BT Business Total Broadband with Intelligent Gateway

Transcription

1 BT Business Total Broadband with Intelligent Gateway Small office network guide

2 Contents Introduction 4 Small business server network 5 Set up your Intelligent Gateway 6 Assigning Static IP addresses using your Intelligent Gateway 8 Allowing all inbound traffic to flow to the SBS Small to medium-sized business network 10 Set up broadband multiple Static IP addresses 11 Set up public network Static IP addressing 12 Assign Static IP addresses to network servers 13 Allow WAN traffic to flow to network servers 15 Allow all inbound traffic to flow to a specified server 15 Allow specific inbound ports to flow to a server 16 Edit advanced firewall settings 18 Resolve DNS entries 20 Summary 21 Appendix A: DHCP service 22 Disabling your Intelligent Gateway DHCP service 22 Using your Intelligent Gateway s DHCP service 24 Appendix B: Your Intelligent Gateway and VPN 25 Outbound VPN client connections 25 Inbound connections to local VPN server 26 3

3 Introduction Welcome to BT Business Total Broadband with Intelligent Gateway This guide describes how to set up a BT Intelligent Gateway to work with a small or small to medium-sized business network. It assumes that the network includes: a DHCP server, including Windows Small Business Server/SBS (You ll find more information about using a DHCP server in Appendix A of this guide.) a hardware firewall a dedicated VPN server a web server. Please ignore those sections of the guide that don t apply to the network in which you re setting up your Intelligent Gateway. If you have any problems, please call We hope your new BT Intelligent Gateway boosts your business. Best wishes, BT Business Total Broadband team 4

4 Small business server network The network example described in this section is based on a Small Business Server (SBS) 2003 with two network interface cards (NICs). The SBS is providing DHCP service to the local area network (LAN) and is routing internet-based network traffic from the LAN to the wide area network (WAN). The following addresses are used: public network address /29 Intelligent Gateway /29 SBS WAN-facing NIC /29 private LAN /24 SBS LAN-facing NIC /24 5

5 Set up your Intelligent Gateway Important: please do not run the Intelligent Gateway set-up CD on the SBS 2003.If you re not sure how to set up your SBS to receive an IP address via DHCP, check your SBS documents for instructions. 1. From the workstation that you ve chosen as the configuring terminal, open Internet Explorer. 2. In the address bar, type and press Enter or your return key. An Internet Explorer security warning will appear, asking you to confirm that you wish to go to a web site that you haven t visited before. 3. Click Add and then Close. The Broadband Link Configuration page will open. 4. In the PPP Authentication and Settings panel: in the Username field, enter your network login username in the Password field, enter your network login password in the Confirm Password field, re-enter your network login password. Note: if you re not sure of your network login username and password, please see your welcome s or letters. 6

6 5. If you subscribe to a no-nat (network address translation) service, scroll down the Broadband Link Configuration page to the Public IP Address panel and: check the Enable box next to Add Additional Network in the Router Address field, enter your Intelligent Gateway s IP address in the Subnet Mask field, enter your subnet mask (e.g. the no-nat 5 service uses subnet mask ). 6. Click Save. Enter your admin password if prompted. A Configuration Successful message will be shown at the top of the page. 7. Click the System Info tab and then Date & Time. 8. From the Time Zone pull-down list, select your time zone. 9. Click Save. A Configuration Successful message will be shown at the top of the page. Once you ve established a connection, the Intelligent Gateway will complete set-up automatically. 7

7 Assign Static IP addresses using your Intelligent Gateway 1. Click the LAN tab. The Statistics page shows what s connected to the router side of your Intelligent Gateway and the Private Network page lets you configure settings for your local network. 2. Click NAT & Address Allocation 3. To assign an available Static IP address, under each device name: in the Address Assignment field, select Public (select WAN IP Mapping) from the pull-down list in the WAN IP Mapping field, select Public Fixed. 4. Click Save after making your selections, to make sure the addresses are properly assigned. Note: once you ve completed these steps, you may need to release and renew your IP addresses. Allow all inbound traffic to flow to the SBS 2003 Note: to protect your network, we recommend that you enable the SBS firewall. To allow all inbound traffic to flow through the firewall to the SBS 2003, please follow these steps: 1. From a computer connected to your Intelligent Gateway, open a web browser, type in the address bar and press Enter or your return key. 2. Click the Firewall tab. 3. Click Allow Applications, Pinholes and DMZ Mode. 8

