Administrator's Guide

Transcription

1 MAGNUM DX FAMILY OF ROUTERS Secure Web Management for Magnum DX family of Routers MNS-DX Version 3.1 Administrator's Guide

2 Preface This guide describes how to setup and use the Magnum DX family of routers. Some simple guidelines which will be useful for configuring and using the Magnum DX family of routers - If you need further information or data sheets on GarrettCom Magnum DX family of routers, refer to the GarrettCom web links at: Any feedback or comments can be sent to the GarrettCom Address shown below. GarrettCom Inc Westinghouse Drive Fremont, CA Phone (510) Fax (510) Tech support support@garrettcom.com Sales sales@garrettcom.com WWW i

3 Trademarks GarrettCom Inc. reserves the right to change specifications, performance characteristics and/or model offerings without notice. GarrettCom, Magnum, S-Ring, MNS-DX, MNS-6K, Link-Loss-Learn, Converter Switch, Convenient Switch and Personal Switch are trademarks and Personal Hub is a registered trademark of GarrettCom, Inc. NEBS is a registered trademark of Telcordia Technologies. UL is a registered trademark of Underwriters Laboratories. Ethernet is a trademark of Xerox Corporation. Rights Except as set forth in the Software License Agreement, GarrettCom makes no representation that software programs and practices described herein will not infringe on existing or future patent rights, copyrights, trademarks, trade secrets or other proprietary rights of third parties and GarrettCom makes no warranties of any kind, either express or implied, and expressly disclaims any such warranties, including but not limited to any implied warranties of merchantability or fitness for a particular purpose and any warranties of noninfringement. The descriptions contained herein do not imply the granting of licenses to make, use, sell, license or otherwise transfer GarrettCom products described herein. GarrettCom disclaims responsibility for errors which may appear in this document, and it reserves the right, in its sole discretion and without notice, to make substitutions and modifications in the products and practices described in this document. Copyright Copyright 2010 by GarrettCom. Printed in the US. All rights reserved. This manual may not be reproduced or disclosed in whole or in part by any means without the written consent of GarrettCom DynaStar is a trademark of GarrettCom. All other trademarks mentioned in this document are the property of their respective owners. This document has been prepared to assist users of equipment manufactured by GarrettCom, and changes are made periodically to the information in this manual. Such changes are reflected in updates or are published in Software Release Notes. If you have i

4 recently upgraded your software, carefully note those areas where new commands or procedures have been added. The material contained in this manual is supplied without any warranty of any kind. GarrettCom therefore assumes no responsibility and shall incur no liability arising from the supplying or use of this document or the material contained in it. Copyright 2010 GarrettCom, Inc. All rights reserved. Printed in the United States of America. Paper Version Part Number: _Rev AF PK ii

5 Table of Contents 1 Conventions Followed Flow of the guide Other Documentation Getting Started Before starting Console connection for CLI Console setup Console screen Logging in for the first time Setting the IP parameters Console connection - DX Web browser Administration menus User management Authentication Authentication: Policies Adding Users Creating Common Users among DX devices Deleting User Modify Password Suspending a User

6 Locked Out User User sessions Policies Active Logins Login Banner Other Administrative Tasks System Information System Status System Time Time Zone and DST Time and Date Time Persistence Adding License Keys Example adding MNS-DX-SECURE license keys Exiting IP Address and System Information IP Addressing Setting the IP address Switching ports Enabling Ethernet Ports Switching and Routing ports Enabling Ethernet Ports DHCP address DHCP and bootp Using SSH and Telnet SSH port forwarding DNS Configuring DNS DNS Status Static Hosts DNS Cache

7 DNS Support in MNS-DX DDNS Configuring DDNS HTTP Profiles DDNS Interface Settings Network time (SNTP Client) Upgrading MNS-DX Saving and loading configuration Erasing configuration Saving changes Configuring Ethernet Assumptions Setting up Ethernet Ports Settings Status Summary Statistics Extended Statistics Port Mirroring and Rate Limits Port Monitoring and Mirroring Port mirroring Rate Limits Bridge Groups Bridging or Switching vs Routing Switch Ports MAC address aging Setting Switch Ports Static MACs Cache Entries Rapid Spanning Tree Protocol (RSTP)

8 RSTP Features and Operations RSTP Setup BPDUs Bridge Roles Port Roles Edge Ports and Point-to-Point Links Port States RSTP Normal Operation Design Considerations Configuring RSTP Bridge Settings RSTP Port Settings RSTP Bridge Status RSTP Port Status VLAN Why VLANs? Configuring VLANs VLANs Design considerations Adding VLANs Importance of Tagging Importance of Filtering Enabling VLANs VLANs and IP Addresses VLANs and Serial Ports DHCP Server Modes of Operation Technical Details DHCP Discovery DHCP Offers DHCP Request DHCP Acknowledgement

9 DHCP Information DHCP Release Client Configuration DHCP Server Configuration Design Consideration Define Networks Static Addresses Dynamic Addresses or DHCP Pools Managing Leases Serial Connectivity Serial IO technologies Serial Protocol Backgrounder Serial IO and Ethernet Terminal Services Serial Ports and Security Serial Ports and VLANs Terminal Server Terminal Server Operations Passive Mode Channels Active Mode Channels Mixed Mode Channels Session Type Configuring Terminal Services Step 1 - Profiles Step 2 Associate ports to profiles Step 3 Setting TCP/IP parameters for Serial ports Troubleshooting Terminal Services Port Status Port Statistics Channel Status

