Tài liệu Nortel VPN Router Configuration — Advanced Features docx

Version 7.00
Part No. NN46110-502
315899-F Rev 01.01
November 2008
Document status: Standard
600 Technology Park Drive
Billerica, MA 01821-4130
Nortel VPN Router
Configuration — Advanced
Features
2
NN46110-502
Copyright © 2008 Nortel Networks. All rights reserved.
The information in this document is subject to change without notice. The statements, configurations, technical data, and
recommendations in this document are believed to be accurate and reliable, but are presented without express or implied
warranty. Users must take full responsibility for their applications of any products specified in this document. The
information in this document is proprietary to Nortel Networks.
The software described in this document is furnished under a license agreement and may be used only in accordance
with the terms of that license. The software license agreement is included in this document.
Trademarks
Nortel Networks, the Nortel Networks logo, Preside, Optivity, and Nortel VPN Router are trademarks of Nortel
Networks.
Adobe and Acrobat Reader are trademarks of Adobe Systems Incorporated.
Check Point and Firewall 1 are trademarks of Check Point Software Technologies Ltd.
Cisco and Cisco Systems are trademarks of Cisco Systems, Inc.
Entrust and Entrust Authority are trademarks of Entrust Technologies, Incorporated.
Java is a trademark of Sun Microsystems.
Linux and Linux FreeS/WAN are trademarks of Linus Torvalds.
Macintosh is a trademark of Apple Computer, Inc.
Microsoft, Windows, Windows NT, and MS-DOS are trademarks of Microsoft Corporation.
Netscape, Netscape Communicator, Netscape Navigator, and Netscape Directory Server are trademarks of Netscape

Communications Corporation.
NETVIEW is a trademark of International Business Machines Corp (IBM).
Novell, NetWare and intraNetWare are trademarks of Novell, Inc.
NDS is a trademark of Novell Inc.
OPENView is a trademark of Hewlett-Packard Company.
SafeNet/Soft-PK Security Policy Database Editor is a trademark of Information Resource Engineering, Inc.
SecurID and Security Dynamics ACE Server are trademarks of RSA Security Inc.
SPECTRUM is a trademark of Cabletron Systems, Inc.
VeriSign is a trademark of VeriSign, Inc.
All other trademarks and registered trademarks are the property of their respective owners.
The asterisk after a name denotes a trademarked item.
Restricted rights legend
Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph
(c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software,
the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the
Commercial Computer Software-Restricted Rights clause at FAR 52.227-19.
3
Nortel VPN Router Configuration — Advanced Features
Statement of conditions
In the interest of improving internal design, operational function, and/or reliability, Nortel Networks Inc. reserves the
right to make changes to the products described in this document without notice.
Nortel Networks Inc. does not assume any liability that may occur due to the use or application of the product(s) or
circuit layout(s) described herein.
Portions of the code in this software product may be Copyright © 1988, Regents of the University of California. All
rights reserved. Redistribution and use in source and binary forms of such portions are permitted, provided that the above
copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials,
and other materials related to such distribution and use acknowledge that such portions of the software were developed
by the University of California, Berkeley. The name of the University may not be used to endorse or promote products
derived from such portions of the software without specific prior written permission.