8 4. Enter your computer s IP address or choose the computer to which you d like to have specific ports open through the Intelligent Gateway firewall. 5. Check the Allow individual application(s) button and, under Filter Applications by, select All applications. 6. Select all the applications in the available list and click Add. This allows all inbound data destined for the SBS 2003 to pass through the firewall. 7. Click Save and review the details in the Status page. 8. Close your browser. 9. Release and renew the IP address of your computer to allow it to move from the IP range to the designated Static IP address. 10. Return to the SBS set-up screen. 9

9 Small to medium-sized business network This section describes the set-up of a typical network for a small to medium-sized business, e.g. if you ve bought five broadband Static IP addresses ( /29). Example of a network for a small to medium-sized business Network server This provides DHCP service to your local area network (LAN) and routes internet-based network traffic from your LAN to your wide area network (WAN). One of the server network interfaces connects to your LAN and the other connects to your hardware firewall. Your network server operating system applies firewall protection to your WAN-connected network interface. Or you can install a specialised hardware firewall between your Intelligent Gateway and the WAN-connected network card in your network server. VPN server This connects directly to your Intelligent Gateway, and may be used to: connect individual remote clients to your LAN connect to another VPN server at a remote location to link two networks together. Web server This connects directly to your Intelligent Gateway and is not connected to your local network. (Depending on your network, this server may be behind a hardware firewall and may have an additional network interface connected to your private LAN.) For help to set up your server/s, please read the information in the following sections. Note: the set-up examples below are for general guidance only. Actual settings (such as values for DNS and IP addresses) may vary, depending on your network. 10

10 Set up broadband multiple Static IP addresses The BT Intelligent Gateway supports the use of multiple, service provider-assigned broadband IP addresses and is designed to enable a public network addressing scheme. The pool of assigned publicly accessible IP addresses can be completely independent of your Intelligent Gateway s broadband IP address. If set up in this way, the Intelligent Gateway still needs an address from the pool. However, this address is logically enabled to represent your Intelligent Gateway LAN network and acts as the default gateway address for public Static IP addressed devices on your LAN. We call this form of Static IP addressing public network addressing, which is shown in the following example. Static IP addressing public network 11

11 Set up public network Static IP addressing To manually set up your Intelligent Gateway to support public network Static IP addressing, please follow these steps: 1. From one of your servers, open a web browser, type in the address bar and press Enter or your return key. 2. Click the Broadband tab. 3. Click Link Configuration and scroll down the page to the Public IP Address panel. 4. Check Enable next to Add Additional Network and enter the router IP address and your subnet mask. You ll find this information in your welcome s or letters. (In the example shown, the router IP address is and the subnet mask is ) 5. Once you ve entered your details, click Save. 12

12 Assign Static IP addresses to network servers Once you ve connected to broadband and set up your multiple Static IP addresses, you need to assign Static IP addresses to your VPN server, web server and network server. You can: assign settings manually, or assign settings using your Intelligent Gateway. Manually assign server TCP/IP settings Manually change your computer s TCP/IP settings from Obtain an IP address automatically to Use the following IP address. Select one of the usable Static IP addresses. As an example, TCP/IP settings may be configured as follows: VPNSRV This is only for the network interface connected to your Intelligent Gateway - the other network interface connected to your LAN isn t changed. Also, after this address is configured, check that traffic from your VPN network is properly routed to your LAN network. (See your VPN software or hardware instructions if you need help with this step.) IP Address: Subnet Mask: Default Gateway: DNS: WEBSRV This is only for the network interface connected to your Intelligent Gateway. IP Address: Subnet Mask: Default Gateway: DNS: MASTERSRV This is only for the network interface connected to your Intelligent Gateway - the other network interface connected to your LAN isn t changed. Also, after this address is configured, check that traffic from your LAN network is properly routed to your WAN network. (See your VPN software or hardware instructions if you need help with this step.) IP Address: Subnet Mask: Default Gateway: DNS: We recommend that you restart each server once you ve finished changing these settings. This will make sure your server operating system and software correctly adjust to your new IP address, and your server is recognised and its traffic properly routed by your Intelligent Gateway. 13

