To menu trees for synchronization must be the same on both devices (which is not always the case with different
firmware versions or device options).
1
If any changes are made to the configuration of the configuration synchronization (menu nodes, etc.) after the cluster
was started already, then the cluster must be restarted.
1-Click WLC High Availability Clustering Wizard
With the 1-Click WLC High Availability Clustering Wizard, you can use LANconfig to simultaneously configure multiple
WLCs under the following conditions:
1728
Reference Manual
17 High availability – backup solutions
1
All of the WLCs have the WLC High Availability Clustering XL option enabled.
1
At least one WLC is fully configured. This is the case if it is already managing APs.
1
At least one WLC has a basic configuration (at least the name and IP address are set).
4
In case of doubt, you should start the Basic Settings Wizard on the corresponding WLC.
4
All WLCs in the cluster have the same rights.
1. In the device list, select the two WLCs that you want to configure together.
There are two ways to start the WLC Clustering Wizard:
1
In the device list, drag & drop the unconfigured WLC onto the configured WLC.
1
Select the two WLCs in the device list and, after a right-click, select the item Setup Wizard from the context
menu.
LANconfig then displays the following message:
Start the Setup Wizard by clicking on Yes The Setup Wizard starts with the selection dialog for the multiple-devices
Wizard.
2. Select the “1-Click WLC High Availability Clustering Wizard” and then click Next.
1729
Reference Manual
17 High availability – backup solutions
3. Select the master device, and then click Next
The master device is the preconfigured WLC. After you finish, the Setup Wizard transfers its configuration to all of
the other selected WLCs.
4
This query does not appear if you transfer the configuration to another WLC via drag & drop. In this case,
the Setup Wizard automatically takes the “dragged” WLC to be the master device.
4. Assign a cluster name and click Device addresses.
The Setup Wizard suggests a cluster name, although you can change this if you so wish.
5. Enter the device addresses of all of the WLCs in the cluster.
1730
Reference Manual
17 High availability – backup solutions
By default, the Setup Wizard enters the devices that LANconfig is able to reach. Make any necessary changes, for
example by entering devices that are accessible via VPN.
Click OK, and then click Next.
6. Click Finish to complete the Setup Wizard.
The Setup Wizard now loads the configuration of the master device to the selected WLCs.
7. The device list displays the WLCs as follows:
The Setup Wizard has configured the SCEP client on all WLCs so that they can fetch a Config Sync. LANconfig now
waits until the certificates are available for all of the WLCs.
4
Creation of the certificates may take up to one minute.
8. Once the certificates are available for all of the WLCs, LANconfig displays the status “OK” for these WLCs along with
the cluster icon and the configured name of the cluster.
From now on, Config Sync configures the complete path Setup > WLAN management between all of the participating
cluster members. Config Sync immediately synchronizes any configuration changes on any of the WLCs to all of the other
WLCs in the cluster.
1731
Reference Manual
17 High availability – backup solutions
The master unit operates a master-CA, while all of the other WLCs operate a sub-CA of this master-CA. APs which connect
to a WLC other than the master WLC will receive a valid certificate from it, if required.
Additions to the Status menu
Sync
This menu displays the status values of the automatic configuration synchronization.
SNMP ID:
1.11.51
Telnet path:
Status > Config
State
This entry shows the state of the device during the automatic configuration synchronization.
SNMP ID:
1.11.51.1
Telnet path:
Status > Config > Sync
Possible values:
Off
PKCS#12 file corrupt
TCP list failed
Not started yet
Incompatible firmware
Incompatible menu node
Own address wrong
No snapshot
Time unknown
OK
New cluster
This table shows you the values of the current automatic configuration synchronization.
SNMP ID:
1.11.51.2
Telnet path:
Status > Config > Sync
1732
Reference Manual
17 High availability – backup solutions
Name
This entry shows the name of the current configuration synchronization.
SNMP ID:
1.11.51.2.1
Telnet path:
Status > Config > Sync > New Cluster
Cluster members
This entry shows information about the group members of the cluster.
SNMP ID:
1.11.51.2.2
Telnet path:
Status > Config > Sync > New Cluster
ID
This entry shows the ID of the entry.
SNMP ID:
1.11.51.2.2.2
Telnet path:
Status > Config > Sync > New Cluster > Group Members
Address
This entry shows the address of the group member.
SNMP ID:
1.11.51.2.2.3
Telnet path:
Status > Config > Sync > New Cluster > Group Members
This device
This entry indicates whether this is the device in question.
1733
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.2.2.4
Telnet path:
Status > Config > Sync > New Cluster > Group Members
Possible values:
Yes
No
Menu nodes
This entry indicates the menu nodes that are included in the automatic configuration synchronization.
SNMP ID:
1.11.51.2.3
Telnet path:
Status > Config > Sync > New Cluster
ID
This entry shows the ID of the entry.
SNMP ID:
1.11.51.2.3.2
Telnet path:
Status > Config > Sync > New Cluster > Menu Nodes
Path
This entry shows the path of the menu node.
SNMP ID:
1.11.51.2.3.3
Telnet path:
Status > Config > Sync > New Cluster > Menu Nodes
SNMP OID
This entry shows the SNMP-ID of the menu node.
1734
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.2.3.4
Telnet path:
Status > Config > Sync > New Cluster > Menu Nodes
Index columns
This entry shows the index column of the menu node.
SNMP ID:
1.11.51.2.3.5
Telnet path:
Status > Config > Sync > New Cluster > Menu Nodes
Ignored rows
This entry shows information about table rows that are excluded by the automatic configuration synchronization.
SNMP ID:
1.11.51.2.4
Telnet path:
Status > Config > Sync > New Cluster
ID
This entry shows the ID of the entry.
SNMP ID:
1.11.51.2.4.2
Telnet path:
Status > Config > Sync > New Cluster > Ignored Rows
Path
This entry shows the path of the table node.
SNMP ID:
1.11.51.2.4.3
1735
Reference Manual
17 High availability – backup solutions
Telnet path:
Status > Config > Sync > New Cluster > Ignored Rows
SNMP OID
This entry shows the SNMP-ID of the table node.
SNMP ID:
1.11.51.2.4.4
Telnet path:
Status > Config > Sync > New Cluster > Ignored Rows
Index columns
This entry indicates the table row that is excluded from the automatic configuration synchronization.
SNMP ID:
1.11.51.2.4.5
Telnet path:
Status > Config > Sync > New Cluster > Ignored Rows
State
This entry shows the status of the automatic configuration synchronization.
SNMP ID:
1.11.51.2.5
Telnet path:
Status > Config > Sync > New Cluster
Possible values:
Off
Invalid
Not running
Running
Changed
Info
This entry shows general information about the automatic configuration synchronization.
1736
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.2.6
Telnet path:
Status > Config > Sync > New Cluster
Home
With this action, you distribute the device configuration to all other members of the group. At the same time, this
launching time is the reference point for the group. From this time on, the cluster is considered to be activated.
SNMP ID:
1.11.51.2.7
Telnet path:
Status > Config > Sync > New Cluster
Cluster time
This entry shows the cluster time.
SNMP ID:
1.11.51.3
Telnet path:
Status > Config > Sync
Local configuration
This menu provides information about the local device configuration.
SNMP ID:
1.11.51.4
Telnet path:
Status > Config > Sync
Detected modifications
This entry shows the changes that were detected.
SNMP ID:
1.11.51.4.1
1737
Reference Manual
17 High availability – backup solutions
Telnet path:
Status > Config > Sync > Local-config
Detected at
This entry indicates the point in time when a change was made by another device.
SNMP ID:
1.11.51.4.1.2
Telnet path:
Status > Config > Sync > Local-config > Detected modifications
Path
This entry shows the changed path.
SNMP ID:
1.11.51.4.1.4
Telnet path:
Status > Config > Sync > Local-config > Detected modifications
Type
This entry shows the type of change.
SNMP ID:
1.11.51.4.1.5
Telnet path:
Status > Config > Sync > Local-config > Detected modifications
Possible values:
Set scalar
The modification affected a value.
Set row
The modification added a table row.
Delete row
The modification removed a table row.
1738
Reference Manual
17 High availability – backup solutions
Value
This entry shows the changed value.
SNMP ID:
1.11.51.4.1.6
Telnet path:
Status > Config > Sync > Local-config > Detected modifications
Applied modifications
This entry shows which configuration changes this device initiated.
SNMP ID:
1.11.51.4.2
Telnet path:
Status > Config > Sync > Local-config
Applied at
This entry indicates the point in time when a change was made by this device.
SNMP ID:
1.11.51.4.2.2
Telnet path:
Status > Config > Sync > Local-config > Applied modifications
Path
This entry shows the changed path.
SNMP ID:
1.11.51.4.2.4
Telnet path:
Status > Config > Sync > Local-config > Applied modifications
Type
This entry shows the type of change.
1739
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.4.2.5
Telnet path:
Status > Config > Sync > Local-config > Applied modifications
Possible values:
Set scalar
The modification affected a value.
Set row
The modification added a table row.
Delete row
The modification removed a table row.
Value
This entry shows the changed value.
SNMP ID:
1.11.51.4.2.6
Telnet path:
Status > Config > Sync > Local-config > Applied modifications
Result
This entry shows the result of the change.
SNMP ID:
1.11.51.4.2.7
Telnet path:
Status > Config > Sync > Local-config > Applied modifications
Possible values:
OK
Configuration synchronization was successful.
OK(Msg-sent)
OK(End-of-line)
OK(Close)
OK(Abort)
OK(More)
OK(Started)
Configuration synchronization was started.
1740
Reference Manual
17 High availability – backup solutions
No login
Syntax error
No path
No path specified for the configuration synchronization.
Path unresolvable
Wrong path specified for the configuration synchronization.
Part ambiguous
The path in the configuration synchronization is ambiguous.
No menu stack
Not settable
The configuration synchronization tried to set or modify a value, where this is not possible.
Value invalid
The configuration synchronization tried to set a value outside the valid range.
Read-only conn.
The connection to a device has no write permissions.
Action failed
The connection to a device has no execute permissions.
Table is full
The configuration synchronization tried to write another line in a full table.
Was ignored
Wrong password
The login attempt to another device failed due to a wrong password.
Path name empty
The path to a configuration synchronization is specified without the value to be modified.
End-of-line
Running cluster
This menu provides information about an ongoing cluster configuration synchronization.
SNMP ID:
1.11.51.5
Telnet path:
Status > Config > Sync
ID
This entry shows the ID of the ongoing configuration synchronization.
SNMP ID:
1.11.51.5.1
1741
Reference Manual
17 High availability – backup solutions
Telnet path:
Status > Config > Sync > Running-Cluster
Name
This entry shows the name of the ongoing configuration synchronization.
SNMP ID:
1.11.51.5.2
Telnet path:
Status > Config > Sync > Running-Cluster
Cluster members
This table contains the groups members of the ongoing configuration synchronization.
SNMP ID:
1.11.51.5.3
Telnet path:
Status > Config > Sync > Running-Cluster
ID
This entry shows the ID of the entry.
SNMP ID:
1.11.51.5.3.2
Telnet path:
Status > Config > Sync > Running-Cluster > Group-Members
Address
This entry shows the address of the device.
SNMP ID:
1.11.51.5.3.3
Telnet path:
Status > Config > Sync > Running-Cluster > Group-Members
1742
Reference Manual
17 High availability – backup solutions
This device
This entry indicates whether this entry relates to this device.
SNMP ID:
1.11.51.5.3.4
Telnet path:
Status > Config > Sync > Running-Cluster > Group-Members
Possible values:
Yes
No
Menu nodes
This table contains the menu nodes of the ongoing configuration synchronization.
SNMP ID:
1.11.51.5.4
Telnet path:
Status > Config > Sync > Running-Cluster
ID
This entry shows the ID of this entry.
SNMP ID:
1.11.51.5.4.2
Telnet path:
Status > Config > Sync > Running-Cluster > Menu-Nodes
Path
This entry shows the path of the menu node.
SNMP ID:
1.11.51.5.4.3
Telnet path:
Status > Config > Sync > Running-Cluster > Menu-Nodes
1743
Reference Manual
17 High availability – backup solutions
SNMP OID
This entry shows the SNMP-ID of the menu node.
SNMP ID:
1.11.51.5.4.4
Telnet path:
Status > Config > Sync > Running-Cluster > Menu-Nodes
Index columns
This entry shows the index column of the menu node.
SNMP ID:
1.11.51.5.4.5
Telnet path:
Status > Config > Sync > Running-Cluster > Menu-Nodes
Ignored rows
This table contains the table rows ignored by the ongoing configuration synchronization.
SNMP ID:
1.11.51.5.5
Telnet path:
Status > Config > Sync > Running-Cluster
ID
This entry shows the ID of this entry.
SNMP ID:
1.11.51.5.5.2
Telnet path:
Status > Config > Sync > Running-Cluster > Ignored-Rows
Path
This entry shows the path of the table node.
1744
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.5.5.3
Telnet path:
Status > Config > Sync > Running-Cluster > Ignored-Rows
SNMP OID
This entry shows the SNMP-ID of the table node.
SNMP ID:
1.11.51.5.5.4
Telnet path:
Status > Config > Sync > Running-Cluster > Ignored-Rows
Row index
This entry indicates the table row that is excluded from the automatic configuration synchronization.
SNMP ID:
1.11.51.5.5.5
Telnet path:
Status > Config > Sync > Running-Cluster > Ignored-Rows
Config history
This menu provides information about the configuration history of the device.
SNMP ID:
1.11.51.6
Telnet path:
Status > Config > Sync
Snapshot received at
This entry indicates when the device received a snapshot.
SNMP ID:
1.11.51.6.1
1745
Reference Manual
17 High availability – backup solutions
Telnet path:
Status > Config > Sync > Config-History
Snapshot timestamp
This entry contains the timestamp of the received snapshot.
SNMP ID:
1.11.51.6.2
Telnet path:
Status > Config > Sync > Config-History
Snapshot
This table displays information about the last snapshot.
SNMP ID:
1.11.51.6.3
Telnet path:
Status > Config > Sync > Config-History
Path
This entry contains the path to a menu node.
SNMP ID:
1.11.51.6.3.2
Telnet path:
Status > Config > Sync > Config-History > Snapshot
Value
This entry contains the value of the corresponding path.
SNMP ID:
1.11.51.6.3.3
Telnet path:
Status > Config > Sync > Config-History > Snapshot
1746
Reference Manual
17 High availability – backup solutions
Modifications
This table contains the modifications to the configuration since the last snapshot.
SNMP ID:
1.11.51.6.4
Telnet path:
Status > Config > Sync > Config-History
Renew snapshot
Click this item to create a new snapshot of the current device configuration.
SNMP ID:
1.11.51.6.5
Telnet path:
Status > Config > Sync > Config-History
Replicas
This table contains information about the devices participating in the automatic configuration synchronization.
SNMP ID:
1.11.51.7
Telnet path:
Status > Config > Sync
ID
This entry contains the ID of the entry.
SNMP ID:
1.11.51.7.2
Telnet path:
Status > Config > Sync > Replicas
Address
This entry contains the address of the device.
1747
Reference Manual
17 High availability – backup solutions
SNMP ID:
1.11.51.7.3
Telnet path:
Status > Config > Sync > Replicas
Resolved address
This entry contains the resolved IPv4 or IPv6 address of the device.
SNMP ID:
1.11.51.7.4
Telnet path:
Status > Config > Sync > Replicas
Connection state
This entry contains the state of the connection to the remote device.
SNMP ID:
1.11.51.7.5
Telnet path:
Status > Config > Sync > Replicas
Possible values:
Not connected
DNS lookup
Connecting
OK
DNS lookup failure
TCP connect failure
TLS connect failure
Closed by replica
Incompatible firmware
Transfer error
State
This entry contains the state of the remote device.
SNMP ID:
1.11.51.7.6
1748
Reference Manual
17 High availability – backup solutions
Telnet path:
Status > Config > Sync > Replicas
Possible values:
Unknown
Missing messages
Missing updates
Old cluster
New cluster
No snapshot
Time unknown
OK
Cluster time
This entry contains the time of the configuration synchronization.
SNMP ID:
1.11.51.7.7
Telnet path:
Status > Config > Sync > Replicas
Last message received at
This entry indicates when the remote device received its last message.
SNMP ID:
1.11.51.7.8
Telnet path:
Status > Config > Sync > Replicas
Last update received at
This entry indicates when the remote device received its last configuration update.
SNMP ID:
1.11.51.7.10
Telnet path:
Status > Config > Sync > Replicas
1749
Reference Manual
17 High availability – backup solutions
Last message sent at
This entry indicates when the remote device sent its last message.
SNMP ID:
1.11.51.7.12
Telnet path:
Status > Config > Sync > Replicas
Additions to the Setup menu
Config Sync
Indicates whether a config sync is possible (restricted) via this interface.
SNMP ID:
2.11.15.10
Telnet path:
Setup > Config > Access-Table
Possible values:
VPN
Access is only possible via VPN.
4
VPN-capable devices only.
Yes
Access is generally possible.
4
By default via all interfaces except WAN.
Read
Access is read only.
No
Access is not possible.
4
Default setting for the WAN interface.
Default:
Yes
No
1750
Reference Manual
17 High availability – backup solutions
Sync
In this directory, you configure the automatic configuration synchronization.
SNMP ID:
2.11.51
Telnet path:
Setup > Config
Operating
Activates or deactivates the automatic configuration synchronization.
SNMP ID:
2.11.51.1
Telnet path:
Setup > Config > Sync
Possible values:
No
Yes
Default:
No
New cluster
Here you can configure the scope of a configuration synchronization.
SNMP ID:
2.11.51.2
Telnet path:
Setup > Config > Sync
Name
Enter an identifier for this entry.
SNMP ID:
2.11.51.2.1
1751
Reference Manual
17 High availability – backup solutions
Telnet path:
Setup > Config > Sync > New Cluster
Possible values:
Max. 254 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
Default
Cluster members
This table lists devices that participate in the automatic configuration synchronization.
SNMP ID:
2.11.51.2.2
Telnet path:
Setup > Config > Sync > New Cluster
Idx.
Index for this entry in the list.
SNMP ID:
2.11.51.2.2.1
Telnet path:
Setup > Config > Sync > New Cluster > Group Members
Possible values:
Max. 5 characters from 0123456789
Default:
empty
Address
IP address of the corresponding device.
SNMP ID:
2.11.51.2.2.2
Telnet path:
Setup > Config > Sync > New Cluster > Group Members
1752
Reference Manual
17 High availability – backup solutions
Possible values:
Max. 63 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Possible arguments:
IPv4 address
IPv6 address
Default:
empty
Menu nodes
Here you configure which configuration items are to be contained in the automatic configuration synchronization. This
enables you to include or exclude values, tables, and entire menus.
SNMP ID:
2.11.51.2.3
Telnet path:
Setup > Config > Sync > New Cluster
Idx.
Index for this entry in the list.
SNMP ID:
2.11.51.2.3.1
Telnet path:
Setup > Config > Sync > New Cluster > Menu Nodes
Possible values:
Max. 5 characters from 0123456789
Default:
empty
Include
Specify here whether the specified menu node is included in or excluded from the automatic configuration synchronization.
SNMP ID:
2.11.51.2.3.2
Telnet path:
Setup > Config > Sync > New Cluster > Menu Nodes
1753
Reference Manual
17 High availability – backup solutions
Possible values:
Include
Exclude
Default:
Include
Path
Enter the path to the menu node. This can be a value, a table, or a complete menu.
SNMP ID:
2.11.51.2.3.3
Telnet path:
Setup > Config > Sync > New Cluster > Menu Nodes
Possible values:
Max. 127 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
/Setup
SNMP OID
Show the SNMP-ID of the specified menu node.
4
The display is updated after you save the entry.
SNMP ID:
2.11.51.2.3.4
Telnet path:
Setup > Config > Sync > New Cluster > Menu Nodes
Possible values:
2
Default:
2
1754
Reference Manual
17 High availability – backup solutions
Ignored rows
If you include a table into the automatic configuration synchronization, this item is used to determine which rows of this
table are to be excluded from it.
SNMP ID:
2.11.51.2.4
Telnet path:
Setup > Config > Sync > New Cluster
Idx.
Index for this entry in the list.
SNMP ID:
2.11.51.2.4.1
Telnet path:
Setup > Config > Sync > New Cluster > Ignored Rows
Possible values:
Max. 5 characters from 0123456789
Default:
empty
Row index
Here you specify the row number (index) to be excluded from the automatic configuration synchronization.
SNMP ID:
2.11.51.2.4.2
Telnet path:
Setup > Config > Sync > New Cluster > Ignored Rows
Possible values:
Max. 127 characters from [A-Z][a-z][0-9]#@{|}~!"$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Path
Specify the path to the node of the table that is contained in the automatic configuration synchronization.
1755
Reference Manual
17 High availability – backup solutions
SNMP ID:
2.11.51.2.4.3
Telnet path:
Setup > Config > Sync > New Cluster > Ignored Rows
Possible values:
Max. 127 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.`
Default:
/Setup
SNMP OID
Show the SNMP-ID of the specified table node.
4
The display is updated after you save the entry.
SNMP ID:
2.11.51.2.4.4
Telnet path:
Setup > Config > Sync > New Cluster > Ignored Rows
Possible values:
2
Default:
2
Home
Starts the automatic configuration synchronization for this entry.
SNMP ID:
2.11.51.2.5
Telnet path:
Setup > Config > Sync > New Cluster
TLS connections
In this directory, you specify the address and port to be used by the device to accept incoming configuration changes.
1756
Reference Manual
17 High availability – backup solutions
SNMP ID:
2.11.51.3
Telnet path:
Setup > Config > Sync
Port
Specify the port to be used by the device to receive incoming configuration changes.
SNMP ID:
2.11.51.3.1
Telnet path:
Setup > Config > Sync > TLS-Connections
Possible values:
Max. 5 characters from [0-9]
0 … 65535
Default:
1941
Loopback address
Specify the loopback address to be used by the device to receive incoming configuration changes.
SNMP ID:
2.11.51.3.2
Telnet path:
Setup > Config > Sync > TLS-Connections
Possible values:
Max. 39 characters from [A-Z][a-z][0-9].-:%
Possible arguments:
Name of the IP networks whose address should be used
“INT” for the address of the first Intranet
“DMZ” for the address of the first DMZ
LBO ... LBF for the 16 loopback addresses
Any valid IPv4 or IPv6 address
Default:
empty
1757
Reference Manual
17 High availability – backup solutions
Renew snapshot
In this directory you configure the snapshots.
SNMP ID:
2.11.51.4
Telnet path:
Setup > Config > Sync > Renew-Snapshot
Modification limit
Enter the modification limit here.
SNMP ID:
2.11.51.4.1
Telnet path:
Setup > Config > Sync > Renew-Snapshot
Possible values:
Max. 10 characters from 0123456789
Special values:
0
This value disables the function.
Default:
2048
Kept modifications
This value specifies the number of kept modifications.
SNMP ID:
2.11.51.4.2
Telnet path:
Setup > Config > Sync > Renew-Snapshot
Possible values:
Max. 10 characters from 0123456789
0 … 4294967295 Powers of two
Special values:
0
This value disables the function.
1758
Reference Manual
17 High availability – backup solutions
Default:
256
Renew snapshot
This action renews the snapshot.
SNMP ID:
2.11.51.4.3
Telnet path:
Setup > Config > Sync > Renew-Snapshot
Local configuration
In this directory you specify the number of applied and detected modifications.
SNMP ID:
2.11.51.5
Telnet path:
Setup > Config > Sync > Local Config
Detected modifications
Specify the number of detected modifications.
SNMP ID:
2.11.51.5.1
Telnet path:
Setup > Config > Sync > Local Config
Possible values:
Max. 10 characters from 0123456789
Applied modifications
Specify the number of applied modifications.
SNMP ID:
2.11.51.5.2
1759
Reference Manual
17 High availability – backup solutions
Telnet path:
Setup > Config > Sync > Local Config
Possible values:
Max. 10 characters from 0123456789
1760
Reference Manual
17 High availability – backup solutions
18 Office communication with LANCAPI
5
This section only applies to devices with ISDN interface.
LANCAPI from LANCOM Systems is a special version of the popular CAPI interface. CAPI (Common ISDN Application
Programming Interface) establishes the connection between ISDN adapters and communications programs. For their
part, these programs provide the computers with office communications functions such as a fax machine or answering
machine.
18.1 What are the advantages of LANCAPI?
The main advantages of using LANCAPI are economic. LANCAPI provides all Windows workstations integrated in the
LAN (local-area network) with unlimited access to office communications functions such as fax machines, answering
machines, online banking and eurofile transfer. All functions are supplied via the network without the necessity of
additional hardware at each individual workstation, thus eliminating the costs of equipping the workstations with ISDN
adapters or modems. All you need do is install the office communications software on the individual workstations.
For example, faxes are sent by simulating a fax machine at the workstation. With LANCAPI, the PC forwards the fax via
the network to the router which establishes the connection to the recipient.
5
Please note: All LANCAPI-based applications access the ISDN directly and do not run across the router of the
device. The connect-charge monitoring and firewall functions are thus disabled! The LANCAPI is also independent
from all routing or VPN functions.
18.2 The client and server principle
The LANCAPI is made up of two components, a server (in the LANCOM) and a client (on the PCs). The LANCAPI client
must be installed on all computers in the LAN that will be using the LANCAPI functions.
ISDN
ISDN Phone
ISDN
PC PC PC
ISDN Router
PCs with LANCAPI client and
ISDN answering machine software
LANCOM with LANCAPI server
18.2.1 Configuring the LANCAPI server
Two basic issues are important when configuring the LANCAPI server:
1
What call numbers from the telephone network should LANCAPI respond to?
1
Which of the computers in the local network should be able to access the telephone network via LANCAPI?
The configuration of the router takes place in the configuration tables of LANconfig or WEBconfig. In the following two
sections you can find the instructions for both of these configuration programs.
1761
Reference Manual
18 Office communication with LANCAPI
Configuration with LANconfig
1. Open the configuration of the router by double-clicking on the device name in the list and enter your password if
requested.
1. In the configuration area 'LANCAPI' click on the tab 'General' and select at the LANCAPI interfaces the ISDN port
you want to set.
1762
Reference Manual
18 Office communication with LANCAPI
1. Activate the LANCAPI server for the outgoing and incoming calls, or allow only outgoing calls.
1. If the LANCAPI server is supposed to respond to incoming calls, enter the call numbers to which the LANCAPI should
respond in the 'Number (MSN)' field. You can enter several call numbers separated by semicolons. If you do not
enter a call number here, all incoming calls are reported to LANCAPI.
Configuration of WEBconfig
1. Select in the main menu the LCOS menu tree.
2. Select in the following menus Setup / LANCAPI-module / Interface-list.
3. Select in the Interface-list the (only) entry S0-1.
4. Activate the LANCAPI server for outgoing and incoming calls ('On'), or only allow outgoing calls ('Dail-only').
1
If the LANCAPI server is supposed to respond to incoming calls, enter the call numbers to which the LANCAPI should
respond in the 'Number (MSN)' field. You can enter several call numbers separated by semicolons. If you do not enter
a call number here, all incoming calls are reported to LANCAPI.
18.2.2 Installing the LANCAPI client
5
For the installation of the LANCAPI client on a system with Windows XP or Windows 2000 administrator rights
are required.
1. Place the LANCOM CD in your CD-ROM drive. If the setup program does not automatically start when you insert the
CD, simply click 'autorun.exe' in the main directory of the LANCOM CD in the Windows Explorer.
1763
Reference Manual
18 Office communication with LANCAPI
2. Select the Install LANCOM software entry.
3. Highlight the LANCAPI option. Click Next and follow the instructions for the installation routine.
If necessary, the system is restarted and LANCAPI is then ready to accept all jobs from the office communications software.
After successful installation, an icon for LANCAPI will be available in the toolbar. A double-click on this icon opens a
status window that permits current information on the LANCAPI to be displayed at any time.
The LANCAPI client starts automatically and shows the status in the windows task bar.
18.2.3 Configuration of the LANCAPI clients
The configuration of the LANCAPI clients is used to determine which LANCAPI servers will be used and how these will
be checked. All parameters can remain at their default settings if you are using only one LANCOM in your LAN as an
LANCAPI server.
1. Start the LANCAPI client in the 'LANCOM' program group. Information regarding the drivers for the available service
can be found on the 'General' tab.
2. In the LANCAPI client, change to the Network tab. First, select whether the PC should find its own LANCAPI server,
or specify the use of a particular server.
1
For the former, determine the interval at which the client should search for a server. It will continue searching
until it has found the number of servers specified in the next field. Once the required number of servers has been
found, it will stop searching.
1
In the event that the client should not automatically search for servers, list the IP addresses of the servers to be
used by the client. This can be useful if you are operating several LANCOM in your LAN as LANCAPI servers and
you would like to specify a server for a group of PCs, for example.
1
It is also possible to set the interval at which the client checks whether the found or listed servers are still active.
18.3 How to use the LANCAPI
Two options are available for the use of the LANCAPI:
1
You may use software which interacts directly with a CAPI (in this case, the LANCAPI) port. This type of software
searches for the CAPI during its installation and uses it automatically.
1764
Reference Manual
18 Office communication with LANCAPI
1
Other programs such as LapLink can establish a variety of connection types, for example, using Windows Dial-Up
Networking. You may select the installed communications device that you would like to use when creating a new
dial-up connection. For the LANCAPI, select the entry 'ISDN WAN Line 1'.
18.4 The LANCOM Systems CAPI Faxmodem
The CAPI Faxmodem provides a Windows fax driver (Fax Class 1) as an interface between the LANCAPI and applications,
permitting the use of standard fax programs with an LANCOM. The LANCOM CAPI Faxmodem emulates the modem
functions, as well as the fax protocols in the software on the PC. For this purpose an adequate performance (500 MHz
Pentium and more) is required.
18.4.1 Installation
The CAPI Faxmodem can be installed from the CD setup. Always install the CAPI Faxmodem together with the current
version of LANCAPI. After restarting, the CAPI Faxmodem will be available for you, e.g. in Windows 98 under Start /
Settings / Control Panel / Modems.
18.4.2 Faxing with the CAPI Faxmodem
Most major fax programs recognize the CAPI Faxmodem automatically during installation and identify it as a 'Class 1'
fax modem. Fax transmissions can thus be realized at speeds of up to 14,400 bps. If your fax program offers you a choice
(such as WinFax and Talkworks Pro), select the option 'CLASS 1 (Software Flow Control)' when setting up the modem.
18.4.3 Faxing under Windows XP and Windows 2000
Windows XP or Windows 2000 provide with the CAPI Faxmodem full functionality for faxing. An additional fax program
is not required.
Thereto start in the Control Panel under “Add or Remove Programs”, “Add/Remove Windows Components” and select
“Fax Services”.
After the installation the fax can be found under “Printers and Faxes”, and can be chosen in any Windows program
instead of a printer.
5
The CAPI Faxmodemis only able to transmit fax messages, if the LANCAPI ist active.
18.5 LANCOM Faxmodem option
Additionally to the CAPI Faxmodem some LANCOM models (LANCOM 800, 4000, 4100) have a faxmodem option. With
this solution the fax and modem services are implemented in the LANCOM itself, the PCs are released from the load of
the modem emulation.
18.6 Provided B channel protocols
Following CAPI-Protocols are provided
RemarkValue
B1 protocol
1765
Reference Manual
18 Office communication with LANCAPI
RemarkValue
64 Kbps with HDLC framing0
64 Kbps transparent with byte framing of the network1
V.110 asynchron with start-stop-byte framing2
T.30-Modem for fax group 34*
Modem with full negotiations (B2 has to be 7)7*
B2-Protocol
ISO 7776 (X.75 SLP)0
Transparent1
T.30 for fax group 34*
Modem with full negotiations (e.g. V.42 bis, MNP 5)7*
V.120 asynchron9
B3-Protocol
Transparent0
T.90NL, compatible with T.70NL in accordance with T.90, Appendix II1
ISO 8208 (X.25 DTE-DTE)2
T.30 for fax group 34*
T.30 for fax group 3 extended5*
Modem7*
* = valid only for LANCOM faxmodem option
1766
Reference Manual
18 Office communication with LANCAPI
19 More services
An LANCOM offers a number of services for the PCs in the LAN. These are central functions that can be used by workstation
computers. They are in particular:
1
Automatic address administration with DHCP
1
Name management of computers and networks with DNS
1
Logging of network traffic with SYSLOG
1
Recording of charges
1
Office communications functions with LANCAPI
1
Time server
19.1 Automatic IP address administration with DHCP
New in LCOS 7.60:
1
BOOTP: Assignment of fixed IP addresses or boot images to specific workstations depending on the IP network (ARF)
19.1.1 Introduction
DHCP server
All devices in a local area network require a unique IP address in order for a TCP/IP network to function smoothly. They
also require the addresses of DNS and NBNS servers and also of a standard gateway that can route data packets to
addresses not located on the local network.
In a small network it is still possible to enter these addresses on all the computers in the network "by hand". However,
in a large network with many workstations this soon becomes an unmanageable task. This is where the use of DHCP
(dynamic host configuration protocol) comes in. A DHCP server in a TCP/IP-based LAN can use this protocol to assign
the required addresses to the individual workstations dynamically.
LANCOM devices have an integrated DHCP server that can assume the task of assigning IP addresses. This process
involves communicating the following parameters to the workstations:
1
IP address
1
Network mask
1
Broadcast address
1
Standard gateway
1
DNS server
1
NBNS server
1
Lease (validity period) of the assigned parameters
The DHCP server either takes the IP addresses from a freely defined address pool or determines the addresses independently
based on its own IP address. A completely unconfigured device in DHCP auto-mode can even specify IP addresses for
itself and for network devices autonomously. Therefore in the most basic scenario you only need to connect a new
out-of-the-box device to a network without a DHCP server and switch it on. The DHCP server will then manage all further
address assignment in the LAN by itself in cooperation with LANconfig using a Wizard.
5
DHCP settings can be different for each network. It is possible to define several IP networks in the LANCOM
devices in conjunction with advanced routing and forwarding (ARF). DHCP settings therefore apply to a particular
IP network, with the exception of a few general settings.
1767
Reference Manual
19 More services
DHCP relay
If another DHCP server is located in the LAN, the device can obtain the address information it requires from the other
DHCP server if it is in DHCP client mode.
The LANCOM can also operate as a DHCP relay agent and as a DHCP relay server.
1
As a DHCP relay agent the LANCOM forwards DHCP requests to another DHCP server.
1
As a DHCP relay server the LANCOM processes DHCP requests forwarded from DHCP relay agents.
BOOTP
The bootstrap protocol (BOOTP) can be used to send a certain IP address and other parameters to a workstation when
it boots up. Workstations without hard drives can use BOOTP to load a boot image, i.e. a complete operating system,
from a boot server.
19.1.2 Configuring DHCP parametersLANconfig
Activating/deactivating a DHCP server for specific logical interfaces
The DHCP server can be activated or deactivated separately for each logical interface (e. g. LAN-1, WLAN-1, P2P-1-1
etc.). To do this, select the appropriate logical interface from the port list and switch the DHCP server on or off for this
interface. You can find the parameters for activating the ports in LANconfig in the configuration area "TCP/IP" on the
"DHCP" tab.
Configuring DHCP networks
The appropriate DHCP settings can be specified separately for any IP network defined in the device. You can find the
parameters for defining DHCP networks in LANconfig in the configuration area "TCP/IP" on the "DHCP" tab.
1768
Reference Manual
19 More services
When configuring DHCP networks, the addresses are defined that can be assigned to the DHCP clients (address pool).
When a client is activated in the network and requests an IP address via DHCP, the device with an activated DHCP server
will offer to issue an address. This address is selected from the pool of valid IP addresses. A computer which received
an IP address in the past requests this address again and, assuming the DHCP server has not assigned this number to
another computer in the meantime, it will attempt to issue this address again.
The DHCP server also checks the LAN to confirm that the selected address is free. Once the address is confirmed as
unique, it is assigned to the requesting computer.
5
The device factory settings include the IP networks 'Intranet' and 'DMZ', although there are no settings for IP
addresses and netmasks. The device is in a special operating mode. It then uses the IP address '172.23.56.254'
and the address pool '172.23.56.x' for assigning IP addresses to the network.
5
Multiple networks on one interface: With the configuration of IP and DHCP networks, multiple networks with
different DHCP settings can be active at a logical interface. In this case, the DHCP settings for the first suitable
network are applied. A prioritization of networks may be necessary here.
1
Selecting the IP network
Select the IP network which the subsequent DHCP settings should apply to. You can find the parameters for defining
DHCP networks in LANconfig in the configuration area "TCP/IP" on the "General" tab.
1
Enabling the DHCP server
The DHCP server can be configured to run in the following modes:
1
'Yes': DHCP server is permanently switched on. When this value is entered the server configuration (validity of the
address pool) is checked.
2
If the configuration is correct then the device starts operating as a DHCP server in the network.
2
Errors in the configuration (e.g. invalid pool limits) will cause the DHCP server to be disabled.
5
Only use this setting if you are certain that no other DHCP server is active in the LAN.
2
'No': DHCP server is permanently switched off.
2
'Auto': With this setting, the device regularly searches the local network for other DHCP servers. The LAN-Rx/Tx
LED flashes briefly when this search is in progress.
1769
Reference Manual
19 More services
If another DHCP server is discovered the device switches its own DHCP server off. If the LANCOM Router is
not configured with an IP address, then it switches into DHCP client mode and queries the LAN DHCP server
3
for an IP address. This prevents unconfigured devices introduced to the network from assigning addresses
unintentionally.
3
If no other DHCP server is discovered the device switches its own DHCP server on. If another DHCP server is
activated later, then the DHCP server in the LANCOM Router will be disabled.
2
'Client mode': The DHCP server is disabled, the device behaves as a DHCP client and obtains its address from
another DHCP server in the LAN.
5
Only use this setting if you are certain that another DHCP server is in the LAN and actively assigning IP
addresses.
1
'Queries forwarded': The DHCP server is active and receives requests from DHCP clients in the LAN. The device does
not respond to requests itself, but forwards them to a central DHCP server in a different network segment.
The DHCP statistics show whether the DHCP server is enabled or not.
The default setting for this parameter is 'Auto'.
1
Assigning IP addresses
The DHCP server must first know which IP addresses it can use to assign before it can actually assign them to workstations
in the network There are three different methods for selecting possible addresses:
1
An IP address can be taken from the defined address pool (First address: to Last address:). Any address can be entered
provided it is valid for the IP network segment.
1
If '0.0.0.0' is entered, the DHCP server determines the relevant first and last addresses itself using the settings for
the IP network (network address and netmask).
1
The device will be in a special operating mode if no IP network has yet been defined. It then uses the IP address
'172.23.56.254' and the address pool '172.23.56.x' for assigning IP addresses to the network.
When a client is activated in the network and requests an IP address via DHCP, the device with an activated DHCP server
will offer to assign an address. This address is selected from the pool of valid IP addresses. A computer which received
an IP address in the past requests this address again and, assuming the DHCP server has not assigned this number to
another computer in the meantime, it will attempt to issue this address again.
The DHCP server also checks the LAN to confirm that the selected address is free. Once the address is confirmed as
unique, it is assigned to the requesting computer.
1
Assigning the netmask
The netmask is assigned in a similar way to assigning addresses. If a netmask has been entered in the DHCP settings, it
will be used when assignment is made. Otherwise the IP network's netmask will be used.
1
Assigning the broadcast address
As a rule, broadcast packets in a local network have an address which results from the valid IP addresses and the netmask.
In special cases (e.g. when using subnets for a selection of workstations) it may be necessary to use a different broadcast
address. In this case the broadcast address to be used is entered in the DHCP settings.
5
We recommend that only experienced network specialists change the pre-setting for the broadcast address.
Errors in the configuration here can lead to costly connections being established!
1
Assigning the standard gateway
As standard, the LANCOM issues its own IP address as the gateway address to computers making requests. If necessary,
the IP address of another gateway can be transmitted if a corresponding address is entered here.
1
Assigning DNS and NBNS servers
IP address of the DNS and NBNS name servers to which DNS and NBNS requests should be forwarded.
1770
Reference Manual
19 More services
If no server is defined in the relevant fields, the router will forward its own IP network address as DNS or NBNS address
if the DNS server has been enabled for the network in question. If the DNS server is not active for this network, then the
IP address in the global TCP/IP settings is communicated as the DNS server.
Configuring the assignment of fixed IP addresses to specific clients
You can find the parameters for configuring BOOTP in LANconfig in the configuration area "TCP/IP" on the "BOOTP"
tab.
Optionally: You can define a boot image in the list of boot images that you wish to assign to a client.
Enter the MAC address of the client that you wish to assign a fixed IP address to in the list of stations. You may also
select a boot image that is to be assigned to this client. If this address assignment is only to be used if the client is in a
particular IP network, enter the appropriate IP network.
1771
Reference Manual
19 More services
19.1.3 Configuring DHCP parameters with telnet or WEBconfig
General DHCP settings
1
User class identifier
The DHCP client in the LANCOM can insert additional information in the DHCP request sent, which simplify request
recognition within the network. The vendor class identifier (DHCP option 60) shows the device type, e.g. 'LANCOM
L-54ag'. The vendor class ID is always transmitted. The user class ID (DHCP option 77) specifies a user-defined string.
The user class ID is only transmitted when the user has configured a value.
1
Default lease minutes
When a client requests an address without asking for a specific lease, the address will be assigned the value set here
as lease.
1
Max. lease minutes
When a client requests an IP address from a DHCP server, it can also ask for a lease for the address. This values
governs the maximum length of lease that the client may request.
Alias list
The alias list defines the names for the boot images that are used to reference the images in the hosts table.
1
Image alias
Enter any name you wish for this boot image. This name is used when you assign a boot image to a particular client
in the station list.
1
Image server
Enter the IP address of the server that provides the boot image.
1
Image file
Enter the name of the file on the server containing the boot image.
DHCP table
The DHCP table provides an overview of the IP addresses used in the IP networks. The DHCP table is purely a status table
where no parameters can be configured.
1
IP address
IP address used by the client.
1
MAC address
The client's MAC address.
1
Timeout
Period of validity (lease) for the address assignment in minutes.
1
Client name
Name of the client, if it was possible to determine this.
1
Type
The 'Type' field indicates how the address was assigned. This field may contain the following values:
2
New: The client made the request for the first time. The DHCP checks that the address to be assigned to the client
is unique.
2
Unknown: When the server checked if the address was unique, it was found that the address had already been
assigned to another client. Unfortunately, the DHCP doe not have any possibility of obtaining further information
about this client.
1772
Reference Manual
19 More services
2
Stat: A client has informed the DHCP server that it has a fixed IP address. This address may not be used for any
other clients in the network.
2
Dyn.: The DHCP server has assigned an address to the client.
1
LAN Ifc
Logical interface connecting the client to the device.
1
Ethernet port
Physical interface connecting the client to the device.
1
VLAN ID
The VLAN ID used by the client.
1
Network name
Name of the IP network where the client is located.
Hosts table
The bootstrap protocol (BOOTP) can be used to communicate a certain IP address and other parameters to a workstation
when it boots up. For this, the workstation's MAC address is entered into the hosts table.
1
MAC address
Enter the MAC address of the workstation to which an IP address is to be assigned.
Possible values:
1
Network name
Enter the name of a configured IP network here. Only if a requesting client is located in this IP network will it be
assigned the relevant IP address defined for the MAC address.
5
If the requesting client is located in an IP network for which there is no corresponding entry in the hosts
table, the client will be assigned an IP address from the address pool of the appropriate IP network.
1
IP address
Enter the client IP address that is to be assigned to the client.
1
Client name
Enter the name that is to be used to identify the client. If the client does not communicate its name, the device will
use the name entered here..
1
Image alias
If the client uses the BOOTP protocol, you can select a boot image that the client should use to load its operating
system from.
5
You must enter the server providing the boot image and the name of the file on the server in the boot image
table.
Network list
DHCP settings for the IP networks are defined in this table.
1
Network name
The name of the network which the DHCP server settings apply to.
1
DHCP server enabled
DHCP server operating mode in this network. Depending on the operating mode, the DHCP server can enable or
disable itself. You can see whether the DHCP server is enabled from the DHCP statistics.
1773
Reference Manual
19 More services
Possible values:
2
No: DHCP server is permanently switched off.
2
Automatic: With this setting, the device regularly searches the local network for other DHCP servers. The LAN-Rx/Tx
LED flashes briefly when this search is in progress.
If another DHCP server is discovered the device switches its own DHCP server off. If the LANCOM Router is not
configured with an IP address, then it switches into DHCP client mode and queries the LAN DHCP server for an IP
address. This prevents unconfigured devices introduced to the network from assigning addresses unintentionally.
If no other DHCP server is discovered the device switches its own DHCP server on. If another DHCP server is activated
later, then the DHCP server in the LANCOM Router will be disabled.
2
'Yes': DHCP server is permanently switched on. When this value is entered the server configuration (validity of
the address pool) is checked.
If the configuration is correct then the device starts operating as a DHCP server in the network.
Errors in the configuration (e.g. invalid pool limits) will cause the DHCP server to be deactivated.
2
'Client mode': The DHCP server is disabled, the device behaves as a DHCP client and obtains its address from
another DHCP server in the LAN.
2
'Relay requests': The DHCP server is active and receives requests from DHCP clients in the LAN. The device does
not respond to requests, but forwards them to a central DHCP server elsewhere in the network (DHCP relay agent
mode).
Default:
2
Automatic
5
Only use the setting "Yes" if you are certain that no other DHCP server is active in the LAN.
5
Only use the "client mode" setting if you are certain that another DHCP server is in the LAN and actively
assigning IP addresses.
1
Broadcast bit check
This setting decides whether the broadcast bit from clients is to be checked. If the bit is not checked then all DHCP
messages are sent as broadcasts.
1
Start address
The first IP address in the pool available to the clients. If no address is entered here the DHCP takes the first available
IP address from the network (as determined by network address and netmask).
1
End address
The last IP address in the pool available to the clients. If no address is entered here the DHCP takes the last available
IP address from the network (as determined by network address and netmask).
1
Network mask
Corresponding netmask for the address pool available to the clients. If no address is entered here the DHCP server
uses the netmask from the corresponding network.
1
Broadcast
As a rule, broadcast packets in a local network have an address which results from the valid IP addresses and the
netmask. In special cases (e.g. when using subnets for a selection of workstations) it may be necessary to use a
different broadcast address. In this case the broadcast address is entered into the DHCP module.
5
We recommend that only experienced network specialists change the pre-setting for the broadcast address.
Errors in the configuration here can lead to costly connections being established!
1
Standard gateway
1774
Reference Manual
19 More services
As standard, the LANCOM issues its own IP address as the gateway address to computers making requests. If
necessary, the IP address of another gateway can be transmitted if a corresponding address is entered here.
1
DNS default
IP address of the DNS name server for the forwarding of DNS requests.
1
DNS backup
IP address of the backup DNS name server for the forwarding of DNS requests, in the event that the first name server
fails.
1
NBNS default
IP address of the NetBIOS name server for the forwarding of NetBIOS requests.
1
NBNS backup
IP address of the backup NBNS name server for the forwarding of NBNS requests, in the event that the first name
server fails.
1
Server address
This is where the IP address for the superordinate DHCP server is entered when the mode 'Relay requests' is selected.
1
Caching of server responses
This option allows the responses from the superordinate DHCP server to be stored in the LANCOM Router. Subsequent
requests can then be answered by the LANCOM Router itself. This option is useful if the superordinate DHCP server
can only be reached via a connection which incurs costs.
1
Adapting server responses to the local network
This option allows the responses from the superordinate DHCP server to be adapted to the local network. When
activated, the LANCOM adapts the responses from the superordinate DHCP server by replacing the following entries
with its own address (or locally configured addresses):
2
Gateway
2
Network mask
2
Broadcast address
2
DNS server
2
NBNS server
2
Server ID
This option is worthwhile if the superordinate DHCP server does not permit the separate configuration for DHCP
clients in another network.
Port table
The port table is where the DHCP server is enabled for the appropriate logical interface of the device.
1
Path: Setup/DHCP/Ports
1
Port
Select the logical interface for which the DHCP server should be enabled or disabled.
1
Enable DHCP
Enables or disables the DHCP server for the selected logical interface.
Additional options
DHCP options can be used to send additional configuration parameters to the clients. The vendor class ID (DHCP option
60) shows e. g. the type of device. This table allows additional options for DHCP operations to be defined.
1
Option number
1775
Reference Manual
19 More services
Number of the option that should be sent to the DHCP client. The option number describes the transmitted information.
For example "17" (root path) is the path to a boot image that a PC without its own hard disk uses to obtains its
operating system via BOOTP. You can find a complete list of all DHCP options in RFC 2132 – "DHCP Options and
BOOTP Vendor Extensions" of the Internet Engineering Task Force (IETF).
1
Network name
Name of the IP network where this DHCP option is to be used.
1
Option value
This field defines the contents of the DHCP option. For the option "17", for example, the path is entered for a boot
image that a PC without its own hard disk uses to obtains its operating system via BOOTP.
5
The maximum possible length value depends on the selected option number. RFC 2132 lists the maximum
length allowed for each option.
19.1.4 DHCP relay server
A LANCOM is not limited to forwarding DHCP requests to superordinate DHCP servers; it can also function as a central
DHCP server (DHCP relay server).
In order for a LANCOM to be provided as a DHCP relay server to other networks, the relay agent IP address (GI address)
is entered as the network name in the table of IP networks.
If the same network is being used by several relay agents (e.g. multiple access points are forwarding requests to a central
DHCP server) then the GI address can also be abbreviated with a "*". If for example clients in the remote network
'10.1.1.0/255.255.255.0' are to be assigned with addresses and several relay agents are available in this network, all
of which use the LANCOM as superordinate DHCP server, then the assignment of IP addresses and standard gateway
to the clients can take place as follows:
5
To operate as DHCP relay server, it is imperative that the address pool and the netmask are given.
DNS resolution of names learned via DHCP
The DNS server considers the interface tags when resolving names learned via DHCP, i.e. the only names to be resolved
are those which were learned from a network with the same interface tag as the requesting computer. If the request
1776
Reference Manual
19 More services
arrives from an untagged network, then all names are resolved, including those that were learned via tagged networks.
Similarly, all names that were learned from untagged networks are visible for tagged networks.
Names learned from relay agents are handled as though they were learned from an untagged network, i.e. these names
are visible to all networks.
19.1.5 Configuring clients
It is standard in a Windows network environment for nearly all settings to be configured in such a way that required
parameters can be requested via DHCP. You can check your Windows settings by clicking on Start / Settings / Control
Panel E Network. Select the entry for TCP/IP on your network adapter and open Properties. You can now see on the
various tabs whether there are special entries for e.g. the IP address or the standard gateway. If you wish to have all
the values assigned by the DHCP server, just delete the corresponding entries.
If a client is to use a different parameter from the one assigned (e.g. for a standard gateway), this parameter must be
configured at the workstation itself. The client will then ignore the corresponding parameter(s) in those assigned by the
DHCP server.. Under Windows this can be effected for example via the properties of the network environment. Click on
Start / Settings / Control Panel / Network. Select the entry for 'TCP/IP' on your network adapter and open Properties.
You can now enter the desired values on the various tabs.
19.1.6 Checking IP addresses in the LAN
You can view a summary of the LAN IP addresses in the DHCP table (WEBconfig: Setup/DHCP/DHCP Table). It shows the
assigned and used IP address, the MAC address, the lease, the client's name (if available) as well as the type of address
assignment.
19.1.7 Addition(s) to LCOS 7.80
DHCP cluster
Introduction
If multiple DHCP servers are active in a network, the stations "divide" themselves equally between them. However, the
DNS server in LANCOM devices can only properly resolve the name of the station which was assigned the address
information by the DHCP server. In order for the DNS server to be able to resolve the names of other DHCP servers, these
can be operated in a cluster. In this operating mode, the DHCP server monitors all DHCP negotiations in the network. It
additionally supplements its table with the stations which are registered at the other DHCP servers in the cluster.
Configuration
A DHCP server's operation in the cluster can be activated or deactivated for each individual ARF network with the
associated DHCP settings.
WEBconfig: LCOS menu tree / Setup / DHCP / Network list
1777
Reference Manual
19 More services
1
Cluster
This setting defines whether the DHCP server for this ARF network is to be operated separately or in the cluster.
Possible values:
2
Yes: With cluster mode activated, the DHCP server monitors all of the ongoing DHCP negotiations in the network,
and it additionally supplements its table with the stations which are registered at the other DHCP servers in the
cluster. These stations are flagged as "cache" in the DHCP table.
2
No: The DHCP server manages information only for the stations connected to it.
Default:
2
No
5
If the lease time for the information supplied by DHCP expires, the station requests a renewal from the DHCP
server which supplied the original information. If the original DHCP server does not respond, the station then
emits its rebinding request as a broadcast to all available DHCP servers. DHCP servers in a cluster ignore
renew requests, which forces a rebinding. The resulting broadcast is used by all of the DHCP servers to update
their entries for the station. The only DHCP server to answer the rebind request is the one with which the
station was originally registered. If a station repeats its rebind request, the all DHCP servers in the cluster
assume that the original DHCP server is no longer active in the cluster, and they respond to the request. The
responses received by the station will have the same IP address, but the gateway and DNS server addresses
may differ. From these responses, the station selects a new DHCP server to connect with, and it updates its
gateway and DNS server (and other relevant parameters) accordingly.
DHCP options with LANconfig
DHCP options can be used to send additional configuration parameters to the clients. The vendor class ID (DHCP option
60) shows e. g. the type of device. This table allows additional options for DHCP operations to be defined.
LANconfig: TCP/IP / DHCP / DHCP-Options
WEBconfig: LCOS menu tree / Setup / DHCP / Additional options
1
Option number
Number of the option that should be sent to the DHCP client. The option number describes the transmitted information.
For example "17" (root path) is the path to a boot image that a PC without its own hard disk uses to obtain its
operating system via BOOTP.
Possible values:
2
Maximum 3 characters.
Default:
2
Blank
5
You can find a list of all DHCP options in RFC 2132 – "DHCP Options and BOOTP Vendor Extensions" of the
Internet Engineering Task Force (IETF).
1
Network name
Name of the IP network where this DHCP option is to be used.
Possible values:
1778
Reference Manual
19 More services
2
Selection from the list of IP networks defined in the device; max. 16 characters
Default:
2
Blank
1
Type