SUCH PORTIONS OF THE SOFTWARE ARE PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains
restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third
parties).
Nortel Networks Inc. software license agreement
This Software License Agreement (“License Agreement”) is between you, the end-user (“Customer”) and Nortel
Networks Corporation and its subsidiaries and affiliates (“Nortel Networks”). PLEASE READ THE FOLLOWING
CAREFULLY. YOU MUST ACCEPT THESE LICENSE TERMS IN ORDER TO DOWNLOAD AND/OR USE THE
SOFTWARE. USE OF THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF THIS LICENSE
AGREEMENT. If you do not accept these terms and conditions, return the Software, unused and in the original shipping
container, within 30 days of purchase to obtain a credit for the full purchase price.
“Software” is owned or licensed by Nortel Networks, its parent or one of its subsidiaries or affiliates, and is copyrighted
and licensed, not sold. Software consists of machine-readable instructions, its components, data, audio-visual content
(such as images, text, recordings or pictures) and related licensed materials including all whole or partial copies. Nortel
Networks grants you a license to use the Software only in the country where you acquired the Software. You obtain no
rights other than those granted to you under this License Agreement. You are responsible for the selection of the
Software and for the installation of, use of, and results obtained from the Software.
1. Licensed Use of Software. Nortel Networks grants Customer a nonexclusive license to use a copy of the Software
on only one machine at any one time or to the extent of the activation or authorized usage level, whichever is applicable.
To the extent Software is furnished for use with designated hardware or Customer furnished equipment (“CFE”),
Customer is granted a nonexclusive license to use Software only on such hardware or CFE, as applicable. Software
contains trade secrets and Customer agrees to treat Software as confidential information using the same care and
discretion Customer uses with its own similar information that it does not wish to disclose, publish or disseminate.
Customer will ensure that anyone who uses the Software does so only in compliance with the terms of this Agreement.
Customer shall not a) use, copy, modify, transfer or distribute the Software except as expressly authorized; b) reverse
assemble, reverse compile, reverse engineer or otherwise translate the Software; c) create derivative works or
modifications unless expressly authorized; or d) sublicense, rent or lease the Software. Licensors of intellectual property
to Nortel Networks are beneficiaries of this provision. Upon termination or breach of the license by Customer or in the

event designated hardware or CFE is no longer in use, Customer will promptly return the Software to Nortel Networks or
certify its destruction. Nortel Networks may audit by remote polling or other reasonable means to determine Customer’s
Software activation or usage levels. If suppliers of third party software included in Software require Nortel Networks to
include additional or different terms, Customer agrees to abide by such terms provided by Nortel Networks with respect
to such third party software.
4
NN46110-502
2. Warranty. Except as may be otherwise expressly agreed to in writing between Nortel Networks and Customer,
Software is provided “AS IS” without any warranties (conditions) of any kind. NORTEL NETWORKS DISCLAIMS
ALL WARRANTIES (CONDITIONS) FOR THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE AND ANY WARRANTY OF NON-INFRINGEMENT. Nortel Networks is not obligated to
provide support of any kind for the Software. Some jurisdictions do not allow exclusion of implied warranties, and, in
such event, the above exclusions may not apply.
3. Limitation of Remedies. IN NO EVENT SHALL NORTEL NETWORKS OR ITS AGENTS OR SUPPLIERS BE
LIABLE FOR ANY OF THE FOLLOWING: a) DAMAGES BASED ON ANY THIRD PARTY CLAIM; b) LOSS OF,
OR DAMAGE TO, CUSTOMER’S RECORDS, FILES OR DATA; OR c) DIRECT, INDIRECT, SPECIAL,
INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING LOST PROFITS OR SAVINGS),
WHETHER IN CONTRACT, TORT OR OTHERWISE (INCLUDING NEGLIGENCE) ARISING OUT OF YOUR
USE OF THE SOFTWARE, EVEN IF NORTEL NETWORKS, ITS AGENTS OR SUPPLIERS HAVE BEEN
ADVISED OF THEIR POSSIBILITY. The forgoing limitations of remedies also apply to any developer and/or supplier
of the Software. Such developer and/or supplier is an intended beneficiary of this Section. Some jurisdictions do not
allow these limitations or exclusions and, in such event, they may not apply.
4. General
a. If Customer is the United States Government, the following paragraph shall apply: All Nortel Networks
Software available under this License Agreement is commercial computer software and commercial computer
software documentation and, in the event Software is licensed for or on behalf of the United States
Government, the respective rights to the software and software documentation are governed by Nortel
Networks standard commercial license in accordance with U.S. Federal Regulations at 48 C.F.R. Sections
12.212 (for non-DoD entities) and 48 C.F.R. 227.7202 (for DoD entities).