13 Assign Static IP addresses using Intelligent Gateway Check that your Intelligent Gateway-connected network interface for each server is configured as a DHCP client (i.e. it s set to Obtain an IP address automatically). You can then assign the Static IP addresses directly to each server via DHCP. To assign the Static IP addresses from your Intelligent Gateway, please follow these steps: 1. From one of the servers, open a web browser, type in the address bar and press Enter or your return key. 2. Click the LAN tab. 3. Click NAT & Address Allocation. 4. To assign an available Static IP address to each server, under each server name: in the Address Assignment field, select Public (select WAN IP Mapping) from the pull-down list in the WAN IP Mapping field, select Public Fixed. For our example, we ve selected the following options: Device IP Address VPNSRV Public Fixed WEBSRV Public Fixed MASTERSRV Public Fixed Once you ve made your choices, click Save to make sure the addresses are properly assigned. 6. Restart each server. After the restart, the network interface for each server will be issued with your chosen Static IP address. 14

14 Allow WAN traffic to flow to network servers Once you ve set up each server with an available Static IP address, the Intelligent Gateway firewall must be configured to allow the appropriate WAN traffic to flow to each server. For our example below, we ll allow all inbound WAN traffic destined for the VPN server and the network server. Allowing all inbound traffic disables the inbound port-blocking feature of your Intelligent Gateway s firewall. However, Stateful Packet Inspection will still give you security as the traffic passes through your Intelligent Gateway. If you have a web server, your Intelligent Gateway s hosted application feature will be used. This feature provides a quick and easy way to allow specific types of unsolicited traffic through the Intelligent Gateway firewall, including traffic on TCP port 80 http. Allow all inbound traffic to flow to a specified server To allow all inbound traffic to flow through the firewall to a particular destination IP address or server, please follow these steps: 1. From a computer connected to your Intelligent Gateway, open a web browser, type in the address bar and press Enter or your return key. 2. Click the Firewall tab. 3. Click Allow Applications, Pinholes and DMZ Mode. 15

15 4. Enter your computer s IP address or choose the computer to which you d like to have all data sent. 5. Check the Allow individual application(s) button and, under Filter Applications by, select All Applications. 6. Select all the applications in the available list and click Add. This allows all inbound data destined for the SBS 2003 to pass through the firewall. 7. Click Save. Note: to allow all traffic for your network server, repeat the above steps, selecting MASTERSRV from the list of computers. Allow specific inbound ports to flow to a server To allow specific types of inbound ports to flow to a given server, please follow these steps: 1. From a computer connected to your Intelligent Gateway, open a web browser, type in the address bar and press Enter or your return key. 2. Click the Firewall tab. 3. Click Allow Applications, Pinholes and DMZ Mode. 16

16 4. Enter your computer s IP address or choose the computer to which you d like to have specific ports open through the Intelligent Gateway firewall. 5. Check the Allow individual application/s button and, under Filter Applications by, select All Applications. 6. Select the appropriate application from the list. 7. Click Save. Each application type in the hosted application list is associated with one or more UDP or TCP ports. Clicking Status displays the current ports that are being directed to each computer on the network. If the application type you want isn t available in the list, you can specify custom port grouping (both UDP and TCP). To do this, in the Status screen: click Add a new user-defined application enter a name for the custom application enter the ports you d like to allow. 17

