ZyXEL Communications P-334WT Manual

P-334WT Support Notes

V360(JN0)

Last Update: October 8, 2004

FAQ

- ZyNOS FAQ

- Product FAQ

- Firewall FAQ

- Content Filtering FAQ

- VPN FAQ

- Wireless FAQ

Application Notes

- IPSec VPN Application Notes

- WLAN Application Notes

- TMSS Application Notes

CI Command List

Troubleshooting

ZyNOS FAQ

1. What is ZyNOS?

2. How do I access the Prestige SMT menu?

3. What is the default console port baud rate? Moreover, how do I change it?

4. How do I upload the ZyNOS firmware via console?

5. How do I upgrade/backup the ZyNOS firmware by using TFTP client program via LAN?

6. How do I upload ROMFILE via console?

7. How do I backup/restore SMT configurations by using TFTP client program via LAN?

8. Why can't I make Telnet to Prestige from WAN?

9. What should I do if I forget the system password?

10. What is SUA? When should I use SUA?

11. What is the difference between NAT and SUA?

12. How many network users can the SUA support?

13. What are Device filters and Protocol filters?

14. Why can't I configure device filters or protocol filters?

15. How can I protect against IP spoofing attacks?

1. What is ZyNOS?

ZyNOS is ZyXEL's proprietary Network Operating System. It is the platform on all Prestige routers that

delivers network services and applications. It is designed in a modular fashion so it is easy for

developers to add new features. New ZyNOS software upgrades can be easily downloaded from our FTP

sites as they become available.

2. How do I access the Prestige SMT menu?

The SMT interface is a menu driven interface, which can be accessed via a RS232 console or a Telnet

connection. To access the Prestige via SMT console port, a computer equipped with communication

software such as HyperTerminal must be configured with the following parameters.

●VT100 terminal emulation

●9600bps baud rate

●N81 data format (No Parity, 8 data bits, 1 stop bit)

The default console port baud rate is 9600bps, you can change it to 115200bps in Menu 24.2.2 to speed

up the SMT access.

3. What is the default console port baud rate? Moreover, how do I change it?

The default console port baud rate is 9600bps. When configuring the SMT, please make sure the

terminal baud rate is also 9600bps. You can change the console baud rate from 9600bps to 115200bps in

SMT menu 24.2.2.

4. How do I upload the ZyNOS firmware code via console?

The procedure for uploading Prestige via console is as follows.

a. Enter debug mode when powering on the Prestige using a terminal emulator

b. Enter 'ATUR' to start the uploading

c. Use X-modem protocol to transfer the ZyNOS code

d. Enter 'ATGO' to restart the Prestige.

5. How do I upgrade/backup the ZyNOS firmware by using TFTP client program via LAN?

The Prestige allows you to transfer the firmware from/to Prestige by using TFTP program via LAN. The

procedure for uploading ZyNOS via TFTP is as follows.

a. Use the TELNET client program in your PC to login to your Prestige.

b. Enter CI command 'sys stdio 0' in menu 24.8 to disable console idle timeout

c. To upgrade firmware, use TFTP client program to put firmware in file 'ras' in the Prestige. After

data transfer is finished, the Prestige will program the upgraded firmware into FLASH ROM and

reboot itself.

d. To backup your firmware, use the TFTP client program to get file 'ras' from the Prestige.

6. How do I upload ROMFILE via console port?

In some situations, you may need to upload the ROMFILE, such as losing the system password, or the

need of resetting SMT to factory default.

The procedure for uploading ROMFILE via the console port is as follows.

a. Enter debug mode when powering on the Prestige using a terminal emulator

b. Enter 'ATLC' to start the uploading

c. Use X-modem protocol to transfer ROMFILE

d. Enter 'ATGO' to restart the Prestige.

7. How do I backup/restore SMT configurations by using TFTP client program via LAN?

a. Use the TELNET client program in your PC to login to your Prestige.

b. Enter CI command 'sys stdio 0' in menu 24.8 to disable console idle timeout.

c. To backup the SMT configurations, use TFTP client program to get file 'rom-0' from the

Prestige.

d. To restore the SMT configurations, use the TFTP client program to put your configuration in file

rom-0 in the Prestige.

8. Why can't I make Telnet to Prestige from WAN?

There are three reasons that Telnet from WAN is blocked.

1. You have disabled Telnet service in Menu 24.11.

Source IP= Telnet host

Destination IP= Prestige's WAN IP

Service= TCP/23

Action=Forward

2. Telnet service is enabled but your host IP is not the securied host entered in Menu 24.11. In this

case, the error message 'Client IP is not allowed!' is appeared on the Telnet screen.