b. Customer may terminate the license at any time. Nortel Networks may terminate the license if Customer fails
to comply with the terms and conditions of this license. In either event, upon termination, Customer must
either return the Software to Nortel Networks or certify its destruction.
c. Customer is responsible for payment of any taxes, including personal property taxes, resulting from
Customer’s use of the Software. Customer agrees to comply with all applicable laws including all applicable
export and import laws and regulations.
d. Neither party may bring an action, regardless of form, more than two years after the cause of the action arose.
e. The terms and conditions of this License Agreement form the complete and exclusive agreement between
Customer and Nortel Networks.
f. This License Agreement is governed by the laws of the country in which Customer acquires the Software. If
the Software is acquired in the United States, then this License Agreement is governed by the laws of the state
of New York.
5
Nortel VPN Router Configuration — Advanced Features
Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Text conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Related publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Hard-copy technical manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Finding the latest updates on the Nortel Web site . . . . . . . . . . . . . . . . . . . . . . . . . 18
Getting help from the Nortel Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Getting help over the phone from a Nortel Solutions Center . . . . . . . . . . . . . . . . . 19
Getting help from a specialist by using an Express Routing Code . . . . . . . . . . . . 19
Getting help through a Nortel distributor or reseller . . . . . . . . . . . . . . . . . . . . . . . . 20
New in this release. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
ISDN Terminal Endpoint Identifier processing . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Chapter 1
Configuring advanced LAN and WAN settings . . . . . . . . . . . . . . . . . . . . . . 23
Configuring 802.1Q VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Configuring the interface MTU and the TCP MSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Configuring the MTU on an interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Configuring TCP MSS clamping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Resetting the TCP MSS on an interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Configuring the MTU on a tunnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Setting up WAN interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Configuring WAN interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configuring E1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Configuring Fractional E1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
6 Contents
NN46110-502
Alarm generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Healthcheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Light emitting diodes (LEDs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Single port T1/E1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Quad T1/E1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Obtaining statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Configuring with Quick Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Event Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Configuring circuitless IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Configuring Security Accelerator (SA) and Hardware Accelerator cards . . . . . . . . . . . 48
VPN Router Security Accelerator (SA) card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Hardware Accelerator card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Performance considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Support for IPsec encryption and authentication algorithms . . . . . . . . . . . . . . . . . 50
Accelerator card security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Load-balancing between the CPUs and accelerator cards . . . . . . . . . . . . . . . . . . 51

