Wave Wireless Networking SLTM Wireless Lan User Manual speedlan xe 3000 6000 manual ver 3 3

Wave Wireless Networking Wireless Lan speedlan xe 3000 6000 manual ver 3 3

UserManual.wiki >

Wave Wireless Networking >

SLTM User Manual

users manual

SPEEDLANSPEEDLANSPEEDLANSPEEDLANSPEEDLANTM 6000OPERATOR’S MANUALVersion 1.0Last revised June, 2000Division941-358-9283941-355-0219 FAX800-721-9283www.speedlan.comsales@speedlan.com1748 Independence Blvd. C-5Sarasota, FL 34234

SPEEDLAN TM3PRODUCT LICENSE AGREEMENTIt is important for users of Wave Wireless hardware and software to take time to read this License Agreement associated with this software PRIOR TO ITS USE.The Customer or Reseller has paid a License fee to Wave Wireless for use of this software on one bridge or bridge/router. This License does not extend to anycopyrights to the program nor does it license use of the program on more than one bridge or bridge/router nor to make copies of the program for distribution or resale.A product registration card is included with the product manual. Please complete the card within 10 days of receipt of the software/hardware and return it to WaveWireless. Registration is required for warranty service, technical support and notification of product updates and revisions.License Agreement: The Customer or Reseller is granted a non-exclusive License to use the licensed program on a single bridge or bridge/router subject to the termsand conditions as set forth in this agreement. The Customer or Reseller may not copy, modify or transfer the reference manual or other documentation or any copythereof except as expressly provided in this agreement.The Copyright and all intellectual/industrial rights of this program and associated material remain the property of Wave Wireless. THE CUSTOMER ORRESELLER MAY NOT USE, COPY, SUBLICENSE, ASSIGN OR TRANSFER THE LICENSED MATERIALS OR ANY COPIES THEREOF INWHOLE OR IN PART, EXCEPT AS EXPRESSLY PROVIDED IN THIS LICENSE AGREEMENT. The Customer or Reseller shall not reverse assembleor reverse compile the Licensed product or any copy thereof in whole or in part.RETURN POLICIES AND WARRANTIESInitial One Year Warranty Term:Each Wave Wireless product is warranted against defects in material and workmanship for a period of one year from date of shipment. During the warranty period WaveWireless will, at its option, repair or replace products that prove to be defective.If equipment fails, the Customer or Reseller shall notify Wave Wireless and request a Return Material Authorization (RMA) number. For warranty service or repair,this product must be returned to Wave Wireless. All returns to Wave Wireless MUST have a valid RMA number written clearly on the outside of the box orthe shipment will be refused. The buyer shall pay all return shipping charges during the one-year warranty. All outbound shipments will be made viaground shipment by Wave Wireless or via air courier with the customer’s account number with the exception of Extended/“Spare in the Air” Warrantyholders.Extended Warranty Policies (Includes “Spare in the Air”)At any time during the first year following an equipment purchase, an Extended Warranty Policy may be purchased for 10% of the original list price. Terms of theExtended Warranty include “Spare in the Air” privileges to allow the use of parts or a spare unit temporarily.“Spare in the Air” Loaner Unit or Parts Replacement PoliciesFor an additional 10% of list price, the customer may purchase a “Spare in the Air” policy. This policy gives the customer the right to a loaner replacement unitshipped within 24 hours of acceptance of the RMA by Wave. All outbound shipments will be made via overnight air courier (during the first year).“Spare in the Air” Policy Steps for Warranty or Extended Warranty Loaner Service:1. Customer obtains RMA approval2. Overnight shipment of spare unit or parts to customer within 24 hours of approved RMA. Customer swaps unit or part(s) with phone assistance, if required.3. Customer returns part(s) to Wave Wireless. All returns to Wave Wireless MUST have a valid RMA number written clearly on the outside of the box orthe shipment will be refused.4. After 14 days from the issuance of an RMA, an invoice for the list price of the unit or components will be issued for any equipment that has not been returned.This will be credited upon the return of the defective or replacement part or unit to Wave Wireless.Extended Warranty Pricing Schedule1st year: 10% of published equipment list price2nd year: 15% of published equipment list price3rd year: 15% of published equipment list price*If all three years are purchased simultaneously, the cost will be 10% per year or 30% of list.Years 2 & 3 can be purchased during the initial year of coverage if the equipment was under extended warranty during the first year or if a physical on-site equipmentinspection is performed and equipment is evaluated in warrantable condition by Wave Wireless personnel at prevailing or site service call rates.Onsite ServicesOnsite services for troubleshooting and repair are billed at daily rate, plus expenses, unless otherwise agreed upon. Use of spectrum analyzers or other test equipmentmay raise the daily rate.Rental Unit LoanerCustomer may rent a unit at an agreed upon daily rate, plus shipping expenses, in lieu of purchasing a spare or “Spare in the Air” policy. Rental days are countedfrom date shipped until the date the unit is received in return by Wave Wireless.Refurbishing FeesAny product returned that requires refurbishing, is damaged due to inadequate or improper packaging protection, or that has not been returned with original packingmaterials may be subject to a refurbishing fee.Bench Test and Repair TimeA unit is returned as defective and through bench testing is determined that the unit is not defective, Wave Wireless, at its discretion, may charge bench test time ata rate of $85 U.S. per hour for testing and troubleshooting. Out of warranty repairs will be performed at a rate of $85 U.S. per hour plus parts. All shipping chargeswill be the responsibility of the customer.

SPEEDLAN TM5Table of Contents5. SETTING UP THE IP ADDRESSES (IPHOST SETUP)..................................33Quick Overview of IP Addressing .........34Setting Up the IP Address......................42Physical (Static) Setup...............42DHCP Client & Interface.......... 44DHCP Server on SPEEDLAN. 45Setting Up NAT.....................................47Incoming NAT.......................................471. INTRODUCTION........................................7Features and Benefits..............................9Features Chart........................................102. USING CONFIGURATOR.......................11Installation and Description.....................133.CONFIGURING SPEEDLAN TM..............15General Setup.........................................17Interface and Advanced Interface .........20The Setup Buttons...................................21Transport Methods .............................224. BRIDGING SETUP...................................25Protocol Filtering.....................................27Ethernet Protocols................................27MAC Filtering.........................................28Permit Ethernet Multicasts......................28Permit Ethernet Broadcasts.....................29Storm Thresholds....................................29Tunnel Partners......................................30Outgoing NAT...........................................496. IP-ROUTER SETUP..................................53IP-Router Setup.......................................54RIP Routing..............................................567. SNMP SETUP.............................................598. SYSTEM ACCESS SETUP......................639. SNMP MONITORING..................................67Remote Statistics......................................69Interface Monitor......................................71SNMP Monitor.........................................72IP Monitor................................................73IP/TCP/UDPMonitor................................76ICMP Monitor.........................................789. TABLES.......................................................83System Information....................................85Bridge Learn Table...................................86IP ARP Table...........................................87IP Route Table.........................................88IP/TCP Connection Table........................90IP/UDP Listener Table.............................91Local - IP Address Table.........................9210. APPENDIX..............................................93Common Ethernet Protocols...................95Common Ethernet Vendor Addresses....98Common Ethernet Multicast Addresses.113Common Ethernet Broadcast Addresses.116

SPEEDLAN TMINTRODUCTION

SPEEDLAN TM9Features and BenefitsIP Routing with Advanced Filtering for SecurityThe SPEEDLAN TM supports IP Routing in addition to bridging. It can be used to add routing capability when anIP router may be a more appropriate choice.Transparent Ethernet Bridging with Advanced Filtering for Security and Network ReliabilitySPEEDLAN TM supports what is known as Transparent Ethernet Bridging with no Spanning Tree or SourceRouting support. Since the brouter contained in the SPEEDLAN TM is intended to provide network securitybetween a local LAN and a campus or enterprise wide network, and since using multiple bridges in a SpanningTree could compromise this security, the Spanning Tree scenario is not supported. In addition to the TransparentEthernet Bridging, the SPEEDLAN TM can drop (i.e., not forward) packets based upon the encapsulated higherlayer data within the packet. It is this option that gives SPEEDLAN TM the ability to perform advanced firewallfiltering and can add a significant measure of security and network reliablility to a network, surpassing thatprovided by modern multiprotocol routers.

SPEEDLAN TM10Features ChartHardware Supported10/100BASE-T Ethernet CardSPEEDLAN Wireless RadioBridging FeaturesTransparent BridgingFiltering by Ethernet Multicast, Broadcast and Bad PacketsFiltering by ProtocolFiltering by Ethernet Address PairGeneric Ethernet Tunneling through IP NetworksLearned Table LockdownExpanded IP ARP SupportAutomatic Broadcast Storm Protection and NotificationSNMP FeaturesIP “ping” SupportIP SNMP Support (MIB II, Ethernet, Inteface, SNMP, and Bridge MIB)IP SNMP WaveLANIP SNMP Trap SupportSNMP Access ListsIP-Router FeaturesIP Static Routing with Direct and Static RoutesICMP Messages, Default Router, and Subnet SupportSNMP Support for All Router-Related MIB VariablesRIP SupportEncryption Features (Add-on Option)Data Encryption of Wireless Packets

SPEEDLAN TM11USING CONFIGURATOR

SPEEDLAN TM13Installing the Windows SPEEDLAN TM Configurator1. Shut down all programs and applications.2. Note: The SPEEDLAN TM Configurator uses digital libraries, which reside on your Windows 95/98/NT 4.0 PC. If a program or application is open, the Setup will not install correctly. If theconfigurator is not installed correctly, the brouter could be rendered and inoperable after saving aconfiguration.3. Insert the CD into your floppy drive (i.e., Drive E, F, etc.).4. If the setup.exe program does not install automatically, click Start + Run. The Run dialog boxappears. Click Browse and locate the setup.exe where your CD-ROM drive is located. Then,click Open and OK.5. Follow the installation prompts.6. After the installation is complete, restart your computer.Note: Visit the web site for the newest SPEEDLAN TM Configurator.File MenuThe Windows 95/98/NT 4.0 Configurator will configure either a remote Flash ROM in the SPEEDLAN unitor configure a SPEEDLAN file saved on your computer. You can configure a SPEEDLAN file on yourcomputer and download it to the brouter later after you have verified that all settings are correct. This can makereconfiguring your SPEEDLAN TM a quick operation if you have the completed configuration already savedto your computer.Configuring a Remote SPEEDLAN TMTo configure a remote (network attached) brouter, you can use the Open Remote Config and Save functions.You must have a remote SPEEDLAN TM configuration opened with the Configuration Utility before anyconfiguration functions may be performed. After you have opened the remote device and configured it, you canthen save your configuration back to the open device. When you ‘Save’ back to the remote device, its FlashROM will be erased and then reprogrammed with the new configuration. After you save the configuration, youmust wait the required 15-second period to allow the Flash ROM to be fully programmed and let the bridgereboot with the new configuration. Turning off the SPEEDLAN TM or otherwise interrupting the repro-gramming of the Flash ROM will damage the programming of the brouter, and render it inoperable.Note: Anytime you make changes in Frequency, IP Routing, or Network ID, start with the brouterfurthest away from your current location. This will help avoid loss of communication between units.Configuring a Saved Configuration FileTo configure a saved CNF file (configuration file), open it from the file menu using the open function. You thenconfigure the file just as if you were configuring a remote SPEEDLAN TM. When you are finished configuringthe file, save it to disk from the file menu using the “Save Config File as...” function. The “Open RemoteConfig...” and “Save Config” functions are used for accessing and saving directly to the brouter without usinga file saved on diskette. Be careful when you save the configuration file that you do not save the configurationdirectly to the SPEEDLAN TM; otherwise, you will be configuring the brouter and may not be able to re-access it after uploading the incorrect configuration to it.Windows 95/98/NT 4.0 SPEEDLAN TM Configurator

SPEEDLAN TM14Exporting and Importing a ConfigurationOnce you have opened a remote brouter, you can take a “snapshot” of the current configuration with the“Save Config as...” function. This function will result in creating a CNF file. The extension .CNF is used todenote the special exported binary configuration file. The CNF file created with the “Save as...” function canlater be imported into another brouter by using the “Import Config File” function, then saving the configurationto the brouter using the “Save Config” function.The ToolbarBelow the menus you see a row of seven icons. Each icon depicts a function that can also be accessed from themenus.The File MenuOpen Config File - This function is used to open a configuration file from disk.Open Remote Config - This opens the configuration file directly from a remote device.Save Config - Saves the configuration you are working on to the place where you opened it.Save Config File as - Saves the current configuration into a file on disk. This file will have the extension .CNF.Import Config File - This opens a configuration file from disk. This function is used when you are going to savethe configuration from disk to a remote brouter.Upload Software - This function is to load a raw and unconfigured binary file to the brouter. This is done onlyin the event that the brouter’s firmware has been damaged.Reboot Remote - Use this function to reboot a brouter from a remote location.Exit - Closes the SPEEDLAN TM Configuration program. OpenOpen RemoteSaveSelect DeviceSave Remote Upload Software System InformationHelp

SPEEDLAN TM15CONFIGURING SPEEDLAN TM

SPEEDLAN TM17General Setup MenuThe third menu from the left is the Setup Menu. In this menu are the screens you will use to configure yourbrouters. Below are descriptions of the menu items and the settings found on their respective screens.Enable IP Routing - The transparent routing function will be enabled when this is item is checked. IP Routingwill work properly only if the routes are set up in the IP Route Menu. If the routes are not set up properlybefore you save the configuration, the bridge will become inoperable. Default is off.Enable Bridging - The transparent bridging function will be enabled when this is item is checked. If you wantthe brouter to perform the bridging function,you must enable this. When bridging is enabled, the Bridge SetupScreen will be accessible. Bridging should be enabled for nearly all applications of the brouter. Default is on.(This function should never be disabled.)General Setup