10 Connecting SCADA devices Secure Serial Connectivity or Serial SSL Configuring Secure Serial Connectivity Troubleshooting Secure Serial Connectivity Modbus Modbus overview Modbus on MNS-DX Serial and TCP variants Exception Handling TCP Connection Handling Configuring Modbus Configuring Local Masters Configuring Local Slaves Configuring Remote Slaves Modbus active connections Wide Area Network (WAN) DDS Circuits Configuring DDS DDS Port Status Configuring T1/E T1/E1 Port Status Configuring Frame Relay Frame Relay Background LMI Protocol Fragmentation Size LMI Types LMI Modes Configuring Frame Relay Frame Relay Applications

11 Configuring DLCI Configuring EEK EEK Status Configuring DLCI based IP Routing Serial Tunnel Over Frame Relay Mapping Serial Ports to DLCI Running PPP over a DLCI Configuring PPP Wireless Data Access Cellular Data and MNS-DX Network Design Considerations Virtual Front Panel Configuring the Cellular Interface Configure the Cellular Interface Cellular Status Cellular Info Cellular Data Statistics Cellular OTASP Status Manually starting OTASP Stopping OTASP Point to Point Protocol (PPP) PPP Overview Configuring PPP PPP Profiles PPP Connections Configuring MLPPP MLPPP Bundles MLPPP Memberships MLPPP Bundle IP Assignment PPP Status

12 PPP Statistics Quality of Service (QoS) QoS Concepts DiffServ and QoS DiffServ Marking DiffServ Processing WAN ports Configuring QoS DiffServ Configuration p configuration Ethernet Port configuration IP Flow configuration RIP Routing Routing Concepts Routing Information Protocol (RIP) RIP a brief history RIP technical overview RIP Version RIP Version Configuring RIP Setting IP address Setting Static Routes Setting RIP Parameters Validating Routing Setup OSPF Routing Open Shortest Path First (OSPF) OSPF Backgrounder OSPF Neighbor relationships OSPF Area types OSPF Backbone area

13 OSPF Stub Area OSPF Not-So-Stubby Area Proprietary Extensions Configuring OSPF Setting IP Address Setting Static Routes Setting OSPF global parameters OSPF Area Settings OSPF Interface Settings OSPF Interface Profiles OSPF Area Aggregates OSPF Neighbor Status Validating Routing Setup BGP Routing Border Gateway Protocol (BGP) BGP Backgrounder Configuring BGP Setting IP Address Setting Static Routes Setting BGP Global Parameters Setting BGP Peer Settings Setting BGP Filters Setting BGP Profiles Checking BGP Status Checking BGP RIB Checking BGP Statistics Validating routing setup VRRP Configuring VRRP VRRP Status

14 21 NAT and PAT NAT Background Protocol Address Translation (PAT) NAT/PAT and Security Configuring NAT and PAT Configuring NAT Configuring Port Forwarding Configuring Static Port Forwarding Security Certificates Security Certificates Certificate Backgrounder RSA and Public Cryptography Digital Signatures X.509 Certificates Certificate Authority MNS-DX Certificate Files MNS-DX Local Certificates MNS-DX CA Certificates Other Security Considerations Ethernet Port Security Address Locking Link Locking Configuring Ethernet Security Serial Port Security MNS-DX Web Server MNS-DX CLI Access RADIUS Authentication Configuring RADIUS Syslog Configuring Syslog

15 24 Firewall Firewall on MNS-DX Traffic Selectors Allowing Inbound Connections Allowing Outbound Connections Session Logging Configuring Firewall Global Settings IP Interfaces Interface Groups Configuring Inbound Connections Configuring Outbound Connections VPN VPN Backgrounder VPN - Brief History Key Management Peer Authentication Packet Integrity and Confidentiality Profiles Tunnels IKE Key Lifetimes VPN Example MNS-DX Stack IP Interface IN FW IN NAT IN IPSEC IN IP FWD IPSEC OUT NAT OUT

16 FW OUT IP Interface OUT Firewall and VPN IKE ESP IP NAT and VPN IKE ESP NAT Bypass No Bypass Bypass Example No Bypass Example Configuring VPN Global Settings VPN Profiles IPSec Authentication VPN Tunnels VPN Status VPN Details RFC compliance Monitoring events Alarms, Events and Logs Events Event Categories Event Descriptions The list below is a list of defined event id s and their default values Logging Configuring Events Configuring Logs Viewing Log Files

17 Alarms SNMP SNMP Concepts SNMP Standards SNMP on MNS-DX Configuring SNMP Global Settings Configuring SNMP Management Stations Configuring SNMP Trap Receivers Configuring SNMP Users SNMP Statistics Wizards Router Setup Wizard Step 1 Router Configuration Wizard Step 2 Router Configuration Wizard Step 3 Router Configuration Wizard Step 3A Router Configuration Wizard Step 4 Router Configuration Wizard Step 5 Router Configuration Wizard Certificate Creation Wizard Step 1 Certificate Creation Wizard Step 2 Certificate Creation Wizard Certificate Request for CA APPENDIX 1 CLI Commands APPENDIX 2 Browser Certificates Certificates Using Mozilla Firefox (ver. 3.x) Using Internet Explorer (ver 7.x or IE 8.x) Using Other Browsers

18 APPENDIX 3 Port and Type Reference Well Known TCP/UDP Network Ports ICMP Types APPENDIX 4 Glossary APPENDIX 5 Generating self signed certificates Step 1: Generate an RSA key and a certificate request for your CA Step 2: Generate a self-signed CA certificate from the request Step 3: Create the CA s Key File Step 4: Create an RSA key and a certificate request for your system Step 5: Create the system s certificate and have it signed by the CA Step 6: Create the System Key File APPENDIX 6 Third Party Licenses GNU LESSER GENERAL PUBLIC LICENSE Preamble TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION NO WARRANTY END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Libraries Index

19 List of Figures FIGURE 1 - HyperTerminal screen showing the serial settings and inlaid is the Putty settings for serial connectivity FIGURE 2 - Prompt showing the login via the console port FIGURE 3 On the console, after logging in, enter the IP menu to setup the IP address FIGURE 4 MNS-DX has help commands built in. In the above example, use the "?" key to get help. The "?" key shows all the relevant commands for the IP command sub menu. We next want to use the "set" command to set the IP address. To go about using it, use "set?" and it shows the choices. The obvious choice to set the address is to use the "set address" option FIGURE 5 Using the "?" help feature of MNS-DX, the above example shows how the administrator can get assistance each step of the way. Here the administrator types in the appropriate values for the command till no more mandatory options are needed. The optional arguments for the command line are shown in "[" and "]". Once the address is set, similarly, the help feature is used to determine if the address is set properly. Make sure you "save" the settings after setup FIGURE 6 On power up, if the space key is held down, the menu appears on serial port S FIGURE 7 Setting the IP address on DX FIGURE 8 Security certificate click yes to proceed FIGURE 9 Login screen Before the login screen is shown, a security banner is displayed. Click on "Continue" to get to the login screen, as shown below. This banner is shown if the MNS-DX-SECURE license key is installed. This banner can be disabled if needed FIGURE 10 Login with the proper user name and password. For the first time use manager as Login ID and manager as the Password FIGURE 11 After a successful login the initial screen displaying the device ports is shown. This screen is called the Virtual Front Panel FIGURE 12 Welcome screen (using the DX940 router). Note the different information provided on the screen and different areas. The menus are used to configure settings on the router FIGURE 13 - Administration Menus. At anytime, if the "+" symbol on the menus is clicked on, the menus associated with that function is exposed FIGURE 14 - Authentication menu allows for authentication of users. This includes adding users, setting policies for user passwords and authentication. Finally, it also allows adding users in bulk under the "Files" sub-menu FIGURE 15 - Authentication: Policies menu enables the administrator to set various time, event, and password limitations to enforce authentication

20 FIGURE 16 - Adding users - select the accounts option FIGURE 17 Adding a user with the login name "administrator". Once the fields are filled out, click on Apply settings FIGURE 18 Once the user is added, the user appears in the Existing User Accounts table FIGURE 19 Adding different types of users FIGURE 20 Importing users or exporting users FIGURE 21 Exporting users FIGURE 22 Descriptor for the user files. Note the version would reflect the MNS-DX version. In this example, a file from version is displayed FIGURE 23 XML file for all the users FIGURE 24 Deleting users - select the "Delete" check box and then click on "Apply Settings" FIGURE 25 Modifying passwords FIGURE 26 - Suspending a user. After clicking "No" in the "Suspended?" column, the suspended user is no longer suspended FIGURE 27 - Locked Out user. The column "Locked Out?" shows the user has been locked out. To unlock the user, change the "Yes" to a "No" and then click on "Apply Settings" FIGURE 28 - Viewing Logs. History of logs are kept. Here we view the current or the Active log FIGURE 29 - The log file shown the repeated unsuccessful login attempts on user administrator. After the 5th invalid attempt the account was suspended FIGURE 30 - Setting up user Session policies. In this example, if the user is idle for more than one hour, the session is ended automatically. Also the policy of whether the user sees the welcome banner or not is set here (Login Banner option) FIGURE 31 - Displaying all the active session FIGURE 32 - To force a user off the system, select the user under the Delete column and click Apply Settings as shown below FIGURE 33 - Customizing Login Banner. Type over the existing text and click Submit when done. It is a good idea to logout and login to ensure that the banner text appears properly FIGURE 34 Updating the System Information via Administration System Information as shown above. Once the proper information is entered, click on Apply Settings FIGURE 35 Status of the device FIGURE 36 Updating Time Zone and DST information FIGURE 37 Specifying Time Zone and Daylight Savings time FIGURE 38 Updating Time and Date - enter in the time (24 hour format) and date as MM/DD/YYYY and click on Apply Settings FIGURE 39 Time Persistence

21 FIGURE 40 Icons depicting the necessary functionality in this Manual FIGURE 41 Adding the MNS-DX-SECURE License key. The feature key is covered in this example FIGURE 42 After the upgrade, the license keys are displayed on the Virtual Front Panel FIGURE 43 License keys are displayed on the Virtual Front Panel FIGURE 44 Logout FIGURE 45 - The DX router Ethernet ports can be set up as a switch group allowing the DX to participate in a switched network. The IP address of the device is for accessing the management interface FIGURE 46 - Enabling Ethernet Ports FIGURE 47 - Setting all Ethernet ports to the same Bridge group i.e. ensuring that the ports are switch ports. Note: the ports can be mixed and matched as switched and routed ports as needed FIGURE 48 - Set the IP address as needed. If necessary, change the IP address to match the IP address schema of the switched network. If the IP address is changed, please make sure the browser points to the new IP address to manage the DX device. Note the Cellular IP address is displayed on this screen FIGURE 49 - Click on Other Options to ignore Link information on the interface FIGURE 50 - On the Ignore Link option, set that to "Yes" to ignore the link information to update the status etc FIGURE 51 - In the above example, the DX device is routing between LAN1, LAN2, WAN and also participating on the switch network on the two ports. Firewall is also enabled on the device as shown, filtering traffic from the WAN port FIGURE 52 - Enabling Ethernet Ports FIGURE 53 - Two ports are set as Bridged ports (E3 and E4), while the others are non-bridged i.e. routed ports FIGURE 54 - Set the IP address as needed for the different interfaces FIGURE 55 - Click on Other Options to ignore Link information on the interface FIGURE 56 - On the Ignore Link option, set that to "Yes" to ignore the link information to update the status etc FIGURE 57 - Once the Links are ignored, the status of the interface is changed FIGURE 58 - Enable routing on the device. More details on routing are covered in a separate chapter FIGURE 59 - Specify the interface for routing as well as if the routing interfaces are passive i.e. listen for route updates FIGURE 60 - Setting an interface for DHCP address

22 FIGURE 61 - Once the IP address is acquired, the address is displayed and the status of the port changes to Up. The Virtual Front Panel (not shown) will also change to reflect the port now being active or Up FIGURE 62 Enabling or disabling telnet is done in the CLI mode. The default, SSH only, is currently set for the CLI mode. From the drop down, telnet can be enabled FIGURE 63 Example of port forwarding. In this example, the DX router connects to the 6K switch. Since the connection is tunneled, the connection is securely sent on over the connection to the DX router and then the connection is unsecure or not encrypted from the DX to the 6K switch FIGURE 64 Enable SSH Port forwarding FIGURE 65 Setting Global DNS setting. In this example the public domain Google DNS servers are used as DNS1 and DNS2. Open DNS is used as DNS FIGURE 66 Check DNS Status FIGURE 67 Adding Static Hosts FIGURE 68 Displaying DNS Cache entries. After a Flush, there will be no entries. The DNS cache is cleared as shown above FIGURE 69 Setting Global DDNS setting. This setting enables or disables DDNS FIGURE 70 Setting DDNS HTTP Profiles FIGURE 71 DDNS Interface Settings FIGURE 72 SNTP parameters set the global settings. See table below for different options FIGURE 73 Adding or deleting SNTP Servers. Note - with DNS enabled, logical server names can be used instead of IP addresses FIGURE 74 Checking the status of the SNTP services FIGURE 75 Software update process state diagram. Note that if the upgrade is unsatisfactory for whatever reason, the user can fall back to the older version FIGURE 76 Upgrading MNS-DX. To upgrade, simply choose the MNS-DX file, and click on upload. Once the upload is done, reboot the router. Once the software is loaded, the old version can be deleted or can fall back to the old version FIGURE 77 List the location and file name for the new image and click on Upload to load the new image FIGURE 78 After the file is uploaded, the message is shown that MNS-DX is ready for upgrade. Click on Upgrade or Fallback FIGURE 79 On Fallback the State Fallback is displayed. User is presented with the choice to delete the new image. Retry takes you back to the choice regarding whether the image should be upgraded or fallback (previous figure) FIGURE 80 On successful upgrade, the router is rebooted and the new image is now the active image. After login, click on Finalize to use the new image

23 FIGURE 81 After successful upgrade, the State changes to Upgraded. Please delete the older version to load an subsequent release of MNS-DX FIGURE 82 Multiple configuration files are stored on the MNS-DX routers. One of them is current. The other is associated with the fallback. To view the files, click on the file name FIGURE 83 Config file. To save a config file, highlight the text and copy/paste that information in a text file. These files can be archived for tracking and history purposes FIGURE 84 Resetting the configuration values to factory default FIGURE 85 If the "Save" icon is orange - there have been configuration changes made on the switch FIGURE 86 Configuring Ethernet parameters FIGURE 87 Setting Ethernet Speed settings. Default is auto negotiate. In some situations, it may be necessary to set the port to a fixed speed setting. Supported speeds will vary depending on the port and technology. For example with 100Mbps fiber ports, only 100Mbps speeds will be supported as fiber ports cannot auto negotiate FIGURE 88 Setting Ethernet Flow control this allows to control the amount of ingress and egress packets which can be sent based on flow control information. Default setting is disabled FIGURE 89 Administrative status. This turns an Ethernet port on or off. Admin status enabled allows traffic flow on the port. Disabled turns the Ethernet port off FIGURE 90 Status Summary screen FIGURE 91 Summary Statistics shows the octets, bytes, errors and received on a specific ports FIGURE 92 Extended Statistics shows the octets, bytes, errors and received on a specific ports FIGURE 93 Editing and enabling port mirroring. Default value is None i.e. port mirroring is disabled FIGURE 94 In this setup, all traffic from port E1 is reflected on Port E FIGURE 95 Rate limits restrict the amount of broadcast, multicast, flooded or all traffic across the interface. Ingress and Egress rates can be defined separately FIGURE 96 Types of incoming or ingress traffic on which rate limits can be set FIGURE 97 The incoming traffic can be limited to the set values shown above FIGURE 98 The outgoing traffic can be limited to the set values shown above FIGURE 99 Setting the MAC address aging interval FIGURE 100 Setting the Bridge group. In this example, ports E3 to E6 from the bridge group i.e. the two ports are switch ports. The ports E1 and E2 are routed ports FIGURE 101 Setting a static MAC address associated with the port FIGURE 102 Enter the MAC address associated with the port and click on Apply Settings as shown