Configuring the SA and Hardware Accelerator cards . . . . . . . . . . . . . . . . . . . . . . 52
Viewing statistics for accelerator cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Chapter 2
Configuring a T1 CSU/DSU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Viewing status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Configuring a T1 CSU/DSU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
56/64K CSU/DSU WAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Chapter 3
Configuring ADSL and ATM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
ADSL WAN interface cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
ATM software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Configuring ADSL and ATM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Configuring an ATM interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Configuring an ATM virtual circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Configuring PPP authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Configuring PPP advanced parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Configuring PPPoE parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Contents 7
Nortel VPN Router Configuration — Advanced Features
Chapter 4
Configuring PPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Configuring PPP settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Chapter 5
Configuring PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Configuring PPPoE settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Chapter 6
Configuring Frame Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Permanent virtual circuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
RFC 1490 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Traffic shaping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Committed information rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Committed burst rate and excess burst rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Traffic shaping configuration notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Overview of Frame Relay configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Configuring Frame Relay settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Configuring FRF.9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Configuring FRF.12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Frame Relay Forwarding Priority to a VC (virtual circuit) . . . . . . . . . . . . . . . . . . . . . . . 97
Assigning priority to a PVC within a map class . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Configuring VC with a map class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
FR Forwarding Priority to a VC with FRF.12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Frame Relay monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Frame Relay OM statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
IP statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Chapter 7
Configuring dial services and Demand Services . . . . . . . . . . . . . . . . . . . 103
Dial interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Configuring the modem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Configuring PPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Configuring ISDN BRI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Demand Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
8 Contents
NN46110-502
Trigger modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Dialing functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Backup Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Configuring subinterfaces as backup interfaces . . . . . . . . . . . . . . . . . . . . . . 111
Configuring an ABOT for backup interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 112
Dial on Demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Configuring Demand Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Configuring Demand Services with an interface group trigger . . . . . . . . . . . . . . 114
Configuring Demand Services with an hour trigger . . . . . . . . . . . . . . . . . . . . . . . 115
Configuring Demand Services with a route unreachable trigger . . . . . . . . . . . . . 116
Configuring Demand Services with a ping trigger . . . . . . . . . . . . . . . . . . . . . . . . 118
Configuring Demand Services with a Traffic trigger . . . . . . . . . . . . . . . . . . . . . . . 119
Configuring Demand dialout parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Configuring a remote network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
System log messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Healthcheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Chapter 8
VPN Router DLSw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Supported functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Ethernet LLC2 functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
SDLC functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Single port V.35/X.21 serial card functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Configuring DLSw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
VPN Router configuration commands example . . . . . . . . . . . . . . . . . . . . . . . . . . 135
DLSw local peer configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
DLSw remote peer configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
LLC2 port configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
SDLC port configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
SDLC link station configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
DLSw timers configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
DLSw miscellaneous configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Single port V.35/X.21 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Contents 9
Nortel VPN Router Configuration — Advanced Features
Chapter 9
Configuring IPX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
IPX client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Windows 95 and Windows 98 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Windows NT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Enabling IPX for group users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Sample IPX VPN gateway topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
10 Contents
NN46110-502
11
Nortel VPN Router Configuration — Advanced Features
Figures
Figure 1 Sample VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 2 Ethernet frame and 802.1Q frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 3 Routing between VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 4 VLAN tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 5 802/1Q tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 6 Adding LAN subinterfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 7 VPN Router-to-PDN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Figure 8 WAN Interfaces > Configure window . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Figure 9 Configure > Controller window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 10 Quick Start window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Figure 11 CLIP network topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Figure 12 56/64K CSU/DSU WAN interface card . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Figure 13 LEDs on the 56/64K CSU/DSU WAN interface card . . . . . . . . . . . . . . . . 60
Figure 14 ATM Interfaces Configure window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 15 PPP Authentication window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 16 PPP Advanced Settings window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Figure 17 PPPoE for single user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Figure 18 PPPoE on a local network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Figure 19 Edit PPPoE window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Figure 20 Frame Relay single public interface to ISP . . . . . . . . . . . . . . . . . . . . . . . . 84

Figure 21 Frame Relay multiple public interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Figure 22 Gateway between Frame Relay network and VPN network . . . . . . . . . . . 86
Figure 23 FRF.9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Figure 24 Adding a map class for Frame Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Figure 25 Editing a map class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Figure 26 Map Class in VC with fragmentation disabled . . . . . . . . . . . . . . . . . . . . 100
Figure 27 Typical demand setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Figure 28 Demand Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Figure 29 Demand Interface > Add Interface window . . . . . . . . . . . . . . . . . . . . . . . 113
12 Figures
NN46110-502
Figure 30 Demand remote network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Figure 31 VPN Router DLSw configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Figure 32 Data Link Connections without DLSw . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Figure 33 Data Link with DLSw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Figure 34 Local and Remote Switching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Figure 35 IPX topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
13
Nortel VPN Router Configuration — Advanced Features
Preface
This guide describes the Nortel VPN Router advanced features. It provides
configuration information and advanced WAN settings.
Before you begin
This guide is for network managers who are responsible for setting up and
configuring the Nortel VPN Router. This guide assumes that you have experience
with windowing systems or graphical user interfaces (GUIs) and familiarity with
network management.
Text conventions
This guide uses the following text conventions:
angle brackets (< >) Indicate that you choose the text to enter based on the

description inside the brackets. Do not type the
brackets when entering the command.
Example: If the command syntax is
ping <ip_address>, you enter
ping 192.32.10.12
bold Courier text
Indicates command names and options and text that
you need to enter.
Example: Use the
show health command.
Example: Enter
terminal paging {off | on}.
14 Preface
NN46110-502
braces ({}) Indicate required elements in syntax descriptions where
there is more than one option. You must choose only
one of the options. Do not type the braces when
entering the command.
Example: If the command syntax is
ldap-server
source {external | internal}
, you must enter
either
ldap-server source external or
ldap-server source internal
, but not both.
brackets ([ ]) Indicate optional elements in syntax descriptions. Do
not type the brackets when entering the command.
Example: If the command syntax is
show ntp [associations], you can enter

either
show ntp or show ntp associations.
Example: If the command syntax is default rsvp
[token-bucket
{depth | rate}], you can enter
default rsvp, default rsvp token-bucket
depth, or default rsvp token-bucket rate.
ellipsis points (. . . ) Indicate that you repeat the last element of the
command as needed.
Example: If the command syntax is
more diskn:<directory>/ <file_name>,
you enter
more and the fully qualified name of the file.
italic text Indicates new terms, book titles, and variables in
command syntax descriptions. Where a variable is two
or more words, the words are connected by an
underscore.
Example: If the command syntax is
ping <ip_address>, ip_address is one variable
and you substitute one value for it.
plain Courier
text
Indicates system output, for example, prompts and
system messages.
Example:
File not found.
Preface 15
Nortel VPN Router Configuration — Advanced Features
Acronyms
This guide uses the following acronyms:

separator ( > ) Shows menu paths.
Example: Choose Status > Health Check.
vertical line (
| ) Separates choices for command keywords and
arguments. Enter only one of the choices. Do not type
the vertical line when entering the command.
Example: If the command syntax is
terminal paging {off | on}, you enter either
terminal paging off or terminal paging on,
but not both.
BIS backup interface service
DF don’t fragment
DLSw Data Link Switching
DoD dial on demand
FTP File Transfer Protocol
IEEE Institute of Electrical and Electronics Engineers
IKE IPSec Key Exchange
IP Internet Protocol
IPX Internetwork Packet Exchange
ISAKMP Internet Security Association and Key Management
Protocol
ISDN integrated services digital network
ISP Internet service provider
L2TP Layer2 Tunneling Protocol
LAN local area network
LDAP Lightweight Directory Access Protocol
LLC2 logical link control 2
16 Preface
NN46110-502
MTU maximum transmission unit

MSS maximum segment size
NetBIOS Network Basic Input Output System
NIC network interface card
OSPF Open Shortest Path First routing protocol
PACE Packet Context Engine
PDN public data networks
POP point-of-presence
PPP Point-to-Point Protocol
PPTP Point-to-Point Tunneling Protocol
PU physical unit
RIP Routing Information protocol
RPA routing protocol application
RPS routing policy server
RTM route table manager
SA Security Accelerator
SAP Service Access Points
SDLC synchronous data link control
SNA System Network Architecture
SSP Switch to Switch Protocol
TCI Tag Control Information
TCP Transmission Control Potocol
TPI Tag Protocol Identifier
UDP User Datagram Protocol
VPN virtual private network
WAN wide area network
XNS Xerox Networking System
Preface 17
Nortel VPN Router Configuration — Advanced Features
Related publications
For more information about the Nortel VPN Router, refer to the following

publications:
• Release notes provide the latest information, including brief descriptions of
the new features, problems fixed in this release, and known problems and
workarounds.
• Nortel VPN Router Configuration—Basic Features (NN46110-500)
introduces the product and provides information about initial setup and
configuration.
• Nortel VPN Router Configuration—SSL VPN Services (NN46110-501)
provides instructions for configuring services on the SSL VPN Module 1000,
including authentication, networks, user groups, and portal links.
• Nortel VPN Router Security—Servers, Authentication, and Certificates
(NN46110-600) provides instructions for configuring authentication services
and digital certificates.
• Nortel VPN Router Security—Firewalls, Filters, NAT, and QoS
(NN46110-601) provides instructions for configuring the Stateful Firewall
and VPN Router interface and tunnel filters.
• Nortel VPN Router Configuration—Tunneling Protocols (NN46110-503)
configuration information for the tunneling protocols IPsec, L2TP, PPTP, and
L2F.
• Nortel VPN Router Configuration—Routing (NN46110-504) provides
instructions for configuring BGP, RIP, OSPF, and VRRP, as well as
instructions for configuring ECMP, routing policy services, and client address
redistribution (CAR).
• Nortel VPN Router Troubleshooting (NN46110-602) provides information
about system administrator tasks such as backup and recovery, file
management, and upgrading software, and instructions for monitoring VPN
Router status and performance. Also, provides troubleshooting information
and interoperability considerations.
• Nortel VPN Router Using the Command Line Interface (NN46110-507)
provides syntax, descriptions, and examples for the commands that you can