Entry type. This value depends on the respective option. For option "35" according to RFC 1232, e.g. the ARP cache
time is defined as follows:
ARP cache timeout option
This option specifies the timeout in seconds for ARP cache entries.
The time is specified as a 32-bit unsigned integer.
The code for this option is 35, and its length is 4.
Code Len Time
+-----+-----+-----+-----+-----+-----+
| 35 | 4 | t1 | t2 | t3 | t4 |
+-----+-----+-----+-----+-----+-----+
This description tells you that this the type "32-bit integer" is used for this option.
Possible values:
2
String, Integer8, Integer16, Integer32, IP address
Default:
2
String
5
You can find out the type of the option either from the corresponding RFC or from the manufacturer's
documentation of their DHCP options.
1
Value
This field defines the contents of the DHCP option.
IP addresses are specified with the usual notation for IPv4 addresses, e.g. as "123.123.123.100", integer types are
entered as normal decimal numbers, and strings as simple text.
Multiple values in a single field are separated with commas, e.g. "123.123.123.100, 123.123.123.200".
Possible values:
2
Maximum 128 characters.
Default:
2
Blank
5
You can find out the possible length of the option value either from the corresponding RFC or from the
manufacturer's documentation of their DHCP options.
1779
Reference Manual
19 More services
19.1.8 Addition(s) to LCOS 8.00
Alternative DHCP server for forwarding
Introduction
The DHCP server offers various operating modes. In the forwarding mode, the device acts in the local network like a
DHCP relay and forwards requests to one of more pre-defined DHCP servers. This setting facilitates the operation of
central DHCP servers in another network.
All DHCP messages sent by DHCP clients as a broadcast are forwarded to all predefined DHCP servers. The client selects
the first server to answer and sends all subsequent messages as unicasts directly to that server. If the selected server
becomes unavailable, the client once again transmits broadcast messages and selects another DHCP server.
Configuration
To configure the DHCP server for forwarding, refer to the following menus:
1
LANconfig: TCP/IP / DHCP / DHCP networks
1
WEBconfig: LCOS menu tree / Setup / DHCP / Network list
1
1st server address
This is where the IP address for the upstream DHCP server is entered when the mode 'Relay requests' is selected.
Possible values:
2
IP address or the broadcast address of the network in which the server is located. The broadcast address is the
highest address in an IP network. All packets sent to this address are received by all hosts.
Default:
2
0.0.0.0
1780
Reference Manual
19 More services
19.1.9 Addition(s) to LCOS 8.80
Displaying status information from the DHCP server
The status table of the DHCP server shows the following information about the devices that to which the DHCP server
has assigned IP addresses:
1
IP address, which the DHCP server has assigned to the network device
1
MAC address of the network device
1
Timeout, remaining validity period in minutes
1
Computer name
1
Type of address assignment, dynamic or from cache
1
LAN-Ifc, logical interface over which the DHCP server assigned the IP address to the network device
1
Ethernet port, physical interface over which the DHCP server assigned the IP address to the network device
1
VLAN ID of the network
1
Network name
1
Assignment, date and time when the DHCP server assigned the IP address to the network device
You can find the status information for the DHCP server at the following locations:
1
Telnet: /Setup/DHCP/DHCP-Table
1
WEBconfig: /Setup/DHCP/DHCP-Table
1781
Reference Manual
19 More services
1
LANmonitor: Broken down by network name under DHCP-server > Network list
19.2 Vendor Class and User Class Identifier
The DHCP client in LANCOM can insert additional information in the DHCP request sent, which simplify request recognition
within the network.
1
The vendor class identifier (DHCP option 60) shows the device type, e.g. 'LANCOM L-54'. The vendor class ID is
always transmitted.
1
The user class identifier (DHCP option 77) displays a user-defined string, which can be entered under Setup/DHCP
or in LANconfig in the configuration area under 'TCP/IP' on the 'DHCP' tab in the 'User Class ID' field (default: empty).
The user class ID is only transmitted when the user has configured a value.
1782
Reference Manual
19 More services
19.3 DNS
The domain name service (DNS) is responsible in TCP/IP networks for associating computer names and/or network
(domains) and IP addresses. This service is required for Internet communications, to return the correct IP address for a
request such as 'www.lancom.de' for example. However, it's also useful to be able to clearly associate IP addresses to
computer names within a local network or in a LAN interconnection.
19.3.1 What does a DNS server do?
The names used in DNS server requests are made up of several parts: one part consists of the actual name of the host
or service to be addressed; another part specifies the domain. Specifying the domain is optional within a local network.
These names could thus be 'www.domain.com' or 'ftp.domain.com', for example.
If there is no DNS server in the local network, all locally unknown names will be searched for using the default route.
By using a DNS server, it's possible to immediately go to the correct remote station for all of the names with known IP
addresses. In principle, the DNS server can be a separate computer in the network. However, the following reasons speak
for locating the DNS server directly in the LANCOM:
1
LANCOM can automatically distribute IP addresses for the computers in the local network when in DHCP server
mode. In other words, the DHCP server already knows the names and IP addresses of all of the computers in its own
network that were assigned IP addresses via DHCP. With the dynamic address assignments of a DHCP server, an
external DNS server might have difficulties in keeping the associations between the names and IP addresses current.
1
When routing Microsoft Networks via NetBIOS, the LANCOM also knows the computer names and IP addresses in
the other connected NetBIOS networks. In addition, computers with fixed IP addresses can also enter themselves in
the NetBIOS table and thus be known by their names and addresses.
1
The DNS server in the LANCOM can also be used as an extremely convenient filter mechanism. Requests for domains
can be prohibited throughout the LAN, for subnetworks, or even for individual computers—simply by specifying the
domain name.
How does the DNS server react to the request?
When processing requests for specific names, the DNS server takes advantage of all of the information available to it:
1
First, the DNS server checks whether access to the name is not prohibited by the filter list. If that is the case, an error
message is returned to the requesting computer stating that access to the address has been denied.
1
Next, it searches in its own static DNS table for suitable entries.
1
If the address cannot be found in the DNS table, it searches the dynamic DHCP table. The use of DHCP information
can be disabled if required.
1
If no information on the name can be located in the previous tables, the DNS server then searches the lists of the
NetBIOS module. The use of the NetBIOS information can also be disabled if necessary.
1
Finally, the DNS server checks whether the request to another DNS server is to be forwarded to another DNS server
via a WAN interface (special DNS forwarding via the DNS destination table).
If the requested name cannot be found in any of the information sources available to it, the DNS server sends the request
to another server—that of the Internet provider, for example—using the general DNS forwarding mechanism, or returns
an error message to the requesting computer.
19.3.2 DNS forwarding
If it cannot serve the request from its own DNS tables, the DNS server forwards the request to other DNS servers. This
process is called DNS forwarding.
Here a distinction is made between
1
special DNS forwarding Requests for certain name areas are forwarded to certain DNS servers.
1
general DNS forwarding All other names not specified in detail are forwarded to the “higher- level” DNS server.
1783
Reference Manual
19 More services
Special DNS forwarding
With “special DNS forwarding” name areas can be defined for the resolution of which specified DNS server are addressed.
A typical application for special DNS forwarding results for a home workstation: The user wants to be able to connect
to the company intranet and directly to the Internet at the same time. The requests sent into the intranet must be routed
to the company DNS server, and all other requests to the DNS server of the provider.
General DNS forwarding
All DNS requests that cannot be resolved in another way are forwarded to a DNS server. This DNS server is determined
according to the following rules:
1
Initially the router checks whether a DNS server has been entered in its own settings. If it is successful there, it obtains
the desired information from this server. Up to two higher-level DNS servers can be specified.
LANconfig: TCP/IP / Addresses / Primary DNS / Secondary DNS
WEBconfig: LCOS menu tree / Setup / TCP-IP / DNS-default / DNS-backup
1
If no DNS server is entered in the router, it will attempt to reach a DNS server over a PPP connection (e.g. from the
Internet provider) to get the IP address assigned to the name from there. This can only succeed if the address of a
DNS server is sent to the router during PPP negotiation.
1
The default route is established and the DNS server searched for there if no connection exists.
This procedure does not require you to have any knowledge of the DNS server address. Entering the Intranet address of
your router as the DNS server for the workstation computers is sufficient to enable you obtain the name assignment.
This procedure also automatically updates the address of the DNS server. Your local network always receives the most
current information even if, for example, the provider sending the address changes the name of his DNS server or you
change to another provider.
19.3.3 Setting up the DNS server
The settings for the DNS server are contained in the following menu or list:
LANconfig:TCP/IP / DNS
WEBconfig: LCOS menu tree / Setup / DNS
Proceed as follows to set the DNS server:
1. Switch the DNS server on.
2. Enter the domain in which the DNS server is located. The DNS server uses this domain to determine whether the
requested name is located in the LAN. Entering the domain is optional.
1784
Reference Manual
19 More services
3. Specify whether information from the DHCP server and the NetBIOS module should be used.
1. The main task of the DNS server is to distinguish requests for names in the Internet from those for other remote
stations. Therefore, enter all computers in the Host names table,
1
for which you know the name and IP address,
1
that are not located in your own LAN,
1
that are not on the Internet and
1
that are accessible via the router.
For example, if would like to access the mail server at your headquarters (name: mail.yourdomain.com, IP: 10.0.0.99)
via the router from a branch office, enter:
Stating the domain is optional but recommended.
When you now start your mail program, it will probably automatically look for the server 'mail.yourdomain.com'.
The DNS server thereupon returns the IP address '10.0.0.99'. The mail program will then look for that IP address.
With the proper entries in the IP routing table and peer list, a connection is automatically established to the network
in the headquarters, and finally to the mail server.
2. To resolve entire name areas of another DNS server, add a forwarding entry consisting of a name area and remote
station:
When entering the name areas, the wildcards '?' (for individual characters) and '*' (for multiple characters) may be
used.
To reroute all domains with the ending '.intern' to a DNS server in the LAN of the remote station 'COMPANY', create
the following entry:
1785
Reference Manual
19 More services
5
The DNS server may either be specified by the remote site name (for automatic setting via PPP), or by an
explicit IP address of the according name server.
19.3.4 URL blocking
1. Finally, one can restrict access to certain names or domains with the filter list.
To block the domain (in this case the web server) 'www.offlimits.com' for all computers in the LAN, the following
commands and entries are required:
LANconfig: TCP/IP / DNS Filter / DNS filter... / Add
WEBconfig: … / Filter-list / Add
The index '001' in the console command can be selected as desired and is used only for clarity.
5
When entering the domains, the wildcards '?' (represents exactly one character) and '*' (for any number of
characters) are permitted.
To only block the access of a certain computer (e.g. with IP 10.0.0.123) to COM domains, enter the following values:
In the console mode the command is:
set 002 *.com 10.0.0.123 255.255.255.255
5
The hit list in the DNS statistics contains the 64 most frequently requested names and provides a good basis
for setting up the filter list.
If your LAN uses subnetting, you can also apply filters to individual departments by carefully selecting the IP addresses
and subnet masks. The IP address '0.0.0.0' stands for all computers in the network, and the subnet mask '0.0.0.0'
for all networks.
19.3.5 Dynamic DNS
Systems with dynamic IP addresses become accessible over the WAN - for example over the Internet - via so-called
Dynamic DNS service providers, e.g. www.dynDNS.org.
Thereby a LANCOM becomes available under a certain DNS-resolvable name (FQDN -’fully qualified Domain Name’, for
example "http://MyLANCOM.dynDNS.org").
The advantage is obvious: If you want to accomplish e.g. remote maintenance for a remote site without ISDN available
(e.g. over WEBconfig/HTTPS), or to connect with the LANCOM VPN Client to a branch office with dynamic IP address,
then you just need to know the appropriate Dynamic DNS name.
1786
Reference Manual
19 More services
How to deposit the current IP address at the Dynamic DNS server?
All Dynamic DNS provider support a set of client programs, which can determine the current assigned WAN IP address
of a LANCOM via different methods , and transfer this address - in case of a change - to their respective Dynamic DNS
server .
INTERNET
server
Router
PC
B
A
DynDNS client program
DynDNS provider
The current WAN IP address of a LANCOM can be picked under the following address:
http://<address of LANCOM>/config/1/6/8/3/
Alternatively the LANCOM can directly transmit the present WAN IP to the DynDNS provider.
PC
INTERNET
LANCOMserver
DynDNS provider
1787
Reference Manual
19 More services
The required settings can be changed comfortably with the Setup Wizard:
19.3.6 Addition(s) to LCOS 8.82
DNS forwarding configurable per ARF context
As of LCOS version 8.82 multiple independent forwarding definitions (especially general wildcard definitions with "*")
are possible for DNS forwarding by identifying them with unique routing tags. Depending on the routing context of the
requesting client, the router considers only the forwarding entries that are identified accordingly and the general entries
marked with "0".
Advanced Routing and Forwarding (ARF)
Routing tags for DNS forwarding
For DNS forwarding, multiple independent forwarding definitions (especially general wildcard definitions with "*") are
possible for DNS forwarding by identifying them with unique routing tags. Depending on the routing context of the
1788
Reference Manual
19 More services
requesting client, the router considers only the forwarding entries that are identified accordingly and the general entries
marked with "0".
Host names
The item Configuration > IPv4 > DNS > Host names is used to define the tag context and IP number used by the
device to resolve the station names.
DNS forwarding
The item Configuration > IPv4 > DNS > Forwarding is used to set the routing tags for the forwarding rules, so ensuring
they only apply when the correct routing tags are used.
1789
Reference Manual
19 More services
Service table
The item Configuration > IPv4 > DNS > Service table is used to assign routing tags to the services, so ensuring that
they are only available when the correct routing tags are used.
Tag context table
It is possible to define tag contexts in LANconfig under Configuration > IPv4 > DNS > Tag context table, which
override the global settings of the DNS server for specific interface and routing tags (routing context):
If an entry for a tag context exists, then only the DNS settings in this table apply for this context. However, if there is no
entry in this table, then the global settings of the DNS server apply.
The following options are possible for each tag context:
1
Routing tag: Unique interface or routing tag in the range of 1 to 65535, the subsequent settings will override the
global settings of the DNS server.
1
DNS server enabled: Enables the DNS server of the device.
1
Answer inquiries to own domain with own IP address: If enabled, DNS requests relating to the router's own
domain will be answered with the router's IP address.
1
Resolve addresses of DHCP clients: Enables resolution of station names that have requested an IP address through
DHCP.
1
Resolve names of NetBIOS stations: Enables resolution of station names that are known to the NetBIOS router.
Additions to the Setup menu
Routing tag
When resolving a station name, the device uses the routing tag to set the tag context for that station.
Telnet path:
Setup > DNS > DNS-List
Possible values:
0 to 65535
Default:
0
1790
Reference Manual
19 More services
Routing tag
The routing tag determines which filters apply in each tag context.
Telnet path:
Setup > DNS > Filter-List
Possible values:
0 to 65535
Default:
0
Routing tag
The routing tag makes it possible to specify multiple forwarding definitions that are independent of each other (especially
general wildcard definitions with "*"). Depending on the routing context of the requesting client, the router considers
only the forwarding entries that are identified accordingly and the general entries marked with "0".
Telnet path:
Setup > DNS > DNS-Destinations
Possible values:
0 to 65535
Default:
0
Routing tag
The routing tag determines whether and how the router should resolve specific service requests within the current tag
context.
Telnet path:
Setup > DNS > Service-Location-List
Possible values:
0 to 65535
Default:
0
19.4 Accounting
Information on connections between clients in the local network and various remote stations is saved in the accounting
table with entries for the connection time and the transferred data volume. Using accounting snapshots, accounting
data can be regularly saved at specific times for later evaluation.
1791
Reference Manual
19 More services
19.4.1 Configuring accounting
When configuring accounting, the general parameters must be defined:
LANconfig: Management / Costs
WEBconfig: LCOS menu tree / Setup / Accounting
1
Collect accounting information
2
Turn accounting on or off.
1
Store accounting information in flash ROM
2
Turn accounting data in flash memory on or off. Accounting data saved to flash will not be lost in the event of
a power outage.
1
Discriminator
Selection of the feature according to which the accounting data are to be gathered:
2
MAC address: The data are collected according to the client's MAC address.
2
IP address: The data are collected according to the client's IP address.
5
When varying IP addresses are in use, e.g. when using a DHCP server, the option 'IP address' can lead to
inaccurate accounting data. In this case, it may not be possible to accurately assign the data to users.
Conversely, with this setting, data can be separated from clients that are behind another router and therefore
appear with the same MAC address as the router in the accounting list.
1
Sort according to
Select here whether the data should be sorted in the accounting table according to connection times or data volume.
1792
Reference Manual
19 More services
19.4.2 Snapshot configuration
When configuring the snapshot, the interval is set in which the accounting data are temporarily saved into a snapshot:
LANconfig: Management / Costs / Accounting Snapshot
WEBconfig: LCOS menu tree / Setup / Accounting / Time snapshot
5
The snapshot function can only be used when the device is set with the correct system time.
1
Accounting snapshot active
2
Turn intermediate storage of accounting data on or off.
1
Interval
2
Daily, weekly or monthly
1
Day of month
The day of the month on which caching will take place: Only relevant if the interval is 'monthly'.
1
Day of week
The weekday on which caching will take place. Only relevant if the interval is 'weekly'.
1
Hour
The hour on which caching will take place:
2
'0' to '23'
1
Minute
The minute in which caching will take place:
2
'0' to '59'
19.5 Call charge management
The capability of the router to automatically establish connections to all desired remote sites and to close them again
when no longer required provides users with extremely convenient access, e.g. to the Internet. However, quite substantial
costs may be incurred by data transfer over paid lines if the router is not configured properly (e.g. in the filter configuration)
or by excessive use of the communications opportunities (e.g. extended surfing in the Internet).
To reduce these costs, the software provides various options:
1
The available online minutes can be restricted to a specific period.
1
For ISDN connections, a limit on time or charges can be set for a particular period.
1793
Reference Manual
19 More services
19.5.1 Connection limits for DSL and cable modem
Even though a DSL or cable modem connection behaves like a leased line, which is always online, depending on the
provider connection charges can be accounted by the time.
5
In this section all connections over a ethernet WAN port of the LANCOM, e. g. cable modem connection, will be
referred as DSL connection.
To limit the costs, the maximal connection duration can be controlled with time, by arranging a time limit for DSL
connections for a period of time. By default the DSL connections can only be used for a maximum of 600 minutes in six
days.
5
If the limit is reached, all DSL connections are automatically terminated. As soon as the current period has passed
the time count is reset and the connection enabled. The administrator can of course reset the time count and
enable the connection beforehand.
5
If the connection has a charge limit and a short hold of '0' or '9999' seconds, the charge control is switched off
and the connection is kept even if the limit is exceeded.
If in an exceptional case you would like to extend the online budget, e.g. to download a large file from the internet, you
do not necessarily have to change the time limit. In this case you can manually reset the limit.
Click with the right mouse button on the error in LANmonitor and select in the menu the entry 'Reset Charge And Time
Limit'
5
If you cannot see the system information in LANmonitor, activate the view with View / Show Details / System
Information.
In WEBconfig and in the console the commands to activate the additional time limit are as follows:
WEBconfig: LCOS menu tree / Setup / Charges / Activate-additional-budget
The additional time limit is activated for the current period, in the following period normal time limit is set.
19.5.2 Charge-based ISDN connection limits
If charge information is sent to an ISDN connection, the resulting connection charges can be limited quite easily. For
example, in its default state, a maximum of 830 charge units may be used in six days. The router will not permit the
establishment of any further connections once this limit has been reached.
5
The best way to use the router's call charge monitoring function is if you have “call charge information enabled
during the connection” to the ISDN network (i.e. AOCD). If necessary, subscribe to this facility from your
1794
Reference Manual
19 More services
telecommunications carrier. Charge monitoring with the “Charge information after connection“ feature is also
possible in principle, but in this case continuous connections may not be detected!
5
If you have enabled least-cost routing on the router modules, connections may be established to providers who
do not transmit any charge information!
19.5.3 Time dependent ISDN connection limit
However, this mechanism of ISDN connection monitoring will not work if the ISDN connection does not provide charge
information. That may be the case, for example, if the provision of charge information was not requested for the
connection, or if the telecommunications provider generally does not supply this information.
To reduce the costs of ISDN connections even if no call charge information is available, maximum connection lengths
based on time can be regulated. This requires setting up a time budget for a specified period. In the router's default
state, for example, connections may only be established for a maximum of 210 minutes within six days.
5
When the limit of a budget is reached, all open connections that were initiated by the router itself will be shut
down automatically.The budgets will not be reset to permit the establishment of connections until the current
period has elapsed. Needless to say, the administrator can reset the budgets at any time if required!
The charge and time monitoring of the router functions can be disabled by entering a budget of 0 units or 0 minutes.
5
Only the router functions are protected by the charge and time monitoring functions! Connections via LANCAPI
are not affected.
19.5.4 Settings in the charge module
LANconfig: Management / Costs
WEBconfig: LCOS menu tree / Setup / Charges
In the charges module, the online time can be monitored and used to control call establishment.
1
Day(s)/Period
The duration of the monitoring period in days can be specified here.
1
Budget units, Online minutes budget
The maximum number of ISDN units or online minutes in a monitoring period
5
The current charge and connect-time information is retained when rebooting (e.g. when installing new
firmware) is not lost until the unit is switched off. All the time references here are in minutes.
19.6 Time server for the local net
LANCOM routers can apply exact information of time either over ISDN or over public time servers on the internet
(NTP-Server with ’Open Access’ policy). The LANCOM can then provide the detected time for all stations in the local
network.
19.6.1 Configuration of the time server under LANconfig
To provide the current time in the local network your LANCOM has to regularly apply the time from a time server. For
this so called real time clock click in the configuration area 'Date & time' on the tab 'Synchronization'. Under 'NTP
1795
Reference Manual
19 More services
settings' open the list of time servers by clicking on the button Time Server .... With the button Add... you can extend
the list.
With these settings only the LANCOM applies the time from public time servers. To provide the real time for the remaining
device enable the local time server under the tab 'Time Server'. Furthermore activate the broadcast mode and enter the
broadcast interval.
19.6.2 Configuration of the time server with WEBconfig or Telnet
When configuring with WEBconfig or Telnet you can find the required parameters in the following areas:
1796
Reference Manual
19 More services
WEBconfig: LCOS menu tree / Setup / NTP
19.6.3 Configuring the NTP clients
The NTP clients must be configured so that they use the time information from the LANCOM. Not all operating systems
provide an integrated NTP client: Windows XP does so, for other Windows operating systems a separate NTP client is
required, Linux distributions have to be installed with NTP.
The settings of date and time in a XP system can be opened with a double click on the time at the bottom left, where
you can select the server for synchronization.
1
Configuring daylight-saving time change according to UTC
LANCOM devices work internally with the coordinated world time (UTC). For protocol displays and time-related settings
(e.g. cron jobs), the local time is taken as calculated from the defined time zone. To take local daylight-saving time into
account, settings can be configured according to requirements.
LANconfig: Date & time / General
1797
Reference Manual
19 More services
WEBconfig: LCOS menu tree / Setup / Time / Daylight-saving time
1
Daylight-saving time
2
Off: The system time will not be adjusted to daylight-saving time.
2
On: As long as this option is enabled, one hour is added statically to the current system time (comprised of UTC
and time zone).
2
Automatic (EU, USA, Russia): In this setting, the daylight-saving time change is performed automatically in
conformance with the time zone of the device's location.
2
Automatic (user-defined): If the device is located in an area that is not listed here, then the daylight-saving time
change options can be manually defined by the user.
User-defined daylight-saving time change
User-defined values can be set for the beginning and the end of the automatic daylight-saving time change.
LANconfig:Date & time / General / Daylight-saving time
WEBconfig: LCOS menu tree / Setup / Time / DST clock changes
1
Index
2
First, second, third, fourth, last, second to last, third to last, fourth to last: The time change will take place on
this recurring day of the month.
1
Day of week
2
Monday to Sunday: The day on which the change will take place.
1
Month
2
January to December: The month on which the change will take place.
1
Hour
2
0 to 23: The hour in which the change will take place.
1
Minute
2
0 to 59: The minute in which the change will take place.
1
Time type
2
Local standard time or UTC: Defines the time zone the data refers to.
5
In the last hour of daylight-saving time or the first hour that follows in standard time, it is possible for time
entries to be ambiguous. If the time is acquired via ISDN or set manually during this time, then it is always
assumed that the time entry is in daylight-saving time.
1798
Reference Manual
19 More services
19.7 Scheduled Events
19.7.1 Regular Execution of Commands
This feature is intended to allow the device to execute predefined commands in a telnet-like environment, at times
defined by the user. The functionality is equivalent to the UNIX cron service. Subject of execution can be any LANCOM
command line command. Therefore, the full feature set of all LANCOM devices can be controlled by this facility.
Application examples:
1
scheduled connection
Many leased lines disconnect automatically after 24 hours of continuous operation. This enforced disconnection can
have some unwanted side-effects for example if it happens to an unsuitable time during the day, because e.g. the
VPN tunnel is disconnected and the IP address of the LANCOM is changed. To control the disconnecting time a
manual disconnection can be set e.g. at midnight, so it can not happen at an unsuitable time.
As a second example devices with a distributed network with only dynamic IP addresses can build up a connection
at a certain time to a VPN gateway, so that data can be transferred safely. This way a protected access is even possible
without an ISDN connection.
1
time-dependant firewall or QoS rules
The firewall and QoS rules are at first temporally constant. But it can be useful to make variable settings for different
daytimes or weekdays. At e. g. off-hours or weekends different priorities for guaranteed bandwidths can be set than
at business hours.
1
regular firmware or configuration updates
Time-controlled rules do not only provide the settings of particular values, it is even possible to switch to a whole
different configuration. This possibility allows you to pool a whole string of settings and change them all at once
with one command. Therefore changing the configuration of the device with completely different values at the
weekend and switching back on monday mornings can be done with just one command.
Additionally the regular update of the newest firmware from one single source is adjustable.
1
Email messages
With the time-controlled rules you have the option that the LANCOM informs the administrator by email not only
about specific firewall events, but even to set times. The email can e.g. inform about building up an internet connection
successfully after an enforced disconnection or after booting the device because of a restart.
1
time-dependant interfaces
The time dependant use of interfaces for a set duration is also provided by the time-controlled rules. Therewith e.g.
a WLAN interface can permit the wireless access to the network only at certain times.
1
Deleting certain tables
It can be useful to delete the content of some tables in LCOS regularly. If your internet access for example has a
monthly limited transfer volume, you can delete your accounting table monthly to have a survey of the present
transferred data volume.
19.7.2 CRON jobs with time delay
CRON jobs are used to carry out recurring tasks on a LANCOM automatically at certain times. If the installation features
a large number of active devices, all of which are subjected to the same CRON job at the same time (e.g. updating a
configuration by script), unpleasant side effects can result if, for example, all devices try to establish a VPN connection
at once. To avoid these effects, the CRON jobs can be set with a random delay time between 0 and 59 minutes.
1799
Reference Manual
19 More services
19.7.3 Configuring the CRON job
The following parameters are available in the LANCOM for configuring CRON jobs:
LANconfig: Date & time / General / CRON table
WEBconfig: LCOS menu tree / Setup / Config / CRON table
1
Entry active
Activates or deactivates the entry.
2
Default: Active
1
Time base
The 'Time base' field determines whether time control is based on real time or on the device's operating time.
2
Real time: These rules evaluate all time/date information.
2
Operation time: These rules only evaluate the minutes and hours since the last time the device was started.
2
Default: Real time
1
Minutes
1
Hours
1
Week days
1
Month days
1
Months
The values 'minutes' to 'months' define the times when a command is to be executed. With no value entered, it is
not included in the controlling. For each parameter, a comma-separated list of values can be entered, or alternatively
a range of minimum and maximum values.
The syntax of the 'Week day' field corresponds with the usual CRON interpretation:
2
0: Sunday
2
1: Monday
2
2: Tuesday
2
3: Wednesday
2
4: Thursday
2
5: Friday
1800
Reference Manual
19 More services
2
6: Saturday
1
Command
The command to be executed or a comma-separated list of commands. Any LANCOM command-line function can
be executed.
1
Owner
An administrator defined in the device can be designated as owner of the CRON job. If an owner is defined, then
the CRON job commands will be executed with the rights of the owner.
2
Default: root
1
Variation
This parameter specifies the maximum delay in minutes for the start of the CRON job after the set start time. The
actual delay time is determined randomly and lies between 0 and the time entered here.
2
Default: 0
2
Values: 0 to 65535 seconds.
2
Particular values: With the variation set to zero the CRON job will be executed at the set time.
5
Real-time based rules can only be executed if the device has a time from a relevant source, e.g. via NTP.
Examples:
commandmonthsm.-daysw.-dayshoursmin.time base
do /oth/man/disconnect internet1-121-310-640real time
mailto:admin@mylancom.de?subject=disconnection?body=Manual
disconnection of the internet connection
1-121-310-6359real time
do /setup/accounting/delete100real time
do /oth/man/connect HEADQUARTER1,2,3,4,5180real time
1
The first entry cuts the connection to the internet provider every morning at 4 am (forced disconnection).
1
The second entry sends an information mail every morning at 3:59 am (directly before the forced disconnection) to
the admin.
1
The third entry deletes on the first of every month the accounting table.
1
The fourth entry builds up a connection to the headquarter every week day at 6 pm.
5
Time based rules are performed with an exactness of one minute. Please keep in mind, that the language of the
used commands should be the same as the language of the console, otherwise the commands of the time
automatic can not be considered. The default language is english, but can be changed.
19.8 PPPoE Servers
19.8.1 Introduction
In accordance with the widespread availability of DSL, PPPoE clients have now been widely integrated into all operating
systems. These can be used to "log on to the network" as well as to manage access rights to services such as the Internet,
e-mail or remote stations.
1801
Reference Manual
19 More services
PPPoE can only be used on a network segment.
As it is what is known as a "Layer 2" technology, PPPoE can only be used within a network segment, i.e. it cannot be
used across IP subnets. The PPPoE connection cannot be established across network segment limits, such as via a router.
After a user logs on to the LAN (e.g. username: 'Purchasing', password: 'secret') using a specified PPPoE logon, further
rights can be regulated via the firewall. This enters the PPPoE user name as a 'remote station' in the firewall. With a
deny all rule, and a PPPoE rule in the following format, user Anyone can be permitted to use the Internet with Web and
FTP:
1
Source: Anyone
1
Target: All stations
Services: WWW, FTP
19.8.2 Example application
All employees in the 'Purchasing' department must first authenticate themselves to the LANCOM using PPoE (IP routing,
PAP check) in order to access the Internet.
Constraint: The LANCOM can be accessed directly by the users in the LAN as a router, firewall and gateway, i.e. there
are no other routers in between them.
The computers in Purchasing are assigned with an IP address from a certain address range (e.g. 192.168.100.200 to
192.168.100.254) from the list of addresses for dial-in connections (LANconfig/ TCP/IP / Addresses).
5
The LANCOM itself is in a different IP address range!
To prevent users from bypassing the authentication, a DENY ALL rule is defined in the firewall to stop local connections
from being established.
1802
Reference Manual
19 More services
The user 'Purchasing' is then entered into the PPP list (LANconfig / Communication / Protocols) without a user name but
with a password which is to be used by all staff members in the department, and authentication (encrypted) is set up
as CHAP. Both IP routing and NetBIOS (Windows Networking) are to be activated for this PPP user:
Along with the activation of the PPPoE server (LANconfig / Communication / General), further limitations (e.g. permissible
MAC addresses) can also be defined in the PPPoE server. The example uses the existing entry 'DEFAULT' with the MAC
address '00.00.00.00.00.00', thereby permitting all MAC addresses.
1803
Reference Manual
19 More services
The firewall (LANconfig / Firewall/QoS / Rules) can be used to control which services are available to the employees in
Purchasing (e.g. release of HTTP and EMAIL only).
19.8.3 Configuration
LANconfig: Communication / General
WEBconfig: LCOS menu tree / Setup / PPPoE server
1
Operating: The 'Operating' button switches the server on or off. The default value is 'Off'.
1
Service: The name of the service offered is entered under 'Service'. This enables a PPPoE client to select a certain
PPPoE server that is entered for the client.
1
Session limit: The 'Session limit' specifies how often a client can be logged on simultaneously with the same MAC
address. Once the limit has been reached, the server no longer responds to the client queries that are received.
Default value is '1', maximum value '99'. A Session limit of '0' stands for an unlimited number of sessions.
1804
Reference Manual
19 More services
1
Name list: Different parameters (such as shorthold time and MAC address) can be assigned to users in the name
list:
5
A MAC address of '000000000000' means that the user may log on with any MAC address. If a MAC address
is entered, then the PPP negotiation is terminated if the user logs on from a different MAC address. The
user's shorthold time is set after the logon. If no entry exists, then the time belonging to user 'DEFAULT' is
used.
In addition to this table, an entry has to be made in the PPP table in which the password, the rights (IP, IPX,NetBIOS)
and other PPP parameters (LCP polling) are entered. The user can therefore also be authenticated using a RADIUS
server.
19.9 Remote bridge
The remote bridge links two remotely networks, as they would be linked physical. The two networks are completely
independently from the used network protocols.
LANconfig: Bridge / General
WEBconfig: LCOS menu tree / Setup / Bridge
1
Remote station
Name of the remote station, which is linked with the remote bridg.
1
Bridge-Aging
Duration after a once learned MAC address will be deleted.
1
Interface allocation
Logical interface, which the remote bridge is assigned to.
1805
Reference Manual
19 More services
5
For the interface allocation are no WLANs possible, because the WAN bridge exists only in devices without
WLAN. Therefore the interface allocation “any” is not possible.
1
VLAN-ID
ID of the VLAN, on which the remote bridge is active.
19.10 RADIUS
RADIUS stands for "Remote Authentication Dial-In User Service“ and is referred to as a "triple-A" protocol. The three
"A"s stand for
1
Authentication
1
Authorization
1
Accounting (billing)
This protocol allow you to grant users access to a network, to assign them certain rights and to track their actions. Where
necessary, the RADIUS server can also be used in the billing of user services such as WLAN hot spots. For every action
performed by the user, the RADIUS server can run an authorization procedure releasing or blocking access to network
resources on a per user basis.
3 different devices are required for RADIUS to work.
1
Client: This is a device (PC, notebook etc.) from which the user wishes to dial in to the network.
1
Authenticator: A network component positioned between network and client and which forwards on the authorization.
This task can be performed by an LANCOM Access Point for example. The authenticator is referred to as the Network
Access Server (NAS).
server
PC
PRINTER
AUTHENTICATOR
ANTENNA
LAPTO P/ W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
Client
RADIUS
1
Authentication server: RADIUS server on which user data is configured. This is usually located within the same network
for which it issues access authorizations. It is accessible to the client via the authenticator. Some scenarios may also
allow the use of a LANCOM access point for this task.
server
PC
PRINTER
RADIUS server
AUTHENTICATOR
AUTHENTICATOR
AUTHENTICATOR
LAPTO P/ W-LAN
LAPTO P/ W-LAN
W-LAN
W-LAN
W-LAN
W-LAN
LAPTO P/ W-LAN
LAPTO P/ W-LAN
W-LAN
LAPTO P/ W-LAN
W-LAN
LAPTO P/ W-LAN
Client
Client
Client
The authenticator has no initial information on the clients wanting to register. This is all stored in a database on the
RADIUS server. The registration information the RADIUS server needs for the authentication process is stored in the
database there and can vary from network to network. The authenticator has just the one task, that of transferring the
information between the client and the RADIUS server.
Access to a RADIUS server can be configured in several ways:
1806
Reference Manual
19 More services
1
Using PPP when dialing into a network
1
Via WLAN
1
Via a public spot for users who register using a browser (see
1
Via the 802.1x protocol
19.10.1 How RADIUS works
The authentication process of a client using the authenticator on a RADIUS server can vary in complexity and is
implementation dependent. In a simplified application, the client sends its registration data to the RADIUS server via
the authenticator and receives back either an "Accept“ or a "Reject“.
server
ACCESS POINT
LAPTO P/ W-LAN
ANTENNA
User ID
Accept
User ID
Accept
In more complicated applications, the RADIUS server can request additional registration data using what is known as a
"Challenge“. The handshake sequence looks something like this:
ACCESS POINT
ANTENNA
LAPTO P/ W-LAN
server
User ID
User ID
Identity
Login data
Challenge
Session key Global key
Challenge
Login data
19.10.2 Configuration of RADIUS as authenticator or NAS
The RADIUS protocol is supported by LANCOM devices in a range of different applications. For each of these cases there
is a specific set of parameters which may be configured independently of other applications. There are also general
parameters which need to be configured for each of these applications. Not all devices support all applications.
General settings
General settings apply to all RADIUS applications. Default values have been selected such that they need not usually be
changed.
1807
Reference Manual
19 More services
LANconfig: Communication / RADIUS
WEBconfig: LCOS menu tree / Setup / RADIUS module
1
Timeout [default: 5.000]
This value specifies how many milliseconds should elapse before retrying RADIUS authentication.
5
With PPP authentication using RADIUS, please note that the device dialing accepts the RADIUS timeout
configured here.
1
Retries [default: 3]
This value specifies how many authentication attempts are made in total before a Reject is issued.
RADIUS accounting
Accounting for a logical WLAN network can be enabled from a RADIUS server by enabling the "RADIUS Accounting"
option in the logical WLAN settings for the network.
LANconfig: Interfaces / Wireless LAN / Logical WLAN settings
WEBconfig: LCOS menu tree / Setup / RADIUS module
1808
Reference Manual
19 More services
Dial-in using PPP and RADIUS
When dialing-in using the PPP protocol (Point-to-Point protocol), RADIUS can be used to check client access authorizations.
A client can dial-in to the network from anywhere. The resulting data transmission between client and authenticator is
encrypted.
LANconfig: Communication / RADIUS
WEBconfig: LCOS menu tree / Setup / WAN / RADIUS
1
Radius server [default: disabled]
When authenticating using RADIUS, the user administration and authentication tasks are passed on to a RADIUS
server.
2
Disabled: The functionality of RADIUS is disabled and no requests are forwarded to the RADIUS server.
2
Enabled: The functionality of RADIUS is enabled and requests may be forwarded to the configured RADIUS server.
Depending on the setting, other sources may be used for the authentication process (e.g. PPP list).
2
Exclusive: RADIUS functionality is enabled and the authentication process is run exclusively by RADIUS.
The appropriate RADIUS server must be configured to use the functionality of RADIUS. All user data, such as user
name and password, is entered on the RADIUS server.
1
Server IP address
Specify here the IP address of your RADIUS server from which users are managed centrally.
1
Server port [default: 1.812]
Specify here the port used for communication to your RADIUS server.
1
Key (shared secret)
Specify here the key to be used for coding data. The key must also be configured on the RADIUS server.
1
PPP mode [default: disabled]
A RADIUS server may be used for the authentication process when dialing-in using PPP.
2
Disabled: PPP clients are not authenticated using RADIUS. They are checked exclusively using the PPP list.
1809
Reference Manual
19 More services
2
Enabled: RADIUS authentication for PPP clients is enabled. User data supplied by clients is first checked using
the PPP list. If no matching entry is found in the PPP list, the client is checked by the RADIUS server. Authentication
is successful if the PPP list checkor RADIUS server check returns as positive.
2
Exclusive: RADIUS authentication for PPP clients is enabled. User data supplied by clients is checked exclusively
by the RADIUS server. In this mode, it is just the advanced settings of the PPP list for the user which are interpreted
(e.g. check for PAP/CHAP – or the allowed protocols IP, IPX and/or NetBIOS).
1
CLIP mode [default: disabled]
A RADIUS server may be used for control of a return call when dialing-in using PPP.
2
Disabled: The return call function is not controlled by RADIUS. Only those entries in the name list are used.
2
Enabled: The RADIUS function for the return call is enabled. Telephone numbers reported by clients are first
checked using the name list. If no matching entry is found in the name list, the telephone number is checked by
the RADIUS server. If the name list check or RADIUS server check returns as positive, a return call can be
established.
5
If the telephone number communicated is in the name list, but no return call is active there, RADIUS
ceases checking.
2
Exclusive: The RADIUS function for the return call is enabled. User data reported by clients is checked exclusively
by the RADIUS server.
In order to use the return call control from RADIUS, a user must be set up on the RADIUS server for each telephone
number to be authenticated. The user name corresponds to the telephone number and the user password is the CLIP
password specified here.
1
CLIP password
Password for return call control.
5
The generic values for retry and timeout must also be configured . They are under PPP on the same page as
PPP parameters.
1810
Reference Manual
19 More services
Dial-in using WLAN and RADIUS
When using a RADIUS server for the authentication of WLAN clients, the RADIUS server uses the MAC address to check
client authorizations.
LANconfig: WLAN Security / Stations
WEBconfig: LCOS menu tree / Setup / WLAN / RADIUS access check
5
To use the RADIUS functionality for WLAN clients, the option "Transfer data from the listed stations, authenticate
all others via RADIUS or filter them out“ must be selected for the "Filter stations" parameter.
1
Server IP address
Specify here the IP address of your RADIUS server from which users are managed centrally.
1
Server port [default: 1.812]
Specify here the port used for communication to your RADIUS server.
1
Key (shared secret)
Specify here the key to be used for coding data. The key must also be configured on the RADIUS server.
1
Backup server IP address [default: 1.812]
Specify here the IP address of your backup RADIUS server from which users are managed centrally.
1
Backup server port
Specify here the port used for communication to your backup RADIUS server.
1
Backup key
Specify here the key to be used for coding data. The key must also be configured on the backup RADIUS server.
5
The generic values for retry and timeout must also be configured.
1811
Reference Manual
19 More services
Dial-in using a public spot and RADIUS
When configuring a public spot (enable using software option for the LANCOM access points), user registration data
can be forwarded to one or more RADIUS servers. These are configured in the provider list. The registration data individual
RADIUS servers require from the clients is not important to the LANCOM access point since this data is passed on
transparently to the RADIUS server.
LANconfig: Public Spot / Public Spot Users/ Provider list
WEBconfig: LCOS menu tree / Setup / WLAN / RADIUS accounting
1
Provider
Name of the provider for whom the RADIUS server is defined.
1
Auth. server IP address
The IP address of the RADIUS server for this provider.
1
Auth. server port
The port over which the LANCOM access point can communicate with the RADIUS server for this provider.
1
Auth. server secret
Key (shared secret) for access to the RADIUS server of the provider. The key must also be configured on the appropriate
RADIUS server.
1
Acc. Server IP address
IP address of the Accounting server for accesses to the public spot.
1
Acc. server port
The port over which the LANCOM access point can communicate with the accounting server.
1
Acc server secret
Key (shared secret) for access to the Accounting server. The key must also be configured on the Accounting server.
1
Backup provider
The name of a different provider can be selected as the backup from the current table. Using these types of entries,
backup chains linking several RADIUS servers can be easily configured.
5
The generic values for retry and timeout must also be configured.
Dial-in using 802.1x and RADIUS
WLAN clients can use the 802.1x protocol for network registration. The LANCOM access point can use this protocol to
forward the registration to the RADIUS server. The MAC address is used for user identification.
1812
Reference Manual
19 More services
5
Please refer to for further information on the 802.1 x protocol.
LANconfig: WLAN Security E IEEE 802.1X / RADIUS server
WEBconfig: LCOS menu tree / Setup / IEEE802.1x / Radius server
1
Name
In this table, each RADIUS server needs a unique name. The name 'DEFAULT' is reserved for all WLAN networks that
use an authentication process in line with IEEE 802.1x and that have not specified their own RADIUS server.
By using the name defined in the 'Key 1/passphrase' field, each WLAN network using authentication in line with
IEEE 802.1x can be assigned its own RADIUS server.
1
Server IP address
Specify here the IP address of your RADIUS server from which users are managed centrally.
1
Server port
Specify here the port used for communication to your RADIUS server.
1
Key (shared secret)
Specify here the key to be used for coding data. The key must also be configured on the RADIUS server.
1
Backup server
Name of the backup server from the list of RADIUS servers configured so far.
5
The generic values for retry and timeout must also be configured.
WLAN clients must be entered as follows on the RADIUS server:
The user name is the MAC address in the format AABBCC-DDEEFF. The password for all users is identical to the key
(shared secret) for the RADIUS server.
19.10.3 Configuring RADIUS as server
In addition to its function as RADIUS authenticator or NAS, an LANCOM access point can also operate as a RADIUS
server. When in this mode, information in the device on users authorized to register is made available to other access
points in Authenticator mode.
RADIUS server parameters
When configuring the RADIUS server, a definition is needed of which authenticator can access the RADIUS server, the
password required for this access, and the open port that is to be used to communicate with the RADIUS server. The
authentication port applies globally for all authenticators.
LANconfig: WLAN security / RADIUS
WEBconfig: LCOS menu tree / Setup / Radius / Server
1
Authentication port [default: 0]
1813
Reference Manual
19 More services
Specify here the port used by the authenticators to communicate with the RADIUS server in the LANCOM access
point. Port '1812' is normally used.
Port '0' disables the RADIUS server.
In addition to the port, 16 authenticators that are allowed to communicate with the RADIUS server may be entered here.
Entries are made in the corresponding table and with the following parameters:
1
IP address
IP address of the authenticator which may communicate with the RADIUS server in the LANCOM access point.
1
Secret
Password required by the authenticator for access to the RADIUS server in the LANCOM access point.
5
In addition to the configuration of the RADIUS server, the client information source must also be defined .
WLAN access list as a basis for RADIUS information
512 WLAN clients, all able to register with the LANCOM access point, may be entered in the access list. When operating
in RADIUS server mode, this list can also be used to check on RADIUS clients wanting to register at other access points.
In an installation having several access points, client access authorizations can be maintained centrally.
LANconfig: WLAN security / RADIUS
WEBconfig: LCOS menu tree / Setup / WLAN / RADIUS access check
1
Provide server database [default: yes]
This parameter specifies whether the WLAN access list is to be used as an information source for the RADIUS server
in the LANCOM access point.
The WLAN access list contains the user name in the form of the MAC address and the password ('WPA passphrase').
In addition to this access data, the access list provides information such as bandwidth restriction and association to
a specific VLAN.
1
Recheck cycle [default: 0]
Once a WLAN client is logged on after authentication by RADIUS, it remains active until it logs off itself or is logged
off by the RADIUS server. By specifying a recheck cycle [minutes], the RADIUS server can regularly check whether
the WLAN clients logged in are still in the access list. If a WLAN client is removed from the access list, it remains
logged in to the WLAN up to the point when the recheck cycle runs again.
5
A recheck cycle of '0' disables regular checking. WLAN clients remain logged in until they log themselves
out.
19.10.4 Addition(s) to LCOS 7.70
Restarting RADIUS accounting
The accounting function in the LANCOM can be used to check the budgets of associated wireless LAN clients, among
other things. Wireless Internet Service Providers (WISPs) use this option as a part of their accounting procedure. Accounting
periods generally switch at the end of the month. A suitable action will cause the accounting session to be restarted at
this time. Existing WLAN connections remain intact. A cron job can be used to automate a restart.
WEBconfig: LCOS menu tree / Setup / WLAN E RADIUS accounting
1
Restart accounting
Terminates all current accounting sessions and opens new accounting sessions on the RADIUS server.
1814
Reference Manual
19 More services
19.10.5 Addition(s) to LCOS 8.84
Targeted (de)activation of RADIUS user accounts
As of LCOS 8.84, you have the option to enable or disable individual RADIUS user accounts. In LANconfig, this is done
under RADIUS server > General > User table using the option Entry active. In this way, you can temporarily disable
individual user accounts without deleting the account entirely.
Additions to the Setup menu
Active
This parameter allows you to enable or disable individual RADIUS user accounts. In this way, you can temporarily disable
individual user accounts without deleting the account entirely.
Telnet path:
Setup > RADIUS > Server > Users
Possible values:
No
Yes
Default:
No
Login to the LCOS administration interface via RADIUS
As of LCOS version 8.84, logging in to the administration interface can now be controlled via RADIUS as well as TACACS+.
Login to the LCOS administration interface via RADIUS
Currently there are three ways to login to the LANCOM administration interface:
1
internal: The LANCOM handles the user management itself by means of user login name, password, and the assignment
of access and function rights.
1815
Reference Manual
19 More services
1
TACACS+: User management is handled by a TACACS+ server in the network.
1
RADIUS: User management is handled by a RADIUS server in the network.
The user can login with RADIUS over the following connections:
1
Telnet
1
SSH
1
WEBconfig
1
TFTP
1
Outband
5
A RADIUS authentication over SNMP is currently not supported.
5
A RADIUS authentication via LL2M (LANCOM Layer 2 Management protocol) is not supported as LL2M requires
plain-text access to the password stored in the LANCOM.
The RADIUS server handles user management with regard to authentication, authorization and accounting (triple-A
protocol), which greatly simplifies the management of admin accounts in large network installations with multiple routers.
Authentication via a RADIUS server is conducted as follows:
1. On login, the LANCOM sends the user credentials to the RADIUS server in the network. The necessary server data
are in stored in the LANCOM.
2. The server checks the credentials for their validity.
3. If the credentials are invalid, it sends the LANCOM a corresponding message and the LANCOM aborts the login
process with an error message.
4. If the credentials are valid, the server informs the LANCOM that the user has permission of access, and also sends
information on the access rights and function rights, so that the user has access only to the corresponding functions
and directories.
5. If the user's sessions are budgeted by the RADIUS server (accounting section), the LANCOM stores the session data
such as start, end, user name, authentication mode and, if available, the port used.
Additions to the Setup menu
Authentication
This menu item is eliminated with the introduction of authentication via RADIUS.
The authentication method is now selected under Setup > Config > Authentication (see
Authentication
).
Authentication
Various options are available to log on to the LANCOM's administration interface:
1
Internal: The LANCOM manages the users internally in the table Setup > Config > Admins.
1
Radius: A RADIUS server handles user management.
1
Tacacs+: A TACACS+ server handles user management.
5
The data relating to the RADIUS server is managed under Setup > Config > RADIUS > Server. The data relating
to the TACACS+ server is managed under Setup > Tacacs+ > Server.
5
Since the RADIUS protocol does not allow for password changes, users who have logged in via RADIUS cannot
change their password in the LANCOM.
Telnet path:
Setup > Config
1816
Reference Manual
19 More services
Possible values:
Internal
Radius
TACACS+
Default:
Internal
Radius
If the user login to the LANCOM administration interface is to be authenticated by RADIUS server, you specify the
necessary server data and the additional administrative data here.
Telnet path:
Setup > Config
Server
This table contains the settings for the RADIUS server.
Telnet path:
Setup > Config > Radius
Name
Enter a name for the RADIUS server here.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 16 characters
Default:
Blank
Server
Enter the IPv4 address of the RADIUS server here.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 64 characters
Default:
Blank
1817
Reference Manual
19 More services
Port