17 Edit advanced firewall settings The Advanced Configuration page (under the Firewall tab) lets you configure advanced features on your firewall. Note: we recommend that you use these features only if you re an advanced user of firewalls and networking. Enhanced security Your Intelligent Gateway firewall provides a high level of security, which you can configure to give you even more advanced protection, including Stealth Mode, Block Pings and Strict UDP Session Control. Stealth Mode When in Stealth Mode, your Intelligent Gateway firewall won t return any information in response to network queries, i.e. it will appear to anyone who tries to access your network that your network doesn t exist. Block Ping Enabling this feature makes sure that your network will block all ping requests. Strict UDP Session Control Enabling this feature provides increased security by preventing your Intelligent Gateway from accepting packets sent from an unknown source over an existing connection. Inbound and Outbound Control The Inbound and Outbound Control panes display some common protocol types. When one of the Inbound Protocol boxes is checked, the firewall allows the corresponding protocol to pass through from the internet to your network. If one of the Outbound Protocol boxes is checked, the firewall allows traffic from your network to pass through the firewall to the internet. Once you ve changed any settings, you need to click Save for the changes to take effect. Note: allowing inbound traffic doesn t mean that the firewall automatically allows this type of traffic to pass through the firewall to your network. Even if a particular protocol/application type is allowed by the Advanced Configuration settings, the firewall will still check and block all unsolicited traffic from the internet unless the firewall is configured to allow traffic using an application profile. Note: firewall filtering takes precedence over application hosting. If you disable incoming traffic, you may disable support for hosted applications that need that type of inbound communication. 18

18 Attack detection Your Intelligent Gateway provides a robust, business-grade firewall to protect all devices on your local network. Some applications and devices need to use specific data ports through the firewall. Your Intelligent Gateway lets you open the necessary ports through the firewall using the Firewall Settings page. If you need to have all incoming traffic available to your computer, this computer can be set to the DMZplus mode. While in DMZplus mode, your computer is still protected against certain kinds of security threats. Although rare, incoming traffic may occasionally be blocked by the firewall (e.g. when integrating with external thirdparty firewalls or VPN servers). You may need to disable one or more of the attack detection capabilities for any device placed in the DMZplus mode. In this case, the third-party server provides the attack protection normally provided by your Intelligent Gateway. The following table lists the attacks for which your Intelligent Gateway firewall filters continuously check. To disable a specific attack detection capability, deselect the applicable checkbox and click Save. Note: we strongly recommend that any computer in the DMZplus mode has its own firewall protection. This applies for both single IP and no-nat services. Attack Excessive Session Detection TCP/UDP Port Scan Invalid Source/Destination IP address (scan inbound and outbound packets) Packet Flood (SYN/UDP/ICMP/ Other) Invalid TCP Flag Attacks (NULL/XMAS/Other) (scan inbound and outbound packets) Invalid ICMP Detection Miscellaneous Description and action taken Blaster or similar worm intrusion detection. UDP port scan detected drop packet. TCP port scan detected drop packet. IP source address is broadcast or multicast drop packet. TCP destination IP address is not unicast drop packet. IP source and destination address are the same drop packet. Invalid IP source received from private/home network drop packet. SYN Flood detected stop SYN Flood. UDP Flood detected stop UDP Flood. ICMP Flood detected stop ICMP Flood. Other Flood detected stop Other Flood. TCP SYN/FIN attack detected drop packet. TCP NULL attack detected drop packet. TCP XMAS attack detected drop packet. Invalid TCP flags attack detected drop packet. Invalid ICMP type/code attack detected drop packet. Port 0 attack detected drop packet. TCP SYN packet drop packet. Not a start session packet drop packet. ICMP destination unreachable terminate session. Stateful Packet Inspection for DMZplus and other public IP address. 19