use from the command line interface.
• Nortel VPN Router—Client (NN46110-306) provides information for setting
up client software for the VPN Router.
• Nortel VPN Router—TunnelGuard (NN46110-307) provides information
about configuring and using the TunnelGuard feature.
18 Preface
NN46110-502
Hard-copy technical manuals
To print selected technical manuals and release notes free, directly from the
Internet, go to www.nortel.com/documentation, find the product for which you
need documentation, then locate the specific category and model or version for
your hardware or software product. Use Adobe Reader to open the manuals and
release notes, search for the sections you need, and print them on most standard
printers. Go to the Adobe Systems Web site at www.adobe.com to download a
free copy of the Adobe Reader.
How to get help
This section explains how to get help for Nortel products and services.
Finding the latest updates on the Nortel Web site
The content of this documentation was current at the time the product was
released. To check for updates to the latest documentation and software for VPN
Router, click one of the following links:
Link to Takes you directly to the
Latest software Nortel page for VPN Router software located at:
www130.nortelnetworks.com/cgi-bin/eserv/cs/
main.jsp?cscat=SOFTWARE&resetFilter=1&poid
=12325
Latest documentation Nortel page for VPN Router documentation
located at:
www130.nortelnetworks.com/cgi-bin/eserv/cs/
main.jsp?cscat=DOCUMENTATION&resetFilter=

1&poid=12325
Preface 19
Nortel VPN Router Configuration — Advanced Features
Getting help from the Nortel Web site
The best way to get technical support for Nortel products is from the Nortel
Technical Support Web site:
www.nortel.com/support
This site provides quick access to software, documentation, bulletins, and tools to
address issues with Nortel products. From this site, you can:
• download software, documentation, and product bulletins
• search the Technical Support Web site and the Nortel Knowledge Base for
answers to technical issues
• sign up for automatic notification of new software and documentation for
Nortel equipment
• open and manage technical support cases
Getting help over the phone from a Nortel Solutions Center
If you do not find the information you require on the Nortel Technical Support
Web site, and you have a Nortel support contract, you can also get help over the
phone from a Nortel Solutions Center.
In North America, call 1-800-4NORTEL (1-800-466-7835).
Outside North America, go to the following Web site to obtain the phone number
for your region:
www.nortel.com/callus
Getting help from a specialist by using an Express Routing
Code
To access some Nortel Technical Solutions Centers, you can use an Express
Routing Code (ERC) to quickly route your call to a specialist in your Nortel
product or service. To locate the ERC for your product or service, go to:
www.nortel.com/erc
20 Preface

NN46110-502
Getting help through a Nortel distributor or reseller
If you purchased a service contract for your Nortel product from a distributor or
authorized reseller, contact the technical support staff for that distributor or
reseller.
21
Nortel VPN Router Configuration — Advanced Features
New in this release
The following section details what is new in Nortel VPN Router Configuration —
Advanced Features for Release 7.0.
Feature
See the following section for information about feature changes:
ISDN Terminal Endpoint Identifier processing
The new ISDN features require version 2.45 of the microcode. To obtain version
2.45 of the microcode, see “Getting help over the phone from a Nortel Solutions
Center” on page 19.
With ISDN Terminal Endpoint Identifier (TEI) processing, the Nortel VPN
Router ISDN module, by default, sends two 64K bearer calls on a single TEI.
Some older ISDN providers do not support two bearer calls on a single TEI;
therefore, Nortel added this option to support these older providers.
You can use the graphical user interface (GUI) or the command line interface
(CLI) to configure the calls per TEI.
For more information about Terminal Endpoint Identified processing, see
“Configuring ISDN BRI” on page 106.
Other Changes
See the following sections for information about changes that are not
feature-related:
22 New in this release
NN46110-502
Configuring the interface MTU and the TCP MSS