Enter the port used by the RADIUS server to communicate with the LANCOM.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 5 characters
Default:
1812
Protocol
Enter the protocol used by the RADIUS server to communicate with the LANCOM.
Telnet path:
Setup > Config > Radius > Server
Possible values:
RADIUS
RADSEC
Default:
RADIUS
Loopback address
This is where you can configure an optional sender address to be used by the LANCOM instead of the one that would
normally be automatically selected for this target address.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Name of the IP networks whose addresses are to be used by the LANCOM.
"INT" for the address of the first intranet.
"DMZ" for the address of the first DMZ.
5
If the list of IP networks or loopback addresses contains an entry named 'DMZ', then the LANCOM
uses the associated IP address.
LB0 to LBF for one of the 16 loopback addresses
Any valid IP address
Default:
Blank
Secret
Enter the password for accessing the RADIUS server here, and repeat the entry in the second input field.
1818
Reference Manual
19 More services
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 64 characters
Default:
Blank
Backup
Enter the name of the alternate RADIUS server to which the LANCOM forwards its requests if the first RADIUS server is
unavailable.
5
The backup server requires an additional entry in the Server table.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 16 characters
Default:
Blank
Category
Set the category for the RADIUS server.
You can select neither, one or both categories.
Telnet path:
Setup > Config > Radius > Server
Possible values:
Authentication
Accounting
Default:
Authentication
Access rights transfer
The authorization of the user is stored in the RADIUS server. When a request arrives, the RADIUS server sends the access-
and function rights to the LANCOM along with the login data, which then logs in the user with the appropriate privileges.
Access rights are usually defined in the RADIUS management privilege level (attribute 136), and the LANCOM simply
maps this value to its internal access rights (option: "Mapped"). The attribute can have the following values, which are
then mapped by the LANCOM:
1
1: User, read-only
1
3: User, write-only
1
5: Admin, read only, no trace rights
1
7: Admin, read and write, no trace rights
1819
Reference Manual
19 More services
1
9: Admin, read-only
1
11: Admin, read and write
1
15: Supervisor
1
The LANCOM maps any other values to "no access".
However, some RADIUS servers may also need to assign function rights, they may use attribute 136 differently, or they
may use different, vendor-specific attributes for the authorization. In this case, you must select the vendor-specific
attributes. These attributes are defined as follows, based on the LANCOM vendor ID '2356':
1
Access rights ID: 11
1
Function rights ID: 12
The transferred access-right values are identical to the above. If the RADIUS server also has to transfer function rights,
you achieve this as follows:
1. Open the console for the LANCOM.
2. Change to the directory Setup > Config > Admins.
3. The command set? shows you the current mapping of the function rights to the corresponding hexadecimal code
(e.g. Device-Search (0x80)).
4. To combine function rights, you add their hex values together.
5. Convert the hexadecimal value to a decimal number.
6. By using this decimal value in the function rights ID, you can transfer the corresponding rights.
Telnet path:
Setup > Config > Radius
Possible values:
Vendor-specific
Mapped
Default:
Vendor-specific
Accounting
Here, you specify whether the LANCOM should record the user's session. In this case, session data is saved including
the start, end, username, authentication mode and, if available, the port used.
Telnet path:
Setup > Config > Radius
Possible values:
No
Yes
Default:
No
Enhancements to LANconfig
Login to the LCOS administration interface via RADIUS
Currently, users can login to the administration interface of the device by using RADIUS, TACACS+, or the internal user
management of the device.
1820
Reference Manual
19 More services
With RADIUS, this is possible over the following connections:
1
Telnet
1
SSH
1
WEBconfig
1
TFTP
1
Outband
5
A RADIUS authentication over SNMP is currently not supported.
5
A RADIUS authentication via LL2M (LANCOM Layer 2 Management protocol) is not supported as LL2M requires
plain-text access to the password stored in the LANCOM.
The RADIUS server handles user management with regard to authentication, authorization and accounting (triple-A
protocol), which greatly simplifies the management of admin accounts in large network installations with multiple routers.
Authentication via a RADIUS server is conducted as follows:
1. On login, the LANCOM sends the user credentials to the RADIUS server in the network. The necessary server data
are in stored in the LANCOM.
2. The server checks the credentials for their validity.
3. If the credentials are invalid, it sends the LANCOM a corresponding message and the LANCOM aborts the login
process with an error message.
4. If the credentials are valid, the server informs the LANCOM that the user has permission of access, and also sends
information on the access rights and function rights, so that the user has access only to the corresponding functions
and directories.
5. If the user's sessions are budgeted by the RADIUS server (accounting section), the LANCOM stores the session data
such as start, end, user name, authentication mode and, if available, the port used.
In the LANconfig, you can set the authentication method under Management > Authentication.
In the section Device login authentication, you choose the method for users to authenticate when accessing the
LANCOM administration interface:
1
Internal administrator table: The LANCOM handles the user management itself by means of user login name, password,
and the assignment of access and function rights.
1
RADIUS: User management is handled by a RADIUS server in the network.
1
TACACS+: User management is handled by a TACACS+ server in the network.
In the the RADIUS authentication section, you enter the necessary RADIUS server data and additional administrative
data.
1821
Reference Manual
19 More services
Access rights via
The authorization of the user is stored in the RADIUS server. When a request arrives, the RADIUS server sends
the access- and function rights to the LANCOM along with the login data, which then logs in the user with
the appropriate privileges.
Access and function rights are usually defined in the RADIUS management privilege level (attribute 136), and
the LANCOM simply maps these values to its internal access and function rights. However, some RADIUS
servers use this attribute differently, or they may use different, vendor-specific attributes for the authorization.
In this situation, the LANCOM is also able to evaluate provider-specific authorizations. Possible values are:
1
Provider-specific attribute: The LANCOM processes the provider-specific attribute (default).
1
Management privilege level attribute: The LANCOM processes the RADIUS server's management privilege
level attribute.
Accounting
Here, you specify whether the LANCOM should record the user's session. Possible values are:
1
No: The LANCOM does not record any session data (default).
1
Yes: The LANCOM records the session data (start, end, user name, authentication mode, port).
RADIUS server
This table is used to define the RADIUS server settings.
1
Profile name: Enter a name for the RADIUS server here.
1
Backup profile: Enter the name of the alternate RADIUS server to which the LANCOM forwards its requests
if the first RADIUS server is unavailable.
5
The backup server requires an additional entry in the Server table.
1
Server address: Enter the IPv4 address of the RADIUS server here.
1
Port: Enter the port used by the RADIUS server to communicate with the LANCOM (default: 1812).
1
Shared secret: Enter the password for accessing the RADIUS server here, and repeat the entry in the
second input field.
1
Source address: This is where you can configure an optional sender address to be used by the LANCOM
instead of the one that would normally be automatically selected for this target address.
1
Protocol: Enter the protocol used by the RADIUS server to communicate with the LANCOM. Possible
values are:
2
RADIUS (default)
2
RADSEC
1
Category: Set the category for the RADIUS server. Possible values are:
1822
Reference Manual
19 More services
2
Deactivated
2
Authentication (default)
2
Accounting
2
Authentication & accounting
Separate RADIUS accounting server for each SSID
As of LCOS 8.84 you can assign a separate RADIUS accounting server to each logical WLAN interface.
Additions to the Setup menu
Servers
This table provides the option to configure alternative RADIUS accounting servers for logical WLAN interfaces. This means
that you can use special accounting servers for selected WLAN interfaces instead of the globally configured server.
Telnet path:
Setup > WLAN > RADIUS-Accounting
Name
Name of the RADIUS server performing the accounting for WLAN clients. The name entered here is used to reference
that server from other tables.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
String, max. 16 characters from
[0-9][A-Z]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
Server address
IP address of the RADIUS server used to perform the accounting for WLAN clients.
5
The general values for retry and timeout must also be configured in the RADIUS section.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
Valid IPv4 address
Default:
0.0.0.0
Port
Port for communication with the RADIUS server during accounting
1823
Reference Manual
19 More services
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
0 to 65535
Default:
0
Key
Enter the key (shared secret) for access to the accounting server here. Ensure that this key is consistent with that in the
accounting server.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
Any valid shared secret, max. 64 characters
Default:
Loopback addr.
You have the option to enter a different address here (name or IP) to which the RADIUS accounting server sends its reply
message.
By default, the server sends its replies back to the IP address of your device without having to enter it here. By entering
an optional loopback address you change the source address and route used by the device to connect to the server. This
can be useful, for example, when the server is available over different paths and it should use a specific path for its reply
message.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
1
Name of the IP network (ARF network), whose address should be used.
1
INT for the address of the first Intranet
1
DMZ for the address of the first DMZ
5
If an interface with the name "DMZ" already exists, the device will select that address instead.
1
LB0…LBF for one of the 16 loopback addresses or its name
1
Any IPv4 address
5
If the sender address set here is a loopback address, these will be used unmasked on the remote
client!
Default:
Protocol
Using this item you specify the protocol that the accounting server uses.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
1824
Reference Manual
19 More services
Possible values:
RADIUS
RADSEC
Default:
RADIUS
Backup
Enter the name of the RADIUS backup server used for the accounting of WLAN clients if the actual accounting server is
not available. This allows you to configure a backup chaining of multiple backup servers.
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
Possible values:
Name
from Setup > WLAN > RADIUS-Accounting > Servers, max. 16 characters
Default:
Accounting server
An alternate RADIUS accounting server for this logical WLAN interface. If you leave this field blank, the device uses the
globally configured accounting server (if RADIUS accounting is enabled on the interface).
Telnet path:
Telnet path:Setup > Interfaces > WLAN > Network
Possible values:
Name
from Setup > WLAN > RADIUS-Accounting > Servers, max. 16 characters
Default:
19.10.6 Addition(s) to LCOS 9.00
Dual-Stack Lite (DS-Lite)
Dual-Stack Lite, abbreviated DS-Lite, is used so that Internet providers can supply their customers with access to IPv4
servers over an IPv6 connection. That is necessary, for example, if an Internet provider is forced to supply its customer
with an IPv6 address due to the limited availability of IPv4 addresses. In contrast to the other three IPv6 tunnel methods
"6in4", "6rd" and "6to4", DS-Lite is also used to transmit IPv4 packets on an IPv6 connection (IPv4 viaIPv6 tunnel).
For this, the router packages the IPv4 packets in an IPv4-in-IPv6 tunnel and transmits them unmasked to the provider,
who then performs a NAT with one of their own remaining IPv4 addresses.
To define a DS-Lite tunnel, all the router needs is the IPv6 address of the tunnel endpoint and the routing tag with which
it can reach this address.
By default, the router uses the IPv4 address of the corresponding internal network, e.g., from "INTRANET". If you would
like to define a different IP address instead (e.g., 192.0.0.2), it must be entered in the IP parameter list along with the
remote site name of the DS-Lite tunnel.
Entering an IPv4 DNS server is not recommended for a DS-Lite tunnel, since its entries would unnecessarily fill the NAT
table of the Internet provider.
1825
Reference Manual
19 More services
You set up a DS-Lite tunnel in LANconfig via IPv4 > Tunnel by clicking on DS-Lite tunnel.
Then click on the Add button and enter the designation of the tunnel, the IPv6 address of the gateway, and the routing
tag.
Name of the tunnel
This entry determines the name of the IPv4-over-IPv6 tunnel.
Gateway address
This entry defines the address of the DS-Lite gateway, the so-called Address Family Transition Router (AFTR).
The following values are possible:
1
One IPv6 address (e.g. 2001:db8::1)
1
An FQDN (Fully Qualified Domain Name) that can be resolved by DNS, e.g., aftr.example.com
1
The IPv6 unspecified address "::" determines that the device should retrieve the address of the AFTRs via
DHCPv6 (factory setting).
1
An empty field behaves the same as the entry "::".
IPv6 routing tag
The routing tag uniquely specifies the route to the DS-Lite gateway.
4
With DS-Lite, since the NAT is performed by the provider, the function of many applications depends on the
settings of the NAT provider (e.g., SIP, H.323, IRC or IPSec). PPTP does not work via DS-Lite at all. If the provider
does not operate port forwarding, the IPv4 server services do not function.
1826
Reference Manual
19 More services
The status table and the number of current DS-Lite connections can be shown using LANmonitor:
Additions to the Status menu
DS-Lite
The statistics of the DS-Lite tunnel are located in this directory.
SNMP ID:
1.81
Telnet path:
State
Rx-Packets
This entry shows the number of data packets received by all DS-Lite interfaces.
SNMP ID:
1.81.1
Telnet path:
Status > DS-Lite
1827
Reference Manual
19 More services
Tx-Packets
This entry shows the number of data packets sent by all DS-Lite interfaces.
SNMP ID:
1.81.2
Telnet path:
Status > DS-Lite
Queue error
This entry shows the number data packets sent by all DS-Lite interfaces.
SNMP ID:
1.81.3
Telnet path:
Status > DS-Lite
Connections
This table shows an overview of the active DS-Lite connections.
Once the device has established a DS-Lite connection, it appears in this table. After a connection terminates without
errors, the entry in the table is deleted automatically. If there is an error, the entry remains until the connection is
reestablished or you manually delete it.
Every status change of a DS-Lite connection sends an SNMP trap (ID 83) with the content of the corresponding line in
the status table
SNMP ID:
1.81.4
Telnet path:
Status > DS-Lite
Remote site
This entry shows the name of the DS-Lite tunnel.
SNMP ID:
1.81.4.1
Telnet path:
Status > DS-Lite > Connections
1828
Reference Manual
19 More services
State
This entry shows the state of the DS-Lite tunnel.
SNMP ID:
1.81.4.2
Telnet path:
Status > DS-Lite > Connections
Last error
This entry shows the last error on the connection.
SNMP ID:
1.81.4.3
Telnet path:
Status > DS-Lite > Connections
IPv4 address
This entry shows the IPv4 address of the device when it sends data packets.
SNMP ID:
1.81.4.4
Telnet path:
Status > DS-Lite > Connections
phys. conn.
This entry shows the name of the IPv6 interface running the DS-Lite connection.
SNMP ID:
1.81.4.5
Telnet path:
Status > DS-Lite > Connections
AFTR-Name
This entry shows the DNS name of the tunnel endpoint (Address Family Transition Router, AFTR).
1829
Reference Manual
19 More services
SNMP ID:
1.81.4.6
Telnet path:
Status > DS-Lite > Connections
AFTR-IPv6-Address
This entry shows the IPv6 address of the DS-Lite tunnel endpoint.
SNMP ID:
1.81.4.7
Telnet path:
Status > DS-Lite > Connections
Conn. time:
This entry shows how long the connection already exists. The query via SNMP returns the connection duration in seconds,
TELNET returns the system time of the connection establishment.
SNMP ID:
1.81.4.8
Telnet path:
Status > DS-Lite > Connections
Tunnel
This entry shows the number of active DS-Lite connections.
SNMP ID:
1.81.5
Telnet path:
Status > DS-Lite
Tunnel
This action deletes all values of the DS-Lite statistics.
SNMP ID:
1.81.6
1830
Reference Manual
19 More services
Telnet path:
Status > DS-Lite
Additions to the Setup menu
DS-Lite-Tunnel
Dual-Stack Lite, abbreviated DS-Lite, is used so that Internet providers can supply their customers with access to IPv4
servers over an IPv6 connection. That is necessary, for example, if an Internet provider is forced to supply its customer
with an IPv6 address due to the limited availability of IPv4 addresses. In contrast to the other three IPv6 tunnel methods
"6in4", "6rd" and "6to4", DS-Lite is also used to transmit IPv4 packets on an IPv6 connection (IPv4 viaIPv6 tunnel).
For this, the router packages the IPv4 packets in an IPv4-in-IPv6 tunnel and transmits them unmasked to the provider,
who then performs NAT with one of their own remaining IPv4 addresses.
To define a DS-Lite tunnel, the router only needs the IPv6 address of the tunnel endpoint and the routing tag with which
it can reach this address.
SNMP ID:
2.2.40
Telnet path:
Setup > WAN
Name
Enter the name for the tunnel.
SNMP ID:
2.2.40.1
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 16 characters from [A-Z][a-z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Gateway address
This entry defines the address of the DS-Lite gateway, the so-called Address Family Transition Router (AFTR). Enter a
valid value from the following selection:
1
An IPv6 address, e. g., 2001:db8::1
1
An FQDN (fully qualified domain name) which can be resolved by DNS, e. g., aftr.example.com
1
The IPv6 unspecified address "::" means that the device should obtain the address of the AFTR via DHCPv6 (factory
setting).
1
An empty field behaves the same as the entry "::".
1831
Reference Manual
19 More services
SNMP ID:
2.2.40.2
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 64 characters from [A-Z][a-z][0-9].-:%
Default:
empty
Rtg tag
Enter the routing tag where the router reaches the gateway.
SNMP ID:
2.2.40.3
Telnet path:
Setup > WAN > DS-Lite-Tunnel
Possible values:
Max. 5 characters from [0-9]
Default:
empty
IPv6 support for RAS services
As of firmware version 9.00, RAS remote stations are able to login via IPv6. The configuration is done in LANconfig under
IPv6 > General and the setup of prefix pools under IPv6 > Router advertisement.
RAS interfaces
There are basically two ways to manage the configuration of RAS remote stations:
The user data or the configurations are locally stored on the device.
The advantage of this alternative is that a RADIUS server is not necessary, which reduces the management
and cost of the network infrastructure.
The user data or the configurations are stored on an external RADIUS server.
The advantage of this alternative is the centralized user management for extensive distributed network
scenarios.
1832
Reference Manual
19 More services
For RAS access via IPv6, you must also set up the corresponding RAS interface.
Entries in the RAS interfaces table have the following meaning:
1
Interface active: Enable or disable this interface here.
1
Interface name: Here you define the name of the RAS interface that the IPv6 remote sites use for access.
1
Interface tag: The interface tag that you enter here is a value that uniquely identifies the network. All packets
received by this device on this network will be internally marked with this tag. The interface tag enables the routes
which are valid for this network to be separated even without explicit firewall rules.
1
Forwarding: Enables or disables the forwarding of data packets to other interfaces.
1
Firewall: If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for each interface individually
here. To globally enable the firewall for all interfaces, navigate to Firewall/QoS > General and check the option
IPv6 firewall/QoS enabled.
If you disable the global firewall, the firewall of an individual interface is also disabled. This applies even if
you have enabled this option.
1
Remote site: Specify the remote site or a list of remote sites for RAS dial-in users.
The following values are possible:
2
A single remote station from the tables under Setup > WAN > PPTP-Peers, Setup > WAN > L2TP-Peers or
Setup > PPPoE-Server > Name-list.
2
The wildcard "*" makes the interface valid for all PPTP, PPPoE and L2TP peers.
2
The "*" wildcard as a suffix or prefix of the peer, such as "COMPANY*" or "*TUNNEL" .
Using the wildcards you can create several peers for IPv6 RAS services based on so-called template interfaces These
template interfaces can be used as normal interfaces for IPv6 services such as DHCPv6 server or router advertisements.
For example, using these, a group of RAS interfaces can be provided from an IPv6 prefix pool.
1
Comment: Enter a descriptive comment for this entry.
Information on RADIUS attributes for IPv6 RAS services can be found under
RADIUS attribute extensions for IPv6 RAS
services
on page 678.
4
If RAS clients are to be delegated to an IPv6 DNS server or are to receive their prefixes by prefix delegation, you
must create a corresponding entry in the table DHCPv6 networks under IPv6 > DHCPv6.
4
If you wish to authenticate a user by PPP list, you navigate to Communication > Protocols > PPP list and
enable the option Activate IPv6 routing for that user.
Prefix pools
1833
Reference Manual
19 More services
This table contains the pools of prefixes which RAS users receive when they connect remotely via IPv6. The following
settings are possible:
Interface name
Specifies the name of the RAS interface that is valid for this prefix pool.
First prefix
Specifies the first prefix in the pool that is assigned to remote users by the router advertisement, e.g.,
"2001:db8::". Each user is assigned precisely one /64 prefix from the pool.
Last prefix
Specifies the last prefix in the pool that is assigned to remote users by the router advertisement, e.g.
'2001:db9:FFFF::'. Each user is assigned precisely one /64 prefix from the pool.
Prefix length
Specifies the length of the prefix that the remote user is assigned by the router advertisement here. The size
of the dial-in pool depends directly on the first and last prefix. Each user is assigned precisely one /64 prefix
from the pool.
In order for a client to be able to form an IPv6 address from the auto-configuration prefix, the prefix
length must always be 64 bits.
SLAAC
Specifies whether the prefix can be used for a stateless address auto-configuration (SLAAC).
Additions to the Setup menu
RAS-Interface
In this directory, you specify the settings for RAS access via IPv6.
SNMP ID:
2.70.14
Telnet path:
Setup > IPv6
Interface name
Here you define the name of the RAS interface that the IPv6 remote sites use for access.
SNMP ID:
2.70.14.1
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
1834
Reference Manual
19 More services
Default:
empty
Rtg tag
The interface tag that you enter here is a value that uniquely identifies the network. All packets received by this device
on this network will contain this tag. The interface tag enables the routes which are valid for this network to be separated
even without explicit firewall rules.
SNMP ID:
2.70.14.2
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Max. 5 characters from 0123456789
Default:
0
Interface status
Enable or disable this interface here.
SNMP ID:
2.70.14.3
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Active
Idle
Default:
Active
Forwarding
Enables or disables the forwarding of data packets to other interfaces.
SNMP ID:
2.70.14.4
1835
Reference Manual
19 More services
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Yes
No
Default:
Yes
Firewall
If the global firewall is enabled for IPv6 interfaces, you can disable the firewall for each interface individually here. To
globally enable the firewall for all interfaces, change the setting under IPv6 > Firewall > Enabled to yes.
If you disable the global firewall, the firewall for an individual interface is also disabled. This applies even if you
have enabled this option.
SNMP ID:
2.70.14.5
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
Yes
No
Default:
Yes
DaD attempts
Before the device can use an IPv6 address on an interface, it uses 'Duplicate Address Detection (DAD)' to check to see
whether the IPv6 address already exists on the local network. In this way, the device avoids address conflicts in the
network.
This option is the number of attempts with which the device searches for duplicate IPv6 addresses in the network.
SNMP ID:
2.70.14.6
Telnet path:
Setup > IPv6 > RAS-Interface
1836
Reference Manual
19 More services
Possible values:
1 characters from 0123456789
Default:
0
Remote site
Set a remote station or a list of remote stations for RAS dial-in users.
The following values are possible:
1
An individual remote site from the tables under Setup > WAN > PPTP-Peers or Setup > PPPoE-Server > Name-List.
1
The "*" wildcard makes this interface valid for all PPTP and PPPoE peers.
1
The "*" wildcard as a suffix or prefix of the peer, such as "COMPANY*" or "*TUNNEL", selects interfaces with names
that match.
By using wildcards you can implement template interfaces, which apply to peers which are named accordingly. In this
manner, the name of the IPv6 RAS interface can be used many places in the IPv6 configuration.
SNMP ID:
2.70.14.7
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
16 characters from [A-Z][0-9]@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Comment
Enter a descriptive comment for this entry.
SNMP ID:
2.70.14.8
Telnet path:
Setup > IPv6 > RAS-Interface
Possible values:
16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
1837
Reference Manual
19 More services
Prefix pools
In this directory you can define pools of prefixes for remote users and/or the corresponding RAS interfaces (PPTP, PPPoE).
Define the prefixes for Ethernet interfaces under Setup > IPv6 > Router > Router-Advertisements > Prefix-Options
or in LANconfig under IPv6 > Router advertisement > Prefix list.
SNMP ID:
2.70.2.6
Telnet path:
Setup > IPv6 > Router-Advertisement
Interface name
Specify the name of the RAS interface applicable for this prefix pool.
SNMP ID:
2.70.2.6.1
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Start-Prefix-Pool
Here you specify the first prefix in the pool that is assigned to remote users by the router advertisement, e.g., "2001:db8::".
Each user is assigned precisely one /64 prefix from the pool.
SNMP ID:
2.70.2.6.2
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 43 characters from [A-F][a-f][0-9]:./
Default:
empty
1838
Reference Manual
19 More services
End-Prefix-Pool
Here you specify the last prefix in the pool that is assigned to remote users by the router advertisement, e.g.
'2001:db9:FFFF::'. Each user is assigned precisely one /64 prefix from the pool.
SNMP ID:
2.70.2.6.3
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 43 characters from [A-F][a-f][0-9]:./
Default:
::
Prefix length
Here you specify the length of the prefix assigned to the remote user by the router advertisement. The size of the dial-in
pool depends directly on the first and last prefix. Each user is assigned precisely one /64 prefix from the pool.
In order for a client to be able to form an IPv6 address from the auto-configuration prefix, the prefix length must
always be 64 bits.
SNMP ID:
2.70.2.6.4
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 3 characters from 0123456789
Default:
64
Adv.-OnLink
Indicates whether the prefix is "on link".
SNMP ID:
2.70.2.6.5
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
1839
Reference Manual
19 More services
Possible values:
Yes
No
Default:
Yes
Adv.-Autonomous
Specifies whether the client can use the prefix for a stateless address auto-configuration (SLAAC).
SNMP ID:
2.70.2.6.6
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Yes
No
Default:
Yes
Adv.-Pref.-Lifetime
Specifies the time in milliseconds for which an IPv6 address is "Preferred". The client also uses this lifetime for its generated
IPv6 address. If the lifetime of the prefix has expired, the client no longer uses the corresponding IPv6 address. Is the
"preferred lifetime" of an address expires, it will be marked as "deprecated". This address is then used only by already
active connections until those connections end. Expired addresses are no longer available for new connections.
SNMP ID:
2.70.2.6.7
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 10 characters from 0123456789
Default:
604800
1840
Reference Manual
19 More services
Adv.-Valid-Lifetime
Defines the time in seconds, after which the validity of an IPv6 address expires. Expired addresses are no longer available
for new connections.
SNMP ID:
2.70.2.6.8
Telnet path:
Setup > IPv6 > Router-Advertisement > Prefix-Pools
Possible values:
Max. 10 characters from 0123456789
Default:
2592000
RADIUS attribute extensions for IPv6 RAS services
The RADIUS client can request RADIUS attributes, such as the “Framed-IP-Address”, from an external RADIUS server and
provide these, for example, to a PPPoE server in order to authenticate them at PPPoE, PPTP or L2TP servers. The device
accepts the following attributes in access-accept messages:
96
Framed-Interface-ID
This attribute conveys the IPv6 interface identifier that should be configured for the user in the IPv6CP.
97
Framed-IPv6-Prefix
Prefix, which is sent to the user via router advertisements.
99
Framed-IPv6-Route
This attribute conveys the route to be used for this user. The device supplements the IPv6 routing table with
this route and the next hop to this user.
100
Framed-IPv6-Pool
This indicates the IPv6 pool from which a prefix is to be taken for the user. The IPv6 pool is referenced by its
name and must be present under IPv6 > Router advertisement > Prefix pools.
123
Delegated-IPv6-Prefix
Prefix, which is sent to the user via DHCPv6 prefix delegation.
The newly available RADIUS attributes are implemented according to RFCs 3162 and 4818. An example for a PPP user
test with IPv6 in the FreeRADIUS is as follows:
test Cleartext-Password := "1234"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IPv6-Prefix = "fec0:1:2400:1::/64",
Delegated-IPv6-Prefix = "fec0:1:2400:1100::/56",
Framed-IP-Address = 172.16.3.33,
1841
Reference Manual
19 More services
The user "test" in a dual-stack PPP session receives the IPv4 address 172.16.3.33, the prefix fec0:1:2400:1::/64 via router
advertisement, and the prefix fec0:1:2400:1100::/56 via DHCPv6 prefix delegation.
Loopback addresses for IPv6
As of LCOS 9.00, you can use IPv6 loopback addresses as the sender address for ping commands at the command line.
MeaningParameters
Sets an IPv6 loopback interface as the sender address.
-6
<Loopback-Interface>
Loopback addresses
IPv6 loopback addresses can be specified in the Loopback addresses table. The device sees each of these addresses
as its own address, which is also available if a physical interface is disabled, for example.
Entries in the Loopback addresses table have the following meaning:
1
Name: Enter a unique name for this loopback address.
1
IPv6 address: Enter a valid IPv6 address here.
1
Routing tag: Here you specify the routing tag of the network that the loopback address belongs to. Only packets
with this routing tag will reach this address.
1
Comment: You have the option to enter a comment here.
Additions to the Setup menu
Loopback
You can set IPv6 loopback addresses here. The device sees each of these addresses as its own address, which is also
available if a physical interface is disabled, for example.
SNMP ID:
2.70.4.3
Telnet path:
Setup > IPv6 > Network
Name
Enter a unique name for this loopback address.
SNMP ID:
2.70.4.3.1
1842
Reference Manual
19 More services
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 16 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
IPv6-Loopback-Addr.
Enter a valid IPv6 address here.
SNMP ID:
2.70.4.3.2
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 39 characters from 0123456789ABCDEFabcdef:./
Default:
empty
Rtg tag
Here you specify the routing tag of the network that the loopback address belongs to. Only packets with this routing
tag will reach this address.
SNMP ID:
2.70.4.3.3
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 5 characters from 0123456789
Default:
0
Comment
You have the option to enter a comment here.
1843
Reference Manual
19 More services
SNMP ID:
2.70.4.3.4
Telnet path:
Setup > IPv6 > Network > Loopback
Possible values:
Max. 64 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Lightweight DHCPv6 relay agent (LDRA)
Unlike a DHCPv6 relay agent, which has the full IPv6 features (such as ICMPv6) and can route data packets on the
network (layer 3), a lightweight DHCPv6 relay agent as per RFC 6221 enables only the creation and forwarding of
relay-agent information between DHCPv6 clients and DHCPv6 servers (layer 2).
In contrast to DHCPv4 snooping, the LDRA does not simply append the DHCPv6 packets with information about the
relay agent: Instead, it packs the message from the client into a separate option, prepends its own relay-agent header
and then forwards this DCHPv6 packet with its supplementary information to the DHCPv6 server (relay forward message).
The DHCPv6 server evaluates this data packet and sends a similarly packaged response to the relay agent. This then
extracts the message and sends it to the requesting client (relay-reply message).
In LANconfig you can set up DHCPv6 snooping for each interface under Interfaces > Snooping and a click on DHCPv6
snooping.
1844
Reference Manual
19 More services
After selecting the appropriate interface, you can set the following:
Orientation
This is where you enable or disable DHCPv6 snooping. The following options are possible:
1
Network facing: The LDRA uses this interface to communicate with a DHCPv6 server.
1
Client facing: The LDRA uses this interface to communicate with DHCPv6 clients connected to the network.
The default setting Network facing disables the LDRA.
Trusted port
With this option enabled, the LDRA forwards DHCP requests from clients and also DHCP responses from DHCP
servers. If this interface is classified as not trusted, the LDRA discards DHCPv6 requests to this interface.
Similarly, the LDRA does not forward DHCPv6 responses with the wrong interface ID to the client.
Remote ID
According to RFC 4649, the remote ID uniquely identifies the client making a DHCPv6 request.
Interface ID
The interface ID uniquely identifies the interface used by a client to make a DHCPv6 request.
Server address
You can set the IPv6 address of a DHCPv6 server here.
4
Leave this field blank if you want to receive responses from all DHCPv6 servers on the network.
Otherwise the LDRA reacts only to DHCPv6 responses from the server you have specified. In this case,
the LDRA discards responses from other DHCPv6 servers.
You can use the following variables for Remote ID and Interface ID:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface where the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Management > General.
1845
Reference Manual
19 More services
Additions to the Setup menu
DHCPv6-Snooping
This is where you can configure the lightweight DHCPv6 relay agent.
SNMP ID:
2.20.41
Telnet path:
Setup > LAN-Bridge
Port
Indicates the physical or logical interface to which this DHCPv6-snooping configuration applies.
SNMP ID:
2.20.41.1
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
WLC-TUNNEL-x
All virtual WLC tunnels
Orientation
Enable or disable DHCPv6 snooping here.
SNMP ID:
2.20.41.2
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
1846
Reference Manual
19 More services
Possible values:
Network-facing
Disables DHCPv6 snooping for this interface. The LDRA does not forward any DHCPv6 requests to a
DHCPv6 server.
Client-facing
Enables DHCPv6 snooping for this interface.
Default:
Network-facing
Type
Here you set how the DHCP relay agent handles the "relay agent info" in incoming DHCP packets.
SNMP ID:
2.20.41.3
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Trusted
The LDRA forwards DHCP requests from clients and also DHCP responses from DHCP servers.
Untrusted
If this interface is classified as untrusted, the LDRA discards DHCPv6-server requests to this interface.
This prevents unauthorized clients from acting as "rogue DHCPv6 servers". Similarly, the LDRA does not
forward DHCPv6 responses with the wrong interface ID to the client.
5
Interfaces that are facing clients should be set as untrusted.
Default:
Trusted
Remote ID
The remote ID according to RFC 4649 uniquely identifies the client that is making a DHCPv6 request.
4
This option is analogous to the DHCP option "remote ID" of the relay agent in the case of IPv4.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface at which the relay agent received the DHCP request. If a WLAN-SSID
is involved, then this is the corresponding BSSID.
1847
Reference Manual
19 More services
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.41.4
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Interface-ID
The interface ID uniquely identifies the interface used by the client to make a DHCPv6 request.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Adds the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.41.5
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
1848
Reference Manual
19 More services
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Server address
Here you can specify the IPv6 address of a DHCPv6 server.
4
Leave this field blank if you want to receive responses from all of the DHCPv6 servers on the network. Otherwise
the LDRA reacts only to DHCPv6 responses from the server you have specified. In this case, the LDRA discards
responses from other DHCPv6 servers.
SNMP ID:
2.20.41.6
Telnet path:
Setup > LAN-Bridge > DHCPv6-Snooping
Possible values:
Max. 39 characters 0123456789ABCDEFabcdef:.
Default:
empty
Router advertisement snooping
In an IPv6 network, router advertisements are sent by routers, either periodically or upon request, to present themselves
as a gateway for networked clients. As with DHCPv4, attackers can use this mechanism to deliver a fake network
configuration to the requesting clients.
With RA snooping, the device mediates router advertisements from routers only, and not from clients. By specifying the
address of a router, the router advertisements can be restricted to one specific router as the broadcaster.
1849
Reference Manual
19 More services
In LANconfig you can set up RA snooping for each interface under Interfaces > Snooping and a click on RA snooping.
After selecting the appropriate interface, you can set the following:
Port type
Specify the preferred interface type here. The following options are possible:
1
Router: The device mediates all of the RAs arriving at this interface (default).
1
Client: The device discards all of the RAs arriving at this interface.
Router-Address
If you have selected the interface type Router, enter an optional router address here. If you specify a router
address, the device will only mediate RAs from that router.
With the interface type Client selected, the device ignores this input field.
Additions to the Setup menu
RA-Snooping
You can configure the RA snooping here.
SNMP ID:
2.20.42
Telnet path:
Setup > LAN-Bridge
1850
Reference Manual
19 More services
Port
Indicates the physical or logical interface to which this RA-snooping configuration applies.
SNMP ID:
2.20.42.1
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
WLC-TUNNEL-x
All virtual WLC tunnels
Orientation
Specify the preferred interface type here.
SNMP ID:
2.20.42.3
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
Router
The device mediates all of the RAs arriving at this interface.
Client
The device discards all of the RAs arriving at this interface.
Default:
Router
1851
Reference Manual
19 More services
Router-Address
If you have selected the interface type Router, enter an optional router address here. If you specify a router address,
the device will only mediate RAs from that router. With the interface type Client selected, the device ignores this input
field.
SNMP ID:
2.20.42.4
Telnet path:
Setup > LAN-Bridge > RA-Snooping
Possible values:
Max. 39 characters 0123456789ABCDEFabcdef:.
Default:
empty
19.10.7 Addition(s) to LCOS 9.10
Comment field for RADIUS clients
As of LCOS version 9.10 it is possible to store a comment for each RADIUS client (IPv4 and IPv6) in the RADIUS table.
Comment
Comment on this entry.
1852
Reference Manual
19 More services
Comment
Comment on this entry.
Additions to the Setup menu
Clients
Here you enter the clients that are to communicate with the RADIUS server.
SNMP ID:
2.25.10.2
Telnet path:
Setup > RADIUS > Server
Comment
Comment on this entry.
SNMP ID:
2.25.10.2.5
Telnet path:
Setup > RADIUS > Server > Clients
Possible values:
Max. 251 characters from [A-Z][a-z][0-9]@{|}~!$%&'()*+-,/:;<=>?[\]^_.`
Default:
empty
IPv6 clients
Here you specify the RADIUS access data for IPv6 clients.
SNMP ID:
2.25.10.16
Telnet path:
Setup > RADIUS > Server
Comment
Comment on this entry.
1853
Reference Manual
19 More services
SNMP ID:
2.25.10.16.5
Telnet path:
Setup > RADIUS > Server > IPv6-Clients
Possible values:
Max. 251 characters from [A-Z][a-z][0-9]@{|}~!$%&'()*+-,/:;<=>?[\]^_.`
Default:
empty
More attributes for RADIUS requests
As of LCOS version 9.10 the device supports additional RADIUS attributes for the Public Spot, see chapter
Public Spot
.
Table 28: The device transmits the following attributes in the access request:
Possible values in LCOSMeaningNameID
Used with 802.1X WLAN,
PPPoE server, L2TP, PPTP,
VPN
The name entered by the user.User name1
Used with 802.1X WLAN,
PPPoE server, L2TP, PPTP,
VPN
The password entered by the user.User-Password2
<IPv4 address of the
device>
Specifies the IPv4 address of the device requesting access
for a user.
NAS-IP-Address4
Specifies the type of service that the device requests or
expects as a response.
Service-Type6
1
Authenticate-Only
1
Framed
PPPSpecifies the protocol to be used.Framed-Protocol7
Specifies the identifier of the called station (e.g. the VPN
server).
Called-Station-Id30
1
Server IP address (for
VPN connections via
PPTP or L2TP)
1
Service name (for
PPPoE)
1
BSSID:SSID (for WLAN)
1
MAC address of the
device (for Public Spot)
Specifies the identifier of the calling station (e.g. the VPN
client).
Calling-Station-Id31
1
Client IP address (for
VPN connections via
PPTP or L2TP)
1
Client MAC address (for
PPPoE, WLAN and
Public Spot)
<Device-Name>Specifies the name of the device being managed by the
RADIUS server.
NAS identifier32
Specifies the physical port through which the device
authenticates the user.
NAS-Port-Type61
1
Virtual (for VPN
connections via PPTP or
L2TP)
1
Ethernet (with PPPoE)
1
Wireless 802.11 (for
WLAN)
1854
Reference Manual
19 More services
Possible values in LCOSMeaningNameID
<IPv6-address of the
device>
Specifies the IPv6 address of the device requesting access
for a user.
NAS-IPv6-Address95
Defines the tunneling protocol which will be used for the
session.
Tunnel-Type64
1
13 (VLAN; for Public
Spot)
Defines the transport medium over which the tunneled
session will be established.
Tunnel-Medium-Type65
1
6 (802; for Public Spot)
Defines the group ID if the session is tunneled.Tunnel-Private-Group-ID81
1
1-4096 (for Public Spot)
Identifies the mobility domain where the client is located.Mobility-Domain-ID177
Contains the HESSID of the 802.11u SSID.WLAN-HESSID181
This is configured under
Wireless-LAN > 802.11u >
Venue information.
Contains information about the category of the site.WLAN-Venue-Info182
This is configured under
Wireless-LAN > 802.11u >
Venue information.
Contains information about the language of the site.WLAN-Venue-Language183
This is configured under
Wireless-LAN > 802.11u >
Venue information.
Contains the name of the site (venue name).WLAN-Venue-Name184
Contains information about the pairwise key used by the
client and AP.
WLAN-Pairwise-Cipher186
Contains information about the group key used by the
client and AP.
WLAN-Group-Cipher187
Contains information about the access management
(authentication and key management) between the client
and AP.
WLAN-AKM-Suite188
Contains information about the group management
key/cipher used to secure a connection via RSNA (robust
WLAN-Group-Mgmt-Cipher189
security network association) between an AP and mobile
client.
Contains information about the frequency band used by
the client.
WLAN-RF-Band190
The following vendor-specific RADIUS attributes use the IANA Private Enterprise Number “3561” of the Broadband
Forum. The remaining entries are LANCOM-specific attributes!
Table 29: Overview of all supported manufacturer-specific RADIUS attributes in the access request
Possible values in LCOSMeaningNameID
<Device interface>Specifies the interface of the device being managed by the
RADIUS server. Only transmitted if agent-relay info is included
in the PPPoED packet (see
PPPoE snooping
).
ADSL-Agent-Circuit-Id,
Vendor 3561
1
<Device identifier>Specifies the identifier of the device being managed by the
RADIUS server. Only transmitted if agent-relay info is included
in the PPPoED packet (see
PPPoE snooping
).
ADSL-Agent-Remote-Id,
Vendor 3561
2
<Device-Name>NAS-identifier of the original access point in WLC mode.LCS-Orig-NAS-Identifier,
Vendor 2356
16
<IPv4 address of the device>NAS IP address of the original access point in WLC mode.LCS-Orig-NAS-IP-Address,
Vendor 2356
17
1855
Reference Manual
19 More services
Possible values in LCOSMeaningNameID
<IPv6-address of the device>NAS IPv6 address of the original access point in WLC mode.LCS-Orig-NAS-IPv6-Address,
Vendor 2356
18
Accounting status types "Accounting On" and "Accounting Off"
As of LCOS version 9.10, devices that use RADIUS for WLAN and Public Spots now also process the RADIUS accounting
status types "Accounting-On" and "Accounting-Off".
Accounting status types "Accounting On" and "Accounting Off"
The RADIUS server and an AP exchange status information, such as the start, end, or update of client sessions at the
AP. These data packets are characterized by the behavior of the logged-on clients.
With the status types "Accounting-On" and "Accounting-Off", the AP informs the RADIUS server about its general ability
to perform RADIUS accounting:
Accounting-On
When the device switches to an operating state where it can exchange accounting information with a RADIUS
server, it sends an "Accounting-On".
Accounting-Off
When the device switches to an operating state where it cannot exchange accounting information with a
RADIUS server, it sends an "Accounting-Off".
The following conditions trigger the transmission of an "Accounting-On" or "Accounting-Off":
1
The device activates or deactivates a physical WLAN interface with the appropriate SSID.
4
Deactivation can also be the result of overheating, loss of connection or incorrect link detection.
1
The WLAN interface switches into a non-AP mode (i.e. neither managed nor stand-alone-AP) or back.
1
In P2P mode, the device switches into "exclusive" mode, which disables all SSIDs.
1
The device activates or deactivates an SSID.
1
The device activates or deactivates the RADIUS accounting for an SSID.
Larger volume budgets in the RADIUS server and Public Spot
As of LCOS version 9.10, the RADIUS server is capable of managing volume budgets in excess of 4GByte.
5
The RADIUS server now interprets existing volume budgets as a value in MBytes (previously in bytes). By updating
to LCOS version 9.10, the device converts existing values and rounds them up to full MBytes. For example, the
entry "1000000" (byte) converts to "1" (MByte).
This extension affects the Public Spot module. The specification of the volume budget via the Public Spot web API can
also include a unit:
volumebudget
Volume budget
The following entries are allowed:
1
k or K: Specified in kilobytes (kB), e.g. volumebudget=1000k.
1
m or M: Specified in megabytes (MB), e.g. volumebudget=1000m.
1
g or G: Specified in gigabytes (GB), e.g. volumebudget=1g.
Without a unit, the specification corresponds to a value in bytes (B).
1856
Reference Manual
19 More services
If this parameter is omitted completely, the wizard uses the default value.
This extension affects the XML interface. The specification of the volume budget at the login request and the login
response can also include a unit:
TRAFFICEXPIRE
The maximum data volume for a user account. The user can use this data volume until a relative or absolute
expiry time (if set) is reached.
The following entries are allowed:
1
k or K: Specified in kilobytes (kB), e.g. <TRAFFICEXPIRE>1000k</TRAFFICEXPIRE>.
1
m or M: Specified in megabytes (MB), e.g. <TRAFFICEXPIRE>100m</TRAFFICEXPIRE>.
1
g or G: Specified in gigabytes (GB), e.g. <TRAFFICEXPIRE>1g</TRAFFICEXPIRE>.
Without a unit, the specification corresponds to a value in bytes (B).
Additions to the Setup menu
Volume budget
The maximum data volume in MBytes for this user account. The user can use this data volume until a relative or absolute
expiry time (if set) is reached.
SNMP ID:
2.25.10.7.12
Telnet path:
Setup > RADIUS > Server
Possible values:
Max. 10 characters from 0123456789
Default:
0
Special values:
0
switches off the monitoring of data volume.
Volume budget MByte
This entry enables you to set the budget volume of the RADIUS user in megabytes.
SNMP ID:
2.25.10.7.22
Telnet path:
Setup > RADIUS > Server > Users
1857
Reference Manual
19 More services
Possible values:
Max. 10 characters from [0-9]
Default:
0
Special values:
0
The volume budget is deactivated.
Volume budget
With this entry you specify the volume budget in MBytes assigned to automatically created users. The value 0 deactivates
the function.
SNMP ID:
2.24.41.3.3
Telnet path:
Setup > Public-Spot-Module > Authentication-Modules > User-Template
Possible values:
Max. 4 characters from 0123456789
Default:
0
Special values:
0
switches off the monitoring of data volume.
RADIUS server: Realm discovery for computer authentication
As of LCOS version 9.10, the RADIUS server additionally determines the realm of a RADIUS request from a computer
authentication.
The device considers the parts of a user name that follow to be the realm:
user@company.com
company.com is the realm and is separated from the name of the user by an @ character.
company\user
company is the realm and is separated from the name of the user by a backslash (“\”). This form of
authentication is used for a Windows login, for example.
host/user.company.com
If the user name starts with the string host/ and the rest of the name contains at least one dot/period, the
device considers everything after the first dot to be the realm (in this case company.com).
1858
Reference Manual
19 More services
Additions to the Setup menu
Realm types
Specify how the RADIUS server determines the realm of a RADIUS request.
SNMP ID:
2.25.10.17
Telnet path:
Setup > RADIUS > Server
Possible values:
Mail domain
user@company.com: company.com is the realm and is separated from the name of the user
by an @ character.
MS domain
company\user: company is the realm and is separated from the name of the user by a backslash
(“\”). This form of authentication is used for a Windows login, for example.
MS-CompAuth
host/user.company.com: If the user name starts with the string host/ and the rest of the
name contains at least one dot/period, the device considers everything after the first dot to be the realm
(in this case company.com).
Default:
Mail domain
MS domain
RADIUS client: Additional source ports for requests when necessary
As of LCOS version 9.10, the RADIUS client opens additional source ports for access requests if necessary.
Additional source ports for access requests
The RADIUS client uses a source port (UDP listener) for negotiating access requests with the RADIUS server. This port
allows the simultaneous negotiation of up to 256 IDs. If a client is processing a large number of requests at the same
time and the RADIUS server is far away, it is possible for all 256 access requests to be open at the same time, causing
the RADIUS client to be unable to handle any further requests. This can happen, for example, in extensive Eduroam
environments.
In this case, the RADIUS client opens the next highest source port to enable the access request negotiation for additional
IDs. This is automatic and is not configurable.
User-defined RADIUS attributes
As of LCOS version 9.10 the RADIUS attributes are configurable.
RADIUS attributes configurable
LCOS allows the configuration of the RADIUS attributes used to communicate with a RADIUS server (for authentication
and accounting).
1859
Reference Manual
19 More services
The attributes are specified by means of a semicolon-separated list of attribute numbers or names (as per
RFC 2865
,
RFC 3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>;<Attribute_2>=<Value_2>.
As the number of characters is limited, the name can abbreviated. The abbreviation must be unique, however. Examples:
1
NAS-Port=1234 is not allowed, because the attribute is not unique (NAS-Port, NAS-Port-Id or
NAS-Port-Type).
1
NAS-Id=ABCD is allowed, because the attribute is unique (NAS-Identifier).
Attribute values can be used to specify names or RFC-compliant numbers. For the device , the specifications
Service-Type=Framed and Service-Type=2 are identical.
Specifying a value in quotation marks ("<Value>") allows you to specify special characters such as spaces, semicolons
or equals signs. The quotation mark requires a leading backslash (\"), as does the backslash itself (\\).
The following variables are permitted as values:
%n
Device name
%e
Serial number of the device
%%
Percent sign
%{name}
Original name of the attribute as transferred by the RADIUS application. This allows attributes to be set with
the original RADIUS attributes, for example: Called-Station-Id=%{NAS-Identifier} sets
the attribute Called-Station-Id to the value with the attribute NAS-Identifier.
Additions to the Setup menu
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.2.22.12
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
1860
Reference Manual
19 More services
L2TP attribute values
With this entry you configure the RADIUS attributes for the tunnel end point of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.2.22.27
Telnet path:
Setup > WAN > RADIUS
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.11.81.1.9
Telnet path:
Setup > Config > Radius > Server
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
1861
Reference Manual
19 More services
SNMP ID:
2.12.29.18
Telnet path:
Setup > WLAN > RADIUS-Access-Check
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Backup attribute values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.12.29.19
Telnet path:
Setup > WLAN > RADIUS-Access-Check
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.12.45.17.9
Telnet path:
Setup > WLAN > RADIUS-Accounting > Servers
1862
Reference Manual
19 More services
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Auth.-Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.24.3.15
Telnet path:
Setup > Public-Spot-Module > Provider-Table > Server
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Acc.-Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.24.3.16
Telnet path:
Setup > Public-Spot-Module > Provider-Table > Server
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
1863
Reference Manual
19 More services
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.25.10.3.15
Telnet path:
Setup > RADIUS > Server > Forward-Servers
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Accnt.-Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
SNMP ID:
2.25.10.3.16
Telnet path:
Setup > RADIUS > Server > Forward-Servers
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Attribute-Values
With this entry you configure the RADIUS attributes of the RADIUS server.
The attributes are specified in a semicolon-separated list of attribute numbers or names (according to
RFC 2865
,
RFC
3162
,
RFC 4679
,
RFC 4818
,
RFC 7268
) and a corresponding value in the form
<Attribute_1>=<Value_1>,<Attribute_2>=<Value_2>.
Variables can also be used as values (such as %n for the device name). Example: NAS-Identifier=%n.
1864
Reference Manual
19 More services
SNMP ID:
2.30.3.9
Telnet path:
Setup > IEEE802.1x > RADIUS-Server
Possible values:
Max. 128 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
19.11 Extensions to the RADIUS server
19.11.1 New authentication method
Up to version 6.30 the LCOS RADIUS server supported PAP as an authentication method only, i.e. the RADIUS client
(henceforth referred to as the NAS, Network Access Server) passed on the user name and password and the server
responded with an access accept or access reject. This is just one of a range of authentication methods which can be
processed by RADIUS. With LCOS version the RADIUS server in the LANCOM supports additional methods of authentication:
1
PAP: The NAS passes the user name and password. The RADIUS server searches its data sets for an entry matching
the user name, compares the password, and responds with a RADIUS accept or RADIUS reject.
1
CHAP: The NAS passes the user name, the CHAP challenge and characteristics of the password (but not the password
itself). The RADIUS server searches its data sets for an entry matching the user name; it uses the associated password
and the CHAP challenge from the NAS to compute the CHAP response. If this computed response and the answer
sent by the client via the NAS correspond, then the RADIUS server sends a RADIUS accept; otherwise it sends a
RADIUS reject.
1
MS-CHAP: The NAS passes the user name, the MS-CHAP challenge and the MS-CHAP password characteristics. The
method continues in the same way as CHAP, although the responses are computed with the MS-CHAP algorithm
(RFC 2433).
1
MS-CHAPv2: The NAS passes the user name, the MS-CHAP challenge and the MS-CHAPv2 response. The method
continues in the same way as CHAP and MS-CHAP, although the responses are computed with the MS-CHAPv2
algorithm (RFC 2759). Furthermore the RADIUS server transmits an MS-CHAPv2 confirmation once the authentication
was successful. This confirmation contains the server's response to the client's challenge, so enabling a mutual
authentication.
1
EAP: The NAS passes the user name and an EAP message. Unlike the methods outlined above, EAP is not stateless,
i.e. in addition to sending an access accept or access reject, the RADIUS server issues its own challenge before
authentication is completed. EAP itself is a modular authentication protocol that accommodates various methods of
authentication.
19.11.2 EAP authentication
EAP is not a specific authentication mechanism, it is more like a framework for various authentication methods. The
LCOS RADIUS server supports a range of EAP methods:
1
EAP/MD5, defined in RFC 2284. EAP/MD5 is a simple challenge/response protocol. It does not cater for mutual
authentication nor does it offer a dynamic key such as those required for 802.1x authentication in wireless networks
(WLANs). Thus it is only used for the authentication of non-wireless clients or as a tunneled method as a part of TTLS.
1
EAP/MSCHAPv2, defined in draft-kamath-pppext-eap-mschapv2-01.txt. As opposed to EAD/MD5, EAP/MSCHAPv2
does supports mutual authentication but does not support dynamic keys, making it just as prone to dictionary attacks
as EAP/MD5. This method is usually used within PEAP tunnels.
1865
Reference Manual
19 More services
1
EAP/TLS, defined in RFC2716. The use of EAP/TLS requires the use of a root certificate, a device certificate and a
private key in the device. EAP/TLS provides outstanding security and the dynamic keys necessary for wireless
connections; its implementation is complex, however, because each individual client requires a certificate and a
private key.
5
Please note that the TLS implementation in LCOS does not support certificate chains or certificate revocation
lists (CRLs).
1
EAP/TTLS, defined in draft-ietf-pppext-eap-ttls-05.txt. TTLS is based on TLS; it does not make use of client certificates
and it utilizes the existing TLS tunnel to authenticate the client. The LCOS RADIUS server supports the following TTLS
methods:
2
PAP
2
CHAP
2
MSCHAP
2
MSCHAPv2
2
EAP, preferably EAP/MD5
1
EAP/PEAPv0, defined in draft-kamath-pppext-peapv0-00.txt. Similar to TTLS, PEAP is based on TLS and works with
an EAP negotiation inside the TLS tunnel.
5
Please note that although PEAP enables the use of any authentication method, the LCOS RADIUS server only
supports MSCHAPv2 for tunneling.
At this time, authentication methods cannot be suppressed. The EAP supplicant and the RADIUS server negotiate the
EAP method with the standard EAP mechanism. Clients requesting a non-EAP method will be rejected by the RADIUS
server.
19.11.3 RADIUS forwarding
In the case of multi-layer EAP protocols such as TTLS or PEAP, the actual "internal" authentication can be carried out by
a separate RADIUS server. Thus an existing RADIUS server can continue to be operated to provide user tables, even
though it is not EAP(/TLS) capable itself. In this situation the TLS/TTLS/PEAP tunnel is managed from the LCOS RADIUS
server.
The configuration of multi-layer protocols of this type is an element of a general method for the forwarding of RADIUS
requests, whereby a LCOS RADIUS server can also be used as a RADIUS proxy. The concept of "realms" is the basis for
request forwarding and the proxy function. A realm is a character string which defines the validity of a range of user
accounts. Once defined, the realm is a suffix to the user name separated by an @ character as follows:
user@realm
The realm can be seen as a pointer to the RADIUS server where the user account is managed. The realm is removed from
the string prior to the search of the RADIUS server's user table. Realms allow entire networks which are mutually
trustworthy to work with common RADIUS servers located in partner networks, and to authenticate users who move
between these networks. The LCOS RADIUS server stores any connected RADIUS servers along with their associated
realms in a forwarding table. The realm is searched for in this table in connection with the communicated user name. If
no entry is found, the request is answered with an access reject. An empty realm is treated as a local request, i.e. the
LCOS RADIUS server searches its own user tables and generates its response accordingly.
To support the processing of realms the LCOS RADIUS server uses two special realms:
1
Default realm: This realm is used where a realm is communicated for which no specific forwarding server has been
defined. Importantly, a corresponding entry for the default realm itself must be present in the forwarding table.
1
Empty realm: This realm is used when no realm is communicated, but the user name only.
In the default state the forwarding table has no entries, i.e. the default and empty realms are empty. This means that
all requests are treated as local requests and any realms which are communicated are ignored. To operate the LCOS
RADIUS server purely as a forwarding server or RADIUS proxy, the default and empty realms must be set to a value that
corresponds with a server defined in the forwarding table.
1866
Reference Manual
19 More services
Please note that the forwarding of RADIUS requests does not alter the user name. No realm is added, changed or
removed. The next server may not be the last one in the forwarding chain, and the realm information may be required
by that server to ensure that forwarding is carried out correctly. Only the active RADIUS server which processes the
request resolves the realm from the user name, and only then is a search made of the table containing the user accounts.
Accordingly the LCOS RADIUS server resolves the realm from the user name for processing requests locally.
The processing of tunneled EAP requests using TTLS and PEAP makes use of a special EAP tunnel server, which is also
in the form of a realm. Here you select a realm that will not conflict with other realms. If no EAP tunnel server is defined
then the LCOS RADIUS server forwards the request to itself, meaning that both the internal and the external EAP
authentications are handled by the LCOS RADIUS server itself.
19.11.4 RADIUS server parameters
For the configuration of the RADIUS server, the clients which are permitted to access the RADIUS server are defined
(including password), as is the UDP port which the clients can use to communicate with the RADIUS server. The
authentication port applies globally for all clients.
WEBconfig: LCOS menu tree / Setup / Radius / Server
Global settings for the RADIUS server
1
Authentication port [default: 0]
Specify here the port used by the authenticators to communicate with the RADIUS server in the LANCOM access
point. Port '1812' is normally used.
2
Port '0' disables the RADIUS server.
1
Default realm
This realm is used if the user name is supplied with an unknown realm that is not in the list of forwarding servers.
1
Empty realm
This realm is used when the user name supplied does not contain a realm.
RADIUS clients
The client table can contain up to 16 clients that can communicate with the RADIUS server.
1
IP address
Enter the IP address of the client that may communicate with the RADIUS server in the LANCOM access point.
1
Secret
Password required by the client for access to the RADIUS server in the LANCOM access point.
5
In addition to the configuration of the RADIUS server, the user information source must also be defined .
RADIUS user
Up to 64 users can be entered into the user table, and these can be authenticated by the RADIUS server without reference
to other databases. This user table is used for local requests to the RADIUS server, i.e. for requests with user name but
no realm.
1
User name
User name.
1
Password
User password.
1
Limit auth. methods
1867
Reference Manual
19 More services
This option allows you to place limitations on the authentication methods permitted for the user.
2
Values: PAP, CHAP, MSCHAP, MSCHAPv2, EAP, All
2
Default: All
Forwarding server
The table of forwarding servers contains up to 16 realms with the associated forwarding destinations.
1
Realm
Character string identifying the forwarding destination.
1
IP address
IP address of the RADIUS server to which the request is to be forwarded.
1
Port
Open port for communications with the forwarding server.
1
Secret
Password required for accessing the forwarding server.
1
Backup
Alternative forwarding server in case the first forwarding server is not available.
EAP options for the RADIUS server
1
EAP tunnel server
This realm refers to the entry in the table of the forwarding server that is to be used for tunneled TTLS or PEAP
requests.
1
TLS check username
TLS authenticates the client via certificate only. If this option is activated, the RADIUS server additionally checks if
the username in the certificate is contained in the RADIUS user table.
19.11.5 Addition(s) to LCOS 7.80
XAUTH with external RADIUS servers
As of LCOS version 7.60, LANCOM devices can identify and authenticate remote stations with the Extended Authentication
Protocol (XAUTH). Authentication referred to the user data in the PPP list.
As of LCOS version 7.80, XAUTH authentication can also be handled by an (external) RADIUS server. For example, this
allows reference to existing RAS user data on the RADIUS server, assuming that RADIUS-authenticated dial-in via PPP
has been set up for VPN with XAUTH.
To supplement VPN dial-in with XAUTH for authentication, please proceed as follows:
1. Set up a VPN dial-in account, for example with the LANconfig Setup Wizard.
1868
Reference Manual
19 More services
2. Activate XAUTH in the VPN client at the station which is to dial in. The user name and password are the same as
those stored on the RADIUS server.
1869
Reference Manual
19 More services
1. Activate the authentication of dial-in remote stations via the XAUTH protocol on an external RADIUS server. In
LANconfig, access the configuration area Communication and the RADIUS tab to activate the "Exclusive" operating
mode for the RADIUS server. With this setting, all incoming XAUTH requests are authenticated by the RADIUS server.
1. You should also specify the IP address, the port, and the key for the external RADIUS server.
2. Also set PPP operation to "Exclusive" so that incoming XAUTH requests are authenticated by the RADIUS server only.
19.11.6 Addition(s) to LCOS 8.80
LCS WPA passphrase in the RADIUS server's user table
As of LCOS version 8.80, of the RADIUS server's user table additionally contains the associated WPA passphrase of the
registered user. This enables a device which is connected to the LAN to operate as a central RADIUS server and use the
benefits of LEPS (LANCOM Enhanced Passphrase Security).
Configuration
The configuration of LEPS merely involves the assignment of an individual passphrase to the MAC address of each client
that is approved for the WLAN. To this end, the MAC filter is set to positive, i. e. the data from clients entered here will
be transmitted.
1870
Reference Manual
19 More services
5
The passphrases should consist of a random string at least 32 characters long.
The client-specific passphrase is stored in the RADIUS server's user table. This enables a device which is connected to
the LAN to operate as a central RADIUS server and use the benefits of LEPS.
Additions to the menu system
WPA passphrase
Here you can specify the WPA passphrase with which users can login to the WLAN.
5
The RADIUS server stores this passphrase in the user table. This enables a device which is connected to the LAN
to operate as a central RADIUS server and use the benefits of LEPS (LANCOM Enhanced Passphrase Security).
Telnet path:
Setup > RADIUS > Server > Users
Possible values:
8 to 63 characters
from ABCDEFGHIJKLMNOPQRSTUVWXYZ@{|}~!$%&'()+-,/:;<=>?[\]^_.0123456789
Default:
Blank
19.11.7 Addition(s) to LCOS 8.82
Input length for RADIUS forwarding destinations
As of LCOS version 8.82, realms can be up to 64 characters long, in order to use roaming providers with long realms.
Additions to the Setup menu
Realm
String with which the RADIUS server identifies the forwarding destination.
Telnet path:
Setup > RADIUS > Server > Forward-Server
Possible values:
Max. 64 characters
Default:
Blank
Backup
Alternative routing server that the RADIUS server forwards requests to when the first routing server is not reachable.
Telnet path:
Setup > RADIUS > Server > Forward-Server
1871
Reference Manual
19 More services
Possible values:
Max. 64 characters
Default:
Blank
Default realm
This realm is used if the supplied username uses an unknown realm that is not in the list of forwarding servers.
Telnet path:
Setup > RADIUS > Server
Possible values:
Max. 64 characters
Default:
Blank
Empty realm
This realm is used when the specified username does not contain a realm.
Telnet path:
Setup > RADIUS > Server
Possible values:
Max. 64 characters
Default:
Blank
Bandwidth allocation by RADIUS
As of LCOS version 8.82, the LANCOM RADIUS server can assign each registered client a bandwidth limitation regardless
of the interface used. Up until now, that was only possible for Public Spot scenarios if the Public Spot gateway and the
associated WLAN interface were both enabled on the same device.
1872
Reference Manual
19 More services
Extensions to the RADIUS server
RADIUS user
You can enter up to 64 users In the user database that the RADIUS server can authenticate without needing other
databases. This user table uses the RADIUS server for local requests, also for requests with usernames without a realm.
1
Name: Enter the name of the user
1
Please note that the username is case-sensitive: When enabled, the RADIUS server distinguishes between
uppercase and lowercase. "User12345" and "user12345" are therefore two different users.
1
Password: User password.
1
VLAN ID: ID of the logical subnet
1
Comment: Additional information about the user
1
Service type: The service type is a special attribute of the RADIUS protocol, which the NAS (Network Access Server)
transmits with the authentication request. The request will only receive a positive response if the requested service
type fits the service type of the user account. Possible values include:
2
Any: The service type can be any type.
2
Framed: For checking WLAN MAC addresses via RADIUS or IEEE 802.1x.
2
Login: For Public-Spot logins.
2
Authentication only: For RADIUS authentication of dialup peers via PPP.
5
Please note that, depending on the device, the number of entries can be limited with the service type Any
or Login. If your device, for example, is able to manage a total of 64 Public Spot users, the LANconfig
rejects them after 64. User account with the service type Any/Login requires the creation of additional
user accounts with these service types.
1
Protocol restriction: This option limits the selection of authentication methods allowed for the user. Possible values
include:
2
PAP
2
CHAP
2
MSCHAP
2
MSCHAPv2
2
EAP
1
Passphrase: Associated WPA passphrase of the registered user
1
TX bandwidth limit: Bandwidth limitation for sending data
1
RX bandwidth limit: Bandwidth limitation for receiving data
1873
Reference Manual
19 More services
5
The bandwidth limitation for sending and receiving applies regardless of the interface used (LAN and WLAN).
1
Calling station: This mask limits the validity of the entry to certain IDs transmitted by the calling station (WLAN
client). When authenticating via 802.1x the calling station's MAC address is transmitted in ASCII format (capital
letters only) with a hyphen separating pairs of characters (for example, "00-10-A4-23-19-C0").
1
Called station: This mask limits the validity of the entry to specified IDs as transmitted by the called station (BSSID
and SSID of the access point). When authenticating via 802.1x the called station's MAC address (BSSID) is transmitted
in ASCII format (capital letters only) with a hyphen separating pairs of characters. The SSID is appended using a
colon as a separator (e.g., "00-10-A4-23-19-C0:AP1").
1
Expiry type: This option specifies the type of the validity period of the user account. Possible values include:
2
Relative & absolute:
2
Relative
2
Absolute
2
Never
1
Relative expiry: Validity period in seconds from the initial successful login
1
Absolute expiry: Validity period in hours, minutes and seconds from a certain date
1
Multiple login: Activates the option for the client to register more than once
1
Maximum number: Maximum number of concurrent logins by the client
1
Time budget: Specifies the time in seconds available to the client.
1
Volume budget: Specifies the data volume available to the client.
Additions to the Status menu
Station table
This table contains the bandwidth allocations for the clients registered on the RADIUS server, regardless of the interface
that the clients are connected to.
Telnet path:
Status > LAN
Interface
Interface to which the client is connected.
MAC address
MAC address of the client
Tx limit
Bandwidth limitation for the reception of data.
Rx limit
Bandwidth limitation for sending data.
VLAN ID
VLAN ID of the network over which the client communicates.
1874
Reference Manual
19 More services
19.12 RADSEC
RADIUS has become established as the standard for server-based authentication, authorization and billing. RADIUS is
now being used for applications outside of its original design purpose, for example in combination with EAP/802.1x,
and a number of deficits have become apparent:
1
RADIUS operates via UDP and thus offers no native procedure for packet-loss detection. Although this is no problem
in a LAN environment, it is becoming increasingly important over WAN connections or on the Internet.
1
RADIUS is equipped only with simple procedures for authentication by means of a "shared secret" and a low level
of confidentiality.
RADSEC is an alternative protocol that transmits RADIUS packets through a TLS-encrypted tunnel. TLS is based on TCP,
thus providing a proven mechanism for monitoring packet loss. Furthermore, TLS is highly secure and it features a method
of mutual authentication by means of X.509 certificates.
19.12.1 Configuring RADSEC for the client
LANCOM as a RADIUS client
To function as a RADIUS client, a LANCOM is set up to use RADIUS via UDP or RADSEC via TCP with TLS. Additionally
the port to be used has to be set. 1812 for authentication with RADIUS, 1813 for billing with RADIUS and 2083 for
RADSEC.
These settings are made at all locations where a LANCOM is configured as a RADIUS client.
WEBconfig: Setup / WAN / RADIUS
WEBconfig: Setup / WLAN / RADIUS-access-check
WEBconfig: Setup / WLAN / RADIUS-accounting
WEBconfig: Setup / Public-spot-module / Provider-table
WEBconfig: Setup / IEEE802.1x / RADIUS-server
LANCOM as a RADIUS server
If a LANCOM operates as a RADIUS server, the RADSEC port for receiving logins can be set up. In addition to that, the
protocol to be used (RADIUS, RADSEC or all) can be set for each of the RADIUS clients in the client list. This allows,
for example, RADIUS to be used for LAN-based clients and the more robust RADSEC via TCP to be used for registrations
arriving over the Internet.
19.12.2 Certificates for RADSEC
Separate X.509 certificates are required for TLS encryption of the RADSEC connection. The individual certificates (root
certificate, devices certificate and private key) can be uploaded to the device individually or as a PKCS#12 container.
1875
Reference Manual
19 More services
WEBconfig: Upload certificate or file
19.13 Operating printers at the USB connector of the LANCOM
With the USB port of various LANCOM models, printers can be connected up and made available to the entire network.
The LANCOM provides a print server to manage the printing jobs from the network. Supported protocols are RawIP and
LPR/LPD.
5
Parallel print jobs arriving from different stations are saved on the respective computer. The print server in the
LANCOM processes the waiting jobs one after the other.
19.13.1 Configuring the printer server in the LANCOM
When configuring the USB port for the connection of a printer, the first thing is to define the ports which will receive
the print jobs as transported by the various protocols.
Printer table
The printer table contains the settings for the connected printer.
WEBconfig: Expert-Configuration / Setup / Printer / Printer
Normally there will be no need to adjust the printer settings. With the default settings, the print server works with RawIP
and LPR/LPD and reacts to the standard ports as suggested by Windows when the printer connection is being configured.
If printer operation does not work with these settings, the printing parameters can be adjusted.
1
Printer [Default: *]
Printer name.
1
RawIP-Port [Default: 9100]
This port can be used to accept print jobs over RawIP.
5
RawIP is used by Windows as standard and is recommended for operating printers at a USB port.
1
LDP-Port [Default: 515]
This port can be used to accept print jobs over LDP.
1876
Reference Manual
19 More services
5
The protocol and port options entered here must agree with the settings for the printer connection in the
corresponding computer's operating system.
1
Active [Default: No]
2
Yes: The print server is active.
2
No: The print server is not active.
1
Bidirectional [Default: No]
2
Yes: The LANCOM transmits the printer's status information at regular intervals to the connected computers.
2
No: The LANCOM does not transmit and status information.
Access list:
Up to 16 networks that have access to the configured printer can be entered into the access list.
LANconfig: Printer / General / Access list
WEBconfig: Expert-Configuration / Setup / Printer / Access-List
1
IP address
IP address of the network with clients requiring access to the printer.
1
Net mask
Netmask of the permitted networks.
5
If the access list is empty, any computer with any IP address can use the printer at the LANCOM's USB port.
5
For reasons of security, access from the WAN to the printer at the USB port of the LANCOM is not permitted.
19.13.2 Printer configuration at the computer
To use the printer at the USB port over the network, the printer drivers on the computers have to be connected with a
corresponding printer connection. The following is a description of the setup under Windows XP; the configuration under
Windows 2000 is similar. Controlling printers via TCP/IP ports with older version of Windows is rather unsatisfactory.
1. In the Control Panel, open the dialog for the configuration of a new printer and start the Wizard to add a new printer.
2. Select the option for a local printer and deactivate Plug&Play.
1877
Reference Manual
19 More services
1. Select the option to add a new printer port.
1. Enter the IP address of the LANCOM as the IP address of the printer port. The name for the printer port will
automatically be filled out with 'IP_<IP address of the LANCOM>'.
1. As the device type, select the option 'Standard' for a 'Generic Network Card'. If you wish to keep the standard settings
(recommended), press on Next to proceed to the next dialog.
1878
Reference Manual
19 More services
1. Alternatively, you can select 'Custom' and press on the Settings button to open an additional dialog. In this dialog,
you can select the protocol to be used for transmitting the print jobs to the printer at the USB port of the LANCOM
('Raw' for RawIP or 'LPR').. The port to be used can be entered here too (for RawIP only). For LPR, port '515' is always
used as standard.
5
The protocol and port options entered here must agree with the settings for the printer in the LANCOM
configuration.
5
The dialog for selecting the protocol and port can also be accesses via the Control Panel by opening the Printer
Properties and accessing the 'Ports' tab.
1. Once the settings have been made, the printer port is set up. The Wizard now goes on with the selection of the
printer driver.
5
Further information about the installation of a printer driver is available in the documentation for the printer.
1879
Reference Manual
19 More services
19.14 Addition(s) to LCOS 7.70
19.14.1 IGMP snooping
Introduction
All LANCOM devices with wireless LAN interfaces feature a "LAN bridge", a software entity for transferring data between
the Ethernet ports and the WLAN interface(s). In many ways the LAN bridge works like a switch. The core task of a switch,
as opposed to a hub, is to forward packets precisely to the port which the relevant user is connected to. Based on the
incoming data packets, the switch automatically creates a table listing the senders' MAC addresses and their ports.
If the table contains the destination address for an incoming packet, the switch forwards the packet to the corresponding
port. If the destination address is not in the table, the switch forwards the packet to all ports. This means that a switch
can only deliver a packet precisely if the destination address appeared earlier in a packet arriving at a certain port from
the sender's address. However, broadcast or multicast packets can never be entered as a sender address into a packet,
and so these packets end up being "flooded" to all ports.
This may be the correct action for broadcasts which are supposed to reach all available receivers, but this may not be
the case for multicasts. Multicasts are generally aimed at a certain group of receivers within a network, but not all of
them:
1
For example, video streams are frequently transmitted as multicasts, but not all of the network stations are intended
to receive that stream.
1
Various applications in the medical field rely on multicasts to send data to certain terminal devices, but this data
should not be available to all stations.
A LAN bridge in the LANCOM will have ports to which no multicast recipients are connected. This "unnecessary"
transmission of multicasts to ports without any receivers is not an error, but it can compromise overall performance.
1
Many stations are unable to reject the unwanted multicasts in their hardware. Instead, the packets are forwarded
to higher protocol layers, which leads to an increase in CPU load.
1
WLANs are particularly susceptible to bandwidth restrictions due to multicasts if none of the associated WLAN clients
want to receive the multicast.
The TCP/IP protocol suite defines a protocol called IGMP that allows network stations to register their desire to receive
certain IP multicasts to their router. Stations carry out a multicast registration with their router to subscribe to certain
multicast groups which deliver the relevant packets. IGMP makes use of Join messages and Leave messages to register
and de-register respectively.
5
Information about which multicast groups a station can or should join are available from other protocols than
IGMP.
As a layer-3 protocol, IGMP only performs multicast guiding/routing for whole IP subnets. However, network devices
such as bridges, switches or WLAN access points only forward the packets on layer 2, meaning that IGMP itself does
not help in any way to further guide multicast traffic through this substructure. For this reason, the bridges use the
multicast registrations between stations and routers to receive additional information for targeting the distribution of
multicasts. IP multicasts only need to be forwarded to an interface where a router is located that is capable of multicast
routing and therefore of forwarding multicasts to other IP subnets. This method is called IGMP snooping. The bridges,
which normally use the MAC on layer 2 for packet forwarding, thus additionally use the layer 3 information in the IP
multicast packets.
For more detailed description of the functions of IGMP snooping in LCOS, we have to differentiate between two important
terms:
1
A port is "member" of a multicast group if at least one station connected to it wishes to receive the packets for a
certain multicast address. Multicast registration can be dynamic via IGMP snooping or configured manually.
1880
Reference Manual
19 More services
1
A port is a "router port" if it is connected to a router that is capable of multicast routing and therefore of forwarding
multicasts to other IP subnets.
1
A multicast group is "unregistered" if none of the interfaces attached to the bridge is a member of this multicast
group.
IGMP snooping operation
Whenever a packet is received, the bridge initially determines whether it is a unicast, broadcast, or multicast packet. For
broadcast and unicast packets, the bridge operates in the usual way, i.e. it floods to all ports or sends to a specific port
based on the MAC table entry for the receiver.
Two types of IP multicast packet are differentiated (whereby packets which are truncated or contain an invalid checksum
are discarded entirely):
1
IGMP messages are handled in different ways depending on their content:
2
A Join message results in the incoming port becoming member of the respective multicast group. This message
is forwarded to router ports only.
2
Similarly, a Leave message results in the incoming port being removed from the multicast group’s member list.
This message is also forwarded to router ports only.
2
An incoming IGMP query results in the port being marked as a router port. These messages are flooded to all
interfaces.
2
All other messages are flooded to all interfaces—no ports experience a change of state.
2
If an IP multicast packet does not contain an IGMP message, the IP destination address is examined. Packets for
the destination address "224.0.0.x" are flooded to all ports because this is a "reserved" range. For all other
packets the destination address is looked up in the IGMP membership table:
2
If the address is found, the packet is forwarded according to the membership stored in the table.
2
If the address is not found, the packet may either be discarded, flooded to all ports, or forwarded exclusively to
all router ports (depending on the configuration).
In either case, packets are forwarded to all router ports.
IGMP snooping through multiple bridges
As described, IGMP snooping only forwards incoming Join or Leave messages via router ports. In a structure with multiple
bridges, initially none of the ports are router ports or members of a multicast group. If a station connected to the bridge
registers with a multicast group, the port automatically becomes a member of this group. However, none of the ports
are router ports at this phase, so the Join messages are not forwarded anywhere. Other bridges thus receive no information
about the port's membership with the multicast group.
PC
Join
Bridge 1
ACCESS POINT
Bridge 2
ACCESS POINT
M
Bridge 3
ACCESS POINT
M
PC
Data
Join
Data
1881
Reference Manual
19 More services
Consequently, bridges must have router ports in order for membership information to be propagated. Since the ports of
a bridge only become router ports in the case of IGMP queries, one of the multicast-capable routers in the network must
take over the task of distributing the necessary IGMP queries throughout the network. This router is referred to as the
IGMP querier. If the network does not contain a multicast router, the LANCOM access points are capable of simulating
a querier. To avoid parallel queries arriving from various queriers, a querier will deactivate itself if it discovers another
querier with a lower IP number. The distribution of IGMP information by the querier can be explained with the following
example:
1. The querier (Bridge 2 in this example) regularly sends out IGMP queries on all ports of bridge 2 (dotted lines). The
next bridge (Bridge 1) receives the query on a port which is then marked as a router port (R). PC 1 responds to this
query with a Join message for all multicast groups (light dashed lines) that it wishes to join. The port connecting
PC 1 to Bridge 2 then becomes a member of the multicasting group(s).
2. In addition to this, Bridge 1 sends the queries on all other ports to the bridges and stations lower down in the
structure. In Bridge 3 the port receiving the query becomes a router port (R).
3. The station (PC 2) connected to bridge 3 responds to this query with a Join message for all registered multicast
groups. The port connecting PC 2 to Bridge 3 then becomes a member of the multicasting group(s).
4. Bridge 3 forwards this Join message to Bridge 1 over the router port. The receiving port on Bridge 1 thus also takes
on membership of the multicast groups that PC 2 has registered for.
5. In the final step, Bridge 1 forwards the Join message from PC 2 via the router port to Bridge 2, where the receiving
port also takes on membership of PC 2's multicast groups.
PC 1
Join
Bridge 1
M
R M
Bridge 2
(Querier)
ACCESS POINT
M
M
Bridge 3
ACCESS POINT
R
M
PC 2
Query
Query
Query
Query
ACCESS POINT
Join
Join
Join
Data
Data
Data
Data
If PC 1 now transmits a multicast for which PC 2 has registered, all of the bridges (2, 1 and then 3) forward the packets
to PC 2 via the member port.
1882
Reference Manual
19 More services
Configuration
General settings
LANconfig: Interfaces / IGMP snooping
WEBconfig: LCOS menu tree / Setup / LAN bridge / IGMP snooping
1
Operating
Activates or deactivates IGMP snooping in the device and all of the defined querier instances. Without IGMP snooping
the bridge functions like a simple switch and forwards all multicasts to all ports.
Possible values:
2
Yes, No
Default:
2
No
5
If this function is deactivated, all IP multicast packets are sent on all ports. If the device operating state
changes, the IGMP snooping function is completely reset, i.e. all dynamically learned values are lost
(membership, router-port states).
1
Query interval
Interval in seconds in which a multicast-capable router (or a simulated querier) sends IGMP queries to the multicast
address 224.0.0.1, so prompting the stations to transmit return messages about multicast group memberships. These
regular queries influence the time in which memberships age, expire, and are then deleted.
2
After the startup phase, the querier sends IGMP queries in this interval.
2
A querier returns to the querier status after a time equal to
"Robustness*Query-Interval+(Query-Response-Interval/2)".
1883
Reference Manual
19 More services
2
A port loses its router-port status after a time equal to "Robustness*Query-Interval+(Query-Response-Interval/2)".
Possible values:
2
10-figure number greater than 0.
Default:
2
125
5
The query interval must be greater than the query response interval.
1
Query response interval
Interval in seconds influencing the timing between IGMP queries and router-port aging and/or memberships.
Interval in seconds in which a multicast-capable router (or a simulated querier) expects to receive responses to its
IGMP queries. These regular queries influence the time in which memberships age, expire, and are then deleted.
Possible values:
2
10-figure number greater than 0.
Default:
2
10
5
The query response interval must be less than the query interval.
1
Robustness
This value defined the robustness of the IGMP protocol. This option tolerates packet losses of IGMP queries with
respect to Join messages.
Possible values:
2
10-figure number greater than 0.
Default:
2
2
1
Advertise interval
The interval in seconds in which devices send packets advertising themselves as multicast routers. This information
makes it quicker for other IGMP-snooping devices to find which of their ports are to operate as router ports. When
activating its ports, a switch (for example) can query for multicast routers, and the router can respond to this query
with an advertisement of this type. Under some circumstances this method can be much quicker than the alternative
IGMP queries.
Possible values:
2
4 to 180 seconds.
Default:
2
20
1
Unregistered data packet handling
This setting defines the handling of multicast data packets with a destination address outside the 224.0.0.x range
and for which neither static memberships were defined nor were dynamic memberships learned.
Possible values:
2
Router ports only: Sends these packets to all router ports.
2
Flood: Sends these packets to all ports.
2
Discard: Drops these packets.
1884
Reference Manual
19 More services
Default:
2
Router ports only
Port settings
This table defines the port-related settings for IGMP snooping.
LANconfig: Interfaces / IGMP snooping / Port table
WEBconfig: LCOS menu tree / Setup / LAN bridge / IGMP snooping / Port settings
1
Port
The port for which the settings apply.
Possible values:
2
Selects a port from the list of those available in the device.
Default:
2
N/A
1
Router port
This option defines the port's behavior.
Possible values:
2
Yes: This port will always work as a router port, irrespective of IGMP queries or router messages received at this
port.
2
No: This port will never work as a router port, irrespective of IGMP queries or router messages received at this
port.
2
Auto: This port will work as a router port if IGMP queries or router messages are received. The port loses this
status if no packets are received for the duration of "Robustness*Query-Interval+(Query-Response-Interval/2)".
Default:
2
Auto
Static members
This table enables members to be defined manually, for example if they cannot or should not be learned automatically.
LANconfig: Interfaces / IGMP snooping / Static members
WEBconfig: LCOS menu tree / Setup / LAN bridge / IGMP snooping / Static members
1
Address
The IP address of the manually defined multicast group.
1885
Reference Manual
19 More services
Possible values:
2
Valid IP multicast address.
Default:
2
Blank
1
VLAN ID
The VLAN ID which is to support this static member. Each IP multicast address can have multiple entries with different
VLAN IDs.
Possible values:
2
0 to 4096.
Default:
2
0
Special values:
2
If "0" is selected as VLAN, the IGMP queries are sent without a VLAN tag. For this reason, this value only makes
sense when VLAN is deactivated in general.
1
Allow learning
This option activates the automatic learning of memberships in this multicast group. If automatic learning is
deactivated, packets can only be sent via the ports which have been manually defined for the multicast group.
Possible values:
2
Yes, No.
Default:
2
Yes
1
Static members
These ports will always be the destination for packets with the corresponding IP multicast address, irrespective of
any Join messages received.
Possible values:
2
Comma-separated list of the desired ports, max. 215 alphanumerical characters.
Default:
2
Blank
Simulated queriers
This table contains all of the simulated queriers defined in the device. These units are employed if IGMP functions are
required but there is no multicast router in the network. The querier can be limited to certain bridge groups or VLANs
by defining multiple independent queriers to support the corresponding VLAN IDs.
LANconfig: Interfaces / IGMP snooping / Simulated queriers
WEBconfig: LCOS menu tree / Setup / LAN bridge / IGMP snooping / Simulated queriers
1886
Reference Manual
19 More services
1
Name
Name of the querier instance
Possible values:
2
8 alphanumerical characters.
Default:
2
Blank
1
Operating
Activates or deactivates the querier instance
Possible values:
2
Yes, No.
Default:
2
No
1
Bridge group
Limits the querier instance to a certain bridge group.
Possible values:
2
Select from the list of available bridge groups.
Default:
2
none
Special values:
2
If bridge group is set to "none", the IGMP queries will the sent via all bridge groups.
1
VLAN ID
Limits the querier instance to a certain VLAN.
Possible values:
2
0 to 4096.
Default:
2
0
Special values:
2
If "0" is selected as VLAN, the IGMP queries are sent without a VLAN tag. For this reason, this value only makes
sense when VLAN is deactivated in general.
IGMP status
General statistics
Status messages for IGMP snooping are to be found under the following paths:
WEBconfig: LCOS menu tree / Status / LAN bridge statistics / IGMP snooping
1
Operating
Indicates whether IGMP snooping is activated or deactivated.
1
IPv4 packets
1887
Reference Manual
19 More services
Shows the number of IPv4 multicast packets received at all ports, whether they were IGMP packets or not.
1
Data packets
Shows the number of intact IPv4 multicast packets received at all ports and which were not IGMP packets.
1
Control packets
Shows the number of intact IGMP packets received at all ports.
1
Bad packets
Shows the number of damaged data or IGMP packets received at all ports. Possible causes for damage to packets
may be IP checksum errors or truncated packets.
5
For performance reasons, IP checksums are evaluated for IGMP packets only and not for the data portion of
multicast packets. This is why packets with a faulty checksum in the TCP/UDP or IP header are not detected.
These packets are counted as data packets.
1
Deleted values
This action deletes all statistical entries.
Port status
This table shows all port-related statistics.
WEBconfig: LCOS menu tree / Status / LAN bridge / IGMP snooping / Port status
1
Router port
Shows whether the port is currently in use as a router port or not, irrespective of whether this status was configured
statically or learned dynamically.
1
IPv4 packets
Shows the number of IPv4 multicast packets received at this port, whether they were IGMP packets or not.
1
Data packets
Shows the number of intact IPv4 multicast packets received at this port and which were not IGMP packets.
1
Control packets
Shows the number of intact IGMP packets received at this port.
1
Bad packets
Shows the number of damaged data or IGMP packets received at this port. Possible causes for damage to packets
may be IP checksum errors or truncated packets.
5
For performance reasons, IP checksums are evaluated for IGMP packets only and not for the data portion of
multicast packets. This is why packets with a faulty checksum in the TCP/UDP or IP header are not detected.
These packets are counted as data packets.
Groups
This table displays all the the multicast group memberships known to the device, irrespective of whether they were
configured statically or learned dynamically. If both static and dynamic memberships exist for a multicast group, these
are shown in separate entries.
WEBconfig: LCOS menu tree / Status / LAN bridge / IGMP snooping / Groups
1
Address
Shows the group's IP multicast address.
1
VLAN ID
Shows the VLAN ID that this entry applies to.
1888
Reference Manual
19 More services
1
Allow learning
Shows whether new memberships for this group can be learned dynamically or not.
1
Static members
Shows the list of statically defined members for this group.
1
Dynamic members
Shows the list of dynamically learned members for this group.
Simulated queriers
This table shows the status of all defined and active IGMP querier instances.
1
Name
Shows the name of the multicast group.
1
Bridge group
Shows the bridge group that this entry applies to.
1
VLAN ID
Shows the VLAN that this entry applies to.
1
Status
Shows the current status of the entry.
2
Initial: The querier instance has just started and is sending IGMP queries in short intervals (four-times faster than
the query interval defined).
2
Querier: The querier instance considers itself to be the active querier and is sending IGMP queries in the defined
query interval.
2
Non-Querier: Another querier instance with a lower IP address has been detected, and the instance listed here
is not sending any IGMP queries.
19.14.2 TACACS+
Introduction
Tacacs+ (Terminal Access Controller Access-Control System) is a protocol for authentication, authorization and accounting
(AAA). It thus provides access to the network for certain authorized users only, it regulates the rights of those users, and
it is a logging mechanism to keep track of user actions. TACACS+ is an alternative to other AAA protocols such as RADIUS.
5
TACACS+ must be used in order to meet with PCI compliance (Payment Card Industry).
Modern networks with their numerous types of service and network components present a massive challenge in terms
of controlling access rights for the user. In large installations in particular, the overhead would be enormous to keep
user data consistent on all devices or for all services. For this reason, user data should be managed on a central server.
As a simple example, a user wishes to register at a router and sends the corresponding login details (user ID) to it. In
this case the router functions as a Network Access Server (NAS): It does not check the user data itself; rather, the data
is forwarded to the central AAA server, which responds by checking the data and answering with an accept or a reject.
AAA-server
User ID
Accept
User ID
Accept
NAS
PC
The advanced TACACS+ functions include, among others, the option of requesting user to change their passwords after
logging in for the first time, or if the password has expired. The corresponding messages are sent from the NAS to the
user.
1889
Reference Manual
19 More services
5
Please note that LANconfig cannot process all of the messages in the extended login dialog. Should LANconfig
reject a login attempt at a LANCOM even if the correct data is entered, please use an alternative method of
configuration (such as WEBconfig or telnet).
TACACS+ is an alternative AAA server to the widespread RADIUS servers. The following table shows some of the major
differences between RADIUS and TACACS+:
RADIUSTACACS+
Connectionless data transfer via UDPConnection-orientated data transfer via TCP
Password only encrypted, other content remains unencryptedFully encrypted data transfer
Authentication and authorization combinedComplete separation of authentication, authorization and
accounting possible
1
TCP-based communication with TACACS+ is more reliable than RADIUS. Communications between the NAS and AAA
server are confirmed, so the NAS is always informed if the AAA server is unavailable.
1
TACACS+ encrypts not only the password like RADIUS but the entire payload data (except for the TACACS+ header).
This assures the confidentiality of information such as user names or the permitted services. TACACS+ encryption
works with a one-time pad based on MD5 hashes.
1
The separation of the three AAA functions enables TACACS+ to operate with multiple servers. Whereas RADIUS
always combines authentication and authorization, TACACS+ allows these to be separated. In this way, for example,
TACACS+ servers can be employed for authentication only, in that only the users are managed but not the permissible
commands.
5
Please note: Even though TACACS+ is used to centrally manage user accounts on an AAA server, you should
ensure that you set a secure password for root access to the LANCOM. If no root password is set, access to the
device configuration can be blocked for security reasons if no connection is available to the TACACS+ server. In
this case, the device may have to be reset to its factory settings in order to regain access to the configuration.
Configuring the TACACS+ parameters
The parameters for configuring TACACS+ are to be found under the following paths:
WEBconfig: LCOS menu tree / Setup / TACACS+
1
Accounting
Activates accounting via TACACS+ server. If TACACS+ accounting is activated, all accounting data is transmitted via
TACACS+ protocol to the configured TACACS+ server.
Possible values:
2
Activated, deactivated
Default
2
Deactivated
5
TACACS+ accounting will only activate if the defined TACACS+ server is available.
1
Authentication
Activates authentication via TACACS+ server. If TACACS+ authentication is activated, all authentication data is
transmitted via TACACS+ protocol to the configured TACACS+ server.
Possible values:
2
Activated, deactivated
Default
1890
Reference Manual
19 More services
2
Deactivated
5
TACACS+ authentication will only activate if the defined TACACS+ server is available. Fallback to local users
is only possible if a root password has been set for the LANCOM. The fallback to local users must be deactivated
for devices without a root password. Otherwise a failure of the network connection (TACACS+ server
unavailable) would make the LANCOM accessible without a password.
1
Authorization
Activates authorization via TACACS+ server. If TACACS+ authorization is activated, all authorization data is transmitted
via TACACS+ protocol to the configured TACACS+ server.
Possible values:
2
Activated, deactivated
Default
2
Deactivated
5
TACACS+ authorization will only activate if the defined TACACS+ server is available. If TACACS+ authorization
is activated, the TACACS+ server will be queried for authorization each time a user enters a command. Data
traffic during configuration will increase correspondingly. Also, the user rights must be defined in the TACACS+
server.
1
Fallback to local users
Should the defined TACACS+ server be unavailable, it is possible to fallback to local user accounts on the LANCOM.
This allows for access to the device even if the TACACS+ connection should fail, e.g. when deactivating the usage
of TACACS+ or for correcting the configuration.
Possible values:
2
Allowed, prohibited
Default
2
Allowed
5
The fallback to local user accounts presents a security risk if no root password is set for the LANCOM. For
this reason, TACACS+ authentication with fallback to local user accounts can only be activated if a root
password has been set. If no root password is set, access to the device configuration can be blocked for
security reasons if no connection is available to the TACACS+ server. In this case, the device may have to be
reset to its factory settings in order to regain access to the configuration.
1
Shared secret
The password for encrypting the communications between NAS and TACACS+ servers.
Possible values:
2
31 alphanumerical characters
Default
2
Blank
5
The password must be entered identically into the LANCOM and the TACACS+ server. We recommend that
you do not operate TACACS+ without encryption.
1
SNMP-GET requests accounting
Numerous network management tools use SNMP for requesting information from network devices. LANmonitor also
uses SNMP to access the LANCOM devices to display information about current connections, etc., or to execute
actions such as disconnecting a connection. SNMP can be used to configure devices. For this reason TACACS+ requires
authentication for SNMP access requests. Since LANmonitor regularly queries these values, a large number of
1891
Reference Manual
19 More services
unnecessary TACACS+ connections would be established. If authentication, authorization and accounting by TACACS+
are activated, then each request would initiate three sessions with the TACACS+ server.
This parameter allows the regulation of the behavior of LANCOM devices with regard to SNMP access in order to
reduce the number of TACACS+ sessions required for accounting. Authentication via the TACACS+ server remains
necessary if authentication for TACACS+ is activated generally.
5
Entering a read-only community under LCOS menu tree / Setup / SNMP enables authentication by TACACS+
to be deactivated for LANmonitor. The read-only community defined here is then entered into LANmonitor
as a user name.
Possible values:
2
only_for_SETUP_tree: With this setting, accounting via TACACS+ server is only required for SNMP access via the
setup branch of LCOS.
2
All: With this setting, accounting by TACACS+ server will be carried out for every SNMP access. In case of regular
request for status information, for example, the load on the TACACS+ server will increase significantly.
2
None: With this setting, accounting by TACACS+ server will not be carried out for SNMP accesses.
Default:
2
only_for_SETUP_tree
1
SNMP-GET requests authorization
This parameter allows the regulation of the behavior of LANCOM devices with regard to SNMP access in order to
reduce the number of TACACS+ sessions required for authorization. Authentication via the TACACS+ server remains
necessary if authentication for TACACS+ is activated generally.
Possible values:
2
only_for_SETUP_tree: With this setting, authorization via TACACS+ server is only required for SNMP access via
the setup branch of LCOS.
2
All: With this setting, authorization by TACACS+ server will be carried out for every SNMP access. In case of
regular request for status information, for example, the load on the TACACS+ server will increase significantly.
2
None: With this setting, authorization by TACACS+ server will not be carried out for SNMP accesses.
Default:
2
only_for_SETUP_tree
1
Encryption
Activates or deactivates the encryption of communications between NAS and TACACS+ servers.
Possible values:
2
Activated, deactivated
Default
2
Activated
5
We recommend that you do not operate TACACS+ without encryption. If encryption is activated here, the
password for encryption entered here must match with the password on the TACACS+ server.
Configuring the TACACS+ server
Two servers can be defined to work with TACACS+ functions. One server acts as a backup in case the other one fails.
When logging in via telnet or WEBconfig, the user can select the server to be used.
The parameters for configuring the TACACS+ server are to be found under the following paths:
WEBconfig: LCOS menu tree / Setup / TACACS+ / Server
1892
Reference Manual
19 More services
1
Server address
Address of the TACACS+ server to which requests for authentication, authorization and accounting are to be forwarded.
Possible values:
2
Valid DNS resolvable name or valid IP address.
Default
2
Blank
1
Loopback address
Optionally you can configure a loopback address here.
2
Possible values:
2
Name of the IP networks whose addresses are to be used
2
"INT" for the address of the first intranet.
2
"DMZ" for the address of the first DMZ.
2
LB0 to LBF for the 16 loopback addresses
2
Any valid IP address
Default
2
Blank
1
Compatibility mode
TACACS+ servers are available as open-source or commercial versions, each of which works with different messages.
The compatibility mode enables the processing of messages from free TACACS+ servers.
Possible values:
2
Activated, deactivated
Default
2
Deactivated
Login to the TACACS+ server
Once TACACS+ has been activated for authentication and/or authorization, all logins to the device are redirected to the
TACACS+ server. The remaining login procedure differs according to the access method.
TACACS+ login via LANconfig
Using LANconfig to login to a device with activated TACACS+ authentication is only possible with the user named "root".
Correspondingly, the user "root" must be configured on the TACACS+ server. To login via LANconfig, enter the password
as configured for the user "root" on the TACACS+ server.
5
Once authenticated by TACACS+, "root" is the only user automatically assigned with full supervisor rights, and
thus able to edit the configuration without having to change privilege level. When authorization is in use, the
TACACS+ server decides whether this is allowed or not.
1893
Reference Manual
19 More services
5
If authorization is activated for the device as well as authentication, the TACACS+ server must permit the
commands "readconfig" and "writeconfig" for the user "root" in order for the user to read the configuration
from the device and to upload any changes.
TACACS+ login via WEBconfig
Using WEBconfig to login to a device with activated TACACS+ authentication is possible for any user configured on the
TACACS+ server. When logging in with WEBconfig, enter the user name configured on the TACACS+ server and select
the server which is to carry out authentication.
The corresponding password is requested in the following dialog. After logging in, the user initially sees a reduced
WEBconfig user interface. If authorization is not being used, all WEBconfig users (except for the user "root") initially
have read rights only.
1894
Reference Manual
19 More services
To gain further rights, click on the link Change privilege level on the left of the screen.
In this dialog you select the required user rights and enter the corresponding password.
5
The passwords for individual user rights are configured as "enable" passwords in the TACACS+ server.
5
If authorization is activated for the device as well as authentication, the TACACS+ server must permit the required
commands for each user in order for the user to read and edit the device configuration.
TACACS+ login with telnet or SSH
Using tenet or SSH to login to a device with activated TACACS+ authentication is possible for any user configured on
the TACACS+ server.
When logging in with telnet, enter the user name configured on the TACACS+ server and select the server which is to
carry out authentication. When logging in with SSH, enter the user name followed by a colon and then the server name,
i.e. "user:1" or "user:2".
After login, all users initially have read-rights only (except for the user "root").
1895
Reference Manual
19 More services
To gain further rights, enter the command enable and enter the password. Rights will be assigned according to
configuration for that password. The parameters for the enable command are the numbers 1-15. 1 is the lowest level,
15 the highest. If no parameter is entered, 15 is taken automatically.
5
The passwords for individual user rights are configured as "enable" passwords in the TACACS+ server.
5
If authorization is activated for the device as well as authentication, the TACACS+ server must permit the required
commands for each user in order for the user to read and edit the device configuration.
Assigning rights under TACACS+
TACACS+ uses privilege levels to separate users into different groups. For the local authorization of users via the "enable"
command under telnet/SSH or via privilege levels under WEBconfig, the various administrator rights of LCOS are mapped
to the TACACS+ privilege levels:
LCOS administrator rightsTACACS+ level
No rights0
Read only1
Read-write3
Read-only limited admin5
Read-write limited admin7
Read-only admin9
Read-write admin11
Supervisor (root)15
Authorizing functions
If authorization is activated for the device as well as authentication, the TACACS+ server must permit the corresponding
functions for the user. Enter the required values into the user configuration on the TACACS+ server.
LANconfig
RemarkArgumentsCommand
Read out the entire configurationnonereadconfig
Write the entire configurationnonewriteconfig
WEBconfig
RemarkArgumentsCommand
Delete rowSNMP-ID of the tabledelRow
Add rowSNMP-ID of the tableaddRow
Edit rowSNMP-ID of the tableeditRow
Edit a menu itemSNMP-ID of the menu itemmodifyItem
View tableSNMP-ID of the tableviewTable
View rowSNMP-ID of the rowviewRow
Set value of a menu itemSNMP-ID of the menu itemsetValue
List sub menuSNMP-ID of the menulistmenu
Execute an actionSNMP-ID of the actionaction
1896
Reference Manual
19 More services
RemarkArgumentsCommand
Restart devicenonereboot
Display a certain URLnone$URL
5
When working with WEBconfig, all URLs sent to the TACACS+ server during configuration must be enabled. For
example, the URL "config2" under WEBconfig provides access to the configuration branch of the LCOS menu
tree. Additionally, the individual parameters which the user may edit must also be enabled. You can view the
URLs sent by WEBconfig to the TACACS+ server with the trace "trace+ tacacs".
Telnet/SSH
RemarkArgumentsCommand
View directory contentSNMP-ID of the directorydir
View directory contentSNMP-ID of the directorylist
View directory contentSNMP-ID of the directoryls
View directory contentSNMP-ID of the directoryllong
Delete rowSNMP-ID of the tabledel
Delete rowSNMP-ID of the tabledelete
Delete rowSNMP-ID of the tablerm
Change directorySNMP-ID of the target directorycd
Add rowSNMP-ID of the tableadd
Changes the order of the columns for adding
values
SNMP-ID of the tabletab
Execute actionSNMP-ID of the actiondo
View informationParameter nameshow
Execute traceParameter nametrace
TimeParameter nametime
Add functionParameter namefeature
Repeat the commandParameter namerepeat
Read-out SNMP-MIBnonereadmib
Read out the entire configurationnonereadconfig
Read-out status menunonereadstatus
Update firmwarenonewritefiash
Activate another firmware imageParameter nameactivateimage
Start pingParameter nameping
Sends wakeup packetParameter namewakeup
WLAN link testParameter namelinktest
Write the entire configurationnonewriteconfig
Start LL2M detectionnonell2mdetect
Execute LL2M commandParameter namell2mexec
Secure copyParameter namescp
Secure copyParameter namercp
1897
Reference Manual
19 More services
RemarkArgumentsCommand
Read-out scriptParameter namereadscript
Start scriptnonebeginscript
Stop scriptnoneendscript
Activate/deactivate flash modeParameter nameflash
5
For telnet access, all of the parameters that the user may edit must be enabled. You can view the values sent by
telnet to the TACACS+ server with the trace "trace+ tacacs".
SNMP
RemarkArgumentsCommand
Read-out valueSNMP-ID of the menu itemget
Set valueSNMP-ID of the menu itemset
Addition(s) to LCOS 7.80
Bypassing TACACS+
Introduction
TACACS+ enables every change to a network-device configuration to be subject to special authorization. TACACS+
accounting enables each of these steps to be logged. TACACS+ is a requirement for systems used in electronic payment
(PCI compliance).
Strict monitoring of this type leads to an increase in traffic to and from the TACACS+ server(s). In large-scale scenarios,
the TACACS+ communications caused when using scripts for centralized configuration changes or if CRON commands
are run regularly could lead to an overload of the TACACS+ server.
Configuration
To avoid overloading the TACACS+ server when carrying out automatic configuration changes, it is possible to exclude
CRON, action tables and scripts from the authorization and accounting by TACACS+.
WEBconfig: LCOS menu tree / Setup / TACACS+
1
Bypass-Tacacs-for-CRON/scripts/action-table
You can activate or deactivate the bypassing of TACACS+ authorization and TACACS+ accounting for various actions.
Possible values:
2
Activated, deactivated.
Default:
2
Disabled.
5
Please observe that this option influences the TACACS+ function for the entire system. Be sure that you
restrict the use of CRON, the action tables, and scripts only to an absolutely trustworthy circle of administrators!
1898
Reference Manual
19 More services
Addition(s) to LCOS 9.10
TACACS+ extension for the passwd command
As of LCOS version 9.10, a user password can additionally be changed using the console command passwd even with
TACACS+ authentication enabled.
Table 30: Overview of all commands available at the command line
DescriptionCommand
Changes the password of the current user account.
In order to change the password without a subsequent input prompt, use the option
switch -n while entering the new and old password.
setpass|passwd [-u
<User>][-n <new> <old>]
In order to change the password of the local user account when authentication by
TACACS+ is enabled, use the option switch -u with the name of the corresponding
user. If the local user does not exist or the user name is missing, the command
aborts. The user must also have supervisor rights, or authorization by TACACS must
be enabled.
19.15 Addition(s) to LCOS 8.00
19.15.1 Basic HTTP file server for LCOS 8.0
Introduction
The HTTP server integrated into the LCOS uses the HTTP protocol to connect to an external storage medium, so providing
a basic data server.
This function is supported by all LANCOM devices with a USB connector.
Praparing the USB storage medium
The following describes how to set up a USB medium for operating with a LANCOM device:
1
File system: Format the USB medium with the FAT16 or FAT32 file system.
1
Base directory: Create the directory public_html on the USB medium. The LCOS HTTP server only accesses the
files and subdirectories in this directory. All other files on the USB medium are ignored.
1
USB connection: Connect the mass storage device to the USB connector on the LANCOM.
Determine the mount point of the USB medium in the LCOS
When a USB medium is connected to a LANCOM device, a mount point is created automatically for the LCOS's internal
management of the medium. This mount point always remains the same for a certain USB medium, even after rebooting
or restarting. Different media are each allocated their own unique mount point.
The mount point must be known in order to access the files on the USB medium. The mount points for USB media are
shown in the status table:
1899
Reference Manual
19 More services
1
WEBconfig: LCOS menu tree / Setup / File system / Volumes
The status table displays all of the volumes discovered by the device.
1
MiniFs is the flash file system integrated into most devices.
1
BlkDev-n are descriptors for the known USB media. If there is just one USB mass storage device connected, it is
named BlkDev-1 and is mounted under /usb.
Accessing the files on a USB medium
Use the following URL to access the files on the USB medium by using the HTTP server in the LCOS:
1
http://<IP address of device>/filesrv/<mount point>/<file name>
