MITEL COMMUNICATIONS DIRECTOR (MCD)

Transcription

1 MITEL COMMUNICATIONS DIRECTOR (MCD) ADVANCED INSTALLATION AND MAINTENANCE COURSE MANUAL ISSUE 3 SOFTWARE RELEASE 5.0

2 NOTICE The information contained in this document is believed to be accurate in all respects but is not warranted by Mitel Corporation (MITEL). The information is subject to change without notice and should not be construed in any way as a commitment by Mitel or any of its affiliates or subsidiaries. Mitel and its affiliates and subsidiaries assume no responsibility for any errors or omissions in this document. Revisions of this document or new editions of it may be issued to incorporate such changes Inter-Tel is a registered trademark of Inter-Tel (Delaware), Incorporated. Mitel is a registered trademark of Mitel Networks Corporation. All other trademarks mentioned in this document are the property of their respective owners, including Mitel Networks Corporation and Inter-Tel (Delaware), Incorporated. All rights reserved Mitel Networks Corporation Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copy righted component of this work in other works must be obtained from Mitel Networks Corporation.

3 Table of Contents 1. LAN, WAN, and L2 Switch Connections on the 3300 ICP 2. IP Networking 3. Session Initiation Protocol (SIP) 4. Emergency Services Management 5. MCD Advanced Embedded Voice Mail 6. Automatic Call Distribution (ACD) 7. System Data Synchronization (SDS) 8. Clusters in a Voice Network 9. Integrated Directory Service 10. Resiliency 11. Bandwidth Management Appendices A. MSDN/DPNSS Trunks B. Advanced ARS C. Multi-Level Precedence and Preemption (MLPP) i

4 ii MCD Advanced I&M TOC_rev4.doc

5 Student Code of Conduct Mitel Training makes every effort possible to provide a safe, clean and professional environment for students attending training classes. It has become necessary, for the benefit of all students, to define what is expected from those attending classes at Mitel Training. Please observe the following guidelines. Punctuality Classes begin promptly at the time designated by your instructor. Students are required to return from breaks and lunch promptly, as the instructor specifies. Instructors will begin lectures promptly at the scheduled times. Appropriate Behavior Students are expected to participate in class as professionals. Disruptive behavior will not be tolerated. Disruptive behavior is any action interfering with the instructor s presentation or action distracting from another student s ability to participate in the class. If, at the instructor s discretion, a student is being disruptive, the following steps will be taken: 1st Occurrence: Verbal warning. The student will be advised that his or her behavior is disruptive. 2nd Occurrence: Verbal warning. The student and the student s manager or supervisor will be informed that this is the final warning. 3rd and Final Occurrence: The student will be dismissed from the remainder of class and the student s manager or supervisor will be informed that the student has been released from class. The only option available to the student is to take the course exam at a proctored testing center, at the student s expense, or retake the course, in its entirety, at full tuition. No refund will be issued. Training Equipment Mitel Training has made every effort to provide a state-of-the-art training facility and training equipment. Every effort has been made to provide the technology and equipment necessary to provide students with a real-world environment. All training systems and equipment (including PCs and the PC Network) are provided as tools to enhance the training experience. Equipment is only to be accessed and utilized for the completion of class lab exercises as the instructor indicates. Unauthorized exploring of, or experimenting with the training equipment will be considered disruptive behavior and will not be tolerated. Leaving Class Prior to the Final Certification Exam Occasionally, a student may have a bona fide reason to leave class early due to a family emergency, death in the family, etc. If a student must leave class prior to the administration of the final written exam for any reason, the only option available to the student is to complete the final written exam at a proctored testing center. Testing fees from the testing center are the responsibility of the student and/or company requesting the test. iii

6 Course Description, Certification, and Prerequisites This Mitel Communications Director (MCD) Advanced Installation and Maintenance course covers advanced tasks involved in installing, configuring, and troubleshooting of both enhanced and networked MCDs. This course qualifies technicians as MCD Advanced System Installers with MCD Release 5.0 Advanced certification. MCD Advanced Installation and Maintenance Certification To become certified on advanced MCD, trainees must successfully complete the: MCD Basic Installation and Maintenance Course Leader-Led. MCD Advanced Installation and Maintenance Course Leader-Led. Important Note Certification in this course requires: Attendance and participation in all class sessions. Completion of all labs. A passing grade of 80% on the certification test. MCD Basic Installation and Maintenance Prerequisites Registration will not be accepted until the student has successfully completed the MCD Basic Installation and Maintenance Course Leader-Led. Please note that instructors will not spend extra time with students who do not have the necessary knowledge. Instructors may, at their discretion, dismiss students who do not meet prerequisite requirements. Should this happen, course fees will prevail and the student will not receive certification for the course. iv MCD Advanced I&M Intro_rev4.doc

7 Resources During this course, you will be referring to the following resources: Student Manual Online Help Files Technician s Handbook Student CD / Flash Drive General Information Guide Engineering Guidelines Hardware Technical Reference Manual Troubleshooting Guide Clustering for Multi-Node Management Resiliency Guidelines All but the Student Manual and Student CD / Flash Drive are available at the Mitel OnLine web site. v

8 vi MCD Advanced I&M Intro_rev4.doc

9 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP 1 Objectives When you finish this module, you will be able to: Program the embedded Layer 2 switch on the MXe and CXi controllers. Program the WAN port on the MXe and CXi controllers.

10 1-2 LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

11 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP CXi Controller Layer 2 Switch The CXi Controller has a built-in, managed Layer 2 Ethernet switch with 16 powered 10/100Base-T/TX LAN ports. The seventeenth is an unpowered 10/100/1GBase-T LAN port. The 16 powered ports are designed for the connection of IP phones or PCs. The one unpowered port is designed for connection of another Layer 2 switch, but can also support an IP phone or other network device. If an IP phone is connected, an external power source for the phone is required. If you connect the CXi II controller to an external Layer 2 switch, the connection must be to port 17. Port 17 The MXe III front panel shown below is for comparison purposes. 1-3

12 System IP Properties Form The System IP Properties form is used to change the system s IP information. In a voice only network, the CXi controller may not require changes to its IP configuration depending on the customers planned voice network. CXi Controller MXe Controller 1-4 LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

13 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP On the MXe and CXi, there are three IP addresses to configure: System IP Address IP address of the RTC card. The default is Gateway IP Address default gateway for the 3300, which is the router address on the same internal subnet as the system IP address or, if no router is present, it is the L2 Switch IP address of the CXi. The default is Layer 2 (L2) Switch IP Address IP address of the L2 switch on the 3300 CXi. This address must be on the same subnet as the System IP address. The default is The Voice VLAN ID is the voice VLAN membership number applied by the embedded L2 switch port connecting to the RTC card. For the CXi controller, it also sets the value for the 16 powered L2 ports. The setting should match the value programmed for DHCP Option 125. The default is 1. The Data VLAN ID field on the CXi controller sets the configuration of the external ports 1 through 17. Use this field to set the Data VLAN to something other than the default value of 1 to maintain consistency with the network configuration. It is also possible to assign a DNS domain name and specify the primary and secondary DNS server IP addresses. Note By default, the DNS Server fields are blank. The system requires a DNS server IP address to access the AMC for license and option information. When making adjustments to the System IP Properties section of the form, with the exception of the Host Name, a reboot is required. No reboot is required for DNS section changes. Once these changes are in place, it will be necessary to adjust the DHCP Configuration in order for the DHCP service to function correctly. 1-5

14 LAN Policy (QoS) Form The LAN Policy Quality of Service (QoS) form provides configuration values for: Differentiated Services Code Point (DSCP) a method that attempts to guarantee quality of service on large networks by assigning priority to traffic based on packet type, such as voice or data. Layer 2 Priority the voice VLAN priority for expedited forwarding of voice traffic. The controller will apply the voice priority to traffic originating from the System IP address. This priority should match the voice priority programmed on the external L2 switches as well as the value programmed for DHCP Option 125. Note that the data VLAN default is 1. Use the form to map DSCP to Layer 2 (L2) Priority. Mapping ensures that voice priority is maintained in networks that use the L2 Priority QoS mechanism. Note Changes to the DSCP values require a system reboot to take effect. 1-6 LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

15 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Layer 2 (L2) Switch Form The Layer 2 (L2) Switch form is used to program the global settings for the managed layer 2 Ethernet switch and to configure the Ethernet ports. The CXi embedded layer 2 switch has: 16 powered LAN ports. When the Voice VLAN has been defined in the System IP Properties form, voice VLAN tagging is always preserved when exiting LAN port 17. By enabling Tag VLAN 1 on Trunk Port 17 in the Layer 2 (L2) Switch form, VLAN 1 tagging information will also be preserved for traffic exiting LAN port 17. A 17th unpowered LAN port to connect to other layer 2 switches. The MXe embedded layer 2 switch has: Two unpowered 10/100/1000 Base-T LAN ports. There are two read-only fields that display the configuration of the VLAN settings on the System IP Properties form: Voice VLAN ID Data VLAN ID, on the CXi only. Note The Layer 2 switch IP address must be programmed in the System IP Properties form before this form will work. 1-7

16 CXi Controller MXe Controller 1-8 LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

17 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Internet Group Management Protocol (IGMP) Snooping IGMP is part of the Internet Protocol Suite and is used by switches, routers and hosts to manage multicast traffic. On a network, a group of devices may all need to simultaneously receive the same particular data stream. An example of this would be a live course offered over the Internet. For all students to receive the transmission at the same time, they must join the multicast group using IGMP. Using the multicast group reduces the amount of bandwidth consumption by sending a single stream of data to all group members. IGMP Snooping is enabled by default, and allows the switch to automatically pass multicast packets to devices that have joined multicast groups. Without it, the switch must forward multicast packets to all ports, which results in unnecessary overhead traffic on non-member ports. IGMP Snooping interferes with port-mirroring. Port-mirroring is enabled on a layer 2 switch in order to monitor network activities on all switch ports using a sniffer. If this feature is enabled, IGMP Snooping will be disabled. The internal switch uses 802.1p/Q VLAN prioritization to ensure the quality of voice calls. Packets from IP phones with priority value 6 are ahead of packets with priority value 0, which is the priority value of PCs and other IP devices. Programming is required only if an expansion L2 switch is connected to port 17. Tag VLAN 1 on Trunk Port (17) enables 802.1p/Q VLAN tagging on Port 17 on the CXi in order for the switch to forward tagged packets, with tags intact, to the connected layer 2 switches. Default is disabled. IGMP Snooping enabled by default, allows the switch to automatically pass multicast packets to devices that have joined multicast groups. 1-9

18 L2 Ports Form This form is used to customize the layer 2 switch on a port-by-port basis. Adjust the fields according to customer requirements: Port the port number State enables or disables the port. Default is enabled. Speed use auto if the connected device also has this capability. Otherwise, always configure both ends of the connection to match. Note For port 17 to run at 1 Gbps, program as auto speed. The connected layer 2 switch must also be capable of auto-negotiation and 1 Gbps speed. Duplex mode defines whether the port will transmit in half or full duplex. Half duplex is capable of transmitting in both directions but only in one direction at a time. Full Duplex allows simultaneous transmission in both directions. Use auto only if the connected devices support auto. Flow Control the default configuration on all ports is auto, allowing the switch to negotiate flow control if the connected device supports it. If flow control is disabled, then any flow control packets received will be ignored and flow control will not be used. Voice VLAN provides per port VLAN membership assignment allowing each port to be tagged or untagged on the particular VLAN or unlisted from a particular VLAN. Data VLAN provides per port VLAN membership assignment allowing each port to be tagged or untagged on the particular VLAN or unlisted from a particular VLAN. Power over Ethernet (CXi only) if auto, the port will only send power to those devices that require power. There is no risk in connecting a PC directly to a switch port with power set to auto. Note The IGMP Snooping field in the Layer 2 Switch form on a CXi controller only applies to ports 1 through 16. The maintenance command L2 VLAN SHOW displays the port table LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