3. The filter rule is applied in the Input Protocol field in menu 11.5 to block Telnet service.

4. The console port is in use.

9. What should I do if I forget the system password?

In case you forget the system password, you need to upload ROMFILE to reset the SMT to factory

default. After uploading ROMFILE, the default system password is '1234'.

10. What is SUA? When should I use SUA?

SUA (Single User Account) is a unique feature supported by Prestige router which allows multiple

people to access Internet concurrently for the cost of a single user account.

When Prestige acting as SUA receives a packet from a local client destined for the outside Internet, it

replaces the source address in the IP packet header with its own address and the source port in the TCP

or UDP header with another value chosen out of a local pool. It then recomputes the appropriate header

checksums and forwards the packet to the Internet as if it is originated from Prestige using the IP address

assigned by ISP. When reply packets from the external Internet are received by Prestige, the original IP

source address and TCP/UDP source port numbers are written into the destination fields of the packet

(since it is now moving in the opposite direction), the checksums are recomputed, and the packet is

delivered to its true destination. This is because SUA keeps a table of the IP addresses and port numbers

of the local systems currently using it.

11. What is the difference between NAT and SUA?

NAT is a generic name defined in RFC 1631 'The IP Network Address Translator (NAT)'.

SUA (Internet Single User Account) is ZyXEL's implementation and trade name for functioning PAT

which is a specific type of NAT. SUA( or PAT for NAT) translates address into port mapping.

The primary motivation for RFC 1631 is that there is not enough IP address to go around. In addition,

many corporations simply did not bother to obtain legal (globally unique) IP addresses for their

networks and now finding themselves unable to connect to the Internet.

Basically, NAT is a process of translating one address to another. A NAT implementation can be as

simple as substituting an IP address with another. This allows a network to rectify the illegal address

problem mentioned above without going through each and every host.

The design goal of ZyXEL's SUA is to minimize the Internet access cost in a small office environment

by using a single IP address to represent the multiple hosts inside. It does more than IP address

translation, so that multiple hosts on the LAN can access the Internet at the same time.

12. How many network users can the SUA/NAT support?

The Prestige does not limit the number of the users but the number of the sessions. The Prestige 334WT

supports 2048 sessions that you can use the 'ip nat iface enif1' command in menu 24.8 to view the

current active sessions.

13. What are Device filters and Protocol filters?

In ZyNOS, the filters have been separated into two groups. One group is called 'device filter group', and

the other is called 'protocol filter group'. Generic filters belong to the 'device filter group', TCP/IP and

IPX filters belong to the 'protocol filter group'.

14. Why can't I configure device filters or protocol filters?

In ZyNOS, you can not mix different filter groups in the same filter set.

15. How can I protect against IP spoofing attacks?

The P-334WT's firewall will automatically detect the IP spoofing and drop it if the firewall is turned on.

If the firewall is not turned on we can configure a filter set to block the IP spoofing attacks. The basic

scheme is as follows:

For the input data filter:

●Deny packets from the outside that claim to be from the inside

●Allow everything that is not spoofing us

Filter rule setup:

●Filter type =TCP/IP Filter Rule

●Active =Yes

●Source IP Addr =a.b.c.d

●Source IP Mask =w.x.y.z

●Action Matched =Drop

●Action Not Matched =Forward

Where a.b.c.d is an IP address on your local network and w.x.y.z is your netmask:

For the output data filters:

●Deny bounceback packet

●Allow packets that originate from us

Filter rule setup:

●Filter Type =TCP/IP Filter Rule

●Active =Yes

●Destination IP Addr =a.b.c.d

●Destination IP Mask =w.x.y.z

●Action Matched =Drop

●Action No Matched =Forward

Where a.b.c.d is an IP address on your local network and w.x.y.z is your netmask.

Product FAQ

General FAQ

1. What is the P-334WT Internet Access Sharing Router?

2. Will the P-334WT work with my Internet connection?

3. What do I need to use the Prestige?

4. What is PPPoE?

5. Does the Prestige support PPPoE?

6. How do I know I am using PPPoE?

7. Why does my provider use PPPoE?

8. Which Internet Applications can I use with the Prestige?

9. How can I configure the Prestige?

10. What network interface does the Prestige support?

11. What can we do with Prestige?

12. Does Prestige support dynamic IP addressing?

13. What is the difference between the internal IP and the real IP from my ISP?

14. How does e-mail work through the Prestige?

15. What is the main difference between WinGate and the Prestige?

16. What is the difference between the 'Standard' and 'RoadRunner' service?

17. Is it possible to access a server running behind SUA from the outside Internet? If possible, how?

18. What DHCP capability does the Prestige support?

19. What to do when Prestige response nothing via Console?

20. What network interface does the new Prestige series support?

Advanced FAQ

1. How does the Prestige support TFTP?

2. Can the Prestige support TFTP over WAN?

3. How can I upload data to outside Internet over the one-way cable?

4. How fast can the data go?

5. My Prestige can not get an IP address from the ISP to connect to the Internet, what can I do?

6. How do I make VPN client x work through my Prestige?

7. What is Multi-NAT?

8. When do I need Multi-NAT?

9. What IP/Port mapping does Multi-NAT support?

10. What is the difference between SUA and Multi-NAT?

11. What is BOOTP/DHCP?

12. What is DDNS?

13. When do I need DDNS?

14. What DDNS servers does the Prestige support?

15. What is DDNS wildcard?

16. Does the Prestige support DDNS wildcard?

17. Can the Prestige's SUA handle IPsec packets sent by the IPsec gateway?

18. How do I setup my Prestige for routing IPsec packets over SUA?

19. Why can't I use video conferencing with MSN 4.6?

20. How can I access internal server via public IP address assigned on WAN?

21. Should I create any firewall rule to allow incoming traffic when NAT is used?

1. What is the P-334WT Internet Access Sharing Router?

The Prestige series fulfills a range of application environments, from small and medium businesses,

SOHO, or Telecommuters, to home user or education applications. The Prestige series provides a robust

Firewall to protect your network. Prestige's design helps users to save expenses, minimize maintenance,

and simultaneously provide a high quality networking environment.

The Prestige series is a robust solution complete with everything needed for providing Internet access to

multiple workstations through your cable or ADSL modem. The router equipped with 1 auto-MDI/

MDIX 10/100Mbps Ethernet WAN port and 4 auto-MDI/MDIX 10/100Mbps Etherent LAN port.

Virtually all-popular applications over Internet, such as Web, E-Mail, FTP, Telnet, Gopher, are

supported.

2. Will the P-334WT work with my Internet connection?

The P-334WT is designed to be compatible with cable and ADSL modems. Most external Cable and

ADSL modems use an Ethernet port to connect to your computer so the Prestige is placed in the line

between the computer and the External modem. As long as your Internet Access device has an Ethernet

port, you can use the Prestige. Besides, if your ISP supports PPPoE you can also use the Prestige,

because PPPoE had been supported in the Prestige.

3. What do I need to use the Prestige?

You need a ADSL modem or cable modem with an Ethernet port to use the Prestige. The Prestige has

two Ethernet ports: LAN port and WAN port. You should connect the computer to the LAN port and

connect the external modem to the WAN port. If the ISP uses PPPoE or RoadRunner Authentication you

need the user account to enter in the Prestige.

4. What is PPPoE?

PPPoE stands for Point-to-Point Protocol Over Ethernet that is an IETF draft standard specifying how a

computer interacts with a broadband modem (i.e. xDSL, cable, wireless, etc.) to achieve access to the

high-speed data networks via a familiar PPP dialer such as 'Dial-Up Networking' user interface. PPPoE

supports a broad range of existing applications and service including authentication, accounting, secure

access and configuration management. There are some service providers running of PPPoE today.

Before configuring PPPoE in the Prestige, please make sure your ISP supports PPPoE.

5. Does the Prestige support PPPoE?

Yes. The Prestige supports PPPoE.

6. How do I know I am using PPPoE?

PPPoE requires a user account to login to the provider's server. If you need to configure a user name and

password on your computer to connect to the ISP you are probably using PPPoE. If you are simply

connected to the Internet when you turn on your computer, you probably are not. You can also check

your ISP or the information sheet given by the ISP. Please choose PPPoE as the encapsulation type in

the Prestige if the ISP uses PPPoE.

7. Why does my provider use PPPoE?

PPPoE emulates a familiar Dial-Up connection. It allows your ISP to provide services using their

existing network configuration over the broadband connections. Besides, PPPoE supports a broad range

of existing applications and service including authentication, accounting, secure access and

configuration management.

8. Which Internet Applications can I use with the Prestige?

Most common applications includes MIRC, PPTP, ICQ, Cu- SeeMe, NetMeeting, IP/TV, RealPlayer,

VDOLive, Quake, Quake11, Quake111, StarCraft, & Quick Time.

9. How can I configure the Prestige?

■Using Console connection-Menu driven user interface for easy local management

■Telnet remote management- Menu driven user interface for easy remote management

■Web broswer- web server embedded for easy configurations

10. What network interface does the Prestige support?

The Prestige supports 10/100M Ethernet to connect to the computer and 10M Ethernet to connect to the

external cable or ADSL modem..

11. What can we do with Prestige?

Browse the World Wide Web (WWW), send and receive individual e-mail, and download software.

These are just a few of many benefits you can enjoy when you put the whole office on-line with the

Prestige Internet Access Sharing Router.

12. Does Prestige support dynamic IP addressing?

The Prestige supports either a static or dynamic IP address from ISP.

13. What is the difference between the internal IP and the real IP from my ISP?

Internal IPs are sometimes referred to as virtual IPs. They are a group of up to 255 IPs that are used and

recognized internally on the local area network. They are not intended to be recognized on the Internet.

The real IP from ISP, instead, can be recognized or pinged by another real IP. The Prestige Internet

Access Sharing Router works like an intelligent router that routes between the virtual IP and the real IP.

14. How does e-mail work through the Prestige?

It depends on what kind of IP you have: Static or Dynamic. If your company has a domain name, it

means that you have a static IP address. Suppose your company's e-mail address is xxx@mycompany.

com. Joe and Debbie will be able to send e-mail through Prestige Internet Access Sharing Router using

[email protected] and [email protected] respectively as their e-mail addresses. They will

be able to retrieve their individual private and secure e-mail, if they have been assigned the proper

access right.

If your company does not have a domain name, it means that your ISP provides you with a dynamic IP

address.

Suppose your company's e-mail address is [email protected]. Jane and John will be able to

send e-mail through Prestige Internet Access Sharing Router using "jane"<[email protected]>

and "john"<[email protected]> respectively as their e-mail addresses. Again, they will be able

to retrieve their individual private and secured e-mail, if they have been assigned the proper access right.

15. What is the main difference between WinGate and the Prestige?

Other manuals for P-334WT

Table of contents

Other ZyXEL Communications Network Router manuals

ZyXEL Communications

ZyXEL Communications GS1100-16 - EDITION 1 User manual

ZyXEL Communications

ZyXEL Communications MAX-200HW2 User manual

ZyXEL Communications

ZyXEL Communications P-660R-T1 User manual

ZyXEL Communications

ZyXEL Communications PRESTIGE 128 User manual

ZyXEL Communications

ZyXEL Communications AX Series User manual

ZyXEL Communications

ZyXEL Communications Prestige 650 User manual

ZyXEL Communications

ZyXEL Communications Dimension ES-116P Reference guide

ZyXEL Communications

ZyXEL Communications MAX218M2W User manual

ZyXEL Communications

ZyXEL Communications Prestige 642M series Supplement

ZyXEL Communications

ZyXEL Communications ZyXEL Dimension ES-2108-F User manual

ZyXEL Communications

ZyXEL Communications LTE3301-PLUS User manual

ZyXEL Communications

ZyXEL Communications NBG318S Series User manual

ZyXEL Communications

ZyXEL Communications P-660RU-Tx v3 SERIES Manual

ZyXEL Communications

ZyXEL Communications ZYWALL 2 WG User manual

ZyXEL Communications

ZyXEL Communications P-660RU-Tx Series Manual

ZyXEL Communications

ZyXEL Communications Dimension ES-4024 User manual

ZyXEL Communications

ZyXEL Communications P-660R-D Series User manual

ZyXEL Communications

ZyXEL Communications IES4005M User manual

ZyXEL Communications

ZyXEL Communications Dimension ES-105A User manual

ZyXEL Communications

ZyXEL Communications NBG-418N User manual

ZyXEL Communications

ZyXEL Communications ADSL2+ Ethernet / USB Router P-660RU-Tx v2 User manual

ZyXEL Communications

ZyXEL Communications P-2900-4HB User manual

ZyXEL Communications

ZyXEL Communications O2 HomeBox User manual

ZyXEL Communications

ZyXEL Communications NBG318S Series User manual

Popular Network Router manuals by other brands

Allnet

Allnet ALL0333AU user guide

HomeSeer

HomeSeer HT-SEL Getting started guide

Sercomm

Sercomm Genesis OC3505D Quick installation guide

Billion

Billion BIPAC 5102 Series user manual

TP-Link

TP-Link TD-8817 QIG

Motorola

Motorola MR1900 user guide

Digi

Digi IX14 user guide

Cisco

Cisco NCS 540 Hardware installation guide

XAVi

XAVi X8821e user manual

BEC

BEC 6200WZL Quick installation guide

MikroTik

MikroTik hAP ac3 Series quick start

Korenix

Korenix JetNet 5428G Series user manual

NETGEAR

NETGEAR FS526T - Switch installation guide

Korenix

Korenix JetNet 5710G Series user manual

Automated Logic

Automated Logic ZN551 Technical instructions

Cisco

Cisco ASR 1000 Series Installation and configuration guide

EnGenius

EnGenius ESR-9710 quick start guide

Cisco

Cisco 805 Series Product overview