If, for example, the file is named coupon.jpeg and it is stored in the base directory \public_html of the
only USB medium, then you can access it with the following link:
http://<IP address of device>/filesrv/usb/coupon.jpeg
5
Files can be accessed with HTTPS as well as HTTP.
Supported content type
The HTTP server in the LCOS uses the file extension to determine the MIME content type required to display the content
correctly in a browser. The following extensions are currently recognized and will be translated into the correct MIME
content type:
1
.htm and .html for HTML files
2
.gif, .jpg, .jpeg, .png, .bmp, .pcx for images in the corresponding format
2
.ico for icon files
2
.pdf for Adobe Acrobat PDF files
2
.css for cascading style sheet files
Directory structure
The directory public_html can contain sub-directories. The LCOS HTTP server observes certain rules for accessing
the directories:
1
If a file named ‘index.html’ exists in the sub-directory, then this is sent to the HTTP client, or else:
1
If a file named ‘index.htm’ exists in the sub-directory, then this is sent to the HTTP client, or else:
1
The file server simply displays a list of the files and sub-directories in the main directory.
19.15.2 SSH client
Introduction
In addition to an SSL server for the secure and authenticated dialing-in to LANCOM devices, LCOS also features an SSH
client. This SSH client enables SSH connections to be established from a LANCOM device to a remote server, such as
another LANCOM device or a Unix server. This function is highly useful if it is impossible to connect directly to a remote
device, but by using an indirect connection via the LANCOM device that can be accessed from both subnets instead.
1900
Reference Manual
19 More services
The SSH client can be started with simple commands at the command line interface, similar to the OpenSSH client on a
Linux or Unix system.
CLI arguments for the SSH client
The SSH connection to a remote system is initiated with the following command:
1
ssh [-?] [-h] [-b loopback-address] [-p port] [-C] [-j interval]
[user@]host [command]
2
-?, -h: Display a brief help text about the available arguments
2
-b: Specifies the loopback address to be used. This option is important in the context of ARF.
2
-p: Specifies the port to be used. If the port is not specified here, the default is TCP port 22.
2
command: The SSH client either starts an interactive shell on the remote system or it can execute a single
command. If no command is entered, the interactive shell starts.
2
user: User name for logging in to the remote system. If you do not explicitly enter a user name here, then the
user name for your current local session is used for logging in at the LCOS CLI.
2
-C: If this option is specified, the SSH client uses the zlib algorithm to attempt to negotiate a method for data
compression with the remote system. If the remote system does not support compression, then the data is
transmitted uncompressed. The use of compression is generally worthwhile only for slow connections (e.g. ISDN).
With fast connections, the performance loss from the additional overhead due to compression tends to be greater
than the gain from reduced data amounts.
2
-j interval: If the connection to the remote system is routed via a NAT router or a firewall, it may be
worthwhile to leave the connection running permanently. With an interactive SSH session, data is not transferred
at all at certain phases, which can lead to disconnection because of timeouts. In such cases the SSH client can
regularly transmit keep-alive packets. These are irrelevant to the remote station, but they inform the gateway
that the connection is still being used. This argument specifies the interval in seconds for transmitting keep-alive
packets. The keep-alive packets are only transmitted when the SSH client is not sending other data to the remote
system.
Public keys for authentication
Authentication with SSH works with public keys sent from the remote system. If an SSH client needs to connect to an
SSH server, the server sends the public key to the client, which then looks for that key in its files. The following situations
can occur here:
1
The SSH client finds the key in its list of known server keys, and the key is allocated to the corresponding host name
or IP address. The SSH connection can be established without further activity from the user.
1
The SSH client does not find the key in its list of known server keys, and also no other key of the same type (RSA or
DSS) for the corresponding host name or IP address. The SSH client assumes that this is the first connection to the
server. It shows its public key and the associated fingerprint. The user can verify the key using a copy from another
source, and can then decide whether the server should be stored in the list of known SSH servers. If the user declines
this verification, the SSH connection is broken immediately.
1
The SSH client finds a key for the corresponding host name or IP address, but this is different from the key currently
in use. Both keys are displayed, but the SSH connection will be terminated because the SSH client suspects a
man-in-the-middle attack. If the public key on the remote system was recently changed, then the administrator has
to delete the outdated entry from the list of known servers.
After successfully verifying the server key, the administrator can enter the password for accessing the remote system.
The password cannot be entered directly at the command line.
SSH connections are usually closed at the server, e.g. by entering "Exit" in the shell. Sometimes it may be necessary to
close the SSH connection with the client, e.g. if the application on the server has problems. The SSH client in the LCOS
uses the same character string as OpenSSH to close the connection, i.e. tilde - dot.
5
If the LCOS CLI session itself was opened with an OpenSSH client, you must use the string tilde – tilde – dot;
otherwise the wrong connection will be closed.
1901
Reference Manual
19 More services
Creating SSH keys
SSH authentication works with two different procedures:
1
Interactive with password entry by keyboard
1
By exchanging public keys
Keys have to be created for each individual as there are no predefined standard keys. For this reason, LANCOM devices
with their factory settings only support authentication by password.
Keys are generated by entering the command sshkeygen at the command line on the device that the administrator
want to run the SSH client on. The following syntax applies:
1
sshkeygen [-?] [-h] [-t dsa|rsa] [-b bits] [-f output-file]
2
-?, -h: Display a brief help text about the available arguments
2
-t: This argument sets the key type.
SSH supports two types of key:
RSA keys are most widely used and have a length between 512 and 16384 bits. If possible you should work with
keys of 1024 to 2048 bits in length.
DSS keys follow the standard set down by the National Institute of Standards and Technology (NIST) and are typically
used in environments which are required to comply with the Federal Information Processing Standard (FIPS). DSS
keys are always 1024 bits long, but they are slower to process than a corresponding RSA key.
An RSA type key will be generated if no key type is specified.
2
-b: This argument sets the length of the RSA key in bits.
If no length is specified, the default value is 1024 bits.
2
-f: Name for the output file of the key.
After generating the key, the public part must be transmitted to the remote system. The public part of the key can
be displayed with the following command:
1
show ssh idkeys
This command generates output similar to the following:
Configured Client-Side SSH Host Keys For User 'root':
ssh-rsa AAAAB3NzaC1yc2EAAAABEQAAAQEA2
8BtnFFInAi8I5B1aOwq5g2YfwIX2O/vMX+9SLZ
AJVAhFnhdOG4wjTpLVuaQRNlITpBESPaWPLqoA
...
wd0T0nkuNQ== root@sshctest
Even though the output is divided into a number of lines, it is a single key consisting of three parts:
1
The first part shows the key type (ssh-rsa or ssh-dss).
1
The second part is the binary output of the key itself, coded as Base64.
1
The third part contains the host name and is intended for entering comments.
This file can be edited with a convenient function in WEBconfig (WEBconfig / Extras / Edit list of allowed SSH public keys).
Copy the first and second parts and replace the third part with a list of users to limit the use of this key to a selection of
LCOS administrators.
Editing the files
During operations, the SSH client uses various files which may require manual editing.
1902
Reference Manual
19 More services
The list of known SSH servers
The SSH client uses the list of known SSH servers to store the corresponding key. This file is changed each time a connection
is established to an SSH server for the first time and the administrator accepts the key displayed for the remote system.
Each key is stored to a line in this file and contains three fields:
1
The name or IP address of the remote system as entered into the SSH command when establishing the connection.
1
The key type, i.e. ssh-rsa or ssh-dss.
1
The binary output of the key itself, coded as Base64.
5
Once an administrator has accepted the public key of an SSH server, this key applies to all LCOS administrators;
there is no differentiation at user level.
The files ssh_id_rsa and ssh_id_dsa
These files contain the keys generated with the sshkeygen command, i.e. the keys for authenticating the remote
SSH server in PEM format. The keys for all LCOS administrators are stored in a central file. This is accessible to root
administrators only, although not for the uploading or downloading of files or certificates.
The ID files have the following structure, which defines the use of a key for a certain LCOS administrator:
*** User xyz
Key
*** End
Priorities for SSH authentication
SSH authentication follows a strict order of priorities:
1
The first method always attempts to authenticate by means of public key, unless the remote system does not support
this method or the current LCOS administrator does not possess a public key.
1
The second method is the interactive authentication by keyboard where public-key authentication is unavailable or
when the remote system has rejected the public key of the current LCOS administrator. Depending on the application,
interactive authentication may consist of exchanging a number of messages between the SSH client and SSH server.
In the simplest case, the password just has to be entered one time.
Rights for operating the SSH client
Rights to work with the SSH client can be allocated on an individual basis to each administrator of LANCOM devices.
The rights for the administrators are to be found in the following menu:
1
LANconfig: Management / Admin / Additional administrators
1903
Reference Manual
19 More services
1
WEBconfig: LCOS menu tree / Setup / Config / Admins
19.15.3 LANCOM Content Filter
Introduction
The LANCOM Content Filter enables you to filter certain content from your network, so preventing access to Internet
pages with content that is illegal or offensive. It also enables you to stop private surfing on specific sites during working
hours. This not only increases staff productivity and network security but also ensures that the full bandwidth is available
exclusively for your business activities.
The LANCOM Content Filter is an intelligent content filter that works dynamically. It contacts a rating server that evaluates
Internet sites reliably and accurately in accordance with the categories that you select.
The LANCOM Content Filter operates by checking the IP addresses behind the URLs that are entered. For any given
domain it is possible to differentiate according to the path, meaning that specific areas of a URL may be rated differently.
5
It is not possible for users to avoid the LANCOM Content Filter website rating simply by entering the website's
IP address into their browsers. The LANCOM Content Filter checks only unencrypted websites via HTTP.
The LANCOM Content Filter license you purchase is valid for a certain number of users and for a specific period (for one
or three years). You will be informed of the expiry of your license in good time. The number of current users is monitored
in the device, with the users being identified by their IP address. You can configure what should happen when the number
of licensed users is exceeded: Access can either be denied or an unchecked connection can be made.
5
Your can test the LANCOM Content Filter on all router modells, which generally support this function, by activating
a demo license that is valid for 30-days. Demo licenses are generated directly with LANconfig. Click on the device
with the right-hand mouse key and select the context menu entry Activate software option. In the dialog that
1904
Reference Manual
19 More services
follows, click on the button Demo license. You will automatically be connected to the website for the LANCOM
registration server. Simply select the required demo license and you can register your device.
All settings relating to categories are stored in category profiles. You select from predefined main and sub-categories in
the LANCOM Content Filter: 58 categories are divided into 14 subject groups such as “Pornography, Nudity", "Shopping"
or "Illegal Activities". You can activate or deactivate each of the categories in these groups. Sub-categories for
“Pornography/Nudity” are, for example, “Pornography/Erotic/Sex” and “Swimwear/Lingerie”.
When configuring these categories, administrators have an additional option of activating an override. When the override
option is active, users may still access the forbidden site for a particular period of time by clicking on a corresponding
button, but the administrator will be notified of this by e-mail, syslog, or SNMP trap.
The category profile, whitelist and blacklist can be used to create a content filter profile that you can assign to particular
users by means of the firewall. For example you can create a profile called “Employees_department_A” and assign this
to all of the computers in that department.
When you install the LANCOM Content Filter, basic default settings are created automatically. These only need to be
activated for the initial start. You can subsequently customize the behavior of the LANCOM Content Filter to match your
own requirements.
Requirements for using the LANCOM Content Filter
The following requirements must be met before you can use the LANCOM Content Filter:
1. The LANCOM Content Filter option has been activated.
2. The firewall must be activated and an appropriate firewall rule must select the content filter profile.
3. The content filter profile must specify a category profile and if desired a whitelist and or blacklist for each part of
the day. A content filter profile can consist of several different entries to provide different levels of protection during
different parts of the day.
1
If a certain part of the day is not covered by an entry, access to websites will go unchecked for this period.
5
If the content filter profile is subsequently renamed, the firewall must also be modified.
1905
Reference Manual
19 More services
Quick start
After installing the LANCOM Content Filter, all the settings have been made to get it up and running quickly.
5
The operation of the LANCOM Content Filter may be restricted by your country's data protection regulations or
by company guidelines. Please check any regulations that may apply before putting the system into operation.
You activate the LANCOM Content Filter by:
1. Start the Setup Wizard for the device.
2. Select the Setup Wizard for configuring the Content Filter.
1. Select one of the pre-defined security profiles (basic, work, parental control):
1
Basic profile: This profile mainly blocks access to the categories pornography, illegal, violent or discriminatory
content, drugs, SPAM and phishing
1
Work profile: In addition to the settings for the basic profile, this profile also blocks the categories shopping, job
search, gaming, music, radio and certain communications services such as chat.
1
Parental-control profile: In addition to the settings for the basic profile, this profile also blocks nudity and
weapons/military.
Should the firewall be deactivated, the Wizard will switch the firewall on. The Wizard then checks if the firewall rule
is set correctly for the content filter and, if necessary, will take corrective measures. After activating the Content Filter
with the steps outlined above, all stations in the network are being filtered according to the settings of the selected
content-filter profile and the as-yet empty blacklist and whitelist. You can adapt these settings for your purposes, if
necessary.
5
Detailed information about manually configuring the content filter is available in the content filter manual
available as a PDF on the CD or as a download from www.lancom.eu.
Standard settings in the LANCOM Content Filter
The following elements have been created in the default configuration of the LANCOM Content Filter:
1
A firewall rule
1
Three firewall action objects
1
Three content filter profiles
1
Two timeframes
1
A blacklist
1
A whitelist
1
Three category profiles
1906
Reference Manual
19 More services
Firewall rule
The preset firewall rule is named CONTENT-FILTER and uses the action object CONTENT-FILTER-BASIC.
5
The firewall rule is not created automatically if the LANCOM Content Filter is installed on a device that has been
configured already. The rule must be added manually. This firewall rule must include one of the action objects
that are pre-defined for the Content Filter.
Firewall action objects
There are three firewall action objects: CONTENT-FILTER-BASIC, CONTENT-FILTER-WORK and
CONTENT-FILTER-PARENTAL-CONTROL. These action objects work with the corresponding content-filter profiles.
Content filter profiles
There are three content filter profiles. All content-filter profiles use the timeframe ALWAYS, the blacklist MY-BLACKLIST
and the whitelist MY-WHITELIST. Each content-filter profile uses one of the predefined category profiles:
1
CF-BASIC-PROFILE: This content-filter profile features a low level of restrictions and works with the category profile
BASIC-CATEGORIES.
1
CF-PARENTAL-CONTROL-PROFILE: This content-filter profile protects minors (e.g. trainees) from unsuitable Internet
content, and it works with the category profile PARENTAL-CONTROL.
1
CF-WORK-PROFILE: This content-filter profile is intended for companies wishing to place restrictions on categories
such as Job Search or Chat. It works with the category profile WORK-CATEGORIES.
Timeframe
There are two predefined timeframes:
1
ALWAYS: 00.00-23.59 hrs
1
NEVER: 00.00-0.00 hrs
Blacklist
The preset blacklist is named "MY-BLACKLIST" and it is empty. Here you can optionally enter URLs which are to be
forbidden.
Whitelist
The preset whitelist is named "MY-WHITELIST" and it is empty. Here you can optionally enter URLs which are to be
allowed.
Category profiles
There are three category profiles: BASIC-CATEGORIES, WORK-CATEGORIES and PARENTAL-CONTROL. The category profile
specifies the categories which are to be allowed and forbidden, and for which one an override can be activated.
1907
Reference Manual
19 More services
General settings
Global settings for the LANCOM Content Filter are made here:
LANconfig: Content-Filter / General
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Global-Settings
1
Operating
This is where you can activate the LANCOM Content Filter.
1
Action-on-Error:
This is where you can determine what should happen when an error occurs. For example, if the rating server cannot
be contacted, this settings either allows the user to surf without restrictions or access to the entire web is blocked.
Possible values:
2
Block, Pass
Default:
2
Block
1
Action-on-License-Exceedance:
This is where you can determine what should happen when the licensed number of users is exceeded. Users are
identified by their IP address. The system keeps count of the IP addresses that connect via the LANCOM Content
Filter. When the eleventh user establishes a connection with a 10-user license, no further checking is performed by
the LANCOM Content Filter. Depending on this setting, the unlicensed user can either surf the web without restrictions,
or access to the entire web is blocked.
Possible values:
2
Block, Pass
Default:
2
Block
5
The users of the content filter are automatically removed from the user list when no connection has been
made from the IP address concerned via the content filter for 24 hours.
1
Action-on-License-Expiration:
The license to use the LANCOM Content Filter is valid for a certain period. You will be reminded of the license expiry
date 30 days, one week and one day before it actually expires (at the e-mail address configured in LANconfig: Log
& Trace / General).
This is where you can specify what should happen when the license expires (i.e. block everything or allow everything
through). After the license used expires, this setting either allows the user to surf the web without restrictions, or
access to the entire web is blocked.
Possible values:
2
Block, Pass
Default:
1908
Reference Manual
19 More services
2
Block
Settings for blocking
You adjust the website-blocking settings here:
LANconfig: Content-Filter / Blocking
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Global-Settings
1
URL-To-Show-On-Blocking:
This is where you can enter the address of an alternative URL. If access is blocked, the URL entered here will be
displayed instead of the requested website. You can use this external HTML page to display your company's corporate
design, for example, or to perform functions such as JavaScript routines, etc. You can also use the same HTML tags
here as in blocking text. If you do not make any entry here, the default page stored in the device will be displayed..
Possible values:
2
Valid URL address
Default:
2
Blank
1
Loopback-To-Use-On-Blocking:
This is where you can configure an optional sender address to be used instead of the one that would normally be
automatically selected for this target address. If you have configured loopback addresses you can specify them here
as sender address.
Possible values:
2
Name of the IP networks whose address should be used
2
"INT" for the address of the first intranet
2
"DMZ" for the address of the first DMZ (caution: If there is an interface called "DMZ", its address will be taken
in this case)
2
LB0 ... LBF for the 16 loopback addresses
2
GUEST
1909
Reference Manual
19 More services
2
Any IP address in the form x.x.x.x
Default:
2
Blank
5
The sender address specified here is used unmasked for every remote station.
Block-Text
This is where you can define text to be displayed when blocking occurs. Different blocking texts can be defined for
different languages. The display of blocking text is controlled by the language setting transmitted by the browser (user
agent).
1
Language
Entering the appropriate country code here ensures that users receive all messages in their browser's preset language.
If the country code set in the browser is found here, the matching text will be displayed.
You can add any other language.
Examples of the country code:
2
de-DE: German-Germany
2
de-CH: German-Switzerland
2
de-AT: German-Austria
2
en-GB: English-Great Britain
2
en-US: English-USA
5
The country code must match the browser language setting exactly, e,g, "de-DE" must be entered for German
("de" on its own is not sufficient). If the country code set in the browser is not found in this table, or if the
text stored under that country code is deleted, the predefined default text ("default") will be used. You can
modify the default text.
Possible values:
2
10 alphanumerical characters
Default:
2
Blank
1
Text
Enter the text that you wish to use as blocking text for this language.
Possible values:
2
254 alphanumerical characters
Default:
2
Blank
Special values:
1910
Reference Manual
19 More services
You can also use special tags for blocking text if you wish to display different pages depending on the reason why
the website was blocked (e.g. forbidden category or entry in the blacklist).
The following tags can be used as tag values:
2
<CF-URL/> for a forbidden URL
2
<CF-CATEGORIES/> for the list of categories why the website was blocked
2
<CF-PROFILE/> for the profile name
2
<CF-OVERRIDEURL/> for the URL used to activate the URL (this can be integrated in a simple <a> tag or in a
button)
2
<CF-LINK/> adds a link for activating the override
2
<CF-BUTTON/> for a button for activating the override
You can use a tag with attributes to display or hide parts of the HTML document: <CF-IF att1 att2> ... </CF-IF>.
Possible attributes are:
2
BLACKLIST: If the site was blocked because it is in the profile blacklist
2
CATEGORY: If the site was blocked due to one of its categories
2
ERR: If an error has occurred.
Since there are separate text tables for the blocking page and the error page, this tag only makes sense if you have
configured an alternative URL to show on blocking.
2
OVERRIDEOK: If users have been allowed an override (in this case, the page should display an appropriate button)
If several attributes are defined in one tag, the section will be displayed if at least one of these conditions is met. All
tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking
text may only contain a maximum of 254 characters.
2
Example:
<CF-URL/> is blocked because it matches the categories <CF-CA/>.<br>Your content profile is <CF-PR/>.<br><CF-IF
OVERRIDEOK><br><CF-BU/></CF-IF>
5
The tags described here can also be used in external HTML pages (alternative URLs to show on blocking).
Error-Text
This is where you can define text to be displayed when an error occurs.
1
Language
Entering the appropriate country code here ensures that users receive all messages in their browser's preset language.
If the country code set in the browser is found here, the matching text will be displayed.
You can add any other language.
Examples of the country code:
2
de-DE: German-Germany
2
de-CH: German-Switzerland
2
de-AT: German-Austria
2
en-GB: English-Great Britain
2
en-US: English-USA
1911
Reference Manual
19 More services
5
The country code must match the browser language setting exactly, e,g, "de-DE" must be entered for German
("de" on its own is not sufficient). If the country code set in the browser is not found in this table, or if the
text stored under that country code is deleted, the predefined default text ("default") will be used. You can
modify the default text.
Possible values:
2
10 alphanumerical characters
Default:
2
Blank
1
Text
Enter the text that you wish to use as error text for this language.
Possible values:
2
254 alphanumerical characters
Default:
2
Blank
Special values:
You can also use HTML tags for the error text.
The following empty element tags can be used as tag values:
2
<CF-URL/> for a forbidden URL
2
<CF-PROFILE/> for the profile name
2
<CF-ERROR/> for the error message
2
Example:
<CF-URL/> is blocked because an error has occurred:<br><CF-ERROR/>
Override settings
The override function allows a website to be accessed even though it is classified as forbidden. The user must click on
the override button to confirm that the forbidden page should be opened. You can configure this feature so that the
administrator is notified when the override button is clicked (LANconfig: Content-Filter / Global-Settings).
5
If the override type "Category" has been activated, clicking on the override button makes all of the categories
for that URL accessible to the user The next blocking page to be displayed has just one category explaining why
access to the URL was blocked. After clicking on the override button, all of the allowed categories are displayed.
If the override type "Domain" has been activated, then the entire domain can be accessed.
1912
Reference Manual
19 More services
The settings for the override function are to be found here:
LANconfig: Content-Filter / Override
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Global-Settings
1
Override-Active
This is where you can activate the override function and make further related settings.
1
Override-Duration
The override duration can be restricted here. When the period expires, any attempt to access the same domain and/or
category will be blocked again. Clicking on the override button once more allows the website to be accessed again
for the duration of the override and, depending on the settings, the administrator will be notified once more.
Possible values:
2
1-1440 (minutes)
Default:
2
5 (minutes)
1
Override-Type:
This is where you can set the type of override. It can be allowed for the domain, for the category of website to be
blocked, or for both.
Possible values:
2
Category: For the duration of the override, all URLs are allowed that fall under the affected categories (as well
as those which would already have been allowed even without the override).
2
Domain: For the duration of the override all URLs in this domain are allowed, irrespective of the categories they
belong to.
2
Category-and-Domain: For the duration of the override, all URLs are allowed that belong to this domain and also
to the allowed categories. This is the highest restriction.
Default:
2
Category-and-Domain
1913
Reference Manual
19 More services
1
URL-To-Show-On-Override:
This is where you can enter the address of an alternative URL. In the event of an override, the URL entered here will
be displayed instead of the usual website. You can use this external HTML page to display your company's corporate
design, for example, or to perform functions such as JavaScript routines, etc. You can also use the same tags here
as in the override text. If you do not make any entry here, the default page stored in the device will be displayed..
Possible values:
2
Valid URL address
Default:
2
Blank
1
Loopback-To-Use-On-Override:
2
This is where you can configure an optional sender address to be used instead of the one that would normally
be automatically selected for this target address. If you have configured loopback addresses you can specify them
here as sender address.
Possible values:
2
Name of the IP networks whose address should be used
2
"INT" for the address of the first intranet
2
"DMZ" for the address of the first DMZ (caution: If there is an interface called "DMZ", its address will be taken
in this case)
2
LB0 ... LBF for the 16 loopback addresses
2
GUEST
2
Any IP address in the form x.x.x.x
Default:
2
Blank
5
The sender address specified here is used unmasked for every remote station.
Override text
This is where you can define text that is displayed to users confirming an override.
1
Language
Entering the appropriate country code here ensures that users receive all messages in their browser's preset language.
If the country code set in the browser is found here, the matching text will be displayed.
You can add any other language.
Examples of the country code:
2
de-DE: German-Germany
2
de-CH: German-Switzerland
2
de-AT: German-Austria
2
en-GB: English-Great Britain
2
en-US: English-USA
1914
Reference Manual
19 More services
5
The country code must match the browser language setting exactly, e,g, "de-DE" must be entered for German
("de" on its own is not sufficient). If the country code set in the browser is not found in this table, or if the
text stored under that country code is deleted, the predefined default text ("default") will be used. You can
modify the default text.
Possible values:
2
10 alphanumerical characters
Default:
2
Blank
1
Text
Enter the text that you wish to use as override text for this language.
Possible values:
2
254 alphanumerical characters
Default:
2
Blank
Special values:
You can also use HTML tags for blocking text if you wish to display different pages depending on the reason why
the website was blocked (e.g. forbidden category or entry in the blacklist).
The following tags can be used as tag values:
2
<CF-URL/> for the originally forbidden URL that is now allowed
2
<CF-CATEGORIES/> for the list of categories that have now been allowed as a result of the override (except if
domain override is specified).
2
<CF-BUTTON/> displays an override button that forwards the browser to the original URL.
2
<CF-BUTTON/> displays an override link that forwards the browser to the original URL.
2
<CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the allowed URL. The tags are of equal value
and their use is optional.
2
<CF-ERROR/> generates an error message in the event that the override fails.
2
<CF-DURATION/> displays the override duration in minutes.
You can use a tag with attributes to display or hide parts of the HTML document: <CF-IF att1 att2> ... </CF-IF>.
Attributes can be:
2
CATEGORY when the override type is "Category" and the override was successful
2
DOMAIN when the override type is "Domain" and the override was successful
2
BOTH when the override type is "Category-and-Domain" and the override was successful
2
ERROR when the override fails
2
OK if either CATEGORY or DOMAIN or BOTH are applicable
If several attributes are defined in one tag, the section should be displayed if at least one of these conditions is met.
All tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the
blocking text may only contain a maximum of 254 characters.
2
Example:
<CF-IF CA BO>Categories <CF-CAT/> are </CF-IF><CF-IF BO> in domain <CF-DO/></CF-IF><CF-IF DO>. Access to
domain <CF-DO/> is allowed for </CF-IF><CF-IF OK> f&uuml;r <CF-DU/> minutes. <br><CF-LI/></CF-IF><CF-IF
ERR>Override error :<br><CF-ERR/></CF-IF>
1915
Reference Manual
19 More services
Profiles in the LANCOM Content Filter
This is where you can create content filter profiles that are used to check websites for prohibited content. A content filter
profile always has a name and, for various time periods, it activates the desired category profile and, optionally, a blacklist
and a whitelist.
In order to provide different configurations for the various timeframes, several content-filter profile entries are created
with the same name. The content filter profile is thus made up of the sum of all entries with the same name.
The firewall refers to this content-filter profile.
5
Please note that you must make corresponding settings in the firewall in order to use the profiles in the LANCOM
Content Filter.
Profiles
The settings for the profiles are to be found here:
LANconfig: Content-Filter / Profiles / Profiles
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Profiles / Profiles
1
Name
The profile name that the firewall references must be specified here.
Possible values:
2
Name of a profile
Default:
2
Blank
1
Timeframe
Select the timeframe for this category profile and, optionally, the blacklist and the whitelist. The timeframes “ALWAYS”
and “NEVER” are predefined. You can configure other timeframes under:
LANconfig: Date/Time / General / Timeframe
WEBconfig: LCOS menu tree / Setup / Time / Timeframe
One profile may have several lines with different timeframes.
Possible values:
2
Always
2
Never
2
Name of a timeframe profile
Default:
2
Blank
1916
Reference Manual
19 More services
5
If timeframes overlap when multiple entries are used for a content filter profile, all pages contained in one
of the active entries will be blocked for that period of time. If a period remains undefined when several entries
are used for a content filter profile, access to all websites is unchecked for this period.
1
Blacklist
Name of the blacklist profile that is to apply for this content filter profile during the period in question. A new name
can be entered, or an existing name can be selected from the blacklist table.
Possible values:
2
Name of a blacklist profile
2
New name
Default:
2
Blank
1
Whitelist
Name of the whitelist profile that is to apply for this content filter profile during the period in question. A new name
can be entered, or an existing name can be selected from the whitelist table.
Possible values:
2
Name of a whitelist profile
2
New name
Default:
2
Blank
1
Category-Profile
Name of the category profile that is to apply for this content filter profile during the period in question. A new name
can be entered, or an existing name can be selected from the category table.
Possible values:
2
Name of a category profile
2
New name
Default:
2
Blank
Blacklist addresses (URL)
This is where you can configure websites which are to be blocked.
LANconfig: Content-Filter / Profiles / Blacklist addresses (URL)
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Profiles / Blacklists
1917
Reference Manual
19 More services
1
Name
Enter the name of the blacklist for referencing from the content-filter profile.
Possible values:
2
Blacklist name
Default:
2
Blank
1
Address (URL)
Access to the URLs entered here will be forbidden by the blacklist.
Possible values:
2
Valid URL address
The following wildcard characters may be used:
2
* for any combination of more than one character (e.g. www.lancom.* encompasses the websites www.lancom.de,
www.lancom.eu, www.lancom.es, etc.)
2
? for any single character (e.g. encompasses www.lancom.e* the websites www.lancom.eu and www.lancom.es)
5
Please enter the URL without the leading http://. Please note that in the case of many URLs a forward slash
is automatically added as a suffix to the URL, e.g. www.mycompany.de/ . For this reason it is advisable to
enter the URL as: www.mycompany.de* .
Individual URLs are separated by a blank.
Default:
2
Blank
Whitelist addresses (URL)
This is where you can configure websites to which access is to be allowed.
LANconfig: Content-Filter / Profiles / Whitelist addresses (URL)
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Profiles / Whitelists
1
Name
Enter the name of the whitelist for referencing from the content-filter profile.
Possible values:
2
Name of a whitelist
Default:
2
Blank
1918
Reference Manual
19 More services
1
Addresses (URL)
This is where you can configure websites which are to be checked locally and then accepted.
Possible values:
2
Valid URL address
The following wildcard characters may be used:
2
* for any combination of more than one character (e.g. www.lancom.* encompasses the websites www.lancom.de,
www.lancom.en, www.lancom.es, etc.)
2
? for any single character (e.g. encompasses www.lancom.e* the websites www.lancom.en and www.lancom.es)
5
Please enter the URL without the leading http://. Please note that in the case of many URLs a forward slash
is automatically added as a suffix to the URL, e.g. www.mycompany.de/ . For this reason it is advisable to
enter the URL as: www.mycompany.de* .
Individual URLs are separated by a blank.
Default:
2
Blank
Category-Profiles
Here you create a category profile and determine which categories or groups should be used to rate websites for each
category profile. You can allow or forbid the individual categories or activate the override function for each group.
LANconfig: Content-Filter / Profiles / Categories
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Profiles / Category-Profiles
1
Category profile
The name of the category profile for referencing from the content-filter profile is entered here.
Possible values:
2
Name of a category profile
Default:
2
Blank
1
Category settings
1919
Reference Manual
19 More services
For each main category and the associated sub-categories, it is possible to define whether the URLs are to be allowed,
forbidden or allowed with override only.
The following main categories can be configured:
2
Pornography/Nudity
2
Shopping
2
Society/Education/Religion
2
Illegal Activities
2
Games/Gaming
2
Entertainment/Culture
2
Information/Communication
2
Information Technology
2
Drugs
2
Lifestyle
2
Finance/Investment
2
Medicine
2
Spam
2
Miscellaneous
The category profile must subsequently be assigned to a content-filter profile (together with a timeframe) to become
active.
Possible values:
2
Allowed, forbidden, override
Default:
2
Allowed
1920
Reference Manual
19 More services
Options with the LANCOM Content Filter
This is where you can determine whether you wish to be notified of events and where LANCOM Content Filter information
is to be stored.
LANconfig: Content-Filter / Options
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Global-Settings
1
Events:
This is where you define how you wish to receive notification of specific events. Notification can be made by e-mail,
SNMP or SYSLOG. You can specify that messages for different events should be output in different ways.
Error:
2
For SYSLOG: Source “System”, priority “Alarm”.
2
Default: SNMP notification
License expiration:
2
For SYSLOG: Source “Admin”, priority “Alarm”.
2
Default: SNMP notification
License exceeded:
2
For SYSLOG: Source “Admin”, priority “Alarm”.
2
Default: SNMP notification
Override applied:
2
For SYSLOG: Source “Router”, priority “Alarm”.
2
Default: SNMP notification
Proxy Limit:
2
For SYSLOG: Source “Admin”, priority “Info”.
1921
Reference Manual
19 More services
2
Default: SNMP notification
1
E-mail recipient:
An SMTP client must be defined if you wish to use the e-mail notification function. You can use the client in the
device, or another client of your choice.
5
No e-mail will be sent if no e-mail recipient is defined.
WEBconfig: LCOS menu tree / Setup / UTM / Content-Filter / Global-Settings / Snapshot
1
Content-Filter-Snapshot
This is where you can activate the content filter snapshot and determine when and how often it should be taken.
The snapshot copies the category statistics table to the last snapshot table, overwriting the old contents of the
snapshot table. The category statistics values are then reset to 0.
1
Interval
Here you decide whether the snapshot should be taken monthly, weekly or daily.
Possible values:
2
Monthly
2
Weekly
2
Daily
Default:
2
Monthly
1
Day of month:
For monthly snapshots, set the day of the month when the snapshot should be taken.
Possible values:
2
Max. 2 characters
Default:
2
1
5
It is advisable to select a number between 1 and 28 in order to ensure that it occurs every month.
1
Weekday:
For weekly snapshots, set the day of the week when the snapshot should be taken.
Possible values:
2
Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday
Default:
1922
Reference Manual
19 More services
2
Monday
1
Time:
If you require a daily snapshot, then enter here the time of day for the snapshot in hours and minutes.
Possible values:
2
Maximum 5 characters, format HH:MM
Default:
2
00:00
Additional settings for the LANCOM Content Filter
Firewall settings for the content filter
The firewall must be activated in order for the LANCOM Content Filter to function. You can activate the firewall under:
LANconfig: Firewall/QoS / General
WEBconfig: LCOS menu tree / Setup / IP-Router / Firewall
In the default configuration, you will find the firewall rule CONTENT-FILTER that refers to the action object
CONTENT-FILTER-BASIC:
5
The firewall rule should be limited to the target service “http” so that only outgoing HTTP connections are
examined. Without this restriction all packets will be checked by the content filter, which could lead to a loss of
system performance.
A content-filter related firewall rule must contain a special action object that uses packet actions to check the data
according to a content-filter profile. In the default configuration you will find the action objects CONTENT-FILTER-BASIC,
1923
Reference Manual
19 More services
CONTENT-FILTER-WORK and CONTENT-FILTER-PARENTAL-CONTROL, each of which refer to their corresponding
content-filter profile:
Example: When a web page is accessed, the data packets pass through the firewall and are processed by the rule
CONTENT-FILTER. The action object CONTENT-FILTER-BASIC checks the data packets using the content-filter profile
CONTENT-FILTER-BASIC.
Timeframe
Timeframes are used to define the periods when the content-filter profiles are valid. One profile may have several lines
with different timeframes. Different lines in a timeframe should complement each other, i.e. if you specify WORKTIME
you will probably wish to specify a timeframe called FREETIME to cover the time outside of working hours.
The timeframes “ALWAYS” and “NEVER” are predefined. You can configure other timeframes under:
LANconfig: Date/Time / General / Timeframe
WEBconfig: LCOS menu tree / Setup / Time / Timeframe
1
Name
Enter the name of the timeframe for referencing from the content-filter profile.
Possible values:
2
Name of a timeframe
Default:
2
Blank
1
Start
Here you set the start time (time of day) when the selected profile becomes valid.
Possible values:
2
Maximum 5 characters, format HH:MM
Default:
2
00:00
1924
Reference Manual
19 More services
1
Stop
Here you set the stop time (time of day) when the selected profile ceases to be valid.
Possible values:
2
Maximum 5 characters, format HH:MM
Default:
2
23:59
1
Weekdays
Here you select the weekday on which the timeframe is to be valid.
Possible values:
2
Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday
Default:
2
Activated for Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday
You can form a time schedule with the same name but with different times extending over several lines:
Addition(s) to LCOS 8.50
Content filter for HTTPS pages
The first version content filter supported only HTTP pages, whereas LCOS 8.50 now also supports HTTPS pages.
By default the content filter uses the firewall rule 'CONTENT-FILTER'. When the content filter option is activated on a
device with LCOS 8.50 or newer, the rule refers to the target 'WEB', which monitors outbound HTTP and HTTPS connections
on ports 80 and 443.
5
If you enabled the content filter option on a device with an LCOS version oder than 8.50, the firewall rule only
uses HTTP port 80 as the target. If this is the case, then you can reset the target of the firewall rule to 'WEB' so
that outgoing HTTPS connections are also checked with the content filter.
One-click override
The override function allows a website to be accessed even though it is classified as forbidden.With this feature enabled,
the content filter informs the user why the page was blocked and also provides the option of unlocking the category for
the set period of time.
1925
Reference Manual
19 More services
In case of an override, the content filter displays the relevant entry from the block-text table and directly below this, the
text from the override-text table together with the 'Override' button. When the user clicks this button the content filter
forwards the user to the requested page, if possible. If it is not possible to forward the user to the requested page, the
content filter displays an error page.
In the LCOS versions earlier than version 8.50, the block texts, override texts and and error texts and associated attributes
were used slightly differently than in the LCOS versions 8.50 and newer.
5
When updating to LCOS 8.50, you should check the texts in the different tables and adjust them if necessary.
Depending on the application, the arguments relating to HTTP requests are transmitted in different ways according to
the requested URL. In most cases, the browser sends a GET request with the arguments in the URL (e.g. a search term).
In the case of an override, the content filter is able to forward GET requests as all the required information is included
in the URL. However, in some cases the browser sends POST requests, for example for file uploads where the data to be
transmitted is in the header of the request. In this case, the information that should be forwarded in case of an override
is not contained in the URL. The content filter can only successfully forward post requests in case of an override if
JavaScript has been enabled in the user's browser. Browsers based on the HTML rendering library 'WebKit' do not support
the override of post requests with JavaScript.
5
Content filters operating on a system without JavaScript activated or with WebKit browsers display an error page
after clicking on the 'Override' button. These users can then click the button for reloading the web page and
forwarding will then succeed.
The following sections show the changes made to the content filter menu system.
URL to show on error
This is where you can enter an alternative URL. In the event of an error, the URL entered here will be displayed instead
of the usual web site. You can use this external HTML page to display your company's corporate design, for example, or
to perform functions such as JavaScript routines, etc. You can also use the same tags here as used in the override text.
If you do not make any entry here, the default page stored in the device will be displayed..
Telnet path: /Setup/UTM/Content-Filter/Global-Settings
Possible values:
1
Valid URL address
Default: Blank
Loopback to use on error
This is where you can configure an optional sender address for the error URL to be used instead of the one that would
normally be automatically selected for this target address. If you have configured loopback addresses, you can specify
them here as sender address.
Telnet path: /Setup/UTM/Content-Filter/Global-Settings
English description: Loopback-To-Use-On-Override
Possible values:
1
Name of the IP networks whose address should be used
1
"INT" for the address of the first intranet
1
"DMZ" for the address of the first DMZ (Note: If there is an interface named "DMZ", its address will be taken).
1
LB0 ... LBF for the 16 loopback addresses
1
GUEST
1
Any IP address in the form x.x.x.x
Default: Blank
1926
Reference Manual
19 More services
5
The sender address specified here is used unmasked for every remote station.
Text
Enter the text that you wish to use as blocking text for this language.
Telnet path: /Setup/UTM/Content-Filter/Global-Settings/Block-Text
Possible values:
1
254 alphanumerical characters
Default:
Blank
Special values:
You can also use special tags for blocking text if you wish to display different pages depending on the reason why the
web site was blocked (e.g. forbidden category or entry in the blacklist).
The following tags can be used as tag values:
1
<CF-URL/> for the forbidden URL
1
<CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the allowed URL. The tags are of equal value
and their use is optional.
1
<CF-CATEGORIES/> for the list of categories why the web site was blocked
1
<CF-PROFILE/> for the profile name
1
<CF-DURATION/> displays the override duration in minutes.
1
<CF-OVERRIDEURL/> for the URL used to activate the URL (this can be integrated in a simple <a> tag or in a button)
1
<CF-LINK/> adds a link for activating the override
1
<CF-BUTTON/> for a button for activating the override
You can use a tag with attributes to display or hide parts of the HTML document: <CF-IF att1 att2> ... </CF-IF>.
Possible attributes are:
1
BLACKLIST: If the site was blocked because it is in the profile blacklist
1
FORBIDDEN: If the site was blocked due to one of its categories
1
CATEGORY: When the override type is "Category" and the override was successful
1
ERR: If an error has occurred.
Since there are separate text tables for the blocking page and the error page, this tag only makes sense if you have
configured an alternative URL to show on blocking.
1
OVERRIDEOK: If users have been allowed an override (in this case, the page should display an appropriate button)
If several attributes are defined in one tag, the section will be displayed if at least one of these conditions is met. All
tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking
text may only contain a maximum of 254 characters.
Example:
1
<CF-URL/> is blocked because it matches the categories <CF-CA/>.</p><p>Your content profile is
<CF-PR/>.</p><p><CF-IF OVERRIDEOK></p><p><CF-BU/></CF-IF>
5
The tags described here can also be used in external HTML pages (alternative URLs to show on blocking).
Text
Enter the text that you wish to use as error text for this language.
1927
Reference Manual
19 More services
Telnet path: /Setup/UTM/Content-Filter/Global-Settings/Error-Text
Possible values:
254 alphanumerical characters
Default:
Blank
Special values:
You can also use HTML tags for the error text.
The following empty element tags can be used as tag values:
1
<CF-URL/> for the forbidden URL
1
<CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the forbidden URL. The tags are of equal value
and their use is optional.
1
<CF-DURATION/> displays the override duration in minutes.
1
<CF-PROFILE/> for the profile name
1
<CF-ERROR/> for the error message
You can use a tag with attributes to display or hide parts of the HTML document: <CF-IF att1 att2> ... </CF-IF>.
Possible attributes are:
1
CHECKERROR: The error occurred while checking the URL
1
OVERRIDEERROR: The error occurred while approving an override
Example:
<CF-URL/> is blocked because an error has occurred:</p><p><CF-ERROR/>
<CF-URL>: Blocked URL <CF-HOST> or <CF-DOMAIN>: Host part of the blocked URL <CF-PROFILE>: User content-filter
profile <CF-DURATION>: Override time in minutes <CF-ERROR>: Error message <CF-IF> to </CF-IF>: Conditional
evaluation of the following parameters with the logical OR: CHECKERROR: The error occurred while checking the URL
(as earlier) OVERRIDE ERROR: The error occurred while approving an override
Text
Enter the text that you wish to use as override text for this language.
Telnet path: /Setup/UTM/Content-Filter/Global-Settings/Override-Text
Possible values:
1
254 alphanumerical characters
Default:
Blank
Special values:
You can also use HTML tags for blocking text if you wish to display different pages depending on the reason why the
web site was blocked (e.g. forbidden category or entry in the blacklist).
The following tags can be used as tag values:
1
<CF-URL/> for the originally forbidden URL that is now allowed
1
<CF-CATEGORIES/> for the list of categories that have now been allowed as a result of the override (except if domain
override is specified).
1
<CF-BUTTON/> displays an override button that forwards the browser to the original URL.
1
<CF-BUTTON/> displays an override link that forwards the browser to the original URL.
1
<CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the allowed URL. The tags are of equal value
and their use is optional.
1928
Reference Manual
19 More services
1
<CF-ERROR/> generates an error message in the event that the override fails.
1
<CF-DURATION/> displays the override duration in minutes.
You can use a tag with attributes to display or hide parts of the HTML document: <CF-IF att1 att2> ... </CF-IF>.
Attributes can be:
1
BLACKLIST: If the site was blocked because it is in the profile blacklist
1
FORBIDDEN: If the site was blocked due to one of its categories
1
CATEGORY: When the override type is "Category" and the override was successful
1
DOMAIN: When the override type is "Domain" and the override was successful
1
BOTH: When the override type is "Category-and-Domain" and the override was successful
1
ERROR: When the override fails
1
OK: When either CATEGORY or DOMAIN or BOTH are applicable
If several attributes are defined in one tag, the section should be displayed if at least one of these conditions is met. All
tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking
text may only contain a maximum of 254 characters.
Example:
<CF-IF CA BO>The categories <CF-CAT/> are</CF-IF><CF-IF BO> in the domain <CF-DO/></CF-IF><CF-IF DO>The
domain <CF-DO/> is</CF-IF><CF-IF OK> released for <CF-DU/> minutes.</p><p><CF-LI/></CF-IF><CF-IF ERR>Override
error:</p><p><CF-ERR/></CF-IF>
Addition(s) to LCOS 8.80
Concurrent user model in the content filter
As of LCOS 8.80, the content filter supports a true concurrent user model. This model licenses the number of concurrent
users of the content filter. In contrast to this, the previous "per-user model" licenses the number of all potential users.
Until now, the content filter retained a user in its internal user list for 24 hours. After using the content filter for the first
time within a 24-hour period, the user is permanently listed and thus licensed.
As of LCOS 8.80, the content filter only maintains a user in its internal user list for 5 minutes. This change makes it
possible for a changing selection of users to use the content filter. Your license now checks only the actual number of
concurrent users (within the 5-minute period).
1929
Reference Manual
19 More services
General settings
Global settings for the LANCOM Content Filter are made here:
LANconfig: Content Filter / General
WEBconfig: LCOS Menu Tree / Setup / UTM / Content-Filter / Global-Settings
1
Operating
This is where you can activate the LANCOM Content Filter.
1
Action-on-Error:
This is where you can determine what should happen when an error occurs. For example, if the rating server cannot
be contacted, this setting either allows the user to surf without restrictions or access to the web is blocked entirely.
Possible values:
2
Block, Pass
Default:
2
Block
1
Action on license exceedance:
This is where you can determine what should happen when the licensed number of users is exceeded. Users are
identified by their IP address. The system keeps count of the IP addresses that connect via the LANCOM Content
Filter. When the eleventh user establishes a connection with a 10-user license, no further checking is performed by
the LANCOM Content Filter. Depending on this setting, the unlicensed user can either surf the web without restrictions,
or access to the web is blocked entirely.
Possible values:
2
Block, Pass
Default:
2
Block
1930
Reference Manual
19 More services
5
The users of the content filter are automatically removed from the user list when no connection has been
made from the IP address concerned via the content filter for 5 minutes.
1
Action-on-License-Expiration:
The license to use the LANCOM Content Filter is valid for a certain period. You will be reminded of the license expiry
date 30 days, one week and one day before it actually expires (at the e-mail address configured in LANconfig: Log
& Trace / General).
This is where you can specify what should happen when the license expires (i.e. block everything or allow everything
through). After the license expires, this setting either allows the user to surf the web without restrictions, or access
to the web is blocked entirely.
Possible values:
2
Block, Pass
Default:
2
Block
5
In order for the reminder to be sent to the specified e-mail address, you must configure the SMTP account.
1
Max. proxy connections
This setting is for the maximum allowable number of simultaneous proxy connections. This limits the load that can
be placed on the system. A notification is sent if this number should be exceeded. You can set the type of notification
under Content filter > Options > Events.
Possible values:
2
0 to 999999 connections
Default:
2
Depends on device
1
Proxy processing timeout
Specifies the maximum time in milliseconds that the proxy can take for processing. A timeout error page is displayed
if this time is exceeded.
Possible values:
2
0 to 999999 milliseconds
Default:
2
3000 milliseconds
Special values:
2
The value 0 sets no time limit. Values less than 100 milliseconds make no sense.
1
Save content filter information to flash ROM activated
If you enable this option, you can additionally save the content filter information to the flash ROM memory of the
device.
Default:
2
Deactivated
New content filter category, Command/Control Server
As of LCOS 8.80, the content filter supports the new Web filter category Command and Control Server ("C&C server" for
short). C&C servers monitor and control bots in a botnet.
1931
Reference Manual
19 More services
Introduction
The LANCOM Content Filter enables you to filter certain content from your network, so preventing access to Internet
pages with content that is illegal or offensive. It also enables you to stop private surfing on specific sites during working
hours. This not only increases staff productivity and network security but also ensures that the full bandwidth is available
exclusively for your business activities.
The LANCOM Content Filter is an intelligent content filter that works dynamically. It contacts a rating server that evaluates
Internet sites reliably and accurately in accordance with the categories that you select.
The LANCOM Content Filter operates by checking the IP addresses behind the URLs that are entered. For any given
domain it is possible to differentiate according to the path, meaning that specific areas of a URL may be rated differently.
5
It is not possible for users to avoid the LANCOM Content Filter website rating simply by entering the website's
IP address into their browsers. The LANCOM Content Filter checks unencrypted (HTTP) and also encrypted Web
pages (HTTPS).
The LANCOM Content Filter license you purchase is valid for a certain number of users and for a specific period (for one
or three years). You will be informed of the expiry of your license in good time. The number of current users is monitored
in the device, with the users being identified by their IP address. You can configure what should happen when the number
of licensed users is exceeded: Access can either be denied or an unchecked connection can be made.
5
You can test the LANCOM Content Filter on any router that supports this function. All you have to do is to activate
a 30-day demo license for each device. Demo licenses are generated directly with LANconfig. Click on the device
with the right-hand mouse key and select the context menu entry Activate Software Option. In the dialog that
follows, click on the button Register demo license. You will automatically be connected to the website for the
LANCOM registration server. Simply select the required demo license and you can register your device.
All settings relating to categories are stored in category profiles. You select from predefined main and sub-categories in
the LANCOM Content Filter: 59 categories are divided into 14 subject groups such as “Pornography, Nudity", "Shopping"