This release updates the describes the configuration of the packets that is accepted
thorough an interface. For more information, see “Configuring the interface MTU
and the TCP MSS” on page 33
.
23
Nortel VPN Router Configuration — Advanced Features
Chapter 1
Configuring advanced LAN and WAN settings
This chapter provides the configuration information for the following:
• 802.1Q VLAN
• Interface MTU and TCP MSS
• WAN interfaces
• Circuitless IP
• Security Accelerator (SA) and Hardware Accelerator cards
Configuring 802.1Q VLAN
You control broadcast traffic and improve network performance with the Virtual
LAN (VLAN). A VLAN is a collection of end nodes grouped logically, rather
than by their physical location. The VPN Router assigns end nodes that frequently
communicate with each other to the same VLAN, regardless of their physical
location on the network. This allows users located in separate areas or connected
to separate ports to belong to a single VLAN.
A VLAN is created based on:
• Membership by port group—a port-based VLAN is a collection of ports
across one or more switches. For example, the VPN Router assigns ports 1, 2,
3, and 4 to VLAN A, and assigns ports 5, 6, 7, and 8 to VLAN B.
• Membership by MAC address—the MAC address of a network device
determines its VLAN membership. To create a MAC address-based VLAN,
you configure a VPN Router with a list of MAC addresses that are associated
with a particular VLAN. The VPN Router looks up the source MAC address
of a received frame to determine its associated VLAN.

24 Chapter 1 Configuring advanced LAN and WAN settings
NN46110-502
• Membership by protocol—protocol-based VLANs use layer 3 protocol type
(such as IP, IPX, Appletalk) to determine membership. For example, you can
create a VLAN for IPX protocol and place ports carrying IPX traffic into this
VLAN. This localizes all IPX traffic (including IPX broadcasts) within the
ports of that VLAN.
• Membership by network address—the network-layer address determines
membership. For example, you can create an IP-subnet-based VLAN for IP
subnet 128.1.1.0/24. The VPN Router then inspects a packet's IP address to
determine if it belongs to subnet 128.1.1.0/24. If it does belong to that subnet,
it is a member of the VLAN.
Hosts assigned to a virtual LAN send and receive broadcast and multicast traffic
as though they are all connected to a common network. Therefore, devices on the
same VLAN function as a single LAN segment or broadcast domain.
VLAN-aware switches isolate broadcast, multicast, and unknown traffic received
from VLAN groups so that traffic from stations in a VLAN are confined to that
VLAN.
You divide the network into separate VLANs to create separate broadcast
domains. This arrangement conserves bandwidth, especially in networks
supporting broadcast and multicast applications that flood the network with
traffic.
Figure 1 shows an example of a VLAN. Two buildings have separate internal
networks and each building is connected to a VLAN-aware switch. The
engineering and sales groups are in separate VLANs. If a workstation from the
sales VLAN sends a broadcast, every workstation belonging to the sales VLAN
receives the broadcast, regardless of the physical location of the workstation. At
the same time, workstations on the engineering VLAN have no knowledge of the
broadcasts. Sales broadcasts do not interfere with the engineering network.
Chapter 1 Configuring advanced LAN and WAN settings 25

Nortel VPN Router Configuration — Advanced Features
Figure 1 Sample VLAN
802.1Q is IEEE (Institute of Electrical and Electronics Engineers) specification
for VLAN implementation in layer 2 switches with emphasis on Ethernet. 802.1Q
provides a 32 bit (4 byte) header for VLAN tagging with VLAN membership
information.
Frame tagging with 802.1Q information is performed at the Data Link layer level
and requires modification to Ethernet frame format. Each 802.1Q tag sits in the
Ethernet frame between the source address field and the MAC (Media Access
Control) client type/length field. Ethernet switches look at this tag to determine
where to deliver the frame.
Figure 2 shows a standard Ethernet frame and an 802.1Q modified Ethernet
frame. The tagged frame has two new fields—Tag Protocol Identifier (TPI) and
Tag Control Information (TCI). TPI represents the Ether Type and is assigned a
fixed value of 0x8100. If the frame has the TPI equal to 0x8100, the frame carries
the 802.1Q tag. The following two bytes (16 bits) stores the tag. The tag contains:
User Priority—3 bits of 802.1p user priority level (0-7);