19 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP CXi Controller MXe Controller 1-11

20 Rapid Spanning Tree Protocol (RSTP) In case of a network failure, redundant physical connections are often used between layer 2 switches on a network. If all redundant physical paths are left available, or unblocked, it causes loops in the network. These loops will cause broadcast storms. Spanning Tree Protocol (STP) is used to block redundant physical connections between layer 2 switches in order to prevent broadcast storms. Rapid Spanning Tree Protocol (RSTP), or IEEE 802.1w, significantly reduces the amount of time it takes to resolve all possible network paths and to block redundant connections between the network layer 2 switches. RSTP will resolve all possible paths and select the most efficient paths through the network. It allows only one connection to be active at a time and will block the least efficient redundant path. In the event that an active path becomes unavailable, RSTP will automatically activate, or unblock, the redundant connection to maintain network connectivity. The MXe and CXi controllers support RSTP protocol and provide the ability to enable or disable RSTP on the embedded layer 2 switch. In addition, the STP Bridge Priority can be configured as one of 15 different priorities. The higher the programmed value, the lower the priority of the STP switches. The network switch with the highest priority becomes the root switch in the Spanning Tree network LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

21 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Spanning Tree Form This form is used to configure Rapid Spanning Tree Protocol (RSTP) parameters. Rapid Spanning Tree (RSTP) enable RSTP on the embedded layer 2 switch only if connecting to expansion layer 2 switches which are also running the STP protocol. STP Bridge Priority program the STP Bridge Priority as one of 15 different priorities. The higher the programmed value, the lower the priority of the STP switches. Force Version select the format, either STP or RSTP, in which to send the Bridge Protocol Data Unit (BPDU) on all L2 ports. STP-compatible sends only STP or legacy BDPUs. RSTP sends RSTP BPDUs unless a legacy port is detected, in which case STP BPDUs are sent instead. The default is RSTP. BPDU is an STP message unit that describes the attributes of a switch port such as its MAC address, priority and cost to reach the root switch. BPDUs enable switches that participate in an STP network to gather information about each other. CXi Controller MXe Controller 1-13

22 IP Network Configuration Options for the CXi Controller The three IP network configuration options for the CXi controller are: Voice Only provides services for IP phones on a private network. Voice and Data with LAN Interface provides services for IP phones and PCs on a private network. Voice and Data with WAN Interface Enabled provides services for IP phones and PCs on a private network, plus a firewall protected connection to the Internet. Voice Only The voice only network configuration is intended for new implementations, where the voice network is physically separated from the data network. This configuration uses the internal layer 2 switch of the CXi. The CXi includes a 16-port layer 2 switch that can be used to connect up to 16 IP phones directly to the controller. No changes are required to the CXi default IP address, or to the DHCP configuration. Simply install the system at the customer site and connect the IP phones. The embedded layer 2 switch provides Power over Ethernet (PoE) on ports 1 through 16 to the IP phones, so external power to the phones is not necessary LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

23 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP If required, the number of Layer 2 switch ports can be expanded to accommodate more IP phones, up to a maximum of 150. To facilitate this, a customer-supplied, layer 2 switch, or switches, can be connected via the CXi 10/100/1000 LAN port 17. Port 17 does not provide PoE and should not be used to connect an IP phone. Since the network is voice only, there are no QoS issues, so unmanaged layer 2 switches can be used. Most unmanaged layer 2 switches do not provide PoE, so the IP phones connected to those switches require an external power source. 1-15

24 Voice and Data Voice and data network configuration is for implementations where voice and data traffic is combined on the internal IP network. This configuration uses the layer 2 switch ports on the CXi. Because voice and data are now sharing the network infrastructure, voice quality must be considered. To ensure quality of service for voice, VLAN prioritization can be used. The CXi can support up to a maximum of 150 IP phones. You can connect up to 16 dual-port IP phones to the embedded layer 2 switch and then connect a PC to the PC port of each phone. On the CXi, voice quality is managed using VLAN tagging. By default, all IP packets that enter the embedded layer 2 switch are tagged as VLAN 1, priority 0, which is the lowest priority. This means that, by default, all traffic is treated with equal consideration. To maintain voice quality in a voice and data configuration, the layer 2 switch must give priority to voice traffic. IP phones have the built-in capability to tag their own IP packets with a VLAN ID and VLAN priority. The IP phones learn what values to use from a DHCP server LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

25 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Using the internal DHCP configuration, two proprietary DHCP option tags can be programmed for the phones in Option 125: VLAN ID default VLAN tag is 1. VLAN Priority (l2p) default lp2 tag is 6, a higher priority Once the IP phones learn their VLAN information, they will tag all their packets as VLAN 1 with a priority of 6. PCs do not recognize Mitel proprietary DHCP Option 125 and most Network Interface Cards (NICs) do not understand VLAN tagging. Because of this, the embedded layer 2 switch will continue to tag data packets as VLAN 1, priority 0. When the switch receives packets tagged with priority 0 and priority 6, preference will be given to priority 6 traffic. The switch will forward voice traffic before the data traffic, giving voice priority over data. 1-17

26 If voice is being added to an existing data network, programming changes may be required to the System IP Properties and DHCP Server forms. This prevents IP address conflicts and allows traffic to be routed between the local and remote subnets. The customer may want to expand the network beyond the 16 ports by adding their own layer 2 switch. These switches must be VLAN-capable and connected to port 17. To maintain priority for voice traffic, port 17 must be able to forward tagged packets to the connected layer 2 switches with the tags intact. To accomplish this, enable the 802.1p/Q VLAN tagging on port 17. It is disabled by default, so all VLAN tags will be removed before port 17 forwards traffic. Once enabled, all VLAN tag information is preserved and passed on. The switches must: Be programmed to give priority to packets tagged with Priority 6. Be IEEE 802.1p/Q compliant. Run at 100 Mbps or 1 Gbps. Be capable of full duplex transmission. Be manageable via a programming interface for configuring VLAN specific information. Note You can connect the customer s layer 2 switch or router to port 17 for connection to a corporate LAN and provide IP Trunking to other 3300 ICPs in the customer s data network LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

27 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Another method to expand the network up to 150 IP devices is to connect the existing customer network to the CXi using a router. In the following scenario, the router is connected to one of the 16 phone ports on the CXi system. PoE can be disabled for this port. For IP traffic to be correctly routed between the internal and external networks, the CXi must be programmed with a network list, which is a combination of IP network addresses and corresponding subnet masks. When the internal Layer 2 switch receives a packet from a host on the LAN, it checks the network list. If a route is found, the CXi forwards the packet to the programmed system gateway. This is either the CXi itself, when the System Gateway IP = L2 Switch IP, or a router connected to the local subnet. If no route is found, the CXi LAN interface will forward the packet to the Internet through the WAN interface. 1-19

28 If the system gateway is down, the CXi can find a default gateway using the Internet Control Message Protocol (ICMP) router discovery protocol. The CXi will send out a router solicitation to all-routers using an IP multicast address. Routers on the network immediately respond with a router advertisement and the CXi chooses a router as its default gateway LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

29 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP IP Routing Form The IP Routing form is used to program the CXi as an ICMP router discover server and to program route lists to destination networks. ICMP Router Discovery Server enable to find an alternate default gateway is there is a network failure. Default is enabled. IP Network List list routes to destination networks on the LAN. The CXi checks this table and if a route is found, the packets are forwarded to the system gateway IP. If no route is found, the packets are forwarded to the Internet gateway, if enabled. The maximum number of static routes in the Network List is

30 WAN Settings Form You ve learned that the CXi provides connectivity to the internal voice and data network through its embedded layer 2 switch and to the Internet through its WAN interface. For customers needing internet connectivity, one possible configuration is to enable the Internet Gateway, whose primary function is to link the internal and external networks. The WAN interface is configured with a public IP address in order to communicate with other devices on the internet. The LAN interface is programmed with a private IP address on the same subnet as the system IP address in order to communicate with devices on the customer s network. The WAN port uses Network Address Translation (NAT) to manage communication between the internal or private network and the external or public network. This means that all devices within the internal network appear like a single public IP address to devices on the internet. Note IP trunks are not routed through the WAN port LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