24 FIGURE 103 Once the MAC address is assigned, it appears on the Static MACs screen as shown above. To delete a static MAC address, check the "Delete" box and click on Apply Settings FIGURE 104 Viewing the MAC address and the ports associated with the MAC addresses. Note the Static entry added in the previous section FIGURE 105 Port Roles in RSTP FIGURE 106 Setting the RSTP parameters for all ports FIGURE 107 RSTP Port Settings FIGURE 108 Operational status of the RSTP Bridge. Note all the information discussed in earlier sections are displayed on this screen FIGURE 109 Port status. The specific information on the state of the ports is displayed on this screen. Note - routed ports are shown as "Not Bridged" FIGURE 110 VLAN as two separate collision domains. The top part of the figure shows two traditional Ethernet segments. Up to 16 VLANs can be defined per router. Traffic between VLANs is routed using MNS-DX FIGURE 111 Assigning VLANs. For adding VLANs, specify the VLAN ID number (VID) and a logical name with it. VLAN 1 is the default VLAN and is always present on all MNS-DX devices FIGURE 112 Setting Port E1 as a trunk port. In the above example, the native VLAN for the trunk will be 10 and VLANs 35 and 40 will be prohibited on this port FIGURE 113 Port E3 is designated to be on VLAN 40. All traffic will be tagged with VID 40 as shown above. The port is an Access port i.e. only packets with the VID of 40 are allowed to pass through the port FIGURE 114 Enabling VLANs. This menu is available as Ethernet VLANs Global Settings. After enabling, click on Apply Settings FIGURE 115 After VLANs are added and enabled, each VLAN can have a unique IP address schema FIGURE 116 Click on other options to ignore the fact that there may not be devices on the VLAN, showing the VLAN as being down, even though the VLAN services are running FIGURE 117 Ignoring the link shows whether the VLAN services are functioning, irrespective whether there are devices on the VLAN FIGURE 118 Ignoring link shows the port status to be up FIGURE 119 DHCP Operation FIGURE 120 Accessing DHCP Services. Define the networks as well as relevant information such as IP address of the Gateway, DNS servers and DNS suffix as shown above FIGURE 121 Assigning Static addresses. In the above example, the device with the MAC address of 00:00:80:21:35:54 will always be assigned the IP address of /

25 FIGURE 122 Assigning DHCP Pools or Dynamic Addresses FIGURE 123 Managing IP addresses. In the above figure no IP addresses have been assigned FIGURE 124 Terminal Server vs local Serial connection FIGURE 125 Terminal Server FIGURE 126 Setting Profiles for the serial ports FIGURE 127 Associating Profiles with Serial Ports FIGURE 128 Associate the IP address and port number, along with other parameters for terminal services to function properly FIGURE 129 Signals associated with serial ports after the ports are configured using the Serial Ports Settings menu FIGURE 130 Statistics for the serial ports FIGURE 131 Channel Status shows the status of active TCP/IP connections on the serial ports FIGURE 132 Example network for connecting multiple SCADA Devices FIGURE 133 Setting up the DX router where the SCADA Master is. Note the call connection directions are set to Out allowing the SCADA Master to initiate the connections FIGURE 134 Setup of the remote DX routers. Note the serial ports call direction is set to In allowing incoming connection requests. The TCP port number (socket number) matches the port number (socket number) of the serial ports on the DX device connected to the SCADA Master FIGURE 135 Setting up specific ports for secure connectivity. The screen above is captured from a DX1000 device to show ports 1 and 6 are configure for secure serial connectivity FIGURE Modbus Communications stack FIGURE Interconnecting different Modbus devices FIGURE Modbus networks can be built out using Magnum family of products, including Magnum 6K family of switches and Magnum DX routers FIGURE 139 Sample Modbus network using Magnum DX routers FIGURE 140 Format of Modbus ASCII packet FIGURE 141 Format of a Modbus RTU packet FIGURE 142 Format of a TCP Modbus packet FIGURE 143 Configuring Modbus Local Masters FIGURE 144 Configuring Modbus local slaves FIGURE 145 Configuring Modbus remote slaves FIGURE 146 Viewing active Modbus connections FIGURE 147 Configuration screen for DDS circuit for WAN port

