manualshive.com logo in svg

virtual access GW1032, User Manual

The virtual access GW1032 User Manual is a comprehensive guide designed to help users navigate and maximize the features of their GW1032 device. This manual offers step-by-step instructions and troubleshooting tips, available for free download at manualshive.com. Enjoy hassle-free device setup and operation with this informative user manual.

Share
Download
background image

26: Configuring IPSec 

_______________________________________________________________________________________________________ 

_____________________________________________________________________________________________________ 

© Virtual Access 2017 
GW1000 Series User Manual 

Issue: 1.9 

 

Page 241 of 350 

26.6

 

IPSec diagnostics using the web interface 

26.6.1

 

IPSec status 

In the top menu, click 

Status -> IPSec

. The IPSec Connections page appears. 

 

Figure 124: The IPSec connections page 

In the Name column, the syntax contains the IPSec Name defined in package dmvpn and 
the remote IP address of the hub, or the spoke separated by an underscore; for 
example, dmvpn_213.233.148.2. 

26.7

 

IPSec diagnostics using UCI 

26.7.1

 

IPSec configuration 

To view IPSec configuration via UCI, enter: 

root@VA_router:~# uci export strongswan 

To restart strongSwan, enter: 

root@VA_router:~# etc/init.d/strongswan restart 

26.7.2

 

IPSec status 

26.7.3

 

To view IPSec status, enter: 

root@VA_router:~# ipsec statusall 

Security Associations (1 up, 0 connecting): 

dmvpn_89_101_154_151[1]: ESTABLISHED 2 hours ago, 

10.68.234.133[10.68.234.133]...89.101.154.151[89.101.154.151] 

dmvpn_89_101_154_151{1}:  REKEYING, TRANSPORT, expires in 55 seconds 

dmvpn_89_101_154_151{1}:   10.68.234.133/32[gre] === 192.168./32[gre] 

dmvpn_89_101_154_151{1}:  INSTALLED, TRANSPORT, ESP in UDP SPIs: cca7b970_i 

d874dc90_o 

dmvpn_89_101_154_151{1}:   10.68.234.133/32[gre] === 89.101.154.151/32[gre] 

To view a list of IPSec commands, enter: 

root@VA_router:~# ipsec –help 

Summary of Contents for GW1032

Page 1: ...GW1000 Series User Manual GW1000 Series Router GW1000M Series Router Issue 1 9 Date 27 March 2017 ...

Page 2: ...nnecting the antenna 17 2 16 Powering up 17 2 17 Reset button 18 3 GW1000 and GW1000M Series LED behaviour 19 3 1 Main LED behaviour 19 3 2 GW1000 and GW1000M Series Ethernet port LED behaviour 20 4 Installing a router into a vehicle 21 4 1 Installing a router into a vehicle using a non fused power cable 21 4 2 Installing a router into a vehicle using a fused power cable 22 5 Factory configuration...

Page 3: ...erties 47 8 3 System settings using UCI 51 8 4 System diagnostics 52 9 Upgrading router firmware 54 9 1 Software versions 54 9 2 Upgrading firmware using CLI 60 10 Router file structure 63 10 1 System information 63 10 2 Identify your software version 64 10 3 Image files 65 10 4 Directory locations for UCI configuration files 65 10 5 Viewing and changing current configuration 65 10 6 Configuration...

Page 4: ...e overview editing an existing interface 96 13 4 Configuring an Ethernet interface using UCI 104 13 5 Interface diagnostics 107 14 Configuring ignition sense 109 14 1 Configuration packages used 109 14 2 Configuring vapowermond using the web interface 109 14 3 Configuring vapowermond using the command line 111 14 4 Ignition sense diagnositcs 112 15 Configuring DHCP server and DNS Dnsmasq 113 15 1 ...

Page 5: ... using packages options 148 20 5 View routes statistics 149 21 Configuring a WiFi connection 150 21 1 Configuration packages used 150 21 2 Configuring a WiFi interface using the web interface 150 21 3 Configuring WiFi in AP mode 156 21 4 Configuring WiFi using UCI 158 21 5 Creating a WiFi in Client mode using the web interface 161 21 6 Configuring WiFi in Client mode using command line 162 22 Conf...

Page 6: ... 227 26 4 Configuring an IPSec template for DMVPN via the web interface 231 26 5 Configuring an IPSec template to use with DMVPN 239 26 6 IPSec diagnostics using the web interface 241 26 7 IPSec diagnostics using UCI 241 27 Configuring firewall 242 27 1 Configuration package used 242 27 2 Configuring firewall using the web interface 242 27 3 Configuring firewall using UCI 254 27 4 IPv6 notes 256 2...

Page 7: ...Terminal diagnostics 304 33 Configuring a GRE interface 305 33 1 Configuration packages used 305 33 2 Creating a GRE connection using the web interface 305 33 3 GRE configuration using command line 310 33 4 GRE configuration using UCI 310 33 5 GRE configuration using package options 310 33 6 GRE diagnostics 311 34 Configuring multicasting using PIM and IGMP interfaces 313 34 1 Overview 313 34 2 Co...

Page 8: ..._______________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 8 of 350 36 5 Generating a report 339 36 6 Reporting device status to Monitor using UCI 342 37 Configuring SLA for a router 346 37 1 Configuration package used 346 37 2 Configuring SLA for a router using the web interface 346 37 3 Configuring SLA for a router using the UCI interface 348 ...

Page 9: ...throughout Feature variations between GW1000 Series and GW1000M Series are described in separate sections 1 1 1 GW1000 Series routers The Virtual Access GW1000 Series router is a compact 3G 4G LTE router with WiFi designed with a lightweight plastic case with optional carrier for use in vehicles and a wide range of site based applications GW1032 Dual Ethernet 3G Dual SIM WiFi GW1042 Dual Ethernet ...

Page 10: ...efault value is shown in a grey cell Values for enabling and disabling a feature are varied throughout the web interface for example 1 0 Yes No True False check uncheck a radio button In the table descriptions we use 0 to denote Disable and 1 to denote Enable Some configuration sections can be defined more than once An example of this is the routing table where multiple routes can exist and all ar...

Page 11: ...og The following levels are available 0 Emergency 1 Alert 2 Critical 3 Error 4 Warning 5 Notice 6 Informational 7 Debug Web Agent Address UCI snmpd agent 0 agentaddress Opt agentaddress Specifies the address es and port s on which the agent should listen udp tcp port address Table 1 Example of an information table 1 2 2 Definitions Throughout the document we use the host name VA_router to cover al...

Page 12: ...el varients 2 1 1 GW1000 Series router Figure 1 GW1000 series router front Figure 2 GW1000 series router back GW1032 Dual Ethernet 3G dual SIM WiFi plastic casing and carrier GW1042 Dual Ethernet 4G LTE dual SIM WiFi plastic casing and carrier 2 1 2 GW1000M Series router Figure 3 GW1000M series router front Figure 4 GW1000M series router back GW1032M Dual Ethernet 3G dual SIM dual WiFi dual WiFi S...

Page 13: ...al antenna SMA connectors for 3G 4G main and aux GPS antenna with 3 3V active power feed Two 10 100 Mbps Ethernet ports WiFi internal antennas Concurrent Access Point and Station mode 2 2 2 GW1000M Series router Dual SIM sockets Dual antenna SMA connectors for 3G 4G main and aux GPS antenna with 3 3V active power feed Two 10 100 Mbps Ethernet ports Dual WiFi internal antennas Dual WiFi SMA female ...

Page 14: ...to 70 C Power lead with 3 connectors for 12V permanent 12V switched ignition sense and ground 2 6 GW1000 Series router dimensions Unit size 114W 114D 29Hmm Unit size with carrier 120W 120D 32Hmm Unit weight 209g 2 7 GW1000M Series router dimensions Unit size 114W 114D 38Hmm Unit size with carrier 120W 120D 42Hmm Unit weight 450g 2 8 Compliance The GW1000 and GW1000M Series router is compliant and ...

Page 15: ...B7 B8 B20 B38 B4 0 20 C to 70 C RFF CDMA TX 452 500 457 475 RX 462 000 467 475 20 C to 60 C RFG 850 900 1800 1900 850 900 2100 B1 B3 B5 B7 B20 40 C to 70 C RFH 850 1900 B2 B4 B5 B17 30 C to 70 C RFJ 450 40 C to 70 C 2 10 Antenna The GW1000 Series router has two SMA connectors for connection of two antennas for antenna diversity Antenna diversity helps improve the quality of a wireless link by miti...

Page 16: ... internal web server and start the configuration ensure the components are correctly connected and that your PC has the correct networking setup 2 11 1 Standard components 1 x GW1000 Series router with carrier 1 x GW1000M Series router 1 x plastic carrier 1 x lockable SIM cover Table 2 GW1000 Series router standard components 2 11 2 Optional components Ethernet cable RJ45 connector at both ends Po...

Page 17: ...necting cables Connect one end of the Ethernet cable into port A and the other end to your PC or switch For information on connecting cables for a vehicle installation read chapter 4 Installing a router into a vehicle 2 15 Connecting the antenna If you are connecting only one antenna screw the antenna into the MAIN SMA connector If you are using two antennas screw the main antenna into the MAIN SM...

Page 18: ...fig No special LED activity Between 3 and 15 seconds Flashing slowly Releasing between 3 15 seconds switches the router back to factory configuration Between 15 and 20 seconds On Releasing between 15 20 seconds performs a normal reset to running config Between 20 seconds and 30 seconds Flashing faster Releasing between 20 30 seconds reboots the router in recovery mode Over 30 seconds On Releasing ...

Page 19: ...________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 19 of 350 3 GW1000 and GW1000M Series LED behaviour 3 1 Main LED behaviour There are five LEDs on the GW1000 and GW1000M Series router Figure 5 LEDs on the GW1000 Series router Figure 6 LEDs on the GW1000M Series router The possible LED states are Off Flashing slowing 2 flashes per second Flashing quickly 5 flashes per second Do...

Page 20: ...ng up process and is in either config 1 or config2 SIM LEDs Off Not selected or SIM not inserted Flashing SIM selected and data connection is being established On SIM selected and registered on the network Signal LEDs Both LEDs off Not connected or signal strength 113dBm Left LED on Right LED off Connected and signal strength 89dBm Left LED off Right LED on Connected and signal strength between 89...

Page 21: ... either a fused or non fused power cable for the installation 4 1 Installing a router into a vehicle using a non fused power cable Install the router using the vehicle installation power cable 840 00076 provided Figure 8 840 00076 3 core power cable 1 Connector Molex Microfit 6circuit standard 2 Label 20mm wide 3 Each wire is 1 0mm square with overall PVC sheath Note Requires 5 amp fuse in series ...

Page 22: ...icle using a fused power cable Install the router using the vehicle installation power cable 840 00105 provided Figure 9 840 00105 3 core power cable 1 Connector Molex Microfit 6circuit standard 2 Label 20mm wide 3 Each wire is 1 0mm square with overall PVC sheath 4 Fuse Note Requires 5 amp fuse in series with red and blue wires Table 8 Power cable descriptions Connect the BLACK wire to a ground w...

Page 23: ...u are inserting has the required configuration written on it 2 Ensure the router is powered off 3 Hold the SIM 1 card with the chip side facing down and the cut corner front left 4 Gently push the SIM card into SIM slot 1 until it clicks in 5 Power up the router Depending on the model the power LED and or the configuration LED flash as usual The SIM LED starts flashing This indicates the applicati...

Page 24: ...hernet using the web interface DHCP is disabled by default so if you do not receive an IP address via DHCP assign a static IP to the PC that will be connected to the router PC IP address 192 168 100 100 Network mask 255 255 255 0 Default gateway 192 168 100 1 Assuming that the PC is connected to Port A on the router in your internet browser type in the default local IP address 192 168 100 1 and pr...

Page 25: ...lient and connect to the router s management IP address on port 22 192 168 100 1 24 On the first connection you may be asked to confirm that you trust the host Figure 11 Confirming trust of the routers public key over SSH Figure 12 SSH CLI logon screen In the SSH CLI logon screen enter the default username and password Username root Password admin 6 3 1 SCP Secure Copy Protocol As part of accessin...

Page 26: ...er reboot f To re enable SSH enter root VA_router etc init d dropbear enable root VA_router reboot f Note As SSH is enabled by default initial connection to the router to enable Telnet must be established over SSH 6 5 Configuring the password 6 5 1 Configuration packages used Package Sections system main 6 6 Configuring the password using the web interface To change your password in the top menu c...

Page 27: ... jRX x8A U5kLCMpi9dcahRhOl7eZV1 If changing the password via the UCI enter the new password in plain text using the password option root VA_router uci system main password newpassword root VA_router uci commit The new password will take effect after reboot and will now be displayed in encrypted format via the hashpassword option 6 8 Configuring the password using package options The root password ...

Page 28: ...m config system main option hostname VirtualAccess option timezone UTC config pam_auth option enabled yes option pamservice login option pammodule auth option pamcontrol sufficient option type radius option servers 192 168 0 1 3333 test 20 192 168 2 5 secret 10 config pam_auth option enabled yes option pamservice sshd option pammodule auth option pamcontrol sufficient it checks package management_...

Page 29: ...nticates against remote RADIUS if password authentication fails then it tries local database user defined in package management_users Required If either authentication fails or RADIUS server is not reachable then user is not allowed to access the router success done new_authtok_reqd done authinfo_unavail ignore default die Local database is only checked if RADIUS server is not reachable UCI system...

Page 30: ...tion pamservice sshd option pammodule account option pamcontrol sufficient option type tacplus option servers 192 168 0 1 49 secret option args service ppp config pam_auth option enabled yes option pamservice sshd option pammodule session option pamcontrol sufficient option type tacplus option servers 192 168 0 1 49 secret option args service ppp config pam_auth option enabled yes option pamservic...

Page 31: ...mcontrol sufficient option type tacplus option servers 192 168 0 1 49 secret option args service ppp config pam_auth option enabled yes option pamservice login option pammodule auth option pamcontrol sufficient option type tacplus option servers 192 168 0 1 49 secret config pam_auth option enabled yes option pamservice login option pammodule account option pamcontrol sufficient option type tacplus...

Page 32: ...management_users Required If either authentication fails or TACACS server is not reachable then user is not allowed to access the router success done new_authtok_reqd done authinfo_unavail ignore default die Local database is only checked if TACACS server is not reachable UCI system pam_auth 0 pammodule auth Opt pammodule Selects which TACACS module this part of configuration relates to auth auth ...

Page 33: ...Page 33 of 350 The router uses a package called Dropbear to configure the SSH server on the box You can configure Dropbear via the web interface or through an SSH connection by editing the file stored on etc config_name dropbear 6 11 1 Configuration packages used Package Sections dropbear dropbear 6 11 2 SSH access using the web interface In the top menu click System Administration The Administrat...

Page 34: ...ropbear dropbear 0 RootPasswordAuth Opt RootPasswordAuth Allows the root user to login with password 0 Disabled 1 Enabled Web Gateway ports UCI dropbear dropbear 0 GatewayPorts Opt GatewayPorts Allows remote hosts to connect to local SSH forwarded ports 0 Disabled 1 Enabled Web Idle Session Timeout UCI dropbear dropbear 0 IdleTimeout Opt IdleTimeout Defines the idle period where remote session wil...

Page 35: ...ation about the key its owner s ID and the digital signature of an individual that has verified the content of the certificate In asymmetric cryptography public keys are announced to the public and a different private key is kept by the receiver The public key is used to encrypt the message and the private key is used to decrypt it To access certs and private keys in the top menu click System Admi...

Page 36: ...iour of the server and default values for certificates generated for SSL operation uhttpd supports multiple instances that is multiple listen ports each with its own document root and other features as well as cgi and lua There are two sections defined Main this uHTTPd section contains general server settings Cert this section defines the default values for SSL certificates 6 14 1 Configuration pa...

Page 37: ...0 0 0 80 Bind at port 80 only on IPv4 interfaces 80 Bind at port 80 only on IPv6 interfaces Range IP address and or port Web Secure Listen Address and Port UCI uhttpd main listen_https Opt list listen_https Specifies the ports and address to listen on for encrypted HTTPS access The format is the same as listen_http 0 0 0 0 443 Bind at port 443 only 443 Range IP address and or port Web Home path UC...

Page 38: ...or CGI or lua requests in seconds Requested executables are terminated if no output was generated 60 Range Web Network timeout UCI uhttpd main network_timeout Opt network_timeout Maximum wait time for network activity Requested executables are terminated and connection is shut down if no network activity occured for the specified number of seconds 30 Range Web N A UCI uhttpd main realm Opt realm D...

Page 39: ...ay exist The init script will launch one webserver instance per section A standard uhttpd configuration is shown below root VA_router uci show uhttpd uhttpd main uhttpd uhttpd main listen_http 0 0 0 0 80 uhttpd main listen_https 0 0 0 0 443 uhttpd main home www uhttpd main rfc1918_filter 1 uhttpd main cert etc uhttpd crt uhttpd main key etc uhttpd key uhttpd main cgi_prefix cgi bin uhttpd main scr...

