Watson SHDSL Router Application Manual

Transcription

1 Watson SHDSL Router Document Identification Watson-SHDSL-Router-Application-Manual.doc Document Document Revision Distribution Customer

2 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Revision History Version Date Author Comment MLr Major cleanup and added Stacked VLAN MLr Added Bridge Management MLr Initial Version for Watson SHDSL Router Copyright 2010 by Schmid Telecommunication, Zurich, Switzerland. All rights reserved. Reproduction of part or all of the contents in any form is expressly prohibited without the prior written consent of Schmid Telecommunication. Schmid Telecommunication has used its discretion, best judgments and efforts in preparing this document. Any information contained in this document is provided without any warranty of any kind. Schmid Telecommunication hereby disclaims any liability to any person for any kind of damage. Schmid Telecommunication may make improvements and/or changes of this document at any time. ii Revision:

3 Table of Contents Table of Contents LAN Extension Theory of operation DSL configuration Master modem Slave modem Bridge configuration VLAN Transparent Bridging Theory of operation Bridge configuration Switch configuration Management over VLAN Theory of operation Create VLAN interface Edit Management VLAN Interface QoS Application Theory of Operation Enabling QoS Traffic shaping Traffic priority DSCP settings Class statistics Port-based VLAN tagging Theory of operation Modem configuration Management consideration LAN Switch Initialization Adding VLAN configuration Management Security Theory of operation Secured Bridge Configuration Disabling Local Management Stacked VLAN Theory of operation Stacked VLAN configuration

4 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc 4 Revision:

5 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 1 LAN Extension 1.1 Theory of operation With the Watson SHDSL Router (SZ.441.Vxxx) it is possible to build an application that enables clients to extend LANs over one to four DSL lines. This section shows the concept of this application as well as the necessary configuration of the modems: Both networks have the same IP address subnet. The Watson SHDSL Routers will be configured as Bridges. Revision:

6 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc 1.2 DSL configuration Master modem Internet Connections -> Settings EFM encapsulation can be selected. In EFM mode each DSL port is independent. The Line rate can be set differently for each DSL port (up to 1:4). The aggregated DSL link is persistent to a wire-pair failure. The Master modem has to be configured as STU-C. Select which pair is enabled and the linerates. The SHDSL Status tab gives information about the link performance. You can adapt the linerate to reach a good RX SNR margin (minimum 4 db is recommended) Slave modem The DSL Slave modem configuration is similar. The slave modem has to be configured as STU-R. 1-2 Revision:

7 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router In the slave modem you only have to select which pair is enabled. The line rate is set automatically by the master modem. 1.3 Bridge configuration By default the Watson SHDSL router is set as NAT. To configure a bridge between the LAN and the WAN interface do the following: System -> Network Connections -> New Connection -> Advanced Connection -> Network Bridging After clicking Next the router will be reconfigured as a bridge. The MAC address of the LAN interface will be replaced with a new Bridge MAC address. Therefore your web-browser will temporarily lose connection to the Web-based management. In order to accelerate the reconnection you can delete the ARP table entries of your PC. For MS Windows users you can use the arp d command from a CMD shell. Revision:

8 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Bridge Settings Perform the Bridge configuration on the master and the slave devices. You can use the Bridge properties settings to set the local IP Management Address (ex for the master and for the slave). 1-4 Revision:

9 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 2 VLAN Transparent Bridging 2.1 Theory of operation In the previous example we have configured the Watson SHDSL Router to extend the LAN over one to four DSL lines. By default the Bridge is not transparent to VLANs. This section shows how to make the Bridge VLAN transparent: 2.2 Bridge configuration To make the Bridge VLAN transparent do the following way: System -> Network Connections -> Edit Bridge Connection Select the edit VLANS buttons for the WAN Ethernet and the LAN Switch in the Bridging tabs of the Bridge properties screen. Revision:

10 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc A new screen will appear. Select Enable VLAN and All VLAN IDs. Click OK to accept the configuration. The bridge is now transparent to all VLANs. 2.3 Switch configuration By default the integrated Ethernet switch is VLAN transparent. To check the configuration open the LAN Switch Properties page. Select the VLAN tab of the LAN Switch Properties screen: If you want the switch to be VLAN transparent select Transparent in the switch settings: Refer to chapter 5 (Port-based VLAN tagging) if you want to use VLAN tagging based on the Ethernet Switch ports. 2-2 Revision:

11 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 3 Management over VLAN 3.1 Theory of operation In this scenario we will configure the Watson SHDSL Router (SZ.441.Vxxx) to make it accessible from a management VLAN. The Watson SHDSL Router was previously configured as VLAN transparent Bridge. We have to create a new VLAN interface (for example VLAN ID 4094) and add it a management IP address. 3.2 Create VLAN interface System -> Network connections -> New Connection -> Advanced Connection -> VLAN Interface Create the first VLAN interface with Bridge as underlying protocol and VLAN ID You can edit the VLAN interface and give it a user friendly name (ex. Management VLAN 4094). Revision:

12 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Edit Management VLAN Interface In order to manage the bridge over the newly created VLAN interface, you need to define the IP address of this interface. Select the Management VLAN 4094 interface. Under settings -> Internet Protocol, you can enter the Management IP address for this interface. 3-2 Revision:

13 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 4 QoS Application 4.1 Theory of Operation The Watson SHDSL Router (SZ.441.Vxxx) is able to process higher priority traffic before lower priority traffic. The most significant bottleneck is where the high speed LAN meets limited broadband bandwidth. Special QoS mechanisms is built into Watson SHDSL router to ensure that this sudden drop in connectivity speed is taken into account when prioritizing and transmitting real-time service-related data packets. This example shows how to configure the SHDSL router to prioritize traffic that is tagged with DSCP priority marking. 4.2 Enabling QoS In order to enable QoS processing do the following: Select Services -> QoS. The Quality of Service screen will appear, displaying the General tab. Select User Defined from the combo-box. Enter the Rx and Tx bandwidth of your DSL interface in Kbit/s. Select the default QoS profile. This turns QoS on without special preferences. We will configure our preferences later. Revision:

14 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc 4.3 Traffic shaping The traffic shaping configuration is needed to have several classes of services each having different priority and different rate limiting. In this example we will create two classes ( class 1 and class 2). Select the Traffic Shaping tab. Click the edit button of the Default WAN device. The Tx Bandwidth of the WAN is Kbit/s as defined above. Let s create two service classes (class 1 and class2). Class 1 has the hight priority 0 and a reserved bandwidth of 20%. Class 2 has the priority 1 and a reserved bandwidth of 3000 kbbit/s. Note that the reserved bandwidth cannot be used by another class. Traffic exceeding the maximum bandwidth (ex.: Class 2, 6000 Kbit/s) will be discarded. 4-2 Revision:

15 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 4.4 Traffic priority We have to set rules determining the priority that packets, traveling through the device, will receive. This can be done here: Select the Traffic Priority tab. We can now create the following two QoS output rules for the WAN interface. Rule #0 detects packets with DSCP 0x2E and put them in Class 1. Rule #1 detects packets with DSCP 0x1A and put them in Class 2. Revision:

16 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc 4-4 Revision:

17 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 4.5 DSCP settings Select the DSP Settings tab. In this table you can add or modify the mapping of the DSCP Value to a priority. Note that in our example DSCP 0x2E is set to high priority and DSCP 0x1A is set to medium priority. 4.6 Class statistics The Class Statistics tab show the two classes and the default class statistics. Check the statistics to see if the QoS is correctly configured. Revision:

18

19 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 5 Port-based VLAN tagging 5.1 Theory of operation In this scenario we want to configure the Watson SHDSL Router (SZ.441.Vxxx) to create VLANs based on the Ethernet switch port number. We will also configure Ethernet port 8 to have local access to the management of the router. 5.2 Modem configuration Management consideration Before to start with the VLAN configuration of the switch you have to ask yourself how do you access the management of the Watson SHDSL router once that the 802.1q VLAN mode is turned on in the Switch. One way to access the management is to create a new VLAN interface on the router (for example 4094). When a LAN interface is created the management can be access when management traffic is tagged with VLAN. This was previously described in chapter 3: Management over VLAN. In this scenario we will reserve one Ethernet port (port 8 in this example) for the local access to the management of the router. We will configure the switch to send all traffic coming from port 8 as untagged packets. Therefore we do not need to create a special VLAN interface for the management LAN Switch Initialization Open the LAN switch configuration page: System -> Network Connections -> LAN Switch Select the VLAN tab. Turn on the VLAN mode: Select 802.1q as VLAN Mode Do not click apply until the configuration is complete, otherwise you will lose access to the management. Revision:

20 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Configure the Default VLAN ID: Port 8 and Trunk must have the same VLAN ID (4094 in this example) Create a new entry in the VLAN table: Enter the same VLAN ID as the default VLAN ID (4094 in this example) and select U (Untagged) for the port 8 and the Trunk port. Click OK. Now the VLAN table should look like this. If the table looks identical you can click Apply. Otherwise correct the table before to proceed. Do not forget that you will completely lose access to the device if your configuration is not correct. You probably have to refresh your browser to access the management. Also check that you are connected to port 8 of the Ethernet switch. Port 1 to 7 will not have access to the management anymore Adding VLAN configuration The switch has been set to VLAN mode and port 8 is configured as untagged in order to access the management of the Watson SHDSL router. You are now ready to add your application related VLAN configuration. For example port 1 and 2 build VLAN 10. Traffic connected to these ports is untagged. Traffic leaving the trunk port (going toward DSL) will be tagged with VLAN ID 10. Similarly Port 3, 4 and the Trunk port will be part of another VLAN Revision:

21 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router Revision:

22

23 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 6 Management Security 6.1 Theory of operation This chapter described secured ways to configure local and/or remote management of the Watson SHDSL Router. It is recommended to follow this procedure to minimize the risk of unauthorized access to the Watson SHDSL router. 6.2 Secured Bridge Configuration By default, when the SHDSL Router is configured as a Bridge, the Internet Connection Firewall is disabled. In this case Web-based management, telnet and SSH access to the management is possible from the LAN and from the WAN sides. This can be unsecured and therefore it is recommended to enable the Internet Connection Firewall. But before to enable this settings you have to prepare Remote Management Access, otherwise you will lose access to the management. Configure the router to bridge mode. The procedure is described in a previous chapter. Then take a look at the Bridge Advanced Properties : System -> Network Connections -> Bridge -> Advanced Here you see that the Internet Connection Firewall is disabled by default. Revision:

24 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Before to enable Internet Connection Firewall you need to allow remote management. If you do not enable remote management you will lose connection to the device when you enable the Internet Connection Firewall. In the example below the HTTPS and the SSH connection are enabled. Once the remote administration is configured. You can go back to the Bridge properties and enable Internet Connection Firewall. 6.3 Disabling Local Management If you need to prevent HTTP Web-based management access from the LAN, you can setup a filter rule to drop packet with the destination IP address of the SHDSL Router. 6-2 Revision:

25 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router Service -> Firewall -> Advanced Filtering -> Input Rules Set -> (LAN Ethernet Rules) New Entry Revision:

26

27 Watson-SHDSL-Router-Application-Manual.doc Watson SHDSL Router 7 Stacked VLAN 7.1 Theory of operation In this example we will see how to configure the Watson SHDSL Router to perform a stacked VLAN operation based on the Ethernet switched port. With this setup an S-VLAN taga ging (Service provider tag) will be performed to packets based on Ethernet switch port number. Even if the customer traffic is C- VLAN tagged (Customer VLAN) a second tag (S-tag) will be added to packets ingressing the switch ports. In order to access the device management a dedicated VLAN management is needed. 7.2 Stacked VLAN configuration The first step is to create a Bridge between LAN and WAN as described in chapter 1.3: Bridge configuration. The second step is to create a VLAN interface in order to access the management over a management VLAN. The procedure is described in chapter 3: Management over VLAN. Now you are ready to enter the stacked VLAN configuration: Network Connections -> Bridge Properties Revision:

28 Watson SHDSL Router Watson-SHDSL-Router-Application-Manual.doc Turn on the Port-based Stacked VLAN mode: Select Port Based as Stacked VLAN Mode You need to specify the Ethertype of the VLAN stacking. If you need to interoperate with older switch you may have to use a TPID (Service Tag) of You have also to enter the management VLAN ID. If the configuration is correct and you have setup a VLAN management you can hit apply and try to reconnect. You may have to use another IP address depending on which management interface you try to access (with or without VLAN). Finally you can enter the S-VLAN port configuration. In the above example we have mapped port 1-4 to S-VLAN ID 444 and port 5-8 to S-VLAN ID Revision: