Summary of the content on the page No. 1
TM
SpeedTouch
610/610i/610s/610v
Business DSL Router
Remote Management
600
SERIES
Summary of the content on the page No. 2
Summary of the content on the page No. 3
TM SpeedTouch 610 Remote Management Application Note Ed. 01
Summary of the content on the page No. 4
Status Released Change Note PeckelbeenS Short Title AppNote_RemoteManagement R4.1 Ed. 01 Copyright © 2002 THOMSON multimedia. All rights reserved. Passing on, and copying of this docu- ment, use and communication of its contents is not permitted without written authorization from THOMSON multimedia. The content of this document is furnished for informational use only, may be subject to change without notice, and should not be construed as a commit- ment by THOMSON multimedia. THOMSON multimedi
Summary of the content on the page No. 5
Contents 1 Introduction .................................................................... 3 TM 2 SpeedTouch 610 Remote Access.............................. 5 TM 2.1 The SpeedTouch 610 Firewall ........................................................................ 6 TM 2.2 Remote SpeedTouch 610 Web Interface Access ......................................... 8 TM 2.3 Remote SpeedTouch 610 Telnet Access ....................................................... 9 TM 2.4 Remote SpeedTouch 610 FTP A
Summary of the content on the page No. 6
Application Note Ed. 01 2
Summary of the content on the page No. 7
1Introduction 1Introduction Overview Abstract Being a key component of your business network, a good operation of the TM SpeedTouch 610 is essential to gain maximum performance of your DSL connections. TM Continuous management and diagnosis of the SpeedTouch 610 should be performed TM to ensure a faultless operation of the SpeedTouch 610, 24 hours a day, 7 days a week. TM As such, the SpeedTouch 610 can be perfectly embedded in high quality networks, covered by Service Level Agreements (SLAs)
Summary of the content on the page No. 8
1 Introduction Application Note Ed. 01 4
Summary of the content on the page No. 9
TM 2 SpeedTouch 610 Remote Access TM 2SpeedTouch 610 Remote Access TM Introduction The application note SpeedTouch 610 Operation and Maintenance described some of TM the standard access methods the SpeedTouch 610 provides to allow users to perform configurations and/or - if needed- the required procedures for maintaining and opti- TM mizing SpeedTouch 610 operation and performance. While that application note described what tools are provided by the TM TM SpeedTouch 610 and how to use them vi
Summary of the content on the page No. 10
TM 2 SpeedTouch 610 Remote Access TM 2.1 The SpeedTouch 610 Firewall TM Introduction All traffic from, to, or via any of the SpeedTouch 610 interfaces is subjected to its powerful programmable firewall. TM For a full description of the SpeedTouch 610 programmable firewall see the applica- TM tion note The SpeedTouch 610 and Firewalling. In the scope of Remote management however, the following topics provide some essen- TM tial information to understand the operation of the SpeedTouch 610 firewa
Summary of the content on the page No. 11
TM 2 SpeedTouch 610 Remote Access Implementation of the In the following an extract is given of the default firewall rules. default firewall rules TM • Sink chain firewall rules applying to traffic destined for the SpeedTouch 610 IP host (sink hook): chain=sink index=0 srcintf="eth0" srcbridgeport=!1 action=drop chain=sink index=1 srcintfgrp=!wan action=accept chain=sink index=2 prot=udp dstport=dns action=accept chain=sink index=3 prot=udp dstport=bootpc action=accept chain=sink index=4 prot=u
Summary of the content on the page No. 12
TM 2 SpeedTouch 610 Remote Access TM 2.2 Remote SpeedTouch 610 Web Interface Access TM Appropriate firewall To allow remote access to the SpeedTouch 610 web pages from the WAN, you must rules add following rules: • To the sink chain: [firewall rule]=> create chain=sink index=2 prot=tcp dstport=www-http action=accept TM The rule allows incoming traffic from the WAN to the SpeedTouch 610 web host. The rule is inserted after the first two rules (index=0 and index=1) as none of the two rules app
Summary of the content on the page No. 13