26 FIGURE 148 Port Status of WAN port. Note - carrier loss indicates the WAN port may not be connected or the interface is down FIGURE 149 Configuring T1/E1 ports FIGURE 150 Port Status of WAN port FIGURE 151 OSI Layers and respective functions of T1/E1, DDS, Frame Relay and Frame Relay applications FIGURE 152 Configuring Frame Relay FIGURE 153 Defining DLCI for Frame Relay Network FIGURE 154 DLCI status screen FIGURE 155 Properly configured DLCI network status FIGURE 156 EEK settings FIGURE 157 EEK status FIGURE 158 Setting the IP addresses on IP DLCI s defined earlier FIGURE 159 Check to see if the IP segment defined for the DLCI appears in the routing table entries FIGURE 160 Adding default gateway information for the router or for each IP segment FIGURE 161 Setting the RIP settings FIGURE 162 Define the interfaces on which the RIP protocol is active on FIGURE 163 Verify the routing table is populated properly. Note the RIP discovered routes are shown as RIP under the Protocol column. The Local are local interfaces on the device these could be VLANs, DLCIs or local interfaces. Management are static addresses on the router FIGURE 164 Adding Channels or mapping a DLCI setting to the Serial port allowing asynchronous traffic to tunnel through the Frame Relay circuit FIGURE 165 Check the status to see if the mapping of serial ports to DLCI is working properly FIGURE 166 DLCI Settings. Adding DLCI's with and without IP addresses FIGURE 167 Mapping the DLCI to a PPP connection FIGURE 168 Error message displayed when port is in use FIGURE 169 Once the error is fixed, the port can be added to PPP FIGURE 170 Virtual Front Panel with a cellular interface FIGURE 171 Configuring the Cellular Interface FIGURE 172 Setting up NAT on the cellular interface FIGURE 173 Checking the status of the cellular connection. In this example, the cellular interface is not connected to the network, and the Operation Status is down. This is usually due to a poor signal or low signal strength, as the signal strength indicator displays

27 FIGURE 174 The above screen shows the status as Connected FIGURE 175 Checking the data statistics for the cellular interface. The above screen capture was taken after the clear counters, which provides an overview of the flow of data through the cellular modem FIGURE 176 Over The Air Service Provisioning or OTASP status FIGURE 177 Starting Over The Air Service Provisioning or OTASP manually. Click on "Proceed" to start the session FIGURE 178 Stopping OTASP manually. Click on "Proceed" to stop the OTASP session FIGURE 179 Setting up PPP Profiles FIGURE 180 Setting up PPP Connections FIGURE 181 Interfaces or Port ID's over which PPP connections are possible FIGURE 182 Interfaces or Port ID's over which PPP connections are possible FIGURE 183 Setting up PPP Multilink Bundles FIGURE 184 Setting up MLPPP Memberships FIGURE 185 Checking PPP status FIGURE 186 Checking PPP statistics FIGURE 187 Block diagram showing the interaction of QoS and DiffServ prioritization FIGURE 188 ToS and DSCP FIGURE 189 WAN QoS flow FIGURE 190 Configuring Diffserv settings FIGURE 191 Configuring 802.1p settings FIGURE 192 Configuring Ethernet Port priority settings FIGURE 193 Configuring priority for IP traffic flows FIGURE 194 Setting IP addresses on the different interfaces FIGURE 195 Setting static route including default route FIGURE 196 Setting RIP parameters FIGURE 197 Setting RIP interfaces FIGURE 198 Routing Table entries FIGURE 199 Setting IP addresses on the different interfaces FIGURE 200 Setting static route including default route FIGURE 201 Setting OSPF global parameters FIGURE 202 Setting OSPF area settings FIGURE 203 Setting OSPF interface settings

28 FIGURE 204 Defining OSPF interface profiles FIGURE 205 OSPF Area Aggregates FIGURE 206 OSPF Neighbor Status FIGURE 207 Routing Table entries FIGURE 208 Setting IP addresses on the different interfaces FIGURE 209 Setting static route including default route FIGURE 210 Setting BGP global settings, including enabling or disabling BGP FIGURE 211 Setting BGP Peer Settings FIGURE 212 Setting BGP Filters FIGURE 213 Setting BGP Profiles FIGURE 214 Checking the status of BGP setup FIGURE 215 Checking the BGP RIB FIGURE 216 Checking the BGP Statistics FIGURE 217 Routing Table entries FIGURE 217 VRRP services require two routers to provide redundancy. One router is always the primary default router FIGURE 219 When the primary or Master device fails, the secondary devices takes over FIGURE 220 Configuring VRRP FIGURE 221 Status of VRRP FIGURE 222 Setting up NAT global parameters. The public interface has been changed from default to E FIGURE 223 Setting up PAT or mapping socket numbers FIGURE 224 Setting up static NAPT or mapping Network Addresses and Protocol Translations FIGURE 225 Managing certificates on Magnum DX devices. Using this menu additional certificates can be loaded, viewed or deleted FIGURE 226 A portion of the WEB_Cert.pem signature file FIGURE 227 A portion of the WEB_Cert.pem signature file FIGURE 228 A portion of the WEB_Cert.pem signature file FIGURE 229 Ethernet port security FIGURE 230 If an Ethernet port is locked out, it can be unlocked by changing the Locked? field from a Yes to a No FIGURE 231 Configuring Web services for MNS-DX FIGURE 232 Configuring CLI access

29 FIGURE 233 Configuring CLI access FIGURE 234 Defining the RADIUS servers FIGURE 235 Defining the Syslog settings FIGURE 236 Defining the Syslog collectors FIGURE 237 Firewall network example for inbound traffic FIGURE 238 Firewall configuration to map the inbound traffic example FIGURE 239 Firewall network example for outbound traffic FIGURE 240 Firewall configuration to map the outbound traffic example FIGURE 241 Firewall Global Settings FIGURE 242 Enabling or disabling Firewall services on a specific interface FIGURE 243 Group definitions for Firewall FIGURE 244 Configure inbound connections FIGURE 245 Configure outbound connections FIGURE 246 VPN example FIGURE 247 Site-to-Site VPN FIGURE 248 Format of a tunneled IP packet using Encapsulated Security Payload (ESP) FIGURE 249 VPN Example FIGURE 250 Tunnels settings for router DX1 in the example. Note the destination gateway should correspond to the public IP address of router DX FIGURE 251 Tunnels settings for router DX2 in the example. Note the destination gateway should correspond to the public IP address of router DX FIGURE 252 MNS-DX network stack. The stack is used to explain packet processing flow and how it impacts VPN, firewall and NAT interactions FIGURE 253 Firewall and VPN Network example FIGURE 254 Defining Firewall rules FIGURE 255 Firewall rules settings FIGURE 256 Firewall rules settings with the Security VPN Tunnels menu item Bypass FW/NAT? set to Yes FIGURE 257 Defining NAT rules FIGURE 258 Defining VPN Tunnels FIGURE 259 Defining VPN with no bypass option FIGURE 260 Defining NAT rules to allow port 80 traffic FIGURE 261 Defining VPN tunnel for the example

30 FIGURE 262 Defining NAT rules to allow port 80 traffic FIGURE 263 VPN Global Settings FIGURE 264 VPN Profiles FIGURE 265 VPN Authentication FIGURE 266 VPN Tunnels FIGURE 267 VPN Status FIGURE 268 VPN Details FIGURE 269 Events Specifications menu. Only a partial screen capture is shown FIGURE 270 Log file settings FIGURE 271 Log files. To view the file, click on the file name FIGURE 272 Enabling the Alarms and defining the relay closure time FIGURE 273 Setting the individual trap actions FIGURE 274 Setting the SNMP global settings FIGURE 275 Adding Management Stations for SNMP FIGURE 276 Adding Management Stations for SNMP FIGURE 277 Defining SNMP users FIGURE 278 Viewing SNMP Statistics FIGURE 279 Accessing the Router Setup Wizard. Note after this wizard all the existing setup and configuration is destroyed. Remember to save the configuration before using this wizard FIGURE 280 Step 1 of the Router setup wizard. Here the choice is made on the choice of what the Ethernet ports will function as a switch port group or a router port FIGURE 281 Step 2 of the Router setup wizard. Enter in a valid IP address for the default interface FIGURE 282 Step 3 of the Router setup wizard. Determine if the routing is enabled or not in this step FIGURE 283 Step 3A of the Router setup wizard. Determine if the router should be the Default Gateway or not FIGURE 284 Step 4 of the Router setup wizard. Determine if the firewall services should be started or not FIGURE 285 Step 4 of the Router setup wizard. Determine if the firewall services should be started or not FIGURE 286 Certificate creation wizard FIGURE 287 Step 1 of self signed certificate wizard. Depending on the key size, the generation of the certificate may take a few minutes

31 FIGURE 288 Step 2 of self signed certificate wizard. Here the created certificate can be viewed, saved to a file or deleted FIGURE 289 A self signed certificate generated by Certificate Creation Wizard FIGURE 290 Saving the certificate using the browser built in functionality FIGURE 291 Certificate which can be sent to the certificate authority. Copy an paste the encrypted information in a file or message. At this stage, the request becomes a pending message FIGURE 292 On finding a mismatch between the certificate and the accesses site, Mozilla Firefox pops the window. Note the site was accessed using the IP address. Typically, sites accessed by their IP address will trigger this mismatch FIGURE 293 Mozilla Firefox tries to warn the user again about the dangers of sites with improper certificates. This window may be different depending on the version of the browser you are using FIGURE 294 Firefox forces you to get the certificate before it lets you access the site FIGURE 295 Here, you can view the certificate, permanently make an exception and confirm the exception. The locations to do those are identified in this figure FIGURE 296 Self signed certificate from GarrettCom Inc for MNS-6K switch. A similar certificate is available on MNS-DX FIGURE 297 Using IE 7or IE

32 Chapter 1 1 Conventions Followed Conventions followed in the manual T o best use this document, please review some of the conventions followed in the manual, including screen captures, interactions and commands with the router. Box shows interaction with the router command line or screen captures from the router or computer for clarity Commands typed by a user will be shown in a different color and this font Router prompt shown in Bold font, with a # or > at the end. For the document we will use MagnumDX# as the prompt. Related Topics Related topics show that GarrettCom strongly recommends reading about those topics. You may choose to skip those if you already have prior detailed knowledge on those subjects. Tool box Necessary software and hardware components needed (or recommended to have) as a perquisite. These include serial ports on a computer, serial cables, computer with a browser, TFTP or FTP software, serial terminal emulation software etc. Caution or take notice Things to watch out for in case of problems or potential problems. This is also used to draw attention to a special issue, capability or fact. 30