or "Illegal Activities". You can activate or deactivate each of the categories that these groups contain. Sub-categories
for “Pornography/Nudity” are, for example, “Pornography/Erotic/Sex” and “Swimwear/Lingerie”.
When configuring these categories, administrators have an additional option of activating an override. When the override
option is active, users may still access the forbidden site for a particular period of time by clicking on a corresponding
button, but the administrator will be notified of this by e-mail, SYSLOG, or SNMP trap.
1932
Reference Manual
19 More services
The category profile, whitelist and blacklist can be used to create a content filter profile that you can assign to particular
users by means of the firewall. For example you can create a profile called “Employees_department_A” and assign this
to all of the computers in that department.
When you install the LANCOM Content Filter, basic default settings are created automatically. These only need to be
activated for the initial start. You can subsequently customize the behavior of the LANCOM Content Filter to match your
own requirements.
Additions to the menu system
Command/Control server
For each main category and the associated sub-categories, it is possible to define whether the URLs are to be allowed,
forbidden or allowed with override only.
Telnet path: /Setup/UTM/Content-Filter/Profiles/Category-Profiles
The category profile must subsequently be assigned to a content-filter profile (together with a timeframe) to become
active.
Possible values:
Allowed, forbidden, override
Default:
Forbidden
Addition(s) to LCOS 9.10
E-mail notification from the Content Filter
As of LCOS version 9.10, it is possible to send e-mail notifications about the causes of content-filter events, either
immediately or daily depending on the cause.
Options for the LANCOM Content Filter
Under Content Filter > Options you determine whether you wish to be notified of events and where LANCOM Content
Filter information is to be stored.
1933
Reference Manual
19 More services
Events
This is where you define how you wish to receive notification of specific events. Notification can be made by
e-mail, SNMP or SYSLOG. For different event types you can specify whether messages should be output and,
if so, how many.
E-mail
Here, you specify if and how e-mail notification takes place:
No
No e-mail notification is issued for this event.
Immediately
Notification occurs when the event occurs.
Daily
The notification occurs once per day.
Notifications can be sent for the following events:
Error
For SYSLOG: Source „System“, priority „Alert“.
Default: SNMP notification
License expiry
For SYSLOG: Source „Admin“, priority „Alert“.
Default: SNMP notification
License exceeded
For SYSLOG: Source „Admin“, priority „Alert“.
Default: SNMP notification
Override applied
For SYSLOG: Source „Router“, priority „Alert“.
Default: SNMP notification
Proxy limit
For SYSLOG: Source „Router“, priority „Info“.
Default: SNMP notification
1934
Reference Manual
19 More services
E-mail recipient
An SMTP client must be defined if you wish to use the e-mail notification function. You can use the client in
the device, or another client of your choice.
4
No e-mail will be sent if no e-mail recipient is specified.
Content Filter snapshot
This is where you can activate the content filter snapshot and determine when and how often it should be
taken. The snapshot copies the category statistics table to the last snapshot table, overwriting the old contents
of the snapshot table. The category statistics values are then reset to 0.
Interval
Here you decide whether the snapshot should be taken monthly, weekly or daily.
Possible values:
1
monthly, weekly, daily
1
Default: monthly
Day of month
For monthly snapshots, set the day of the month when the snapshot should be taken. Possible values:
1
Max. 2 characters
1
Default:1
5
It is advisable to select a number between 1 and 28 in order to ensure that it occurs every month.
Day of week
For weekly snapshots, set the day of the week when the snapshot should be taken. Possible values:
1
Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday
1
Default: Monday
Time of day:
If you require a daily snapshot, then enter here the time of day for the snapshot in hours and minutes. Possible
values:
1
Maximum 5 characters, format HH:MM
1
Default: 00:00
Additions to the Setup menu
E-mail
Here you specify whether you want to receive notifications by e-mail.
The option presettings differ depending on the cause.
SNMP ID:
2.41.2.2.9.2
Telnet path:
Setup > UTM > Content Filter > Global settings > Notifications
1935
Reference Manual
19 More services
Possible values:
Off
Immediate
Daily
19.16 Addition(s) to LCOS 8.50
19.16.1 Bandwidth restriction of the LAN interfaces
Introduction
For a device with an integrated WLAN module, you can specify a bandwidth limit for individual LAN ports. The table of
LAN interfaces contains the parameters necessary to configure bandwidth restrictions.
Additions to the menu system
LAN interfaces
This menu contains the settings for the LAN interfaces.
Telnet path: Setup/Interfaces/LAN-Interfaces
Tx limit
Enter the bandwidth limit (kbps) in the transmission direction. The value 0 means there is no limit.
Telnet path: Setup/Interfaces/LAN-Interfaces
Possible values:
1
Maximum 10 numerical characters
Default: 0
5
This setting is only available for devices with a WLAN module.
Rx limit
Enter the bandwidth limit (kbps) in the receive direction.The value 0 means there is no limit.
Telnet path: Setup/Interfaces/LAN-Interfaces
Possible values:
1
Maximum 10 numerical characters
Default: 0
5
This setting is only available for devices with a WLAN module.
1936
Reference Manual
19 More services
19.17 Addition(s) to LCOS 8.80
19.17.1 LLDP
The Link Layer Discovery Protocol (LLDP) provides a simple and reliable way to exchange information between neighboring
devices on the network and for determining the topology of networks. LLDP provides discovery functions to identify
individual devices and entire network structures using the procedures defined in the IEEE 802.1AB standard. Since the
protocol works on Layer 2 (security level) of the OSI layer model and it is, therefore, used for physically addressing devices,
its functionality is not limited to logical networks such as IP networks. In principle, LLDP covers all physically accessible
devices on the network.
In particular, the vendor-independent LLDP protocol offers many advantages in complex networks:
1
It enables the automatic detection of components attached to a network such as routers, switches, and WLAN access
points.
1
It simplifies the integration of a wide range of different devices, which support the LLDP standard, into an existing
network: Using central network management software, and automatic testing and diagnostic processes, the time
required for setup, operation and maintenance of a network is reduced.
1
The information sent by the individual devices provides an overview of the topology (i.e., structure and arrangement)
of the entire network. Central management software provides the administrator with a virtual image of the network,
which is automatically updated when there are changes in the topology.
1
With the help of management software, the administrator can also easily monitor and manage complex networks.
Using this software, he can determine which components and devices are interconnected and can easily locate any
faults.
1
LLDP can reduce the costs of buying, building or restructuring a network, since companies are no longer dependent
on specific manufacturers because of this open standard. Individual network components can be selected based on
which one is best for your implementation. This was previously not possible when proprietary protocols were in use.
How it works
LLDP works on a simple principle: The so-called LLDP agent runs on all devices with LLDP support. On the one hand,
this software component sends information to all interfaces of the device at regular intervals. This is done using either
Unicast or Multicast, depending on the destination addresses, which you can configure as required. On the other hand,
1937
Reference Manual
19 More services
the LLDP agent is continuously receiving information from neighboring devices. The transmission and reception of the
respective data packets is handled independently from each other.
The data packets being sent and received contain information such as the name and the description of the device, the
ID and description of ports, the IP address or MAC address of the device, the specific capabilities of the device (e.g., in
terms of switching and routing), VLAN identifiers and vendor-specific details. In this case, LLDP defines basic information
that a data packet must always include, as well as optional additional information.
The individual devices store the information received locally in a data structure, the so-called MIB (Management Information
Base). An MIB therefore contains data from its own LLDP agent and of the detected, direct neighbor agent.
The information exchange provides a continuing identification of the devices within the network, because the devices
normally send packets cyclically (i.e. in configurable intervals). Furthermore, the devices also inform their network
neighbors when changes occur on the device or in its network connection.
For the actual device identification process it is crucial that each connection point in the topology is clearly identified as
a "Media Service Access Point" (MSAP). An MSAP is composed of a device ID (Chassis ID) and a port identification (Port
ID). The unique identification or assignment of devices is therefore based on the fact that each MSAP in the monitored
network topology may occur only once.
The Administrator can query and capture the data reported by the devices via a central network management software
on his computer, where the query of the individual MIBs is performed using the SNMP protocol. The management
software thus documents the entire topology of the network and allows automatic display of this topology along with
a graphic representation of the current diagnostic data.
Structure of LLDP messages
Information is exchanged using specific units of data known as LLDP Data Units (LLDPDU). These data unit consists of
TLVs ( Type-Length-Values), and each TLV field corresponds to a certain type and has a certain length.
In accordance with the LLDP standard IEEE 802.1AB three TLVs are mandatory at the beginning of an LLDPU in the
following order:
1
Type 1 = Chassis ID
1
Type 2 = Chassis ID
1
Type 3 = Time to live
Following these mandatory TLVs, an LLDPDU can include additional, optional TLVs:
1938
Reference Manual
19 More services
1
Type 4 = Port description
1
Type 5 = System name
1
Type 6 = System description
1
Type 7 = System capabilities
1
Type 8 = Management address
At the end of an LLDPDU the following TLV is mandatory:
1
Type 0 = End of LLDPDU
Tabular overview of the TLVs
FunctionExampleNameUsageTLV
Identifies the device0018.2fa6.b28cChassis IDMandatoryType 1
Identifies the portFi-0/12Port IDMandatoryType 2
Signals to the receiving device how long the received
information should remain valid
60 secTime to liveMandatoryType 3
Displays details about the port such as the hardware
version
GigabitEthernet0/12Port
description
OptionalType 4
Displays the name given to the device by the
administrator
PN-I/O 3System nameOptionalType 5
Displays details about the device such as the version
of the networking software
LCOS software,
version 8.9.1 SE
System
description
OptionalType 6
Displays the primary function and capabilities of the
device.
RouterSystem
capabilities
OptionalType 7
Shows the IP or MAC address of the device192,168.0.1Management
address
OptionalType 8
Signals the end of the data unit-------------End of
LLDPDU
MandatoryType 0
Supported operating systems
In principle, LLDP works on all popular systems, provided that LLDP agents or an appropriate software for evaluation of
the LLDP packages is available. For Linux there are various open source projects, such as "LLDPD", "Open-LLDP" (with
hyphen) or "ladvd", which deploy an LLDP agent.
The project "OpenLLDP" aims to achieve a further dissemination and acceptance of the LLDP protocol (802.1AB). The
software supports the transmission and reception of LLDP messages on the Linux, Mac OS X, FreeBSD, and NetBSD
platforms. Currently, however, this development seems to be stalled.
Microsoft Windows Vista and Windows 7 contain a proprietary protocol called LLTD (Link Layer Topology Discovery),
which is essentially the same functionality as LLDP. On Windows XP, the LLTD component can be installed later as a
patch. However, the patch is limited compared to the features implemented in Vista and Windows 7 because the "LLTD
Responder" only reports IPv4 addresses, and not IPv6 addresses.
If you want to install LLDP on Windows systems, you can use a shareware called "haneWIN LLDP Agent". Using this,
LLDP works on all Windows systems as of Windows 2000, i.e., on both 32-bit and 64-bit systems.
The most widely used free software for evaluation and analysis is Wireshark. The basic version of Wireshark is free of
charge and now well-established as a standard. The software supports a wide variety of operating systems and can read
and evaluate a wide variety of protocols (including LLDP). However, the focus of the basic version of Wireshark is the
analysis of problems within the network. If you need more features (such as the visualization of network traffic in the
form of colored graphs), you can purchase add-on modules.
1939
Reference Manual
19 More services
Additions to the menu system
Additions to the Setup menu
LLDP
This submenu contains the configuration options relating to the Link Layer Discovery Protocol (LLDP). The options are
similar to the configuration options according to LLDP MIB. If the information contained here is not sufficient, you can
find more details in the IEEE 802.1AB standard.
Telnet path:
Setup > LLDP
Management addresses
In this table, enter the management address(es) that the device transmits via LLDPDUs. Management addresses take
their names from the TCP/IP network list. The device only transfers the network and management addresses in this table
for the LLDPDUs. A network from this list has the option of using the port list to limit the wider disclosure of the individual
device addresses.
Telnet path:
Setup > LLDP > Management-Addresses
5
Defining address bindings limits the disclosure of management addresses regardless of the settings in the port
lists. The device only reports a network that is connected to an interface. This is irrespective of the settings of
the port list.
Network name
The name of the TCP/IP network, as entered in the TCP-IP network list.
Telnet path:
Setup > LLDP > Management-Addresses > Network-Name
Possible values:
Max. 16 alphanumerical characters
Default:
Blank
Port list
The list of interfaces and ports belonging to the corresponding management address.
Telnet path:
Setup > LLDP > Management-Addresses > Port-List
Possible values:
>Comma-separated list of ports, max 251 alphanumeric characters, e.g., LAN-1 or WLAN-1. Use wildcards
to specify a group of ports (e.g., "*_*" ).
Default:
Blank
1940
Reference Manual
19 More services
Ports
This table includes all port-dependent configuration options. The table index is a string, specifically the interface/port
name.
Telnet path:
Setup > LLDP > Ports
Name
The name of the port or interface
Telnet path:
Setup > LLDP > Ports > Name
Possible values:
Depending on the interfaces, e.g., LAN-1, WLAN-1
Admin status
Specifies whether PDU transfer and/or reception is active or inactive on this port. This parameter can be set individually
for each port.
Telnet path:
Setup > LLDP > Ports > Admin-Status
Possible values:
Off
TX only
RX only
Rx/Tx
Default:
Off
Notification
Use this to set whether changes in an MSAP remote station for this port are reported to possible network management
systems.
Telnet path:
Setup > LLDP > Ports > Notifications
Possible values:
No
Yes
Default:
No
1941
Reference Manual
19 More services
Admin status
Specify the quantity of the optional standard TLVs that will be transmitted to the PDUs.
Telnet path:
Setup > LLDP > Ports > TLVs
Possible values:
Port description
System name
System description
System properties
None
Default:
Port description
TLVs-802.3
Specify the quantity of the optional standard TLVs-802.3 that will be transmitted to the PDUs.
Telnet path:
Setup > LLDP > Ports > TLVs-802.3
Possible values:
PHY config status
Power via MDI
Link aggregation
Max frame size
None
Default:
PHY config status
Maximum neighbors
This parameter specifies the maximum number of LLDP neighbors.
Telnet path:
Setup > LLDP > Ports > Max-Neighbors
Possible values:
0 to 65535
Default:
0
Update source
This parameter specifies the optional sources for LLDP updates.
1942
Reference Manual
19 More services
Telnet path:
Setup > LLDP > Ports > Update-Source
Possible values:
Auto
LLDP only
Other only
Both
Default:
Auto
TLVs-LCS
These settings define the quantity of the optional standard LCS TLVs that the device sends to PDUs.
Telnet path:
Setup > LLDP > Ports > TLVs-LCS
Possible values:
SSID
Radio channel
PHY type
None
Default:
SSID
Protocol
This table contains the LLDP port settings for the spanning-tree and rapid-spanning-tree protocols.
Telnet path:
Setup > LLDP > Protocols
Protocol
This parameter sets the protocol for which the LLDP ports are enabled.
Telnet path:
Setup > LLDP > Protocols > Protocol
Possible values:
Spanning-Tree
Rapid-Spanning-Tree
Default:
Spanning-Tree, Rapid-Spanning-Tree
1943
Reference Manual
19 More services
Port list
This value describes the ports, which the LLDP uses with the associated protocol (spanning-tree or rapid-spanning-tree).
Telnet path:
Setup > LLDP > Protocols > Port-List
Possible values:
>Comma-separated list of ports, max 251 alphanumeric characters, e.g., LAN-1 or WLAN-1. Use wildcards
to specify a group of ports (e.g., "*_*" ).
Default:
Blank
Notification interval
This value specifies the time interval until the device sends notifications of changes to the remote station tables. The
value defines the smallest time period between notifications. Thus the default value of 5 seconds causes the device to
send messages at most once every 5 seconds, even if the device has detected multiple changes in the meantime.
Telnet path:
Setup > LLDP > Notification-Interval
Possible values:
0 to 9999 seconds
Default:
5
Operating
This parameter enables or disables the use of LLDP.
Telnet path:
Setup > LLDP > Operating
Possible values:
Yes
No
Default:
No
Message TX hold multiplier
This value is used to calculate the time in seconds after which the device discards the information received with LLDP
messages (hold time or time to live – TTL). The device calculates this value as the product of the Message TX hold
multiplier specified here and the current Message TX interval:
Hold time = Message TX hold multiplier x Message TX interval
The default settings result in a hold time for received LLDP messages of 120 seconds.
1944
Reference Manual
19 More services
Telnet path:
Setup > LLDP > Message-TX-Hold-Multiplier
Possible values:
0 to 99
Default:
4
Message TX interval
This value defines the interval in seconds for the regular transmission of LLDPDUs by the device.
5
If the device detects changes to the LLDP information during an interval, the device can send additional LLDP
messages. The Tx delay parameter defines the maximum frequency of LLDP messages caused by these
changes.
5
The device also uses this Message TX interval for calculating the hold time for received LLDP messages
with the help of the Message TX hold multiplier,
Telnet path:
Setup > LLDP > Message-TX-interval
Possible values:
0 to 65535 seconds
Default:
30
Reinit delay
This value defines the time the device suppresses transmission of LLDPDUs despite the LLDP being activated.
Telnet path:
Setup > LLDP > Reinit-Delay
Possible values:
0 to 99 seconds
Default:
2
Immediate delete
This parameter enables or disables the direct deletion of LLDPDUs.
Telnet path:
Setup > LLDP > Immediate-Deletion
Possible values:
Yes
No
1945
Reference Manual
19 More services
Default:
Yes
Tx delay
In principle the device sends LLDP messages in the interval set under Message TX interval. If the device
detects changes to the LLDP information during an interval, the device can send additional LLDP messages.
The value set here defines the maximum frequency in seconds, in which the device uses LLDP messages. Thus the default
value of 2 seconds causes the device to send LLDP messages once every 2 seconds, even if the device has detected
multiple changes in the meantime.
Telnet path:
Setup > LLDP > Tx-Delay
Possible values:
0 to 9999 seconds
Default:
2
19.18 Addition(s) to LCOS 8.84
19.18.1 Sending and receiving SMS text messages
If your device has a 3G/4G WWAN module, is capable of sending and receiving text messages via the Short Message
Service (SMS).
In this case the SMS function is mainly used as a messaging and function-enhancing interface for the internal LCOS
modules, but also for external instances such as routers, management solutions, accounting systems, and so on. You as
a user also have the option to send SMS text messages using the corresponding
function in LANmonitor
or the smssend
command at the command prompt. LANmonitor also provides you with convenient functions for
managing
sent and
received messages.
5
The sending and receiving of SMS text messages must also be included in the SIM card's contract.
Receiving SMS text messages
Your device uses the ETSI standard TS 127.005 to receive and request these SMS text messages, to store them and, if
required, to log the receipt of an SMS to the SYSLOG. The entry in the SYSLOG counts as a "notice" to inform you about
any important messages, such as a notification from an external instance, for example. An instance might be the
accounting system of your provider:
If you connect to the Internet via a 3G/4G WWAN module and the contract with your Internet provider includes a volume
limit, then depending on the contract your provider will throttle or stop data transfer once this volume limit has been
reached. In countries with the appropriate legislation, this also applies when a charging limit for data roaming has been
reached. Before the data transfer is throttled or stopped, many providers send an SMS text message informing the
customer that the volume limit has been reached. With the corresponding notification settings in the SYSLOG and/or via
e-mail, the device can immediately inform you about the reception of the SMS, so that you can respond promptly.
1946
Reference Manual
19 More services
Basic configuration of the SMS module
The following steps show you the basic configuration of the SMS module in a 3G/4G WWAN-enabled device.
1. Start LANconfig and open the configuration dialog for the device.
2. Navigate to the menu item Log & trace > SMS messages.
3. Under Inbox size you set the maximum number of text messages stored in the device inbox.
If the preset number is exceeded, the oldest message will be deleted. In this case there is no SYSLOG entry. The value
0 disables the limit, i.e. an unlimited number of messages will be stored.
4. The item Deletion of sent messages decides how the device handles sent text messages.
1
Immediately: Sent messages are not saved.
1
Never: Sent messages are saved permanently.
5. Under Outbox size you set the maximum number of text messages stored in the device outbox.
If the preset number is exceeded, the oldest message will be deleted. In this case there is no SYSLOG entry. The value
0 disables the limit, i.e. an unlimited number of messages will be stored.
6. Under Syslog messaging you specify if and how the arrival of text messages is logged to the SYSLOG.
1
No: Incoming text messages are not logged to SYSLOG.
1
Only sender/no content: The arrival of a text message is recorded to the SYSLOG together with the sender's
phone number.
1
Full: The arrival of a text message is recorded to the SYSLOG together with the sender's phone number and the
message in full.
7. Optional: Under Mail forwarding address you specify the e-mail address to which the device is to forward the
incoming SMS text messages.
5
E-mail routing will only work if a valid SMTP account is configured in the device.
8. Now write the configuration back to the device.
That's it! This concludes the basic configuration of the SMS module.
Managing SMS text messages with LANmonitor
The following section explains shows how you can use LANmonitor to read and delete text messages sent or received
by a 3G/4G WWAN-enabled device.
1. Start LANmonitor and navigate to the menu tree of the respective device under SMS messages > Inbox or Outbox.
If there are already text messages on the device, LANmonitor displays the last five received messages under Inbox
and the last five sent messages under Outbox.
1947
Reference Manual
19 More services
2. Open the context menu on the entry and choose Show SMS inbox or Show SMS outbox.
LANmonitor then displays a window listing all of the sent and received text messages and their status. In the Inbox you
have the option to delete single or multiple selected messages, or to mark them as read/unread; the Status shows whether
they have been read or not (New or Read). In the Outbox, the messages can only be deleted; the Status shows their
send status (Sent or Unsent).
You can manage these messages by using the context menu. To delete all messages in the inbox or outbox, go to the
menu bar under Messages and select the appropriate action.
4
You can easily toggle between the inbox and outbox by selecting View from the menu bar and selecting the
desired option.
Sending SMS text messages with LANmonitor
The following section explains how you can use LANmonitor to send SMS text messages via a 3G/4G WWAN-enabled
device.
1. Start LANmonitor and navigate to the menu tree of the respective device under SMS messages.
2. Open the context menu on the entry and select Send message.
3. In the Editor window that opens, enter the phone number of the recipient and the message content to be sent.
The number of characters is limited to one SMS text message (max. 160 characters). For an overview of available
characters, see the section
Character set for sending SMS
on page 1949.
4. Click Send to send the message via the internal SMS module.
URL placeholder for sending SMS text messages
You have the option of addressing the SMS module as an interface by means of a URL. By integrating predefined
placeholders (parameters) into the URL, you can use the device to send SMS text messages by means of an HTTP(S) call.
This makes LANCOM cellular routers ideal for use as an SMS gateway.
1948
Reference Manual
19 More services
5
SMS transmission is suitable for installations with a maximum throughput of 10 SMS per minute.
You use your access credentials to authenticate at the device; just how these are Integrated into the URL is determined
by your browser's requirements. The typical notation is Username:Password@Host.
5
Depending on the use case (for example, SMS gateway), we recommended that you create an administrator
without access rights (None) and with just one function right, Send SMS.
5
Not all Web browsers support the transmission of credentials via the URL. This includes current versions of the
Microsoft Internet Explorer, among others. In this case you should use another browser to send SMS via the URL.
The URL call uses the syntax:
(http|https)://<User>:<Password>@<Host>/sms/?<Param1>=<Value1>&…&oldauth
The parameter oldauth is vital, otherwise none of the available browsers will send the access credentials to the
device. In addition, the following placeholders are defined:
DestinationAddress
Phone number to which the device should send the SMS. The same conventions apply as for normal telephone
calls. Specify the parameters as follows:
&DestinationAddress=01511234567
&DestinationAddress=00491511234567
Content
Content of the text message. The number of characters is limited to one SMS text message (max. 160
characters). For an overview of available characters, see the section
Character set for sending SMS
on page
1949.
Spaces and other special characters to be included into an SMS must be sent to the device in the URL-encoded
form. For example, spaces are encoded with %20 and full stops with %2E. Specify the parameters as follows:
&Content=This%20is%20a%20message%2E
Learn more about this topic on the Internet under the keyword "URL encoding" and also at
www.w3schools.com
.
4
Some browsers perform the URL encoding automatically. Despite this, we recommend that you encode
the content yourself to ensure that all of the characters are converted correctly.
Character set for sending SMS
An SMS can contain a maximum of 160 characters (each of 7 bits = 1,120 bits). These are made up of the GSM basic
character set (total of 128 characters) as well as selected characters from the extended GSM character set. Although the
extended character set allows the use of some additional characters, these take up twice the space and correspondingly
reduce the maximum number of characters that the SMS can contain. Characters not implemented in the SMS module
are ignored by the device.
1949
Reference Manual
19 More services
The following characters are defined in the GSM basic character set:
The following characters are implemented from the extended GSM character set:
{|}[]~^\€
Additions to the Status menu
SMS
This menu contains the status values for the SMS module that handles the sending and receiving of text messages (SMS).
Telnet path:
Status
Inbox
This table caches all text messages (SMS) received by the device.
Telnet path:
Status > SMS
Idx
This status shows the index entry of the text message.
MsgRef
This status value groups multiple parts of a message into a single multi-part message.
PartNo
This status value indicates the order of multi-part messages.
Sender
This status value shows the number of the phone that sent the message to the device.
1950
Reference Manual
19 More services
Status
This status value indicates the read status for the message, i.e. if a message was already read by an
administrator or not.
Possible values:
1
new
1
read
Time stamp
This status value shows the time when the text message was received.
Contents
This status value displays the contents of the received message.
Outbox
This table stores all text messages (SMS) sent by the device.
Telnet path:
Status > SMS
Idx
This status shows the index entry of the text message.
MsgRef
This status value groups multiple parts of a message into a single multi-part message.
PartNo
This status value indicates the order of multi-part messages.
Destination
This status value shows the phone number that sent the device sent the message to.
Status
This status value displays the transmission status of the text message.
Possible values:
1
Unsent: The message was not yet passed to the radio module.
1
Sent: The message was passed to the service center for delivery to the recipient.
Time stamp
This status value shows the time when the text message was send.
Contents
This status value displays the contents of the sent message.
Inbox messages
This status value indicates the total number of messages that are in the Inbox.
Telnet path:
Status > SMS
1951
Reference Manual
19 More services
Unread messages
This status value indicates the total number of unread messages in the inbox.
Telnet path:
Status > SMS
Outbox messages
This status value indicates the total number of messages in the outbox.
Telnet path:
Status > SMS
SMSC address
This status value displays the phone number of the service center as stored on the USIM card of the device. In this case,
the service center is a unit in the network of your service provider, which forwards the messages between the network
and the device, and which caches them if necessary. The device uses this number unless there is a different number
under
SNMP-ID 2.83.1
.
Telnet path:
Status > SMS
Clear inbox
This action clears the table
1.83.1
.
Telnet path:
Status > SMS
Possible parameters:
No parameters available
Clear outbox
This action clears the table
1.83.2
.
Telnet path:
Status > SMS
Possible parameters:
No parameters available
Mark read inbox
With this action you can mark all of the messages stored in the table
1.83.1
as read.
Telnet path:
Status > SMS
Possible parameters:
No parameters available
1952
Reference Manual
19 More services
Additions to the Setup menu
SMS
This menu contains the settings for the SMS module that handles the sending and receiving of text messages (SMS).
Telnet path:
Setup
SMSC address
This parameter allows you to configure an alternative number for the "short message service center" (SMSC).
By default, the device uses the phone number stored in the USIM card, which you can view by calling the status value
SMSC number (
SNMP ID 1.83.5
). The SMS messages can be sent to a specific SMSC if you specify a different phone
number.
Telnet path:
Setup > SMS
Possible values:
Valid SMSC phone number, max. 31 characters
Default:
Inbox size
This parameter lets you set the maximum number of text messages stored in the device inbox. If the preset number is
exceeded, the oldest message will be deleted. In this case there is no SYSLOG entry.
Telnet path:
Setup > SMS
Possible values:
0 to 999999
Special values:
0: This value disables the limit, i.e. an unlimited number of messages will be stored.
Default:
100
Outbox size
This parameter lets you set the maximum number of text messages stored in the device outbox. If the preset number is
exceeded, the oldest message will be deleted. In this case there is no SYSLOG entry.
Telnet path:
Setup > SMS
Possible values:
0 to 999999
Special values:
0: This value disables the limit, i.e. an unlimited number of messages will be stored.
1953
Reference Manual
19 More services
Default:
100
Outbox preservation
This parameter defines what the device does with sent text messages.
Telnet path:
Setup > SMS
Possible values:
1
None: Sent messages are not saved.
1
All: Sent messages are saved permanently.
Default:
All
Mail-Forward-Addr.
This parameter sets an optional e-mail address, to which the device will forward any incoming text messages.
5
E-mail routing will only work if a valid SMTP account is configured in the device.
Telnet path:
Setup > SMS
Possible values:
Any valid e-mail address, max. 31 characters
Default:
Syslog
This parameter specifies if and how the arrival of text messages is logged to the SYSLOG.
Telnet path:
Setup > SMS
Possible values:
1
No: Incoming text messages are not logged to SYSLOG.
1
SenderOnly: The arrival of a text message is recorded to the SYSLOG together with the sender's phone
number.
1
Full: The arrival of a text message is recorded to the SYSLOG together with the sender's phone number
and the message in full.
Default:
No
1954
Reference Manual
19 More services
Enhancements to command-line commands
SMS send command
As of LCOS 8.84, you can manually send SMS text messages with the command-line entry smssend, assuming that
your device has a 3G/4G WWAN module.
Table 31: Overview of all commands available at the command line
DescriptionCommand
Available only on devices with 3G/4G WWAN module: Sends a text message to
the destination number entered.
smssend [-s <SMSC-Number>] (-d <Destination>)
(-t <Text>)
1
-s <SMSC-Number>: Alternative SMSC phone number (optional).
If you omit this part of the command, the device uses the phone number
stored on the USIM card or that configured under SNMP ID 2.83.
1
-d <Destination>: Destination phone number
1
-t <Text>: Contents of the message with <=160 characters For an
overview of available characters, see the section
Character set for sending
SMS
on page 1949. Special characters must be in UTF8 encoded form.
Legend
1
Characters and brackets:
2
Objects, in this case dynamic or situation-dependent, are in angle brackets.
2
Round brackets group command components, for a better overview.
2
Vertical lines (pipes) separate alternative inputs.
2
Square brackets describe optional switches.
It follows that all command components that are not in square brackets are necessary information.
19.19 Addition(s) to LCOS 9.00
19.19.1 Deactivating device LEDs – boot-persistent
To operate an access point as unobtrusively as possible, you can disable the operating and status LEDs on the device.
Even after restarting the device, the LEDs stay switched off. You can set up the device so that the LEDs light up briefly
for a certain time after a restart, before the device disables them. This is useful for access points that are managed by
WLAN controllers, for example to monitor the establishment of the connection to a WLAN controller.
You can set the operating mode of the LEDs in the Display section under Management > Advanced.
The selection list LED mode has three options to choose from:
Normal
The LEDs are always enabled, also after rebooting the device.
1955
Reference Manual
19 More services
All off
The LEDs are all off. Even after restarting the device, the LEDs remain off.
Timed off
After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This is useful for
the LEDs to indicate critical errors during the restart process.
The Timed off option uses the setting in the field LED switch-off delay in seconds to control the time before the LEDs
are disabled after a restart.
The "LED-Test" function is available despite the LEDs being disabled.
4
If you change this value and save it within the previously set time, you should restart the timer.
Additions to the Setup menu
LED mode
This sets the operating mode of the device LEDs.
The "LED test" function can still be run even if the LEDs are disabled.
SNMP ID:
2.11.90
Telnet path:
Setup > Config
Possible values:
On
The LEDs are always enabled, also after rebooting the device.
Off
The LEDs are all off. Even after restarting the device, the LEDs remain off.
Timed off
After a reboot, the LEDs are enabled for a certain period of time and are then turned off. This is useful
for the LEDs to indicate critical errors during the restart process.
Default:
On
LED-Off-Seconds
Here you set the time in seconds after which the device disables the LEDs following a restart.
4
If you change this to a value less than the previously set time, you have to save it and restart the timer.
1956
Reference Manual
19 More services
SNMP ID:
2.11.91
Telnet path:
Setup > Config
Possible values:
Max. 4 characters 0123456789
Default:
300
19.19.2 Comment box for CRON jobs
As of LCOS9.00 you can add comments to CRON job entries.
Configuring the scheduler
The following tutorial shows you how to create a new CRON job and which parameters are available to you.
1. In LANconfig, open the configuration for your device.
2. Open the Cron table in the dialog Date & Time > General and click Add... to create a new CRON job.
3. Enter a time base.
The time base determines whether LCOS performs the timing of future actions based on the real time or the uptime
of the device. With the setting Real time, the system evaluates time and dates. With the setting Operating time,
the system evaluates only the minutes and hours since the device was last started.
4. The value for Variation specifies the maximum delay in minutes for the start of the CRON job after the specified
start time.
The device determines the actual delay time at random. It lies between 0 and the time entered here. With the variation
set to zero the CRON job will be executed at the specified time.
5
Rules based on real-time can only be executed if the device has a time from a valid source, e.g. via NTP.
5. Enter the minute(s), hour(s), day(s) of the week, day(s) of the month and the month(s) when your device should
execute the specified command.
If you do not enter a value, your device ignores the corresponding value. For each parameter you can optionally
specify a comma-separated list of values or a range of values (in the form of <Min.>-<Max.>).
The syntax of the field Days of week corresponds to the usual CRON interpretation:
1957
Reference Manual
19 More services
SaturdayFridayThursdayWednesdayTuesdayMondaySunday
6543210
4
The day-of-the-week field is also significant for rules relating to the operating time. This is useful for actions
that you perform only once when you start the device (i.e., with zero days uptime). In this way you can match
the day of the week to the days of operating time, for example.
6. Under Commands you enter the command or a comma-separated list of commands.
Any command-line function can be executed.
7. Specify the Owner of the CRON job.
An owner is able to select an administrator defined in the device. If an owner is specified, then the CRON job
commands will be executed with the rights of the owner.
8. A brief description of the CRON job can be entered in the Comment field.
9. Click OK to save the entry. You then write the configuration back to the device.
Other configuration examples:
CommandMonthsM. daysW. daysHr.At leastTime base
do /so/man/disconnect internet1-121-310-640Real time
mailto:admin@example.com?sub-
ject=Forced-disconnect?body=Manual
Internet discconnect
1-121-310-6359Real time
do /setup/accounting/delete100Real time
do /so/man/connect MAINOFFICE1,2,3,4,5180Real time
1
The first entry disconnects from the ISP every morning at 04:00h (forced disconnect).
1
The second entry sends a brief e-mail to the admin each morning at 03:59h, just before the forced disconnect.
1
The third entry deletes the accounting table on the 1st day of each month.
1
The fourth entry establishes a connection to the main office each weekday at 18:00h.
5
The device executes scheduled rules with an accuracy of one minute. Please ensure that the language you use
to enter commands matches with that set for the console, otherwise scheduler commands will be ignored.
Additions to the Setup menu
Comment
This parameter is used to leave a comment about the entry in the CRON table.
SNMP ID:
2.11.20.12
Telnet path:
Setup > Config > Cron-Table
Possible values:
Max. 63 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
1958
Reference Manual
19 More services
19.19.3 LANCAPI disabled by default
As of LCOS9.00 LANCAPI is disabled for the individual interfaces by default.
Additions to the Setup menu
Active
You can specify if and how this interface is available for LANCAPI clients.
SNMP ID:
2.13.6.2
Telnet path:
Setup > LANCAPI > Interface-List
Possible values:
Yes
The device allows all calls through this interface.
No
The device allows no calls through this interface.
Dial-only
The device only allows outgoing calls through this interface.
Dial-in only
The device only allows incoming calls through this interface.
Default:
No
19.19.4 DHCP snooping and DHCP option 82
In its original form, DHCP has no safeguards to protect from attacks on the assignment of the network configuration.
For example, if a client sends a 'DHCP discover' packet on the network in order to retrieve a valid network configuration
from a DHCP server, an attacker can send the client fake 'DHCP offer' packets and trick it into using a false default
gateway (DHCP spoofing).
With DHCP snooping, the devices that receive and redirect DHCP packets are able to analyze and change these data
packets, and to filter them by certain criteria. Additionally inserted information about the origin of the DHCP packets
improves a DHCP server's capacity to manage extensive networks. Further, as this additional information is missing from
the attacker's DHCP packets, they can no longer be used to interfere with the DHCP negotiations between DHCP servers,
DHCP relay agents and the DHCP clients.
The access point supports DHCP snooping on layer 2. This enables it, for example, to add information (such as the SSID)
to the DHCP packets received from the client on the WLAN before forwarding them to the LAN. The access point then
adds the DHCP relay agent information option (option 82) according to RFC 3046.
1959
Reference Manual
19 More services
In LANconfig you can set up DHCP snooping for each interface under Interfaces > Snooping and a click on DHCP
snooping.
After selecting the appropriate interface, you can set the following:
Add agent info
Here you decide whether the DHCP relay agent appends incoming DHCP packets with the DHCP option "relay
agent info" (option 82), or modifies an existing entry, before forwarding the request to a DHCP server.
The "relay agent info" is composed of values for the Remote ID and the Circuit ID.
On present agent info
Here you set how the DHCP relay agent handles the "relay agent info" in incoming DHCP packets. The following
settings are possible:
1
Keep content: In this setting, the DHCP relay agent forwards a DHCP packet and any existing "relay agent
info" unchanged to the DHCP server.
1
Replace content: In this setting, the DHCP relay agent replaces any existing "relay agent info" with the
values specified in the fields Remote ID and Circuit ID.
1
Drop packet: In this setting, the DHCP relay agent deletes any DHCP packet containing "relay agent info".
Remote ID
The remote ID is a sub-option of the "Relay agent info" option. It uniquely identifies the client making a DHCP
request.
Circuit ID
The circuit ID is a sub-option of the "Relay agent info" option. It uniquely identifies the interface used by the
client to make a DHCP request.
1960
Reference Manual
19 More services
You can use the following variables for Remote ID and Circuit ID:
1
%%: Inserts a percent sign.
1
%c: Inserts the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface where the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For other clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
Additions to the Setup menu
DHCP snooping
Here you can configure DHCP snooping for each interface.
SNMP ID:
2.20.40
Telnet path:
Setup > LAN-Bridge
Port
Indicates the physical or logical interface to which this DHCP-snooping configuration applies.
SNMP ID:
2.20.40.1
Telnet path:
Setup > LAN-Bridge > DHCP-Snooping
Possible values:
LAN-x
All physical LAN interfaces
WLAN-x
All physical WLAN interfaces
WLAN-x-x
All logical WLAN interfaces
P2P-x-x
All logical P2P interfaces
1961
Reference Manual
19 More services
WLC-TUNNEL-x
All virtual WLC tunnels
Add-Agent-Info
Here you determine how the DHCP relay agent handles the incoming DHCP packets, i.e. whether it appends the DHCP
option "relay agent info" (option 82) or edits any existing "relay agent info", before forwarding the request to a DHCP
server.
This option allows the relay agent to deliver additional information to the DHCP server about the interface used by the
client to make the request.
The "relay agent info" consists of the Remote ID and the Circuit ID.
If these two fields are empty, the DHCP relay agent does not add any "relay agent info" to the data packets.
SNMP ID:
2.20.40.2
Telnet path:
Setup > LAN-Bridge > DHCP-Snooping
Possible values:
Yes
Adds "relay agent info" to the DHCP packets.
No
This setting disables DHCP snooping for this interface.
Default:
No
Treat-Existing-Agent-Info
Here you set how the DHCP relay agent handles the "relay agent info" in incoming DHCP packets.
SNMP ID:
2.20.40.3
Telnet path:
Setup > LAN-Bridge > DHCP-Snooping
Possible values:
Keep
In this setting, the DHCP relay agent forwards a DHCP packet and any existing "relay agent info"
unchanged to the DHCP server.
1962
Reference Manual
19 More services
Replace
In this setting, the DHCP relay agent replaces any existing "relay agent info" with the values specified
in the fields Remote ID and Circuit ID.
Discard
In this setting, the DHCP relay agent deletes any DHCP packet containing "relay agent info".
Default:
Keep
Remote ID
The remote ID is a sub-option of the "Relay Agent Info" option. It uniquely identifies the client making a DHCP request.
You can use the following variables:
1
%%: Inserts a percent sign.
1
%c: Adds the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.40.4
Telnet path:
Setup > LAN-Bridge > DHCP-Snooping
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
Circuit ID
The circuit ID is a sub-option of the "Relay Agent Info" option. It uniquely identifies the interface used by the client to
make a DHCP request.
You can use the following variables:
1963
Reference Manual
19 More services
1
%%: Inserts a percent sign.
1
%c: Adds the MAC address of the interface where the relay agent received the DHCP request. If a WLAN-SSID is
involved, then this is the corresponding BSSID.
1
%i: Inserts the name of the interface on which the relay agent received the DHCP request.
1
%n: Inserts the name of the DHCP relay agent as specified under Setup > Name.
1
%v: Inserts the VLAN ID of the DHCP request packet. This VLAN ID is sourced either from the VLAN header of the
DHCP packet or from the VLAN ID mapping for this interface.
1
%p: Inserts the name of the Ethernet interface that received the DHCP packet. This variable is useful for devices
featuring an Ethernet switch or Ethernet mapper, because they can map multiple physical interfaces to a single logical
interface. For other devices, %p and %i are identical.
1
%s: Inserts the WLAN SSID if the DHCP packet originates from a WLAN client. For others clients, this variable contains
an empty string.
1
%e: Inserts the serial number of the relay agent, to be found for example under Status > Hardware-Info > Serial
number.
SNMP ID:
2.20.40.5
Telnet path:
Setup > LAN-Bridge > DHCP-Snooping
Possible values:
Max. 30 characters [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_.
Default:
empty
19.19.5 Enabling LLDP with LANconfig
As of LCOS 9.00, LLDP can also be enabled via LANconfig.
In LANconfig, LLDP is enabled under Interfaces > LAN.
19.19.6 Wildcard certificates in the LANCOM Content Filter
As of LCOS 9.00 you have the possibility of using wildcard certificates in the LANCOM Content Filter.
1964
Reference Manual
19 More services
Allow wildcard certificates
With this feature enabled, Web sites with wildcard certificates (consisting of CN entries such as
*.mydomain.com) are verified using the main domain (mydomain.com). Verification is evaluated
in this sequence:
1
Server name check in the “Client Hello” (depends on the browser used)
1
Check of the CN in the SSL certificate that you received
1
Entries with wildcards are ignored
1
If the CN cannot be verified, the field “Alternative Name”is evaluated.
1
DNS reverse lookup of the associated IP address and verification of the host name obtained
1
If wildcards are included in the certificate, the main domain is checked instead (corresponds to the above
function)
1
Verification of the IP address
Additions to the Setup menu
Wildcard
With this feature enabled, Web sites with wildcard certificates (consisting of CN entries such as *.mydomain.com)
are verified using the main domain (mydomain.com). The check takes place in this order:
1
Verification of the server name in the “Client Hello” (depending on the browser used)
1
Verification of the CN in the SSL certificate that you received
1
Entries with wildcards are ignored
1
If the CN cannot be verified, the field “Alternative Name” is evaluated
1
DNS reverse lookup of the associated IP address and verification of the host name obtained
1
If wildcards are included in the certificate, the main domain is checked instead (corresponds to the above function)
1
Verification of the IP address
SNMP ID:
2.41.2.2.29
Telnet path:
Setup > UTM > Content-Filter > Global-Settings
Possible values:
No
Yes
Default:
No
1965
Reference Manual
19 More services
19.20 Addition(s) to LCOS 9.10
19.20.1 Smart certificates
As of LCOS version 9.10 you have the option to use a LANCOM router to create and issue digital
certificates.
Furthermore, LANmonitor as of LCOS version 9.10 displays an overview of active and revoked certificates.
Table 32: Overview of function rights
Rights descriptionHex notation in the
console
Description: [1]LANconfig, [2]Setup menu
Creates profiles for the CA web interface0x10000001. CA-Web-Interface Wizard
2. CA-Web-Interface
Using smart certificates
The configuration of the SCEP client for the generation and distribution of certificates can quickly become a complex
and laborious task in extensive network infrastructures. This work required for this task can be reduced with the help of
predefined, selectable profiles and access via a web interface.
A LANCOM router enables you to create and issue highly secure certificates. It is easy to manage the certificates via the
WEBconfig interface of the corresponding device. An external CA is no longer required, which is particularly advantageous
for small-scale infrastructures.
Using the Certificate Wizard from LANCOM, even users without certificate know-how can create certificates in just a few
steps.
The devices administrator creates the profile as a collection of certificate properties. It contains the configuration of the
certificate and also a unique certificate ID. From this point on, all you need to do to create and distribute a certificate is
to select one of the profiles.
Profiles can also be managed in LANconfig under Certificates > Certificate handling in the section CA web interface.
1966
Reference Manual
19 More services
Creating templates for certificate profiles
In LANconfig, profiles are created under Certificates > Certificate handling > Templates.
4
A “DEFAULT” a template is already available.
The administrators specifies which of the profile properties are mandatory and which are to be edited by the user. The
following options are available:
1
No: The field is invisible, the value entered is considered to be a default value.
1
Fixed: The field is visible, but cannot be changed by the user.
1
Yes: The field is visible and can be changed by the user.
1
Mandatory: The field is visible, the user must enter a value.
These permissions apply to the following profile and ID fields:
Profile fields
1
Key usage
1
Key usage (extended)
1
RSA key length
1
Validity period
1
Create CA certificate
1
Password
Identifier
1
Country code (C)
1
Locality name (L)
1
Organization (O)
1
Organization unit (OU)
1
State or province (ST)
1
E-mail (E)
1
Surname (SN)
1967
Reference Manual
19 More services
1
Serial no. (serialNumber)
1
Postal code (postalCode)
1
Subject alt. name
4
If the Templates table is empty, the user can only see the input fields for the profile name, the common name
(CN), and the password. The other profile fields retain the default values as set by the device administrator.
Creating a profile in LANconfig
4
The user needs the appropriate access rights to create, select, modify and assign profiles.
In LANconfig, profiles are created under Certificates > Certificate handling > Profile.
4
By default three profiles are already available for common application scenarios.
Profile name
The unique name of the profile.
Profile template
Select a suitable profile template here, if applicable.
The profile template specifies which certificate information is mandatory and which can be changed. Templates
are created under Certificates > Certificate handling > Templates.
Key usage
Specifies for which application the profile is to be used. The following usages are available using the Select
button:
1968
Reference Manual
19 More services
Table 33: The available key usages
MeaningValue
This restriction requires the extended key usage to be considered. If the extension is not supported,
the certificate is rejected as invalid.
critical
Is this option is used, the public key is used for digital signatures.digitalSignature
With this option set, the key is used for digital signatures of a non-repudiation service, i.e. one with
a rather long-term character such as notary public service.
nonRepudiation
If this option is set, the key is used for encrypting other keys or security information. It is possible
to restrict the use of encipher only and decipher only.
keyEncipherment
If this option is set, the key is used for encrypting user data (but not other keys).dataEncipherment
If this option is used, the "Diffie-Hellman" algorithm is used for key agreement.keyAgreement
If this option is set, the key is applied to certificates for signature verification. This is useful for CA
certificates, for example.
keyCertSign
If this option is set, the key is applied to CRLs for signature verification. This is useful for CA
certificates, for example.
cRLSign
This is only useful with the Diffie-Hellman keyAgreement.encipherOnly
This is only useful with the Diffie-Hellman keyAgreement.decipherOnly
5
Multiple comma-separated entries can be selected.
Ext. key usage
Specifies the extended application for which the profile is to be used. The following usages are available using
the Select button:
Table 34: Extended usages
MeaningValue
critical
SSL/TLS Web server authenticationserverAuth
SSL/TLS Web client authenticationclientAuth
Signing of program codecodeSigning
E-mail protection (S/MIME)emailProtection
Furnishing data with reliable time stampstimeStamping
Microsoft Individual Code Signing (authenticode)msCodeInd
Microsoft Commercial Code Signing (authenticode)msCodeCom
Microsoft Trust List SigningmsCTLSign
Microsoft Server Gated CryptomsSGC
Microsoft Encrypted File SystemmsEFS
Netscape Server Gated CryptonsSGC
5
Multiple comma-separated entries can be selected.
1969
Reference Manual
19 More services
RSA key length
Sets the length of the key.
Validity period
Specifies the duration, in days, for which the key is valid. After this period, the key becomes invalid unless
the user renews it.
Create CA certificate
Indicates whether this is a CA certificate.
Password
Password to protect the PKCS12 certificate file.
The following input creates a certificate ID. The following options are available:
Country code (C)
Enter the country identifier (e.g. “DE” for Germany).
This entry appears in the subject or issuer of the certificate under C= (Country).
Locality name (L)
Enter the name of the locality.
This entry appears in the subject or issuer of the certificate under L= (Locality).
Organization (O)
Specify the organization that issues the certificate.
This entry appears in the subject or issuer of the certificate under O= (Organization).
Organization unit (OU)
Specify the unit within the organization that issues the certificate.
This entry appears in the subject or issuer of the certificate under OU= (Organization Unit).
State or province (ST)
Enter the State or province.
This entry appears in the subject or issuer of the certificate under ST= (STate).
E-mail (E)
Enter an e-mail address:
This entry appears in the subject or issuer of the certificate under emailAddress=.
Surname (SN)
Enter a surname.
This entry appears in the subject or issuer of the certificate under SN= (SurName).
Serial no. (serialNumber)
Enter a serial number.
This entry appears in the certificate under serialNumber=.
Postal code (postalCode)
Enter the location post code.
This entry appears in the subject or issuer of the certificate under postalCode=.
1970
Reference Manual
19 More services
Subject alt. name (SAN)
The “Subject Alternative Name” (SAN) links additional data with this certificate. The following data are allowed:
1
E-mail addresses
1
IPv4 or IPv6 addresses
1
URIs
1
DNS names
1
Directory names
1
Any names
This entry appears in the subject or issuer of the certificate under subjectAltName= (e.g.
subjectAltName=IP:192.168.7.1).
4
The certificate issuer assigns the general name "CN". The "CN" is required as a minimum.
Certificate creation with WEBconfig
4
You need the appropriate access rights to select, modify and assign profiles.
To create your certificates, navigate to the WEBconfig of the LANCOM device.
1. To create a certificate using the web interface, navigate to the view Setup Wizards > Manage certificates and
select Create new certificate.
2. From the Profile name drop-down menu, select the profile to be used as the basis for the certificate.
4
Empty templates only contain fields with the selection “No”. If the user selects a profile based on an empty
template, the input mask displays only the common name. The other profile fields retain the default values
as set by the device administrator.
3. Fill out the common name (CN) field. Set a validity period for the certificate and give it a secure password (PIN).
The other fields such as Email and Organization name are optional information. However, under certain circumstance
this information can help to find the certificate recipient if there are problems with the certificate.
1971
Reference Manual
19 More services
5
The following characters are allowed in the password: [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
4. To complete of the changes, click the Enroll (PKCS12) button. In the following dialog box, you can set the name
and location of the file.
4
The newly created certificates appear in the certificate status table under Status > Certificates > SCEP-CA >
Certificates.
5. Issue the newly enrolled certificate to the recipient together with the access password set in step 3.
6. The recipient is now able to use a secure VPN dial-in. For the dial-in to succeed, the user must enter the password
(PIN) set in step 3.
Certificate management with WEBconfig
4
You need the appropriate permissions to be able to manage the certificates.
To manage a certificate via the web interface, navigate to the view Setup Wizards > Manage certificates. This gives
you an overview of the enrolled certificates, which you can revoke if necessary.
The column headers have the following meanings:
1972
Reference Manual
19 More services
Page
This column is used to mark the entry.
Index
Displays the sequential index of the entry.
Name
Displays the name the certificate.
Serial number
Contains the serial number of the certificate.
Status
Displays the current status of the certificate. Possible values are:
1
V: Valid
1
R: Revoked
1
P: Pending
Creation date
Displays the date of the certificate's creation (date, time).
Ending time
Indicates the date and time of (regular) certificate expiry.
Revocation time