SPEEDLAN TM18Enable Remote Bridging using IP Tunnels - SPEEDLAN TM supports a special feature which will enableEthernet packets of any protocol type to be encapsulated in IP packets and sent to other brouters (purchasedfrom Wave Wireless )for de-encapsulation. This method can be used to setup virtual Ethernet LANs betweenseveral points using an IP network as the transport layer.Enable Advanced Network Monitoring Support - This option is not available at this time.Enable IP Security Counter Measures - This option is not available at this time.Enable Access Control - This option is not available at this time.Enable Digital Alarm Monitoring and Reporting - This option is not available at this time.Enable Data Encryption - This optional feature allows you to encrypt wireless data transmissions on topof the encryption provided by the radio. It provides 56 bit DES encryption. It is not shipped standard aspart of the XE units. If you did not purchase it when you originally bought the SPEEDLAN TM units, it canbe purchased later as a software upgrade.Data encryption is disabled by default. Check the box labeled “Enable Encryption” to enable the encryptionfeatures. You will still need to define at least one encryption key before your wireless traffic will be transmit-ted using wireless data encryption. To do this, return to the drop down menu presented when you clik onSetup. Now you will see a Data Encryption Setup item added to the menu list. Select Data EncryptionSetup. Select the DES Encryption button and enter an 8 digit alhpanumeric string in the range of “a-z”, “A-Z”, and “0-9”.Examples:· Alphanumeric: a5F2z4wKWarning: This setting must be set to the same value on all XE units you wish to have communicatetogether. Failure to set them to the same value will prevent any communications from taking place.(e.g. for multipoint to work properly, the base station AND all of the satellite units must use the sameEncryption Key setting.

SPEEDLAN TM19Enable Watchdog Reboot Timer - This feature instructs the bridge to reboot in the event that the bridge failsto receive any incoming packets, from any port, for a period of 10 minutes. The brouter will assume an errorhas occured and will reboot. If, after the brouter reboots, it does not receive an incoming hello signal, thebridge will listen for the hello signal until the user reboots the brouter manually. The Watchdog will recognizewhen a signal has been re-established and will reset the timer accordingly.Enable VGA Realtime Display - This feature allows a client to install a video card and a monitor and viewthe statistics directly from the unit, instead of Configurator, laptop, PC, etc.Note: Click Scale to view the LED Forwarding Scale.Enable Outgoing Network Address Translation - This option enables a company to map the privatenetworks IP addresses into one or more global public network IP addresses. This means that outsiders willonly view the single (or more if designated) IP network address assigned for global viewing on the Internet.For more informatoin, see Setting UP NAT, page 61.Enable Incoming Network Address Translation - This option enables a company to unmap publicnetwork IP address into private network IP addresses. For more information, see Setting UP NAT onpage 61Enable DHCP Server - This option enables the DHCP client and the interface that is selected. For moreinformation, see Setting UP the IP Addresses, page 58.Enable Access Point Radius Authentication - This option is not available at this timeEnable CampusPRC Radius Authentication - This option is not available at this time.Enable Link Integrity - This option is not available at this time..Enable IP/UDP/TCP Security Filters - This option is not available at this time.Enable AppleTalk Security Filters - This option is not available at this time.Enable Novell Security Filters - This option is not available at this time.

SPEEDLAN TM20The interfaces that are installed in your brouter will be represented on this screen. The Remote check box isused to designate which interfaces will be considered local and remote. The local interface is consider to be theinterface that connects directly to the local LAN with respect to the unit. The remote interface is considered tobe the interface that connects with the remote LAN. The set up buttons are used to access the portion of theconfiguration which controls how the individual interfaces are configured.The Advanced Interface Setup has a few more advanced settings, but essentially they are the same set upscreen. Note that the Max Tx rate is available on both the Interface Setup and Advanced Interface Setup.Max Tx Rate is useful to ISPs that want to regulate the maximum bandwidth provided to each customer. Thesesettings should not be changed without the assistance of a Wave Wireless Networking Technical SupportEngineer. Backup and Perm are not used with the XE series products. These fields must remain empty.Interface & Advanced Interface Setup

SPEEDLAN TM21Setup 2 - 11 Mb RF Interface Setup - On this screen are the configuration settings that control the individualinterfaces and how they communicate with each other. On the next page you will find a description of thesettings and how they effect the performance of the SPEEDLAN interfaces.The Setup ButtonsPressing the Setup buttons (1 and 2) on the Interface & Ad-vanced Interface Setup screen will open the Setup screen forthe interface selected.The card also supports full-duplex operation when connectedto either a 10 or 100 Mbps LAN port. The default setting isfor Half-Duplex. The interface can be configured to operatein Full Duplex using the options on this setup screen.Setup 1 - Ethernet SetupSPEEDLAN products come standard with a 10/100 Base-Tinterface to connect to your wired network. Although theinterface is capable of operating at both 10 Mbps and 100Mbps, it is not autosensing or autoswitching. The default set-ting is for 10 Mbps half-duplex operation. If you which toconnect your SPEEDLAN unit to a 100 Mbps port, theEthernet interface can be manually switched to 100 Mbps inthis portion of the setup.

SPEEDLAN TM22Campus PRC Mode (This is a Polling Base Station) - This setting should be used if this is the one and onlybase station in the wireless network cell. When the number of satellites become greater then approximately 5to 10 stations the Non-Polling Base Station sometimes is not as able to keep up with the wireless traffic thatneeds to be forwarded. The Polling Base Station alleviates this problem by continuously communicating withall of the satellite stations in its cell, and is responsible for dynamically assigning how much time is to be alottedto each satellite in the next transmission of data packets from that satellite. This is done after every transmissionCampus Cell PRC Mode (No base stations) - This method of transportation requires that all brouters beable to detect each other. If any of the stations are unable to see each other then a Base Station must beassigned that can repeat traffic from one brouter to another. This method utilizes Campus Cell PRC packetbundling which reduces the amount of overhead caused by sending smaller individual packets across thewireless network. This greatly improves the performance of the SPEEDLAN networkCampus PRC Mode (This is a Non-Polling Base Station) - This setting should be used if this is the onlybase station in the SPEEDLAN TM wireless network cell. With the previously mentioned ‘Campus Cell PRCMode (No Base Stations)’ setting there is a requirement that all wireless stations be able to transmit to andreceive from ALL other stations in the wireless network. This is not always possible due to particular topologyand terrain. SPEEDLAN TM has a special mode where one of the wireless stations can be configured as aBase Station and all other wireless nodes setup as Satellite Stations. In this configuration the only requirementis that each satellite station be able to communicate directly with the base station. The base station is respon-sible for repeating packets that need travel between the satellite stations. The Non-Polling Base Station doesnot allocate bandwidth to each statellite. This is preferable when the total number of satellites in the wireless cellis less then somewhere between 5 to 10 stations.The performance of this approach is greatly improved if the base station is connected to the most heavilyloaded network or network server. This is due to the fact that data flowing from one satellite to anothersatellite station must be repeated (retransmitted) by the base station, thus more of the wireless band-width is used. Data packets flowing from a satellite station to the base station are transmitted directly tothe base station without the need to be repeated.Transport MethodsThe industry compatible method of transmitting and receiving data over wireless networks cause data packetsto frequently be lost. This is due to the fact that a wireless network does not have the ability to detect collisionslike a wired Ethernet network. On an Ethernet network collisions can be detected by the hardware and areautomatically retransmitted. Ethernet is refered to as CSMA/CD (Carrier Sense Multiple Access with Colli-sion Detection). Wireless networks are CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance).The reason collisions can not be detected is wireless cannot receive and transmit at the same time, henceSPEEDLAN TM is not able to listen for the collisions. In practice a properly operating SPEEDLAN point-to-point network will loose, due to collisions, less than 1% of the transmitted packets. This packet loss is notnormally a problem with protocols such as Novell IPX (without the Burst Mode NLM), but may causenetworks using most other protocols to experience poor performance. Campus Cell PRC helps to alleviatethis problem by placing multiple packets into one larger packet, thus saving bandwidth by eliminating the extraoverhead.

SPEEDLAN TM23Campus PRC (This is a Satellite Station) - This is the configuration required for stations that are to beinstalled into a wireless network cell that utilizes a base station. Except for the base station, all the stations in thistype of wireless network cell should be configured as Satellite Stations. The satellite configuration tells thebrouter to forward all data that needs to pass through the wireless network to the base station. In addition, thesatellite stations are configured to listen to the base station for instructions if they are forthcoming.and greatly improves the performance of a base station wireless network cell when the total number of satellitestations is greater then 5 to 10 stations. As the number of stations increases, the usage of the wireless networkcell increases and efficiency is proportionately improved.Frequency Button - The Frequency button can be found in thelower right hand corner of the individual interfaces setup screens.Clicking this button will open a new screen that allows you tochange the operating frequency of the interface. All of the broutersexpected to communicate with this device should be configuredwith the same frequency.Advanced 11 Mb RF Interface SetupNetwork ID - The Network ID is a security setting that allowsthe SPEEDLAN TM unit to reject packets from other wirelessbridges in the area. Although the bridging or routing table wouldreject the packet once it was processed, the Network ID allowsthe bridge to reject the packet with much less processing. Thisimproves the performance of the SPEEDLAN TM units in installations where many wireless bridges are co-located in the same area or where other organizations may be running wireless bridges of their own. Thedefault setting is 0 and the valid range is 0 to 15.Warning: This setting must be set to the same value onall SPEEDLAN TM units you wish to have communicatetogether. Failure to set them to the same value will pre-vent any communications from taking place. (e.g. formultipoint to work properly, the base station AND all ofthe satellite units must use the same Network ID setting)Rate – This setting refers to the RF data rate. TheSPEEDLAN TM 11 Mbps radio has four data rates that canbe used:High - This is the full 11 Mbps data rate. The interface default to this value and it is recommended that youoperate using it for most installations. The receiver sensitivity of the radio with this setting is –82 dBm.Medium – This setting limits the card to providing 5.5 Mbps of bandwidth. The receiver sensitivity of the radiowith this setting is –85 dBm.

SPEEDLAN TM2411 Mb RF Security Setup – These settings are used to encrypt data that will be transmitted by the 11 Mb RFport and also to decrypt data that is received by 11 Mb RF port. You may define up to 4 encryption keys to beused for decrypting incoming data and one key for encrypting outgoing data.Check the box labeled “Enable Encryption” to enable the encryption features. You will still need to define atleast one encryption key before your wireless traffic will be transmitted using wireless data encryption.The Encryption Key can be defined using either:• 5 alphanumeric characters in the range of “a-z”, “A-Z”,and “0-9”• A 10 digit hexadecimal value using the range “A-F” and“0-9”. If you choose to use the hexadecimal method, usethe prefix “0x” (zero, x) in defining the keyExamples:• Alphanumeric: a5F2z• Hexadecimal: 0xA95F2BR39KWrite down the values you enter as Encryption Keys and storethem in a secure place. The values you enter will only be visiblewhen they are entered for the first time. Each time this option isdisplayed after the initial setup, the values will appear only as“xxxxxxxxxx”Warning: This setting must be set to the same value on allXE units you wish to have communicate together. Failureto set them to the same value will prevent any communications from taking place. (e.g. for multipointto work properly, the base station AND all of the satellite units must use the same Encryption Keysetting.There is also an option to Deny non encrypted Data. This feature is disabled by default and is designedprimarily for multipoint SPEEDLAN installations where it may not be necessary to run using data encryption atall locations. If you enable this option, any data received by this SPEEDLAN TM unit will not be passed to thewired network interface.Standard – This setting limits the card to providing 2 Mbps of bandwidth. The receiver sensitivity of the radiowith this setting is –89 dBm. You must use this setting if you want your XE unit to communicate with an olderSPEEDLAN unit that uses a 2 Mbps radio.Low - This setting limits the card to providing 1 Mbps of bandwidth. The receiver sensitivity of the radio withthis setting is –92 dBm.Warning: This setting must be set to the same value on all XE units you wish to have communicatetogether. Failure to set them to the same value will prevent any communications from taking place.

SPEEDLAN TMBRIDGING SETUP

SPEEDLAN TM27The SPEEDLAN TM is an IEEE 802.3MAC- layer bridge. The bridge can be con-figured to bridge or pass any 802.3 frametype protocols, including Novell IPX, TCP/IP, AppleTalk, etc. The SPEEDLAN TMcan also be configured to filter packets bytheir destination and origin. This is done us-ing the unique MAC (Media Access Con-trol) addresses that all network interface de-vices have assigned to them at the factory.Protocol Filtering - By default, theSPEEDLAN is configured to pass all net-work protocols. When you press the Editbutton, you will be presented with a list ofprotocols which you can select for filtering.After selecting the protocols, highlight themon this screen and press the Bridge or Denybuttons to set how each protocol will betreated. The radio buttons in the ProtocolFiltering box determine how unselected pro-tocols are treated.Ethernet Protocols - Some commonEthernet protocols and their associatedID numbers have been placed in thistable. Simply select one from this list ifyou wish to set a filter for it.If the protocol you wish to filter is notpresented here, click Custom, Add andenter the hex ID for that protocol.

SPEEDLAN TM28Permit Ethernet Multicasts - Standard Ethernet bridges will always forward multicast packets. Some pro-tocols do not use multicast packets, such as TCP/IP and Novell IPX. If you do not use protocols that usemulticast packets, you can drop them by shutting off multicasts on the SPEEDLAN TM. Shutting off multicastpackets will reduce the traffic being sent across your wireless network link. This will also reduce the number ofinterrupts that each computer connected to your network experiences.Pass Bad Ethernet Source - The standard Ethernet bridgeswe have tested will pass Ethernet packets with a broadcast ormulticast address as their source (i.e., packets with their first bitset to 1). The Ethernet specification for Transparent (i.e. Non-Source-Routing) Bridges does not allow these types of packets,which are considered bad packets. Our studies have shown thata common failure mode of many Ethernet interfaces and net-working software is to transmit packets like these. If you do notneed to permit Source-Routing packets, we suggest that youdeny these packets. The default setting is selected to permit thesepackets.Advanced Features - Clicking the Advanced button brings up this screen. Below are descriptions of thesettings and how they will effect your network.MAC Filtering - By default, the SPEEDLAN TM is config-ured to pass all traffic between all MAC-Address pairs. To addan address pair into the filter, click on the Add button in the MACFiltering box. You will be prompted to enter the Remote Ad-dress, which will be the MAC Address that resides on the remoteside of the brouter, and the Local Address, which will be theMAC Address that resides on the local side of your network.The side of the bridge you configured determines the remote sideand local side (in the Interface Setup screen).

SPEEDLAN TM29Storm Thresholds - One of the unique and very useful features of the SPEEDLAN TM is its ability to keepbroadcast and multicast storms from spreading throughout a network. Network storms are common and cancause bridges, routers, workstations, servers, and PCs to slow down or crash. Storms occur if networkequipment is configured incorrectly, if network software is not functioning properly, or poorly designed pro-grams such as network games are used. These settings are disabled by default.Enable Expanded IP ARP Support - Enabling this feature will cause the Bridge to also watch the IP/ARPpackets that occur on the network. The SPEEDLAN TM takes no action in response to IP/ARP packets(since that is the role of an IP router) except to add the IP address to its IP/ARP table. This feature is helpful onan IP network because it will build a database of MAC-layer-address-to-IP address pairs. An SNMP moni-toring program, such as the SPEEDLAN TM Configurator, can at any time extract this information. NOTE: 1)The IP/ARP table is never timed out in this mode. 2) This feature is not available if the brouter is routing IP. Thedefault value for this setting is Disabled.Permit Ethernet Broadcasts - Standard Ethernet bridges will always forward broadcast packets. Manyprotocols do not use broadcasts (e.g. AppleTalk Phase II, DECnet, and others). However, IP/ARP does usebroadcasts. If you do not use IP or any other protocol that requires broadcasts, you can deny them. Shuttingoff broadcast packets will reduce the traffic being sent across your wireless network link. This will also greatlyreduce the number of interrupts that each computer connected to your network experiences. Networks with ahigh number of broadcasts will slow down the processing of all attached computers, even those that aren’tusing the network.Enable Learned-Table Lockdown - A standard bridge watches the source address of each packet it receiveson any of its interfaces. As new addresses are seen, entries are added to the learned table that contains eachsource address and the interface number that address was received on. If a source address is later seen on adifferent interface, the bridge will immediately change the interface number in the learned-table entry. Thiscondition could happen in a correctly functioning network if someone moved a computer to a different part ofthe network. This could also happen if someone was trying to capture network packets by spoofing the bridge.Enabling learned-table lockdown will prevent the interface number from being changed once the source ad-dress has been seen. A standard bridge will also time-out the learned-table records every 10 minutes. Iflearned-table lockdown is enabled, these records will not be timed out. Once a record is learned, it will notchange or be deleted until either the bridge reboots or the learned table become completely filled and needs tobe reset. (NOTE: A typical SPEEDLAN TM learned table can contain over 12,000 records.) The defaultvalue for this setting is Disabled.Pass Unseen Ethernet Source - Standard Ethernet bridges will always forward packets with destinationaddresses that have not been learned (i.e., have not previously been seen as a source address of a packet).This characteristic is needed for the proper operation of an Ethernet bridge. The downside to this, as ourstudies have shown, is that the failure mode of many Ethernet interface cards is to send out erroneous packetswith good CRCs but with random Ethernet destination and source addresses. Standard bridges will permitthese erroneous packets because they have not “learned” the random destination, and then add this packet’srandom source address to their finite learned table. This situation is not uncommon and can greatly hinder theoperation of standard bridges. If you choose to deny unlearned packets, the brouter will not forward unicastpackets to Ethernet addresses that have not already been seen as a source address. This scheme works formost protocols because it relies on the characteristics of most upper-layer protocols to transmit ARP requestsor hello packets. It should be set to deny only by a qualified network engineer after careful testing and consid-eration. The default value for this setting is checked.

SPEEDLAN TM30Interface Threshold - This setting deter-mines the maximum number of broadcastor multicast packets that can occur duringa one-second period before a storm isdeclared for the assigned interface. Onceit is determined that a storm is occurring, any additional broadcast or multicast packets received on thatinterface will be denied until the storm is determined to be over. The storm will be determined to be over oncea one-second period has occurred with no broadcast or multicast packets received on that interface. Thesettings for broadcast packets and multicast packets are configured independently.Address Threshold - This setting deter-mines the maximum number of broadcastor multicast packets that can occur duringa one-second period before a storm con-dition is declared for a particular Ethernetaddress (host). Once it is determined thata storm is occurring, any additional broad-cast or multicast packets from that hostaddress will be denied until the storm isdetermined to be over. The storm will bedetermined to be over when 30 secondshave passed in which every one-secondperiod has less then the stated threshold inbroadcast or multicast packets. The set-tings for broadcast packets and multicastpackets are configured independently.Preset Button - This button sets the broadcast and multicast storm thresholds to the recommended values.These values have been determined to offer good protection without interfering with the operation of thetypical network. These values may need to be tuned for your particular network.Tunnel Partners - Tunneling is a method of encapsulatingEthernet packets received from the local interface in an IP/UDP packet and sending them to one or more tunnel part-ners. Tunneling can be used to set up virtual Ethernet net-works. In the General Setup menu, if the Remote Bridgingusing IP Tunnels is enabled, Tunnel Partners can be setup. This menu specifies the IP addresses of each of thebridge/routers that are to participate in the tunnel group.Specify the addresses of all the bridges that are participat-ing in the tunnel group but DO NOT specify the IP ad-dresses on this brouter.

SPEEDLAN TM31LAN CBridgeBridgeInternetor CampusIP NetworkBridgeLAN AStandard EthernetPacketEthernet PacketEncapsulated inIP/UDPEthernet PacketEncapsulated inIP/UDPStandardEthernetPacketRemoteInterfaceLocalInterfaceLAN BGeneric Ethernet Tunneling(Through an IP Network)The three brouters are set up to tunnel oneor more protocols and each is a tunnelpartner to the other two brouters. Thisconfiguration allows LAN A, LAN B, andLAN C to become a virtual private Ethernetnetwork with the Internet as the transportmechanism for data between them. Theencapsulated data packets can be optionallyencrypted to make the virtual privatenetwork more secure.Encrypt Bridge Tunnel Packets - If purchased, brouters (from Wave Wireless) may contain a special soft-ware-encryption algorithm that is distinct from the optional SPEEDLAN encryption chip on the brouters. IfData Encryption is enabled on the General Setup menu and if an Encryption Key is set up in the Data Encryp-tion menu, enabling encryption here will cause all Ethernet packets transmitted to tunnel partners to be en-crypted and encapsulated inside IP packets. The IP packet itself cannot be encrypted, because industry-standard IP routers, like those on the Internet, would not be able to forward the encrypted packets.

SPEEDLAN TM33Setting Up the IP Addresses (IP Host Setup)

SPEEDLAN TM34Use DHCP to set up the server and client IP addressing for the network. Use NAT to set up the translationfor incoming and outgoing network IP addresses.If you do not understand the basics of IP addressing, DHCP, or NAT please read the next section,Part I - Quick Overview of IP Addressing, below. Otherwise, skip to Part II - Setting Up the IPAddress, page 56 .Part I - Quick Overview of IP AddressingIP Addressing is important because it tells the network how to locate the computers or network equipmentconnected to it. IP addresses are given so each computer or equipment on the network contains a uniqueaddress. In addition, network addresses and node addresses, depending on the Class (A, B, C, etc),contain their own unique address as well. IP addressing provides the following information:•Provides communication between different platforms and diverse systems•Provides universal data transfer over large geographic distances•Has been “adopted” as a standard in the computer industryWhat is an IP address?An IP address contains 32 bits of information, which is divided into the following:•Two sections: the network address and the node address (also known as the host address)•To keep it simple, lets call it four bytes (octets)Note: Each octet contains 8 bits, which are equivalent to 1 byte. Each octet is separated by aperiod (.).The following examples show the conversion of the same IP address into several different formats:Decimal (130.57.30.56)Hexadecimal (82.39.1E.38)Binary (10000010.00111001.00011110.00111000).Internet Address ClassesUnderstanding this methodology is difficult, even for customers. Therefore, let’s explain this in easier terms.The first octet defines the “class” of the address, which is the only method to tell the size of the network(how big) and where the internet address belongs. There are three main classes:•Class A: 35.0.0.0•Class B: 128.5.0.0•Class C: 192.33.33.0This definition is not random; it is based on the fact that routers, by reading just the first three bits of theaddress field, designate which network class it belongs to. This selection simplifies the way routers handlethe messages (packets) and speed up the forwarding process.-non-bolded text = Part of network address-bolded text = Part of local address (node section)

SPEEDLAN TM35In fact, IP defines five classes:•Class A addresses use 8 bits (1 octet) for the network portion and 24 bits (3 octets) for the node(or host) section of the address. This provides up to 128 networks with 16.7 million nodes for eachnetwork.•First byte is assigned as network address•Remaining bytes used for node addresses•Format: network, node, node, node•In IP address 49.22.102.70, “49” is network address and “22.102.70” is the nodeaddress – all machines on this network have the “49” network address assigned to them•Maximum of 224 or 16,777,216 nodes • Class B addresses use 16 bits (two octets) for the network portion and 16 bits for the node (orhost) section of the address. This provides up to 16, 384 networks with 64,534 nodes for eachnetwork.•First two bytes are assigned as network address•Remaining bytes used for node addresses•Format: network, network, node, node•In IP address 130.57.30.56, “130.57” is the network address, and “30.56” is thenode address•Maximum of 216 or a total of 65,534 nodes•Class C addresses use 24 bits (3 octets) for the network portion and 8 bits (two octets) for thenode (or host) section of the address. This provides 16.7 million networks with 256 nodes for eachnetwork.•First three bytes are assigned as network address•Remaining byte used for node address•Format: network, network, network, node•In IP address 198.21.74.102, “198.21.74” is the network address, and “102” is thenode address•Maximum of 28 or 254 node addresses•Class D•Range is 224.0.0.0 to 239.255.255.255•Used for multicast packets (i.e., host sends out router discovery packets to learn all of therouters on the network)•Class E•Range is 240.0.0.0 to 255.255.255.255•Reserved for future useNote: Class D & E should NOT be assigned to net assignment of IP addresses. In addition, thefirst octet, 127, is reserved.In each network definition, the first node number (i.e., “0”) is used todefine the network, as well as the last number (i.e., “255”). The last number is known as thebroadcast address.Public IP addresses can be obtained from the following address:Network SolutionsInterNIC Registration Services505 Huntmar Park DriveHerndon, VA 22070hostmaster@internic.net

SPEEDLAN TM36Note: Non-public Addresses can include network address assigned from the network administrator orfrom the IP provider. Also, there is one network in each class that is defined for private use, allowingthe creation of internal networks. These addresses are Class A: 10.0.0.0, Class B: 172.10.0.0, andClass C: 192.168.0.0.Subnetting a NetworkThe increasing number of hosts and networks make impractical address blocks that are not smallerthan 245. In order keep the IP address small, so routers can manage them without changing thewhole protocol, a smaller network definition is created. This is called a subnet. Subnets are intended to:•Reduce network traffic•Optimize performance•Simplify management•Create more effective and efficient addresses for large geographic distancesDefault Subnet masks•Class A: 255.0.0.0•Class B: 255.255.0.0•Class C: 255.255.255.0Note: Subnet mask is bolded.What is a Subnet?This term allows you to create multiple networks within one Class A, B, or C network. Each data link(octet) contains its own unique identifier also known as the subnet. Also, each node on the same data linkmust belong on the same subnet as well.What is a Subnet Mask?This term allows you to mask section(s) (depending on the class specified) of the octets in the networkaddress. Each octet used in the subnet mask is assigned to a data link. The leftover octet(s) are assigned tothe remaining nodes.For more information on subnetting, see the example below and figure on the next page.Example of Subnetting:For example, a Class C network (255.255.255.0) contains three masked octets (255.255.255). The lastoctet (0) is leftover for remaining nodes (i.e., computers).If Router D is reading IP Addresses 195.172.3.1 (let’s call this IP Address 1) and 195.172.3.64 (let’s callthis IP Address 2) on this Class C network, it would send IP Address 1 to Subnet A and IP Address 2 toSubnet B. The remaining nodes in each subnet (A through D) on this network can contain up to 254 piecesof network equipment (computers, printers, fax machines, bridges or routers (also know as brouters), etc.).

SPEEDLAN TM37Figure of Subnetting a NetworkStill confused?An easier method to explain this concept is to use the classic “mailing” analogy used in IP addressing.Consider that this network, called Long Street, is four blocks long. There are 254 houses on Long Street,and each block contains 64 houses. Houses 1 to 63 reside on Block A. Houses 64 to 127 reside on BlockB. Houses 128 to 191 reside on Block C. Houses 192 to 254 reside on Block D. Think of each block as asubnet. This means that Blocks A, B, C, and D are all part of Long Street, which is also known as thenetwork in this example. The mailman would organize the letters (or IP addresses for network equipment)by creating four piles (one for each block, or subnet). As soon as the mailman picks up Pile A in his hand, heknows which block to turn on. This same reasoning applies to Piles B, C, and D as well. Router D knowsexactly which subnet to transfer (or turn) the packets to by reading its IP and subnet mask address. Notethat each subnet on this network is 255.255.255.192. Why is 192 the last octet in the subnet mask and not64? The last octet, 192, is the mask that allows 64 “houses” to know that the mailman (or router) is comingin advance. The “houses” will know it’s mailman “Jim” by looking at the IP number.Note: If the network is managed by a Simple Network Management Protocol for local or Internetaccess, each brouter must contain a unique IP Address. This is one of the benefits of static or dynamicaddressing.InternetRouter DRouter BRouter CComputer ComputerComputerComputerComputer Computer ComputerComputer Computer ComputerLong StreetSubnet AIP Address: 195.172.3.1Subnet Mask: 255.255.255.192Subnet BIP Address: 195.172.3.64Subnet Mask: 255.255.255.192Subnet CIP Address: 195.172.3.128Subnet Mask: 255.255.255.192Subnet DIP Address: 195.172.3.192Subnet Mask: 255.255.255.192Router A

SPEEDLAN TM38How does a network administrator assign an IP address?IP addresses are supplied by the network administrator (you), the ISP, or hosting company.The two types of IP addressing – manual (static) and automatic (dynamic) addressing – are describedbelow.Manual (static) Addressing - Each device connected to the Internet must have its own unique IP address.Also, if a computer is being used as a server, you will assign it a permanent IP address. This enables othercomputers to connect to it. Static addressing is also beneficial to users that need to maintain a “constant”connection to the Internet. This will enable users to easily access the IP address.Automatic (dynamic) Addressing - A DHCP (Dynamic Host Configuration Protocol) server assigns theIP address to each computer as the computer connects to the network. If a computer moves to a newnetwork (i.e., great for temporary employees or mobile users), it must be assigned a new IP address for thatnetwork. DHCP can be used to manage these assignments automatically. DHCP is described in furtherdetail below.What is DHCP?Dynamic Host Configuration Protocol (DHCP) allows network administrators (you) to assign static ordynamic IP addresses for the period of time needed to connect to the Internet. Think of DHCP as leasing anapartment. A prospective tenant may not need to live in an apartment for two years, maybe just a year.Therefore, the tenant will only sign a one-year lease agreement. For example, each time a computer is set upto connect to the Internet, the network administrator uses DHCP to automatically assign the computer aunique IP address. That computer will give up its IP address when it is no longer needed (when the leasehas ended) allowing new a computer (or a new tenant) on the same network to use it. This benefitseducational and corporate settings where users often log on to different computers. In this case more IPaddresses outnumber computers because you can quickly reconfigure the network if needed from acentralized location.Servers that utilize DHCP help resolve security, costly IP addressing services, and compatibility problems.DHCP is an alternative to BOOTP, which reduces the agony of assigning IP addresses and also providesadvanced configuration options.Note: The figure on the next page may help you understand how a DHCP address is generallyassigned.

SPEEDLAN TM39Figure of DHCP AddressingClientDHCP Server1. The client asks DHCP server for IP address and configuration if needed.2. The DHCP server assigns an available IP address to client.3. The client takes IP address from DHCP server and requests for any configuration needed.4. DHCP server confirms IP address and configuration.What is NAT?Network Address Translation (NAT) is the conversion of an Internet Protocol address (IP address) usedwithin one network to a different IP address within another network. One network is designated the insidenetwork and the other is the outside network.Network Address Translation (NAT) occurs when there is a translation among an Internet Protocol (IPaddress) used within one network (designated as inside network) to a different IP addresses within anothernetwork (designated as outside network). Network Address Translators (NATs) allow companies todecrease the number of global IP addresses. This enables companies to communicate with a single IPaddress (or more than one IP address). For example, a company can provide its clients with one IPaddress, allowing access to the company’s firewall only. This IP address is not a “real” address on thecompany’s internal network, but it is successfully translated to the correct IP location through NAT(i.e., NAT router). Therefore, the company controls access through firewalls and provides multiple IPaddresses to outside customers without excessive limited resources, or “global” Internet IP protocols.

SPEEDLAN TM40As the packet is transmitted from the private network across the public network, the packet will bere-addressed as 204.101.20.3 (public address of SPEEDLAN TM). When the packet returns to theSPEEDLAN TM and then back to the private network, the packet will be re-addressed (the IP address ofthe private network) by using the MAC address contained in the header to identify the destination.Outgoing NAT

SPEEDLAN TM41Incoming NATIncoming NAT allows you to specify ports on the private network that you would like to be available onthe public network. For example, if a web server on a server is IP Address 10.0.0.3, you can create a pairthat will specify that all requests received on the public IP address, Port 80, be forwarded to IP Address10.0.0.3 on the private IP address, Port 80.

SPEEDLAN TM42Part II - Setting Up the IP AddressIn this section you will first assign a static IP address or enable the DHCP client. Second, choose theappropriate interface for the DHCP client. Third, enable the DHCP Server on the SPEEDLAN TM.Note: Confirm the IP address of your SPEEDLAN TM units by performing the following tasks.Open the SPEEDLAN TM Configurator. From the File menu, choose Open Remote Config.Then, click Scan. The Scan dialog box appears. Select the appropriate brouter and click OK.Click OK again. A message box appears confirming that the “Configuration has been read from theBridge” (i.e., 128.104.224.1). Click OK.To set up the IP address, do one of the following:1. Physically assign a static IP address (Static IP)2. Enable DHCP client and choose appropriate interface (Dynamic).Note: After following Option #2 above, proceed to Enabling the DHCP Server on theSPEEDLAN, page 59.Physically Assigning a Static IP AddressTo physically assign a static IP address, do the following:1. From the Setup menu, choose IP Setup. The IP Setup dialog box appears.

SPEEDLAN TM432. Select the Specify an IP address option. Enter the following information:•Our IP Address – The unique number assigned by the network administrator, ISP or hostprovider. This tells network the location (IP address) of the computer on the Internet (i.e.,128.104.224.2).•Our Subnet Mask - This term allows network administrators to mask section(s) (depending onthe class specified) of the octets in the network address. Each octet used in the subnet mask isassigned to a data link. The leftover octet(s) are assigned to the remaining nodes.Note: For more information, see the figure called Subnetting a Network in the section calledPart I - A Quick Overview of IP Addressing, page 48. Once the packet has traveled to theappropriate network, it goes through a masking process. A subnet mask is composed of zeros (0s)and (1s). This tells the router which addresses to look under and which ones not to look under.Therefore, subnet masking allows the router to transfer the packet traffic more quickly than anetwork without a subnet. Again, this address is obtained from the network administrator, IP host, orhost provider.•Default Router IP – If you have an established network, use the IP address for the routeralready set up for that network. If you do not have an established network, leave this entryblank.•Default TTL – This information should already be entered. The IP host on the Internet will sendout each packet with a default “Time to Live” parameter. If you want to override the factorydefault of 64 attempts, you can specify your new default here. This parameter should not bechanged unless you are very familiar with IP functionality and how the Time to Live parameterwill affect the method packets the treated by your network, as well as the network to which youare bridged (or routed).Note: Click Select to view the IP Mask List. Select the appropriate IP Mask and click OK.3. After you have finished entering the appropriate information, click OK.4. Now save the changes to the brouter. From the File menu, choose Save Config.5. A message box appears informing you that the information will be saved to the brouter(i.e., 128.104.22.4). Click Ye s .6. The Configurator confirms that the configuration has been saved. Click OK. Restart the computer.Note: You are finished with this section. If you want to set up NAT, see Part III - Setting Up NAT,page 61.