33 MAGNUM DX ROUTERS MNS- DX ADMINISTRATOR GUIDE Terminology Whenever the word PC is used it implies a UNIX, Linux, Windows or any other operating system based work station, computer, personal computer, laptop, notebook or any other computing device. Most of the manual uses Windows XP or Windows 7 based examples. While effort has been made to indicate other Operating System interactions, it is best to use a Windows-XP based machine when in doubt. Supported MNS-DX Version The documentation reflects features of MNS-DX version 3.0 or higher. If your router is not at the current version, GarrettCom Inc. recommends upgrading to the current version. Please refer to the GarrettCom Web site for information on upgrading the MNS-DX software on Magnum DX family of routers or contact GarrettCom Inc. on how to go about updating the software. Product Family this manual is for all the Magnum DX family of routers. Flow of the guide The manual is designed to guide the user through a sequence of events. Chapter 1 is a guide to this manual. Chapter 2 is the basic setup as required by the Magnum DX family of routers. Chapter 2 is perhaps the most critical chapter in what needs to be done by the network administrator once the DX device is received. Adding license keys to unlock features in MNS-DX is also covered in this chapter. Chapter 3 focuses on operational issues of the DX router. This includes time synchronization, IP Addressing, DHCP setup, erasing and saving configuration. Chapter 4 focuses on setting up the Ethernet ports. All ports on the Magnum DX device are disabled by default - except one port. This chapter also covers those issues. Chapter 5 builds on the pervious chapter and discusses Port Mirroring and rate limits for Ethernet. Chapter 6 talks about how the Ethernet ports can be configured. In the Magnum DX devices, the Ethernet ports can be setup as switch ports or routed ports. Other issues such as Static MACs, ARP cache etc. are also discussed in this chapter. Chapter 7 shows how RSTP can be used with ports setup as Bridge Groups. Chapter 8 discusses VLANs and inter-vlan routing. Chapter 9 configures DHCP server to service DHCP requests from the various IP routable networks setup. 31

34 MAGNUM DX ROUTERS MNS- DX ADMINISTRATOR GUIDE Chapter 10 provides a lot of useful information for Serial connectivity. Serial ports are available with Magnum DX devices. Examples of how terminal services can be used along with some trouble shooting tips are also covered in this chapter. Chapter 11 builds on Chapter 10 and shows how secure serial connectivity can be established using MNS-DX. Chapter 12 discusses about Modbus protocols on Serial ports as well as Ethernet ports. Chapter 13 discusses Wide Area Networking and how the different interfaces can be configured for WAN connectivity. Chapter 14 discusses the cellular interface option and how it can be used for connectivity. Chapter 15 configures PPP for use with an external modems and other interfaces. Chapter 16 discusses about QoS. Chapters 17 through 19 focus on Routing. Chapter 17 discusses RIP and configuration / setup of RIP. Chapter 18 discusses OSPF and configuration / setup of OSPF. This is a licensed feature of MNS-DX. Chapter 19 focuses on BGP and configuration / setup of BGP. This is a licensed feature of MNS-DX. Chapter 20 shows how redundancy can be introduced in routing using VRRP. Chapter 21 starts to introduce concepts on security with NAT and PAT. Chapter 22 discusses issue and topics about Security Certificates. Chapter 23 talks about Other Security consideration such as Address Locking, RADIUS and more. Most features in this chapter are a licensed feature of MNS-DX. Chapter 24 shows how Firewall services can be used to secure traffic flow. This is a licensed feature of MNS-DX. Chapter 25 discusses how VPNs can be configured. This chapter includes several examples and also has a state diagram of MNS-DX stack to show the interaction of different modules (MNS-DX applications) on setup. This is a licensed feature of MNS- DX. 32

35 MAGNUM DX ROUTERS MNS- DX ADMINISTRATOR GUIDE Chapter 26 discusses Events and notifications from MNS-DX and how they can be sent to various places. Chapter 27 discusses SNMP and how SNMP can be configured and used. Chapter 28 Shows how some wizards included with MNS-DX can be used to ease configuration. There are several Appendix's included as well. If you find an error or have a helpful tip on the layout or informational content of this or any other GarrettCom manual please feel free to contact us via with any problems or helpful information. All enquiries will be responded to with a correction or whatever resolution is required. Please make all comments to support@garrettcom.com or phone a support engineer at Other Documentation The DX installation guides can be found on their respective web pages. For example, the DX940 installation guide can be found at the web site. Once on the web site navigate to Product and then to the router of choice - in this example, DX940. The URL in the example is - on that web page click on the URLs to download the necessary documents needed. 33

36 Chapter 2 2 Getting Started First few simple steps T his section explains how the GarrettCom Magnum DX family of routers can be setup using the console port on the router. Some of the functionality includes setting up the IP address of the router, securing the router with a user name and password, and more. Before starting Before you start, it is recommended that you acquire the software and necessary hardware listed below. 1) Make sure you are using the latest version of MNS-DX. 2) Make sure you know the IP address or the logical name of the router and can ping the router. If you do not know the IP address or cannot ping the switch, please follow the steps listed below in the section on Console connection. 3) Make sure you have a browser that supports secure socket connection 4) Should you need to configure the router using the Command Line interface (CLI) it may be necessary to use the serial connection. To use the serial port, follow the guidelines below. A new router from GarrettCom will have a static IP address of with a netmask of Ethernet interface E2 is active for DX40 routers, E4 is active for DX800, DX900, E6 for DX940 routers and E5 is active for DX1000 routers. All other interfaces are disabled (except the console port). Once a router is assigned a static IP address, a browser can be used to configure the router. Type in the URL to start using SWM. If a different IP address is used, please use the IP address accordingly. 34