Indicates the date and time of (premature) certificate revocation.
Revoke reason
Indicates the cause of the premature revocation. The selection is made via a drop-down selection list.
To revoke a certificate, select it in the Page column, in the Revoke reason column you select why you are revoking the
certificate, and then click the Revoke button.
The column entries for Status, Revocation time and Revoke reason change accordingly.
To reverse a revocation, highlight the certificate again in the first column and click Set as valid again.
1973
Reference Manual
19 More services
Managing certificates in LANmonitor
LANmonitor displays the active and revoked certificates, as well as the certificate requests from the SCEP clients.
To revoke a certificate, right-click on the corresponding certificate and select Revoke certificate from the context menu.
An overview of all revoked certificates is located in the Revoked section.
Certificate requests from SCEP clients can be seen in the Pending requests section. Right-click on the corresponding
request and select either Reject or Accept in the context menu.
Creating certificates via URL-API
A special API can greatly simplify the creation of certificates for a complex and extensive network infrastructure.
For example, you can use a script to automate the process by sending a call to a URL with parameters attached. The
following parameters are possible:
1
a: Specifies the profile name.
1
b: Specifies the common name.
1
c: Specifies the surname.
1
d: Specifies the email.
1
e: Specifies the organization.
1
f: Specifies the organization unit.
1
g: Specifies the locality.
1
h: Specifies the State or province.
1
i: Specifies the country.
1
j: Specifies the postal code.
1
k: Specifies the serial number.
1
l: Specifies the subject alternative name.
1
m: Specifies the key usage.
1
n: Specifies the extended key usage.
1
o: Specifies the key length
1
p: Specifies the validity period in days.
1
q: Specifies the password for the PKCS12 file.
1974
Reference Manual
19 More services
1
r: Indicates whether this is a CA certificate.
2
1: CA certificate
2
0: No CA certificate
5
The Wizard only processes the parameters set with the appropriate permissions in the presets table.
The call to the URL with the appropriate parameters looks like this:
192.168.10.74/scepwiz/a=VPN&b=iPhone&q=company
Tutorials
Setting up a CA and creating and using certificates for a VPN connection
This tutorial describes how you enable a CA (certificate authority) on a LANCOM router and how the CA helps you to
create and use new certificates for a VPN connection between two LANCOM routers (manual certificate distribution).
5
All devices need to be set with a valid date and time.
1. You enable the certificate authority in LANconfig and you set the device as the root CA. You will find these settings
under Certificates > Cert. authority (CA).
2. You are now able to create CA certificates for the VPN endpoints that will later provide the connection.
a) The Setup Wizard Manage certificates helps you to create certificates easily and conveniently.
1975
Reference Manual
19 More services
b) The first page of the Wizard is an overview of all certificates previously issued by the CA.
5
The certificate of the CA itself is not displayed here.
With the Create new certificate button you start the process that generates a new certificate.
c) Under the entry to Enroll certificates, you have the option to configure the profile, the official name of the
certificate (common name or CN), and other information that is useful for identifying the certificate. Set the
validity period of the certificate and the password for the Pkcs12 file that contains the new certificate, the
corresponding private key, and the certificate of the CA.
Once you have entered all the necessary information, you create the certificate by clicking the button Enroll
(Pkcs12). The dialog for saving the Pkcs12 file appears automatically once the certificate has been created on
the device. This process can take several seconds.
d) In the Save the Pkcs12 file window, choose the location and name of the Pkcs12 file. By default, the file is
named according to the following format:
pkcs12<YYYY_MM_DD-hh_mm_ss>.p12
YearYYYY:
MonthMM:
DayDD:
Hourhh:
Minutemm:
1976
Reference Manual
19 More services
Secondss:
5
As shown by the example, the file can have any name.
e) Use the same method to create further certificates.
5
Overview page with two created certificates.
3. In order to use the certificates for a VPN connection, you need to upload them to the devices.
a) Uploading to the corresponding VPN endpoints is easy to do with WEBconfig under File management > Upload
certificate or file.
b) Upload certificate or file
First, select the file type and where to save it. For VPN connections, please choose an unused VPN container.
5
As long as no certificates were set up for VPN, all of the VPN containers are unused.
In the next step you select the Pkcs12 file that contains the certificate that you want to use for this VPN endpoint.
Enter the password that you have set for the file in step 2.c.
1977
Reference Manual
19 More services
Finally, start the upload.
5
This process is required for all VPN endpoints. Please bear in mind that each VPN endpoint needs a
certificate of its own.
4. Establish a VPN connection between two VPN endpoints. This is carried out via the Setup Wizard Connect two local
area networks (VPN).
a) In the Setup Wizard, set the VPN connection authentication to Certificates (RSA signature).
b) In the Local and remote identity window, specify the "ASN.1-Distinguished-Name". This is the official name
of the certificate plus any additional information that you entered in step 2.c. You can see this additional
information in the overview of certificates (step 2.e) in the "Name" column. For the Local identity, enter the
information for the certificate on the local machine. The item Remote identity contains the certificate information
of the other VPN endpoint.
c) Continue to run the Wizard. You repeat this process for the other VPN endpoint of this VPN connection.
1978
Reference Manual
19 More services
Setting up a CA and creating and using certificates for a VPN connection with certificate rollout via SCEP
This tutorial describes how you enable a CA (certificate authority) on a LANCOM router and how the CA helps you to
create and use new certificates for a VPN connection between two LANCOM routers (certificate distribution via SCEP).
5
We only explain the menu items that are important for the successful conclusion of the tutorial.
5
All devices must be set with the correct date and time and the certificate authority must be accessible via "HTTPS".
1. You enable the certificate authority in WEBconfig or LANconfig and you set the device as the root CA. You will find
these settings under Certificates > Cert. authority (CA).
2. SCEP clients can automatically obtain certificates by SCEP (simple certificate enrollment protocol). A necessary step
for this is for you to set a general challenge password in the root CA. Set a password at Certificates > Certificate
handling.
5
If you write the configuration back to the device after enabling the CA, the CA automatically generates a
general challenge password.
You are now able to create CA certificates for the VPN endpoints that will later provide the connection.
1979
Reference Manual
19 More services
3. In order for the VPN endpoints to obtain their certificates via SCEP, the SCEP client must be configured on each of
them. This setting is located under Certificates > SCEP client.
a) Specify the further information about the certificate authority under Certificates > SCEP client > CA table.
This table contains information about the CA from which a certificate is to be obtained.
Name
The name can be freely selected and used to identify this device.
URL
The URL is always constructed in the same way: https://<IP
address>/cgi-bin/pkiclient.exe. Replace <IP address> with the IPv4 address where
the CA is accessible from the WAN.
5
If the VPN endpoint is also the CA, you need to enter the loopback address here.
Distinguished name
The distinguished name of the CA (see screenshot in step 1).
1980
Reference Manual
19 More services
b) The additional information about the certificate that the CA is to issue to this device is specified under
Certificates > SCEP client > Certificate table.
Name
The name can be freely selected and used to identify this device.
CA Distinguished Name
The CA distinguished name (see screenshot in step 1).
Subject
The desired distinguished name of the certificate. In this example, only the common name is used.
Challenge password
The general challenge password set on the certificate authority (see step 2).
Usage type
The location where this certificate is to be stored. In this example "VPN 1".
4. Once you have set up a SCEP client on each of the VPN endpoints, you can establish a VPN connection between two
VPN endpoints. This is carried out via the Setup Wizard Connect two local area networks (VPN).
a) In the Setup Wizard, set the VPN connection authentication to Certificates (RSA signature).
b) In the Local and remote identity window, specify the "ASN.1-Distinguished-Name". This is the official name
of the certificate plus any additional information that you entered under "Subject" in step 3.b. For the Local
1981
Reference Manual
19 More services
identity, enter the information for the certificate on the local machine. The item Remote identity contains the
certificate information of the other VPN endpoint.
c) Continue to run the Wizard. You repeat this process for the other VPN endpoint of this VPN connection.
Additions to the Status menu
SCEP-CA
Displays an overview of SCEP CA certificates and requests and allows you to manage these certificates.
SNMP ID:
1.61.2
Telnet path:
Status > Certificates
Certificates
Displays current SCEP CA certificates and allows you to manage them.
SNMP ID:
1.61.2.1
Telnet path:
Status > Certificates > SCEP-CA
Certificate status table
This table displays the status of current SCEP CA certificates.
SNMP ID:
1.61.2.1.1
1982
Reference Manual
19 More services
Telnet path:
Status > Certificates > SCEP-CA > Certificates
Index
Displays the sequential index of the entry.
SNMP ID:
1.61.2.1.1.1
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Serial number
Displays the serial number of the certificate.
This entry appears in the certificate under serialNumber=.
SNMP ID:
1.61.2.1.1.2
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Status
Displays the status of the certificate. Possible values are:
1
V: Valid
1
R: Revoked
1
P: Pending
SNMP ID:
1.61.2.1.1.3
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Creation date
Displays the creation date of the certificate.
1983
Reference Manual
19 More services
SNMP ID:
1.61.2.1.1.4
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Ending time
Displays the expiry time of the certificate.
This entry appears in the certificate under Validity.
SNMP ID:
1.61.2.1.1.5
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Revocation time
Displays the certificate revocation time if the certificate has been revoked.
SNMP ID:
1.61.2.1.1.6
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Revoke reason
Displays the reason for certificate revocation if the certificate has been revoked.
SNMP ID:
1.61.2.1.1.7
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Possible values:
unspecified
No reason given.
keyCompromise
The private key is compromised.
cACompromise
The private CA key is compromised.
1984
Reference Manual
19 More services
affiliationChanged
Details of the holder or the issuer of the certificate have changed.
superseded
The certificate is outdated and has been replaced by a new certificate.
cessationOfOperation
The certificate is no longer required for the original purpose.
certificateHold
The certificate is on hold until it is finally revoked or released again.
privilegeWithdrawn
The certificate contains a right that is not longer valid.
aACompromise
The private AA key is compromised.
MAC address
Displays the MAC address of the device for which the certificate was issued.
SNMP ID:
1.61.2.1.1.8
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Name
Displays the CN of the certificate.
SNMP ID:
1.61.2.1.1.9
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
Profile name
Displays the name of the profile that the certificate is based on.
SNMP ID:
1.61.2.1.1.10
Telnet path:
Status > Certificates > SCEP-CA > Certificates > Certificate status table
1985
Reference Manual
19 More services
Revoke certificate
This action revokes a certificate. This is necessary if the certificate has been compromised or if there have been changes
(rights, information about the issuer) to the certificate.
This action requires the specification of up to three parameters in the form <Index>,<Reason>[,<Date>]:
Index
The index of the corresponding certificate in the certificate table (required).
Reason
The reason of the revocation (required). The following values are possible:
1
0: Unspecified
1
1: Key compromise
1
2: CA compromise
1
3: Affiliation changed
1
4: Superseded
1
5: Cessation of operation
1
6: Certificate hold
1
8: Remove from CRL
1
9: Privilege withdrawn
1
10: Attribute authority compromise
Date
This specification describes the time in UTC format (YYMMDDHHSSZ) when the certificate is compromised
(optional if you specify the reasons 1, 2 and 10).
5
Specify the parameters each separated by a comma and without spaces.
4
Entering ? generates a help text.
SNMP ID:
1.61.2.1.2
Telnet path:
Status > Certificates > SCEP-CA > Certificates
Set certificate on hold
This action sets a certificate on “Hold”. This option is available if you want to clarify the status of the certificate before
fully revoking it.
This action requires a parameter to be specified in the form <Index>:
Index
The index of the corresponding certificate in the certificate table (required).
4
Entering ? generates a help text.
1986
Reference Manual
19 More services
SNMP ID:
1.61.2.1.3
Telnet path:
Status > Certificates > SCEP-CA > Certificates
Declare certificate as valid again
With this action you declare a certificate that was previously on “Hold” to be valid again.
This action requires an index list to be specified in the form <Index1>,<Index2>,<Index3>:
Indexn
The indexes of the corresponding certificates in the certificate table (required).
5
Specify the indexes each separated by a comma and without spaces.
4
Entering ? generates a help text.
SNMP ID:
1.61.2.1.4
Telnet path:
Status > Certificates > SCEP-CA > Certificates
Requests
Displays current requests for SCEP CA certificates and allows you to manage them.
SNMP ID:
1.61.2.2
Telnet path:
Status > Certificates > SCEP-CA
Pending-Requests
This table displays the status of pending requests for SCEP CA certificates.
SNMP ID:
1.61.2.2.1
Telnet path:
Status > Certificates > SCEP-CA > Requests
1987
Reference Manual
19 More services
Index
Displays the sequential index of the entry.
SNMP ID:
1.61.2.2.1.1
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
Transaction ID
Displays the transaction ID of the entry.
SNMP ID:
1.61.2.2.1.2
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
MAC address
Displays the MAC address of the requesting device.
SNMP ID:
1.61.2.2.1.3
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
Name
Displays the name of the requesting device.
SNMP ID:
1.61.2.2.1.4
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
IP address
Displays the IP address of the requesting device.
1988
Reference Manual
19 More services
SNMP ID:
1.61.2.2.1.5
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
PKI-Status
Displays the status of the public-key infrastructure of the requesting device.
SNMP ID:
1.61.2.2.1.6
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
Reason
Displays the reason for the request.
SNMP ID:
1.61.2.2.1.7
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
DN
Displays the fingerprint for the request.
SNMP ID:
1.61.2.2.1.8
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
Receive date
Displays the time of the request.
SNMP ID:
1.61.2.2.1.9
1989
Reference Manual
19 More services
Telnet path:
Status > Certificates > SCEP-CA > Requests > Pending-requests
Issue certificate
With the syntax do Issue-Certificate [index-list] you issue a SCEP-CA certificate for a device.
[index-list] is a comma-separated list of the indexes from the table "Pending requests". Each request index
entered here receives a certificate.
SNMP ID:
1.61.2.2.2
Telnet path:
Status > Certificates > SCEP-CA > Requests
Grant all certificates
With the syntax do Issue-Certificate you issue a SCEP-CA certificate for all devices. You do not have to
specify any additional parameters. All pending requests will receive a certificate.
SNMP ID:
1.61.2.2.3
Telnet path:
Status > Certificates > SCEP-CA > Requests
Decline request
With the syntax do Decline-Request [index-list], you reject the request from a device.
[index-list] is a comma-separated list of the indexes from the table "Pending requests". Any request with the
index you specified will be declined. The requesting device does not receive a certificate.
SNMP ID:
1.61.2.2.4
Telnet path:
Status > Certificates > SCEP-CA > Requests
Deny all requests
With the syntax do Deny-all-requests [index-list], you reject the requests from all devices. You do
not have to specify any additional parameters. All pending requests will be rejected.
1990
Reference Manual
19 More services
SNMP ID:
1.61.2.2.5
Telnet path:
Status > Certificates > SCEP-CA > Requests
Delete-pending-request
You delete a pending request with the syntax do Delete-Pending-Request [index-list].
[index-list] is a comma-separated list of the indexes from the table "Pending requests". Any request with the
index you specified will be deleted.
SNMP ID:
1.61.2.2.6
Telnet path:
Status > Certificates > SCEP-CA > Requests
Delete-all-pending-requests
With the syntax do Delete-all-pending-requests you delete all pending requests. You do not have to
specify any additional parameters. All pending requests will be deleted.
SNMP ID:
1.61.2.2.7
Telnet path:
Status > Certificates > SCEP-CA > Requests
CA-Status
Displays the current status of SCEP-CA certificates and allows you to manage them.
SNMP ID:
1.61.2.3
Telnet path:
Status > Certificates > SCEP-CA
Log table
This table displays current events relating to the CA status.
1991
Reference Manual
19 More services
SNMP ID:
1.61.2.3.7
Telnet path:
Status > Certificates > SCEP-CA > CA-Status
Web interface
This directory gives you an overview of the settings for the SCEP-CA web interface.
SNMP ID:
1.61.2.4
Telnet path:
Status > Certificates > SCEP-CA
Profiles
The configured profiles are shown in this table. To view the certificate properties, click on a profile name.
SNMP ID:
1.61.2.4.1
Telnet path:
Status > Certificates > SCEP-CA > Web-Interface
Template
The templates for the certificate profiles are shown in this table. To view the custom settings, click the name of a template.
SNMP ID:
1.61.2.4.2
Telnet path:
Status > Certificates > SCEP-CA > Web-Interface
Additions to the Setup menu
Web interface
In this directory, you configure the settings for the SCEP-CA web interface.
SNMP ID:
2.39.2.14
1992
Reference Manual
19 More services
Telnet path:
Setup > Certificates > SCEP-CA
Profiles
In this table you create profiles with collected certificate properties.
4
By default three profiles are already available for common application scenarios.
SNMP ID:
2.39.2.14.1
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface
Profile name
Here you assign a unique name for the profile.
SNMP ID:
2.39.2.14.1.1
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Key usage
Specifies for which application the profile is to be used. The following usages are available:
1
critical
1
digitalSignature
1
nonRepudiation
1
keyEncipherment
1
dataEncipherment
1
keyAgreement
1
keyCertSign
1
cRLSign
1
encipherOnly
1
decipherOnly
1993
Reference Manual
19 More services
Multiple comma-separated entries can be selected.
SNMP ID:
2.39.2.14.1.2
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 251 characters from [A-Z][a-z][0-9]#@{|}~!"$%&'()*+-,/:;<=>?[\]^_. `
Default:
critical,digitalSignature,keyEncipherment
Extended key usage
Specifies the extended application for which the profile is to be used. The following usages are available:
1
critical
1
serverAuth: SSL/TLS Web server authentication
1
clientAuth: SSL/TLS Web client authentication
1
codeSigning: Signing of program code
1
emailProtection: E-mail protection (S/MIME)
1
timeStamping: Furnishing data with reliable time stamps
1
msCodeInd: Microsoft Individual Code Signing (authenticode)
1
msCodeCom: Microsoft Commercial Code Signing (authenticode)
1
msCTLSign: Microsoft Trust List Signing
1
msSGC: Microsoft Server Gated Crypto
1
msEFS: Microsoft Encrypted File System
1
nsSGC: Netscape Server Gated Crypto
Multiple comma-separated entries can be selected.
SNMP ID:
2.39.2.14.1.3
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 251 characters from [A-Z][a-z][0-9]#@{|}~!"$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
RSA key length
Sets the length of the key.
1994
Reference Manual
19 More services
SNMP ID:
2.39.2.14.1.4
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
1024
2048
3072
4096
8192
Default:
2048
Validity period
Specifies the duration, in days, for which the key is valid. After this period, the key becomes invalid unless the user renews
it.
SNMP ID:
2.39.2.14.1.5
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 10 characters from 0123456789
Default:
365
CA
Indicates whether this is a CA certificate.
SNMP ID:
2.39.2.14.1.6
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
1995
Reference Manual
19 More services
Possible values:
Yes
No
Default:
No
Password
Password to protect the PKCS12 certificate file.
SNMP ID:
2.39.2.14.1.7
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
Country
Enter the country identifier (e.g. “DE” for Germany).
This entry appears in the subject or issuer of the certificate under C= (Country).
SNMP ID:
2.39.2.14.1.8
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
2 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Locality name
Enter the name of the locality.
This entry appears in the subject or issuer of the certificate under L= (Locality).
1996
Reference Manual
19 More services
SNMP ID:
2.39.2.14.1.9
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Organization
Enter the organization that issues the certificate.
This entry appears in the subject or issuer of the certificate under O= (Organization).
SNMP ID:
2.39.2.14.1.10
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Organization unit name
Enter the organization that issues the certificate.
This entry appears in the subject or issuer of the certificate under OU= (Organization Unit).
SNMP ID:
2.39.2.14.1.11
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
1997
Reference Manual
19 More services
State or province
Enter the State or province.
This entry appears in the subject or issuer of the certificate under ST= (STate).
SNMP ID:
2.39.2.14.1.12
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
E-mail
Enter an e-mail address:
This entry appears in the subject or issuer of the certificate under emailAddress=.
SNMP ID:
2.39.2.14.1.13
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 36 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Surname
Enter a surname.
This entry appears in the subject or issuer of the certificate under SN= (SurName).
SNMP ID:
2.39.2.14.1.14
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
1998
Reference Manual
19 More services
Default:
empty
Serial number
Enter a serial number.
This entry appears in the certificate under serialNumber=.
SNMP ID:
2.39.2.14.1.15
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 32 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Postal code
Enter the location post code.
This entry appears in the subject or issuer of the certificate under postalCode=.
SNMP ID:
2.39.2.14.1.16
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 25 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Template
Select a suitable profile template here, if applicable.
The profile template specifies which certificate information is mandatory and which can be changed. Templates are
created under Setup > Certificates > SCEP-CA > Web-Interface > Template.
1999
Reference Manual
19 More services
SNMP ID:
2.39.2.14.1.17
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 31 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Subject-Alternative-Name
Specify the subject alternative name (SAN) here. The SAN contains further information for use by applications.
SNMP ID:
2.39.2.14.1.18
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Profiles
Possible values:
Max. 254 characters from [A-Z][0-9]@{|}~!$%&'()+-,/:;<=>?[\]^_.
Default:
empty
Template
In this table, you define the templates for certificate profiles.
Here you specify which of the profile properties are mandatory and which are to be edited by the user. The following
options are available:
1
No: The field is invisible, the value entered is considered to be a default value.
1
Fixed: The field is visible, but cannot be changed by the user.
1
Yes: The field is visible and can be changed by the user.
1
Mandatory: The field is visible, the user must enter a value.
4
A “Default” template is already available.
SNMP ID:
2.39.2.14.2
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface
2000
Reference Manual
19 More services
Name
Give the template a unique name here.
SNMP ID:
2.39.2.14.2.1
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Max. 31 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*-:<>?[\]_.
Default:
empty
Key usage
Specifies for which application the profile is to be used.
SNMP ID:
2.39.2.14.2.2
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Extended key usage
Specifies the extended application for which the profile is to be used.
2001
Reference Manual
19 More services
SNMP ID:
2.39.2.14.2.3
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
RSA key length
Sets the length of the key.
SNMP ID:
2.39.2.14.2.4
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
2002
Reference Manual
19 More services
Validity period
Specifies the duration, in days, for which the key is valid. After this period, the key becomes invalid unless the user renews
it.
SNMP ID:
2.39.2.14.2.5
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
CA
Indicates whether this is a CA certificate.
SNMP ID:
2.39.2.14.2.6
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
2003
Reference Manual
19 More services
Default:
Yes
Password
Password to protect the PKCS12 certificate file.
SNMP ID:
2.39.2.14.2.7
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Country
Specifies the country identifier (e.g. “DE” for Germany).
SNMP ID:
2.39.2.14.2.8
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
2004
Reference Manual
19 More services
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Locality name
Specifies the locality.
SNMP ID:
2.39.2.14.2.9
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Organization
Specifies the organization issuing the certificate.
SNMP ID:
2.39.2.14.2.10
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
2005
Reference Manual
19 More services
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Organization unit name
Specifies the unit within the organization that issues the certificate.
SNMP ID:
2.39.2.14.2.11
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
State or province
Specifies the State or province.
2006
Reference Manual
19 More services
SNMP ID:
2.39.2.14.2.12
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
E-mail
Specifies the e-mail address.
SNMP ID:
2.39.2.14.2.13
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
2007
Reference Manual
19 More services
Surname
Specifies the surname.
SNMP ID:
2.39.2.14.2.14
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Serial number
Specifies the serial number.
SNMP ID:
2.39.2.14.2.15
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
2008
Reference Manual
19 More services
Default:
Yes
Postal code
Specifies the postal code.
SNMP ID:
2.39.2.14.2.16
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
Subject-Alternative-Name
The “Subject Alternative Name” (SAN) links additional data with this certificate.
SNMP ID:
2.39.2.14.2.17
Telnet path:
Setup > Certificates > SCEP-CA > Web-Interface > Template
Possible values:
Yes
The field is visible and can be changed by the user.
No
The field is invisible, the value entered is considered to be a default value.
2009
Reference Manual
19 More services
Mandatory
The field is visible, the user must enter a value.
Fixed
The field is visible, but cannot be changed by the user.
Default:
Yes
19.20.2 ISDN
Additions to the Status menu
PCM-SYNC-SOURCE
This value indicates which ISDN interface provides the clock signal for the PCM bus. The PCM bus transfers the internal
calls between the various interfaces (ISDN, analog and SIP).
SNMP ID:
1.33.2.2
Telnet path:
Status > ISDN > Framing
PCM-Switch
This menu contains the status values for the PCM switch.
SNMP ID:
1.33.20
Telnet path:
Status > ISDN
PCM connection
This table maps the switching of internal telephone calls. Under certain circumstances, this information can be relevant
to troubleshooting by LANCOM Support.
SNMP ID:
1.33.20.1
Telnet path:
Status > ISDN > PCM-Switch
2010
Reference Manual
19 More services
19.20.3 Prefer perfect forward secrecy (PFS) for connections
As of LCOS version 9.10 it is possible to enter a PFS encryption method (cipher suite) irrespective of whether the client
has a different setting.
Additions to the Setup menu
Prefer PFS
When setting the cipher suite, the device usually takes over the same setting as the requesting client. Certain client
applications by default require a connection without perfect forward secrecy (PFS), even though both the device and the
client are PFS-capable.
This option means that your device always prefers to connect with PFS, regardless of the default setting of the client.
SNMP ID:
2.11.29.6
Telnet path:
Setup > Config > Telnet-SSL
Possible values:
On
Off
Default:
On
Prefer PFS
When setting the cipher suite, the device usually takes over the same setting as the requesting client. Certain client
applications by default require a connection without perfect forward secrecy (PFS), even though both the device and the
client are PFS-capable.
This option means that your device always prefers to connect with PFS, regardless of the default setting of the client.
SNMP ID:
2.21.40.7
Telnet path:
Setup > HTTP > SSL
Possible values:
On
Off
Default:
On
2011
Reference Manual
19 More services
Prefer PFS
When setting the cipher suite, the device usually takes over the same setting as the requesting client. Certain client
applications by default require a connection without perfect forward secrecy (PFS), even though both the device and the
client are PFS-capable.
This option means that your device always prefers to connect with PFS, regardless of the default setting of the client.
SNMP ID:
2.25.10.10.19.6
Telnet path:
Setup > RADIUS > Server > EAP > EAP-TLS
Possible values:
On
Off
Default:
On
Prefer PFS
When setting the cipher suite, the device usually takes over the same setting as the requesting client. Certain client
applications by default require a connection without perfect forward secrecy (PFS), even though both the device and the
client are PFS-capable.
This option means that your device always prefers to connect with PFS, regardless of the default setting of the client.
SNMP ID:
2.25.20.5
Telnet path:
Setup > RADIUS > RADSEC
Possible values:
On
Off
Default:
On
19.20.4 Input field for DHCP options extended to 251 characters
As of LCOS version 9.10, it is possible to enter 251 characters when specifying DHCP options.
2012
Reference Manual
19 More services
Additions to the Setup menu
Option value
This field defines the contents of the DHCP option. IP addresses are normally specified using the conventional IPv4
notation, e.g. 123.123.123.100. Integer tapes are usually entered in decimal digits and string types as simple
text. Multiple values in a single field are separated with commas, e.g.123.123.123.100, 123.123.123.200.
4
The maximum possible length value depends on the selected option number. RFC 2132 lists the maximum length
allowed for each option.
SNMP ID:
2.10.21.3
Telnet path:
Setup > DHCP > Additional-Options
Possible values:
Max. 251 characters from [A-Z][a-z][0-9]#@{|}~!$%&'()*+-,/:;<=>?[\]^_. `
Default:
empty
2013
Reference Manual
19 More services
20 Appendix
20.1 Error messages in LANmonitor
It is possible to read out VPN error messages over the LANmonitor.
20.1.1 General error messages
Connection attempt cancelled
Bus activation failedConnection establishment failed (D-channel layer 1)
no UA on SABMEConnection establishment failed (D-channel layer 2)
a/b portsConnection establishment failed (Layer 1)
a/b portsConnection establishment failed (Layer 2)
Cable not connectedISDN line error (Layer 1)
X.75 / V.110Connection aborted (layer 2)
Required resource not available -> ISDN problem; boot
telecommunications system
Local error
Remote device can only handle PAP, but CHAP is requiredPP login at remote site - PAP rejected
Remote did not send PAP requestPPP login from remote site - timeout (PPP-PAP RX)
Remote did not respond to PAP requestPPP login at remote site - timeout (PPP-PAP TX)
a CHAP reject was received after a CHAP challengePPP login from remote site - CHAP rejected
Remote did not send CHAP responsePPP login from remote site - timeout (PPP-CHAP RX)
Remote did not respond to CHAP responsePPP login at remote site - timeout (PPP-CHAP TX)
exactly like fee limit... .Time limit exceeded
no HDLC flags foundConnection establishment failed (Layer 1)
X.75 / V.110 not workingConnection establishment failed (Layer 2)
Cable not connectedDSL line error (Layer 1)
20.1.2 VPN error messages
5
For correct evaluation of error messages for VPN connections, at least LCOS version 3.22 must be installed on
both LANCOM devices.
A VPN connection is always either an outgoing or an incoming connection. To make searching for the error faster and
more efficient, the error messages are different for the initiator and the responder. The initiator is the remote device
which initiates the connection. The responder is the device which receives the connection. After the error message is
read out, look in the appropriate menu item on the corresponding remote.
Example:
For the error message 'IKE or IPSec establishment timeout (Initiator)', no direct error can be determined. The responder,
however, has determined an error like 'No proposal matched (Responder, IPSec)', which it send to an SNMP client
2014
Reference Manual
20 Appendix
(LANmonitor) using an SNMP trap. Using this error message, the corresponding parameter in the configuration can be
checked and changed if necessary. Thus is it always necessary to verify the error messages on both sides.
ResponderInitiatorMessage
The maximum number of possible VPN channels has been
reached.
xxLicense exceeded - no more VPN tunnels
available (Responder, IKE)
The router to the remote gateway could not be found.
Please check the public IP address or the DynDNS name of
the remote device.
xxNo route to remote gateway
In dynamic VPN, the outgoing call could not be
authenticated with the PPP data sent. Please check the PPP
xDynamic VPN - no PPP table entry
matched
username and PPP password on both sides under
"Configure --> Communication --> Protocols --> PPP list
--> Remote site".
The incoming call cannot be authenticated with the PPP
data received. Please check the PPP username and PPP
xDynamic VPN - no PPP table entry
matched
password on both sides under "Configure -->
Communication --> Protocols --> PPP list --> Remote site".
A time limit was reached. The router on the remote side is
no longer responding. Please check the VPN error message
in the LANmonitor on the remote device.
xxIKE or IPSec establishment timeout
The LCP polling failed. Please check on the remote device
whether ping blocking is enabled in the firewall menu under
"Configure --> Firewall --> General --> Ping blocking"
Line polling to remote gateway failed
The holding time of the VPN tunnel under "Configure -->
VPN --> Connection list --> Names" is set to Short hold
No entry in polling table and keep alive
in configured
(9999 sec.). However, the required ICMP polling is missing.
Please add them under "Configure --> Communication -->
Remote Sites --> Polling Table". As remote site, enter the
VPN remote device, for the IP address enter an IP address
from the LAN at the remote site.
The fee limit under "Configure --> Costs --> Fees - Limit
(ISDN)" was reached. Please reboot the device.
xDynamic VPN - predefined charge limit
exceeded
The time limit under "Configure --> Costs --> Time limit
(ISDN)" was reached. Please reboot the device.
xDynamic VPN - preset time limit exceeded
The ISDN call number for the remote device for dynamic
VPN is missing. Please enter the call number under
xDynamic VPN - no ISDN call number for
negotiator channel
"Configure --> Communication --> Remote sites --> Name
list (ISDN) --> Name".
While establishing multiple ISDN connections, a limit was
reached. Please check under "Configure --> Management
Dynamic VPN - Multiple connections on
ISDN interface for negotiator channel not
allowed --> Interfaces --> Interface Settings --> ISDN --> Max.
outgoing calls".
The fee limit under "Configure --> Management --> Costs
--> Charge limit (ISDN)" was reached. Indicated by a
synchronized blinking of the Power LED.
xPredefined charging limit exceeded
The time limit under "Configure --> Management --> Costs
--> Time Limit (ISDN)" was reached. Indicated by a
synchronized blinking of the Power LED.
xPredefined time limit exceeded
The IP address of the PPTP selected has not been entered.
Enter the IP address under "Configure --> Communication
--> Protocols --> PPTP list". Also see .
xNo IP address for PPTP server
2015
Reference Manual
20 Appendix
ResponderInitiatorMessage
The exchange type does not match that of the remote
device. Please check the value under "Configure --> VPN
x (IKE)Exchange type mismatch (Main or
Aggressive mode)
--> Connection list --> Edit VPN remote site entry --> IKE
Exchange"
The IKE proposals do not match. -- > Check VPN rulesx (IKE)No proposal matched
The IKE proposals do not match. -- > Check VPN rulesx (IKE)No proposal matched
Please check the IKE groups on both sides under "Configure
--> VPN --> Connection parameters --> VPN remote site
identification --> IKE Group"
x (IKE)IKE group mismatch
The value for the lifetime is not supported. Please use a life
type in "sec = seconds" or "kb = kilobytes". Check this entry
under "Configure --> VPN --> Parameters --> Lifetime"
x (IKE)Life type unsupported (other than Kbytes
or seconds?)
The lifetime specified does not match that of the remote
device. Check this entry under "Configure --> VPN -->
Parameters --> Lifetime"
x (IKE)Lifetime mismatched
False entry of identity. Please correct your entry under
"Configure --> VPN --> IKE --> IKE key"
x (IKE)ID type value unsupported (other than IP
network, domain, or email)
The two sites are using different identities. Compare the
identification at both sites under "Configure --> VPN -->
IKE --> IKE key"
x (IKE)ID type mismatch (e.g. IP network,
domain, or email)
The incoming VPN connection could not be assigned to a
remote device.
x (IKE)No rule matched ID - unknown connection
or wrong ID (e.g. remote gateway
definition)
Please compare the preshared keys under "Configure -->
VPN --> IKE --> IKE key"
x (IKE)IKE key mismatch
Please compare the preshared keys under "Configure -->
VPN --> IKE --> IKE key"
x (IKE)IKE key mismatch
The number of VPN connections has overloaded the device's
memory. To maintain the stability of the device, no further
VPN connections should be established.
x (IKE)Out of memory
The number of VPN connections has overloaded the device's
memory. To maintain the stability of the device, no further
VPN connections should be established.
x (IKE)Out of memory
The incoming VPN connection could not be assigned to a
remote device. Please check the following parameters: ID
x (IKE)No rule matched IDs - unknown
connection or wrong ID (e.g. IP network
definition) type does not match (see this document), incorrect network
definition, VPN rules do not match (see VPN RULES).
The devices cannot agree on a matching proposal. Please
check the settings under "Configure --> VPN --> IKE -->
x (IPsec)x (IPsec)No proposal matched
IKE Proposals" and under "Configure --> VPN --> IPSec
parameters --> IPSec proposal lists".
Please check the PFS (Perfect Forward Sequence) under
"Configure --> VPN --> Connection parameters --> VPN
remote identification --> PFS Group"
IPSec PFS group mismatch
2016
Reference Manual
20 Appendix
20.2 SNMP Traps
ExplanationMIB2 Traps
Device was restarted by switching power off and on.coldstart
LCOS was restarted, for instance by a software rebootwarmstart
Login failed during access to the configurationauthentication failed (= console
login failed)
ExplanationEnterprise specific Traps
Firmware upload was startedFirmware upload started
The reading of the firmware or configuration was startedConfiguration upload started
The reading of the firmware or configuration was successfulUpload succeeded
The reading of the firmware or configuration failed: maximum time was exceededUpload failed (timeout)
The reading of the firmware or configuration failed: incomplete configurationUpload failed (incomplete)
The reading of the firmware or configuration failed: wrong deviceUpload failed (bad device)
Output of the configuration was startedConfiguration download started
Output of the configuration was successfulDownload succeeded
Login to configuration successfulConsole login
Logout from configuration was successfulConsole logout
Information about a firewall eventFirewall trap
WAN connection statusConnection status
Status of VPN connectionVPN Connection status
WAN interface available or not availableWAN-Ethernet UP/DOWN
ExplanationOperating modeWLAN traps
The WLAN station has started a scan for free radio channelsAccess point or clientWLAN Scan started
The WLAN station has created a new radio cellAccess pointStarted WLAN BSS ID
The WLAN station has found a radio cellClientJoined WLAN BSS ID
The authentication of a client WLAN station was successfulAccess pointAuthenticated WLAN station
The client WLAN station has signed offAccess pointDeauthenticated WLAN station
Client WLAN station connectedAccess pointAssociated WLAN station
Client WLAN station has reconnected, was previously signed in to another
access point
Access pointReassociated WLAN station
Checking of RADIUS access to the WLAN station was successfulAccess pointRADIUS access check for WLAN
station succeeded
Checking of RADIUS access to the WLAN station was unsuccessfulAccess pointRADIUS access check for WLAN
station failed
WLAN station was signed off due to a request from the stationAccess pointDisassociated WLAN station due
to station request
The sign on of the WLAN station was rejectedAccess pointRejected association from WLAN
station
2017
Reference Manual
20 Appendix
ExplanationOperating modeWLAN traps
WLAN card stopped, resetAccess point or clientWLAN card hung, resetting
20.3 Radio channels
20.3.1 Radio channels in the 2,4 GHz frequency band
In the frequency range from 2400 to 2483 MHz are up to 13 channels available. The following overview shows which
channels are supported by the different regions (EU/WORLD). The last column shows which channels can be used without
overlapping.
no overlapping with2400–2500 MHzFrequency range
WORLD (ETSI + FCC)EU (ETSI)Channel No.
6, 11241224121
7241724172
8242224223
9242724274
10243224325
1, 11243724376
2244224427
3244724478
4245224529
52457245710
1, 62462246211
––246712
––247213
Bold values indicate the default setting of the LANCOM DSL/I-10 Office radio adapters when utilized in a base station.
20.3.2 Radio channels in the 5 GHz frequency band
In the frequency range from 5,13 to 5,805 GHz up to 19 non-overlapping channels are available in Europe, defined as
the sub-bands as follows:
1
Band 1: 5150 - 5350 MHz (channels 36, 40, 44, 48, 52, 56, 60 and 64)
1
Band 2: 5470 - 5725 MHz (channels 100, 104, 108, 112, 116, 120, 124, 128, 132, 136 and 140)
1
Band 3: 5725 - 5875 MHz (channels 147, 151, 155, 167)
5
Please note that frequency ranges an radio channels in band 3 are reserved for operation in UK only!
The following overview shows which channels are allowed in different regions.
FCC (US)ETSI (EU)FrequencyChannel No.
yesyes5,180 GHz36Band 1
yesyes5,200 GHz40
2018
Reference Manual
20 Appendix
FCC (US)ETSI (EU)FrequencyChannel No.
yesyes5,220 GHz44
yesyes5,240 GHz48
yesyes5,260 GHz52
yesyes5,280 GHz56
yesyes5,300 GHz60
yesyes5,320 GHz64
noyes5,500 GHz100Band 2
noyes5,520 GHz104
noyes5,540 GHz108
noyes5,560 GHz112
noyes5,580 GHz116
noyes5,600 GHz120
noyes5,620 GHz124
noyes5,640 GHz128
noyes5,660 GHz132
noyes5,680 GHz136
noyes5,700 GHz140
yesno5,735 GHz147Band 3 (UK
only)
yesno5,755 GHz151
yesno5,775 GHz155
yesno5,835 GHz167
20.3.3 Radio channels and frequency ranges for Indoor and Outdoor operating
In several countries specific regulations are valid concerning the use of frequency ranges and radio channels for indoor
and outdoor operating. The following table gives information on the permitted application:
Indoor/
Outdoor
Emitted
power (dBm)
Turbo
channels
ChannelsFrequencySub bandBand (GHz)Country
I+O100/2061-132,4-2,483512,4Germany,
Austria,
I200/2342-5836-645,15-5,3515
Switzerland,
I+O1000/30106-130100-1405,470-5,7252
Netherlands,
Belgium,
Luxembourg,
Italy, Malta,
France
I+O100/2061-132,4-2,483512,4UK
I200/2342-5836-645,15-5,3515
I+O1000/30106-130100-1405,470-5,7252
(only fixed
WLAN outdoor
installations!)
2000/33,1–147, 151, 155,
167
5,725-5,5853
I+O100/2061-132,4-2,483512,4Czechia
2019
Reference Manual
20 Appendix
Indoor/
Outdoor
Emitted
power (dBm)
Turbo
channels
ChannelsFrequencySub bandBand (GHz)Country
I200/2342-5836-645,15-5,3515
Further details to the restrictions for the use of wlan adapters within the EU can be found in the internet:
LinkOrganizationCountry
www.bipt.beInstitut Belge des Postes et Telecommunications
(BIPT)
Belgium
www.tst.dkNational Telecom AgencyDenmark
www.regtp.deRegulierungsbehörde für Telekommunikation und
Post
Germany
www.ficora.fiFinnish Communications Regulatory Authority
(FICORA)
Finland
www.art-telecom.frAutorité de Régulation des Télécommunications
(ART)
France
www.eett.grNational Telecommunications Commission (EET)Greece
www.oftel.gov.ukOffice of Telecommunications (Oftel)Great Britain
www.postcomm.gov.uk/Postal Services Commission (Postcomm)
www.open.gov.uk/radiocomRadiocommunications Agency
www.comreg.ieCommission for Communications Regulation
(ComReg)
Ireland
www.pta.isPost and Telecom Administration (PTA)Iceland
www.agcom.itL'Autorità per le garanzie nelle communicazioni
(AGC)
Italy
www.vei.lvTelecommunication State InspectionLatvia
www.ak.liAmt für Kommunikation (AK)Liechtenstein
www.rrt.lt/Radio AdministrationLithuania
www.etat.lu/ILTInstitut Luxembourgeois des Télécommunications
(ILT)
Luxembourg
www.opta.nlOnafhankelijke Post en Telecommunicatie Autoriteit
(OPTA)
Netherlands
www.agentschap-telecom.nlAgentschap Telecom
www.ez.nlMinisterie Economische Zaken
www.npt.noNorwegian Post and Telecommunications Authority
(NPT)
Norway
www.rtr.atRundfunk und Telekom Regulierungs-GmbHAustria
www.bmvit.gv.atBundesministerium für Verkehr, Innovation und
Technologie
www.urt.gov.plUrzad Regulacji Telekomunikacji (URT)Poland
www.anacom.ptAutoridad Nacional De Comunicaçòes (ICP-Anacom)Portugal
www.pts.seNational Post and Telecom AgencySweden
www.bakom.chBundesamt für KommunikationSwitzerland
www.atrp.siAgencija za telekomunikacije, radiodifuzijo in poštoSlowenia
2020
Reference Manual
20 Appendix
LinkOrganizationCountry
www.cmt.esComision del Mercado de las Telecomunicaciones
(CMT)
Spain
www.ctu.czCzech Telecommunication OfficeCzechia
www.hif.huCommunication Authority (HIF)Hungary
5
Please inform yourself about the current radio regulations of the country you want to operate a Wireless LAN
device.
20.4 RFCs supported
TitleRFC
Routing Information Protocol1058
The Point-to-Point Protocol (PPP) for the Transmission of Multi-protocol Datagrams over Point-to-Point Links1331
PPP Authentication Protocols1334
RIP Version 2 MIB Extensions1389
Multiprotocol Encapsulation over ATM Adaptation Layer 51483
Clarifications and Extensions for the Bootstrap Protocol1542
The PPP Internetworking Packet Exchange Control Protocol (IPXCP)1552
Classical IP and ARP over ATM1577
The IP Network Address Translator (NAT)1631
PPP Internet Protocol Control Protocol Extensions for Name Server Addresses1877
PPP Stack LZS Compression Protocol1974
Extensible Authentication Protocol2284
HMAC: Keyed-Hashing for Message Authentication2104
Dynamic Host Configuration Protocol2131
DHCP Options and BOOTP Vendor Extensions2132
Classical IP and ARP over ATM2225
PPP Over AAL52364
Security Architecture for the Internet Protocol2401
IP Authentication Header2402
The Use of HMAC-MD5-96 within ESP and AH2403
The Use of HMAC-SHA-1-96 within ESP and AH2404
The ESP DES-CBC Cipher Algorithm With Explicit IV2405
IP Encapsulating Security Payload (ESP)2406
The Internet IP Security Domain of Interpretation for ISAKMP2407
Internet Security Association and Key Management Protocol (ISAKMP)2408
The Internet Key Exchange (IKE)2409
The NULL Encryption Algorithm and Its Use With IPsec2410
2021
Reference Manual
20 Appendix
TitleRFC
The OAKLEY Key Determination Protocol2412
The ESP CBC-Mode Cipher Algorithms2451
A Method for Transmitting PPP Over Ethernet (PPPoE)2516
Multiprotocol Encapsulation over ATM Adaptation Layer 52684
Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile3280
20.5 Glossary
Wireless LAN specification of the IEEE; data rate up to 2 Mbps; in 2.4 GHz ISM band; FHSS and DSSS; infrared
spectrum communications also planned
802.11
Extension to 802.11; data rate up to 54 Mbit/s; in 5 GHz band; OFDM802.11a
Extension to 802.11; data rate up to 11 Mbit/s; in 2.4 GHz band; high market penetration; DSSS/CCK802.11b
Extension to 802.11; data rate up to 54 Mbit/s; in 2.4 GHz band; OFDM and DSSS802.11g
802.11a customization, data rate up to 54 Mbit/s; in 5 GHz band; in area of transmission power and frequency
management; for use in Europe; OFDM
802.11h
Future 802.11 extension with additional security features802.11i
Specification of a port-based authentication mechanism from the IEEE802.1x
Advanced Encryption StandardAES
Base station in a wireless LAN; independent LAN-WLAN bridge; connects stations of a LAN (local network)
with a WLAN (wireless network) in a point-to-multipoint mode; connects two networks over a wireless
network in point-to-point mode
Access point
Active network component for connection of a local network to the Internet or a company networkAccess router
Asymmetrical Digital Subscriber Line - transmission process for high-speed data transmission over normal
telephone lines. With ADSL, transmissions (downstream) of up to 6 Mbps can be implemented over normal
ADSL
telephone lines; for bidirectional transmission there is a second frequency band with transmission speeds
of up to 640 kbps (upstream) - hence the name "asymmetric".
Data rate with which a user can surf the Internet; the higher the bandwidth, the faster the connectionBandwidth
Service which provides high bandwidth; e.g.: DSL or WLANBroadband
Transport protocol-independent, transparent network component; transmits all packets which are identified
as "not local" and only understands the difference between "local" and "remote". Works on Layer 2 of the
OSI model
Bridge
Broadcasts are packets to all stations of a local network; bridges transmit broadcasts; routers do not transmit
broadcasts
Broadcast
Basic Service SetBSS
Common ISDN Application Programming Interface - CAPI is a standard for control of ISDN adaptersCAPI
Code Complementary Keying; type of modulation used by DSSSCCK
Any computer equipped with a wireless LAN adapter (wireless LAN card), which uses services provided by
other participants in the wireless network
Client
Carrier Sense Multiple Access with Collision Avoidance; access procedure to the radio channel used under
802.11
CSMA/CA
Cyclic Redundancy Check; process for detecting bit errorsCRC
Speed at which you can surf on the Internet; depends on the bandwidth and the number of usersData throughput
2022
Reference Manual
20 Appendix
Dynamic Host Configuration ProtocolDHCP
Domain Name Service - computers communicate with computers in remote networks using IP addresses;
DNS servers translate names into IP addresses; without DNS servers, you would have to remember all IP
addresses and couldn't work with names (e.g. www.lancom.de)
DNS
area of network closed to outside; => IntranetDomain
Download / downstream denotes the direction of dataflow in a WAN. Downstream is the direction from the
head end or Internet to the participant connected to the network.
Download /
Downstream
Distribution SystemDS
Digital Subscriber Line - DSL procedures include all procedures for digital-broadband use of telephone lines,
such as ADSL, HDSL, SDSL, VDSL and so on, which are also called xDSL.
DSL
Direct Sequence Spread Spectrum; code multiplex -- band spreading processDSSS
IPsec-VPN implementation which allows the transparent connection of local networks into a VPN solution,
even when their routers work with dynamic addresses (dial-up)
Dynamic DNS
Extensible Authentication ProtocolEAP
EAP variant which uses password for one-sided authenticationEAP-MD5
EAP Transport Layer Security; EAP variant which uses certificates for mutual authenticationEAP-TLS
EAP Tunneled Transport Layer Security; EAP variant which uses certificates for mutual authenticationEAP-TTLS
Effective Isotropic Radiated PowerEIRP
Extended Service SetESS
Extended Service Set Identity; “network name" of the wireless LANESSID
Strand or star-formed physical transport medium; all stations can send simultaneously; collisions are detected
and corrected through the network protocol
Ethernet
Frequency Hopping Spread Spectrum; frequency skipping band spread procedureFHSS
Protective mechanism for an Intranet against attacks from outsideFirewall
Number of oscillations per second (given in Hertz; 1 Hz = 1 oscillation per second; GHz = Gigahertz = 1
billion Hertz or oscillations per second)
Frequency
File Transfer Protocol enables data transfer between different systems and simple file manipulation; FTP is
based on the TCP transmission protocol
FTP
Contiguous frequency range which has the same transmission propertiesFrequency band
Every radio application uses globally regulated radio frequenciesRadio frequency
Network component which provides access to other network components on a layer of the => OSI model.
Packets which do not go to a local partner are sent to the gateway. The gateway takes care of communication
with remote networks.
Gateway
Network component; distributor; collector; also used to translate from one connection type to anotherHub
Locally limited wireless network with a base station with Internet access; public wireless Internet accessHotSpot
Roaming between the cells of a wireless network using IAPP (Inter Access Point Protocol)IAPP roaming
Independent Basic Service SetIBSS
Intrusion Detection System -- earliest possible detection of attacks on the networkIDS
Institute of Electrical and Electronics Engineers, New York - www.ieee.orgIEEE
Internet ProtocolIP
Combination of PAT (Port Address Translation) and NAT (Network Address Translation) from LANCOM
Systems process used for connection of an intranet (multiple workstations) to the Internet over a single IP
address; simultaneously, the internal computers are protected from attacks from outside
IP masquerading
Internet Protocol SecurityIPSec
2023
Reference Manual
20 Appendix
These functions give precedence to enterprise-critical applications, particular services, or user groupsIP Quality of Service
Integrated Services Digital Network -- fast connection; two independent channels; higher transmission rates
than analog (up to 128 Kbit/s); uses the old analog lines; comfort features (call forwarding, callback on
busy, etc.); supports both analog and digital services
ISDN
Industrial-Scientific-Medical, license-free frequency bands which can be used for industrial, scientific, and
medical purposes.
ISM frequency band
Internet Service Provider -- service provider with a connection to the Internet (backbone) who provides
connection points for end customers
ISP
LANCOM Operating System - uniform operating system for LANCOM productsLCOS
Local Area Network - local network limited to one siteLAN
Virtual CAPI which is provided over the network; with LANcapi, which is implemented in all LANCOM routers
with ISDN interfaces, a PC connected to the LAN can use ISDN telematic services
LANcapi
Software for configuration of LANCOM devices under WindowsLANconfig
Diverse, user-friendly set of tools for the management and monitoring of LANCOM products and systemsLANtools
Media Access Control; radio access protocol on ISO Layer 2 data link; it defines packet format, packet
addressing, and error detection
MAC
Serial number of a network component which is assigned by the manufacturerMAC address
Megabit: standard unit for the specification of data quantities in the context of bandwidthsMbit
Message Integrity Check, cryptographic integrity protection mechanismMIC
Network Basic Input/Output System. Non-routable network protocol for local networks developed by IBM
and later taken over by Microsoft.
NetBIOS
Network Termination Basic Adaptor . The NTBA (network termination adapter) is responsible in an ISDN
base connection for the translation of the connection created by the telephone company to the S0 bus.
NTBA
Orthogonal Frequency Divison MultiplexOFDM
Protected EAP, EAP variant for mutual authenticationPEAP
Public Key InfrastructurePKI
Point to Point Protocol: network protocol for connections between two computers. PPP is based on TCP/IP.PPP
Point to Point Tunneling Protocol: Network protocol for the construction of virtual private networks over the
Internet.
PPTP
Multiple WLAN stations log into a base station and constitute a common network with the wired stationsPoint-to-Multipoint
(WLAN)
Two base stations connect two wired networks over WLAN; point-to-point operation enables coupling of
networks even across streets without cables
Point-to-Point (WLAN)
Quality of Service (see also IP Quality of Service)QoS
Remote Authentication Dial-In User Service; authentication and monitoring protocol on the application level
for authentication, integrity protection, and accounting for network access
RADIUS
Streaming cipher process by Ron Rivest, "Ron's Code"RC4
Request for CommentsRFC
Intelligent network components; comparable with a post office, which can determine from the logical
destination address of a packet which next network component should transmit the packet; knows the
overall topology of the network
Router
Single Line Digital Subscriber Line - downstream and upstream with 2.048 Mbit/s (two-strand wire)SDSL
Computer which provides services over the network (e.g. files, news, email, WWW pages)Server
Secure Inter-Network ArchitectureSINA
2024
Reference Manual
20 Appendix
Simple Mail Transfer Protocol - SMTP protocol is the Internet standard for distribution of electronic mail;
the protocol is based on the TCP protocol
SMTP
Simple Network Management Protocol Version 3SNMPv3
Service Set Identity; “network name" of the wireless LANSSID
Secure Socket LayerSSL
The splitter is comparable with an audio frequency filter; in an ADSL connection, the splitter separates the
ISDN signals from the DSL signals; the ISDN signals go to the NTBA and the DSL signals go to the DSL
modem
Splitter
A central distributor in a star-shaped network; each station has the entire bandwidth available; if a station
fails, the rest of the network is not affected; is used for collision prevention; increases the overall throughput
of the network; switches are cascadable
Switch
Telephone connection unit used in Germany. Plug for the connection of analog devices like a telephone or
modem into the telephone network.
TAE
Transmission Control Protocol/Internet Protocol; family of protocols (ARP, ICMP, IP, UDP, TCP, HTTP, FTP,
TFTP) used mainly in the Internet, although it is making headway in intranets as well
TCP/IP
Temporal Key IntegrityTKIP
Transport Layer SecurityTLS
Transmission Power ControlTPC
Upload / upstream denotes the direction of dataflow in a WAN; upstream is the direction from the node
connected to the network to the head end/Internet
Upload/Upstream
Concatenation of bit sequencesChaining
Virtual Private Network - a VPN is a network consisting of virtual connections over which non-public or
company internal data can be transmitted securely, even if public network infrastructures are used
VPN
Wide Area Network - network connection over long distances (e.g. over ISDN with a LANCOM router)WAN
Wireless Ethernet Compatibility Alliance; alliance of manufacturers of wireless LAN components based on
IEEE 802.11; renamed the WiFi Alliance
WECA
Web-based configuration interface for LANCOM devices.WEBconfig
Wired Equivalent PrivacyWEP
Wireless Fidelity; marketing concept generated by the WECAWiFi
Alliance of manufacturers of wireless LAN components based on IEEE 802.11; formerly the WECAWiFi-Alliance
Wireless Local Area Network - local radio networkWLAN
WiFi Protected Access; name for security mechanisms beyond IEEE 802.11; generated by the WiFi AllianceWPA
Wireless Internet Service ProviderWISP
xDSL stands for the family of Digital Subscriber Line technologiesxDSL
Logical operation "exclusive OR"XOR
2025
Reference Manual
20 Appendix
… 2023

Hulp nodig? Stel uw vraag in het forum

Spelregels

Misbruik melden

Gebruikershandleiding.com neemt misbruik van zijn services uitermate serieus. U kunt hieronder aangeven waarom deze vraag ongepast is. Wij controleren de vraag en zonodig wordt deze verwijderd.

Product:

Bijvoorbeeld antisemitische inhoud, racistische inhoud, of materiaal dat gewelddadige fysieke handelingen tot gevolg kan hebben.

Bijvoorbeeld een creditcardnummer, een persoonlijk identificatienummer, of een geheim adres. E-mailadressen en volledige namen worden niet als privégegevens beschouwd.

Spelregels forum

Om tot zinvolle vragen te komen hanteren wij de volgende spelregels:

Belangrijk! Als er een antwoord wordt gegeven op uw vraag, dan is het voor de gever van het antwoord nuttig om te weten als u er wel (of niet) mee geholpen bent! Wij vragen u dus ook te reageren op een antwoord.

Belangrijk! Antwoorden worden ook per e-mail naar abonnees gestuurd. Laat uw emailadres achter op deze site, zodat u op de hoogte blijft. U krijgt dan ook andere vragen en antwoorden te zien.

Abonneren

Abonneer u voor het ontvangen van emails voor uw Lancom LCOS 9.10 bij:


U ontvangt een email met instructies om u voor één of beide opties in te schrijven.


Ontvang uw handleiding per email

Vul uw emailadres in en ontvang de handleiding van Lancom LCOS 9.10 in de taal/talen: Engels als bijlage per email.

De handleiding is 54,4 mb groot.

 

U ontvangt de handleiding per email binnen enkele minuten. Als u geen email heeft ontvangen, dan heeft u waarschijnlijk een verkeerd emailadres ingevuld of is uw mailbox te vol. Daarnaast kan het zijn dat uw internetprovider een maximum heeft aan de grootte per email. Omdat hier een handleiding wordt meegestuurd, kan het voorkomen dat de email groter is dan toegestaan bij uw provider.

Stel vragen via chat aan uw handleiding

Stel uw vraag over deze PDF

Uw handleiding is per email verstuurd. Controleer uw email

Als u niet binnen een kwartier uw email met handleiding ontvangen heeft, kan het zijn dat u een verkeerd emailadres heeft ingevuld of dat uw emailprovider een maximum grootte per email heeft ingesteld die kleiner is dan de grootte van de handleiding.

Er is een email naar u verstuurd om uw inschrijving definitief te maken.

Controleer uw email en volg de aanwijzingen op om uw inschrijving definitief te maken

U heeft geen emailadres opgegeven

Als u de handleiding per email wilt ontvangen, vul dan een geldig emailadres in.

Uw vraag is op deze pagina toegevoegd

Wilt u een email ontvangen bij een antwoord en/of nieuwe vragen? Vul dan hier uw emailadres in.



Info