TM 2 SpeedTouch 610 Remote Access TM 2.3 Remote SpeedTouch 610 Telnet Access TM Appropriate firewall To allow remote access to the SpeedTouch 610 Command Line Interface (CLI) via a TM rules Telnet session from the WAN to the SpeedTouch 610, you must add following rules: • To the sink chain: [firewall rule]=> create chain=sink index=2 prot=tcp dstport=telnet action=accept TM The rule allows incoming traffic from the WAN to the SpeedTouch 610 Telnet server. The rule is inserted after the first t
Summary of the content on the page No. 14
TM 2 SpeedTouch 610 Remote Access TM 2.4 Remote SpeedTouch 610 FTP Access TM Appropriate firewall To allow remote access to the SpeedTouch 610 File System via an FTP session from TM rules the WAN to the SpeedTouch 610, you must add two rules per chain: one rule for the FTP control channel and one for the FTP data channel: • To the sink chain: [firewall rule]=> create chain=sink index=2 prot=tcp dstport=ftp action=accept [firewall rule]=> create chain=sink index=3 prot=tcp dstport=ftp-data acti
Summary of the content on the page No. 15
TM 2 SpeedTouch 610 Remote Access TM 2.5 SpeedTouch 610 Controlled Access Introduction In sections “2.2 Remote SpeedTouchTM610 Web Interface Access” on page 8, “2.3 Remote SpeedTouchTM610 Telnet Access” on page 9 and “2.4 Remote SpeedTouchTM610 FTP Access” on page 10 the methods for allowing remote manage- TM ment of the SpeedTouch 610 by a remote host or network on the WAN are described. Generally the method existed of changing or adding firewall rules to which the packets TM arriving at or
Summary of the content on the page No. 16
TM 2 SpeedTouch 610 Remote Access TM In case you use the SpeedTouch 610 DHCP server for automatic IP configuration for the hosts on your local network, DHCP requests from local hosts will no longer be TM accepted to arrive at the SpeedTouch 610 IP host (i.e. its DHCP server), and equally, TM DHCP replies will no longer be accepted to leave the SpeedTouch 610 IP host towards the local LAN. To solve this, you can add following firewall rules: chain=sink index=3 srcintfgrp=lan prot=udp dstport=
Summary of the content on the page No. 17
TM 3 SpeedTouch 610 Syslog TM 3SpeedTouch 610 Syslog Introduction Syslog is a basic, uncomplicated, yet powerful method to administer a network device as TM TM the SpeedTouch 610. By sending syslog messages, the SpeedTouch 610 is able to inform network managers about the general state of the device and to record events which can be retrieved for later analysis and diagnosis. TM This section describes how to use the SpeedTouch 610 Syslog server. TM TM SpeedTouch 610 Next to Syslog the SpeedTou
Summary of the content on the page No. 18
TM 3 SpeedTouch 610 Syslog TM 3.1 The SpeedTouch 610 Syslog Daemon What is Syslog Syslog is a message generating tool that can be implemented in any network device. The intention of the tool is to send messages over the network indicating status, actions, possible problems, etc. from the device. Although the syslog protocol is widely spread and evolved to a de-facto standard, only recently some first Internet drafts and informational Request For Comments (RFC) became available to describe th
Summary of the content on the page No. 19
TM 3 SpeedTouch 610 Syslog Syslog priority facilities Following priority facilities are possible for a syslog message generated by the TM SpeedTouch 610. The facilities are listed by descending priority: Priority Notation Code Kernel messages kern 0 User-level messages user 8 Mail system mail 16 System daemons daemon 24 Authorization messages auth 32 Syslog daemon messages syslog 40 Line printer subsystem lpr 48 Network news subsystem news 56 UUCP subsystem uucp 64 Clock daemon cron 72 Security
Summary of the content on the page No. 20
TM 3 SpeedTouch 610 Syslog TM Syslog message bodies The SpeedTouch 610 syslog daemon is internally responsible for collecting and admin- istering messages generated by one or more of its subsystems. Following of the TM SpeedTouch 610 subsystems are able to trigger a message: • The PPP dial-in client • The PPPoA-to-PPTP relaying facility • The DHCP server and DHCP client • The SNTP client • The RIP module • The login authentication module • The NAPT module • The Firewall module TM • The SpeedTou