SPEEDLAN TM44Enabling the DHCP Client and Choosing the Appropriate InterfaceTo enable the DHCP client and choose the appropriate interface, do the following:1. From the Setup menu, choose IP Setup. The IP Setup dialog box appears.2. Select the Obtain an IP address from DHCP Server option.3. Next, select the interface for Ethernet or wireless network from the Using Interface drop-down list.Make sure that you select the interface that the DHCP server is located on..Note: The information for Default TTL should already be entered. The IP host on the Internetsends out each packet with a default “Time to Live” parameter. If you want to override the factorydefault of 64 attempts, you can specify your new default here. This parameter should not bechanged unless you are very familiar with IP functionality and how the Time to Live parameterwill affect the method packets the treated by your network, as well as the network to which youare bridged (or routed).

SPEEDLAN TM45Enabling the DHCP Server on the SPEEDLAN TMTo enable the DHCP Server on the SPEEDLAN TM, do the following:1. From the Setup menu, choose General Setup. The General Setup dialog box appears.2. Select the Enable DHCP Server check box; this will enable you to set up the DHCP Server.Note: The only active NAT / DHCP check boxes in the NAPT / DHCP Features section (in the dialog box above) are the following:•Enable Outgoing Network Address Translation - This feature enables a company to mapthe private networks IP addresses into one or more global public network IP addresses. Thismeans that outsiders will only view the single (or more if designated) IP network addressassigned for global viewing on the Internet. For more information, see Part III - Setting UpNAT, page 61.•Enable Incoming Network Address Translation - This feature enables a company to unmappublic network IP address into private network IP addresses. For more information, seePart III - Setting Up NAT, page 61.3. From the Setup menu, choose DHCP Server Setup. The DHCP Server Setup dialog boxappears (as shown on the next page).

SPEEDLAN TM464. Enter the IP range and gateway/routerinformation:•Offered IP Starting Address – Thisis the start of the block of allowed IPaddresses. For example, the“offered” IP address between a blockof 20 to 40 is 20.•Offered IP Ending Address – This isthe end of the block of allowed IPaddresses. For example, the “ending”IP address between a block of 20 and40 is 40.•Default Router Address – This is theIP address of the default router thatallows clients to move outgoing packetsto a single router on the same subnet.•Default Router Mask – This is therouter that initially accepts or transferspacket to the directly connectednetworks or static networks.•Lease Time in Minutes – This is theamount of minutes that the computercan use the assigned IP address. Whenthe time is up, the IP address will bereassigned to another computer.Note: Click Select to view the IP Mask List. Select the appropriate IP Mask and click OK.5. Enter the domain name information:•1st DNS Server IP – This setting will specify the client’s 1st DNS Server.•2nd DNS Server IP – This setting will specify the client’s secondary DNS server.•3rd DNS Server IP – If needed, this setting will specify the client’s third DNS server.•Domain Name – This is the web domain name of the organization on the Internet such as“www.speedlan.com”. It is not necessary to use the first portion of the domain name leavingthe entry as “Speedlan.com”.6. Select the interface that you want to Enable DHCP on (i.e., Ethernet or wireless interface).7. Click OK.8. After you have finished entering the appropriate information, click OK.9. Now save the changes to the bridge or router. From the File menu, choose Save Config.10. A message box appears informing you that the information will be saved to the bridge or router.Click Ye s .11. The Configurator confirms that the configuration has been saved. Click OK. Restart the computer.

SPEEDLAN TM47Part III - Setting UP NATThis section explains how to setup outgoing and incoming Network Address Translation (NAT). For moreinformation on outgoing and incoming NAT, see pages 54 and 55.To setup outgoing NAT, do the following:1. From the Setup menu, choose General Setup. The General Setup dialog box appears.2. Select the Enable Outcoming Network Address Translation check box. Click OK.3. From the Setup menu, choose Outgoing Network Address Translation Setup.4. The Outgoing Address Translation Setup dialog box appears (as shown on the next page).

SPEEDLAN TM48Note: Click Select to view the IP Mask List. Select the appropriate IP Mask and click OK.6. Click OK.7. After you have finished entering the appropriate information, click OK.8. Now save the changes to the bridge or router. From the File menu, choose Save Config.9. A message box appears informing you that the information will be saved to the bridge or router.Click Ye s .10. The Configurator confirms that the configuration has been saved. Click OK. Restart the computer.Note: NAT is a useful tool that will be enabled the majority of the time on the client or satellite sideof the SPEEDLAN ISP or SPEEDLAN MP. It is rarely enabled on the base unit. NAT is alsouseful to have private networks connected to public networks (i.e., the Internet) without needed apublic IP address for every node. By using only one pulbic IP address, NAT controls who in theprivate network made a request to an address in the public network. This translates the IPaddresses from one side to another, hiding the private network from the public. This means that thepublic will view only one public and valid IP address.5. Enter the appropriate outgoing information:•Public IP Address – This is the IP address for the outside network. If you have more than onepublic address, you can assign it to node on a private network (One-to-One NAT). Therefore,all requests for a particular IP address from the outside or public network will be translated tothe appropriate private IP address. This may be necessary if you have a server or workstation(computer) that needs to be connected to a remote network.•Private IP Address – This is the IP address for the inside or private network only, which hidesbehind the Public IP address.•Public IP Mask – This address assigns the Subnet mask to the Public (Ethernet) portion of theSPEEDLAN unit.•Private IP Mask - This address assigns the Subnet mask to the private network interface.

SPEEDLAN TM49To set up incoming IP network address for NAT, do the following:1. From the Setup menu, choose General Setup. The General Setup dialog box appears.2. Select the Enable Incoming Network Address Translation check box. Click OK.3. From the Setup menu, choose Incoming Network Address Translation Setup.4. The Incoming Address Translation Setup dialog box appears (as shown on the next page).

SPEEDLAN TM505. Enter the appropriate incoming information:•Public IP Address – This is the IP address for the outside network. If you have more than onepublic address you can assign it to a node on the private network (One-to-One NAT).Therefore, all requests for a particular IP address from the outside or public network will betranslated to the appropriate private IP address. This may be necessary if you have a server orworkstation (or computer) that needs to be connected to a remote network.•Private IP Address – This is the IP address for the inside network only, which hides behind thepublic IP address.•Private IP Mask - This address assigns the Subnet mask to the private network interface.Note: Click Select to view the IP Mask List. Select the appropriate IP Mask and click OK.