31 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Use the WAN Settings form to enable the WAN interface and program the parameters that the WAN interface port uses when it connects to an Internet Service Provider (ISP), which include PPPoE, DHCP or statically configured IP address. WAN Access enable if the customer wants to connect to the internet using the CXi capabilities. Disabled by default. WAN IP Address Method selects the method of obtaining an IP address; DHCP, PPPoE, or Static IP address. Note Only one option can be active at a time and the choice depends on the interface provided by the ISP. Current IP Address read-only information displays the current IP address, subnet mask and external gateway information received from the Internet Service Provider. 1-23

32 WAN Access Using Static IP The IP address, subnet mask and external gateway information is provided by the ISP and programmed directly on the CXi system. IP Address program the IP address assigned to the WAN interface by the ISP. Subnet Mask assign the subnet mask provided for the WAN interface by the ISP. External Gateway program the WAN default gateway assigned to the WAN interface by the ISP LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

33 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP WAN Access Using DHCP Dynamic Host Configuration Protocol (DHCP) is a common method for connecting to the internet through an ISP. The ISP s DHCP server dynamically assigns an IP address, subnet mask, default gateway and DNS information to the CXi WAN interface and authentication is provided using either the system s MAC address or using a Client ID. The Client ID is usually the MAC address in ASCII format or a predefined ASCII string as specified by the ISP. Client Name program the client name assigned to the WAN interface by the ISP. Authenticate By specify whether authentication with the ISP is via Client ID or Ethernet Address. Client ID / Ethernet Address value provided by the ISP, only if Client ID authentication is used. 1-25

34 PPPoE Access Point-to-Point Protocol (PPP) is commonly used over a serial connection to connect a home computer to an ISP. Authentication with the ISP server, a user name, and password allows internet access. In similar fashion, Point-to-Point Protocol over Ethernet (PPPoE) is a specification used to connect users on an Ethernet network to the internet via a DSL line, wireless device, or cable modem. PPPoE also requires authentication using a user name and password LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc

35 LAN, WAN, AND L2 SWITCH CONNECTIONS ON THE 3300 ICP Remote Access Point-To-Point Tunneling Protocol (PPTP) Form To provide remote access to the customer s private network for maintaining or programming the CXi, the embedded firewall can be configured as a PPTP server for a single inbound client. PPTP Access enable to allow inbound access for a single client. User Name username required for inbound PPTP access to the network. Password password required for inbound PPTP authentication. Client IP Address IP address on the LAN that will be assigned to the PPTP user. The IP address should not conflict with any DHCP Static IP addresses or any programmed IP address range and must be on the same subnet as the system IP address. 1-27

36 Firewall Control Form Once communication is opened up between a customer s private network and the internet, security needs to be considered. To provide this, a firewall is embedded within the CXi. The firewall examines all packets destined for the internal network and unless they are initiated from within the private network, the packets are declared unknown. Unknown packets are either dropped or rejected and can be logged for analysis. The firewall can also be programmed to allow outbound VPN tunnels with PPTP and IPSEC pass-through and inbound connections with IP port forwarding. Logging State enables or disables logging of unknown packets. PPTP Pass-Through enable PPTP VPNs are initiated from within the customer network to remote networks. IPSEC Pass-Through enable if IPSEC VPNs are initiated from within the customer network to remote networks. Action for Unknown Packets if Drop is selected, unknown packets will be dropped by the CXi with no notification returned to the sending party. If Reject is selected, then an unknown packet will generate an error packet to the sender. Do Not Log UDP Ports list the UDP ports that do not cause logs to be generated for any packets received on the specified ports. Do Not Log TCP Ports list the TCP ports that do not cause logs to be generated for any packets received on the specified ports. WAN Firewall allows disabling of the firewall and NAT on the WAN port, making it possible to connect the WAN port to a separate network with transparent routing provisioned between the network on the WAN port and the network on the LAN ports of the controller LAN, WAN, and L2 Switch Connections on the 3300 ICP_rev7.doc