19 Resolve DNS entries Your Intelligent Gateway maintains a local DNS table so that one LAN device can access other LAN devices by using your computer's network name. As LAN devices are assigned IP addresses, your Intelligent Gateway populates its local DNS table, which associates the computer name with an IP address. To access the DNS Resolve table and manually add additional entries, please follow these steps: 1. Open a web browser, type in the address bar and press Enter or your return key. 2. Select the Broadband tab, then DNS Resolution. The Domain Name Server Resolution window will open. 3. In the DNS Name field, enter the appropriate DNS name. 4. In the IP Address field, enter the appropriate IP address. 5. Click Add to Name Resolution Table. 6. The entry is added to the Name resolution table, and the Entry Type will be shown as User Added. 7. To add more entries, repeat steps 3 to 5. To remove the DNS entry, click Remove next to the entry you wish to remove. 20

20 Summary If you ve followed the steps above for setting up our example network, you should now be able to: set up your Intelligent Gateway to support broadband multiple Static IP addresses assign each server its proper Static IP address, either by manually configuring the TCP/IP settings of the server or by assigning the address directly from your Intelligent Gateway allow both your VPN server and network server to receive all inbound traffic destined for its respective Static IP address allow your web server to receiving only TCP port 80 inbound traffic for its Static IP address. 21

21 Appendix A: DHCP service Disabling your Intelligent Gateway DHCP service Occasionally, you may need to disable your Intelligent Gateway on-board DHCP service. This will usually be when an existing network already has a functioning DHCP server and your Intelligent Gateway is connected to the network as a peer to this server. Note: we strongly advise you not to change your Intelligent Gateway settings until you ve established a broadband connection. If you do make any changes, be sure to make a note of them. Example network existing DHCP server 22

22 To disable the Intelligent Gateway DHCP server, please follow these steps: 1. From one of the servers, open a web browser, type in the address bar and press Enter or your return key. 2. Click the LAN tab, then click Private Network. 3. In the DHCP Configuration panel, check the Configure manually button. 4. In the Router Address field, enter the IP address for your Intelligent Gateway. (This address should be a part of your local network range but not the DHCP address pool, i.e. your Intelligent Gateway should have a local Static IP address that doesn t change.) 5. Enter the Subnet Mask of your local network. (In our example network, the subnet mask is ) 6. Deselect the DHCP Server Enabled checkbox. 7. Once you ve made your changes, click Save. Important: once you ve disabled the DHCP in your Intelligent Gateway, you ll need to change the Default Gateway to your Intelligent Gateway s IP address, to allow internet traffic to flow from your local network to the internet. In our example, the existing DHCP server software would be reconfigured so that the Default Gateway (sometimes referred to as the Router field) issued was Once you ve completed set-up, you ll need to restart all computers, workstations and other devices connected to your local network, to make sure the proper network information is received. 23

23 Using your Intelligent Gateway s DHCP service Your Intelligent Gateway has a built-in DHCP server that provides IP addresses to any device on your local network. By default, your Intelligent Gateway provides the following range of IP addresses: x.x IP Range IP Range to Subnet Mask Gateway DNS If the default IP range is not suitable for you, your Intelligent Gateway can also be set to provide the following preconfigured IP address ranges: x.x IP Range IP Range to Subnet Mask Gateway DNS For each IP range, the first 32 IP addresses are available for devices that need Static IP assignment. You can also configure a custom range of IP addresses. Select the DHCP Server Enabled checkbox and click the Save button to submit your changes. After set-up 1. Set up and configure your Intelligent Gateway using a network computer and make sure you can connect to broadband using this computer. 2. Make sure you ve disabled the existing network DHCP server. 3. Connect the remaining computers to your Intelligent Gateway, and release and renew the IP address to request a new IP address from your Intelligent Gateway. 4. If any computers need Static IP, manually change its TCP/IP settings to one of the 1 to 32 IP addresses. 5. Check you can connected to the internet. 10.x.x.x IP Range IP Range to Subnet Mask Gateway DNS

24 Appendix B: Your Intelligent Gateway and VPN Your Intelligent Gateway is designed to work with a wide range of existing VPN (Virtual Private Network) options. You ll find some typical VPN set-ups below, including any additional Intelligent Gateway settings that you may need. VPN Scheme Client Type Supported Configuration L2TP Client NAT (A) Fully Supported DMZplus (B) Fully Supported Static IP (C) Fully Supported PPTP Client NAT (A) Fully Supported DMZplus (B) Fully Supported Static IP (C) Fully Supported IPSec Client NAT (A) ESP Tunnel-mode only DMZplus (B) ESP Tunnel-mode only Static IP (C) ESP Tunnel-mode only Outbound VPN client connections Clients on the local area network can establish VPN connections to external VPN concentrators. Local network clients with three types of IP addressing are: Client Type A Local clients with non-routable addresses issued by the Intelligent Gateway and which connect to the internet via Network Address Translation (NAT). Client Type B Clients for which the Intelligent Gateway firewall has been configured for DMZplus operation. The local client shares the broadband IP address with the Intelligent Gateway. Only one client can share the broadband IP address, so only one computer may be configured for DMZplus at a time. Client Type C Client computers on the network for which a routable, Static IP address has been configured. This IP address is configured either directly by changing the TCP/IP settings of the computer or by assigning the Static IP address automatically using the Intelligent Gateway address allocation feature. 25

25 VPN Scheme Hosted L2TP Server Hosted PPTP Server Hosted IPSec Server Supported Configuration Fully supported when firewall configured to allow all applications Fully supported when firewall configured to allow all applications Fully supported when firewall configured to allow all applications Inbound connections to local VPN server You can host a VPN server on your local network. However, to allow remote clients to connect to your VPN server, you ll need to configure your Intelligent Gateway firewall to Allow All Applications to pass through to your VPN server. If multiple broadband (Static) IP addresses aren t available, the single broadband IP address will be shared via your Intelligent Gateway DMZplus feature with the VPN server. If this is the case, when only one broadband IP address is available, only one VPN server can be hosted on the local network. You may use dual servers to load balance VPN traffic using multiple public IP addresses. 26

26 Notice to users We may need to charge for software updates and additions. We may need to charge for subscriptions to online service providers and may ask you for credit card information. Financial services may need advance arrangements with participating financial institutions. Please check that the use of BTShare/Network is permitted by your broadband service provider and that any applicable consent or licences from landlords or other third parties have been obtained before installing and operating this product. Owner's record You ll find the serial number on the bottom of the BT Business Hub. Make a note of your serial number here and have it handy if you call the help team. Serial number: Safety information The symbol shown here and on the product means that the product is classed as Electrical or Electronic Equipment and should not be disposed with other household or commercial waste at the end of its working life. The Waste of Electrical and Electronic Equipment (WEEE) Directive (2002/96/EC) has been put in place to recycle products using best available recovery and recycling techniques to minimise the impact on the environment, treat any hazardous substances and avoid the increasing landfill. Make sure you always use the power cable supplied with your BT Business Hub don t use any other power cable as this may damage the Hub, and will invalidate the approval that accompanies it. Don t expose the BT Business Hub to rain, water, moisture or direct sunshine. Don t try to disassemble or open up your Hub yourself. Not only will it make your warranty void, it may expose you to dangerous voltage or other hazards. If there s an electrical storm, you must unplug all of your equipment from the electricity supply and phone sockets. Never install telephone sockets in wet locations unless the socket is specifically designed for wet locations. Never touch uninsulated telephone wire or terminals unless the telephone line has been disconnected at the network connection. Take care when installing or modifying cable or telephone lines. Do not use the Hub or a telephone to report a gas leak in the vicinity of the leak. Install the BT Business Hub within 1830mm of a mains socket. Take care when laying out the cable to avoid hazard to people walking near or using the equipment. Product disposal instructions for residential users When you have no further use for it, please remove any batteries and dispose of them and the product as per your local authority's recycling processes. For more information please contact your local authority or the retailer where the product was purchased.

27 Offices worldwide The services we ve described in this publication may not always be available and we may change them. And nothing we ve written here is contractual. When we supply services and equipment, our terms and conditions apply. British Telecommunications plc 2010 Registered office: 81 Newgate Street, London EC1A 7AJ Registered in England No PHME Item code V1 Designed by Design Directions Ltd