Page 40: ...d UCI Package Option Description Web Days UCI uhttpd px5g days Opt days Validity time of the generated certificates in days 730 Range Web Bits UCI uhttpd px5g bits Opt bits Size of the generated RSA key in bits 1024 Range Web Country UCI uhttpd px5g country Opt country ISO code of the certificate issuer Web State UCI uhttpd px5g state Opt state State of the certificate issuer Web Location UCI uhtt...

Page 41: ...blin option location Dublin option commonname 00E0C8000000 6 15 Basic authentication httpd conf For backward compatibility reasons uhttpd uses the file etc httpd conf to define authentication areas and the associated usernames and passwords This configuration file is not in UCI format Authentication realms are defined in the format prefix username password with one entry and a line break Prefix is...

Page 42: ...curing uhttpd By default uhttpd binds to 0 0 0 0 which also includes the WAN port of your router To bind uhttpd to the LAN port only you have to change the listen_http and listen_https options to your LAN IP address To get your current LAN IP address enter uci get network lan ipaddr Then modify the configuration appropriately uci set uhttpd main listen_http 192 168 1 1 80 uci set uhttpd main liste...

Page 43: ...ver the IP address changes the client notifies the DNS provider to update the corresponding domain name When the DNS provider responds to queries for the domain name it sets a low lifetime typically a minute or two at most on the response so that it is not cached Updates to the domain name are thus visible throughout the whole Internet with little delay Note most providers impose restrictions on h...

Page 44: ...CI ddns name update_url Opt update_url Defines the customer DNS provider Displayed when the service is set to custom in the web UI Web Hostname UCI ddns name domain Opt domain Defines the fully qualified domain name associated with this entry This is the name to update with the new IP address as needed Web Username UCI ddns name username Opt username Defines the user name to use for authenticating...

Page 45: ..._unit 10 Range Web Check time unit UCI ddns name check_unit Opt check_unit Defines the time unit to use for check for an IP change Used in conjunction with check_interval minutes hours Web Force update every UCI ddns name force_interval Opt force_interval Defines how often to force an IP update to the provider Used in conjunction with force_unit 72 Disabled Range Enabled Web Force time unit UCI dd...

Page 46: ... 350 ddns ddns1 check_unit minutes ddns ddns1 force_interval 72 ddns ddns1 force_unit hours ddns ddns1 interface dsl0 Package options for DDNS root VA_router uci export ddns package ddns config service ddns1 option enabled 1 option service_name dyndns org option domain fqdn_of_interface option username test option password test option ip_source network option ip_network dsl0 option check_interval ...

Page 47: ...SSH session Note this document shows no host name in screen grabs Throughout the document we use the host name VA_router The system configuration contains a logging section for the configuration of a Syslog client 8 1 Configuration package used Package Sections system main timeserver 8 2 Configuring system properties To set your system properties in the top menu click System There are four section...

Page 48: ...zone UCI system main timezone Opt timezone Specifies the time zone that the date and time should be rendered in by default Web n a UCI system main timezone Opt time_save_interval_min Defines the interval in minutes to store the local time for use on next reboot 10m Table 14 Information table for general settings section 8 2 2 Logging Figure 22 The logging section in system properties Web Field UCI...

Page 49: ...conditions 3 Alert Should be addressed immediately 2 Emergency System is unusable 1 Web Cron Log Level UCI system main cronloglevel Opt cronloglevel Sets the maximum log level for kernel messages to be logged to the console Only messages with a level lower or level equal to the configured level will be printed to the console Web value Description UCI Normal Normal operation messages 8 Warning Erro...

Page 50: ...formation table for the language and style page 8 2 4 Time synchronization Figure 24 The time synchronization section in system properties Web Field UCI Package Option Description Web Enable built in NTP Server UCI system ntp Opt config timeserver Enables NTP server Web NTP update interval UCI system ntp interval_hours Opt interval_hours Specifies interval of NTP requests in hours Default value se...

Page 51: ... time in the future In the top menu select System Reboot The System page appears Ensure you have saved all your configuration changes before you reboot Figure 25 The reboot page Check the Reboot now check box and then click Reboot 8 3 System settings using UCI root VA_router uci show system system main system system main hostname VA_router system main timezone UTC system main log_ip 1 1 1 1 system...

Page 52: ...ver 0 VA_router pool ntp org list server 10 10 10 10 8 4 System diagnostics 8 4 1 System events Events in the system have a class sub class and severity All events are written to the system log 8 4 1 1 Logread To view the system log enter root VA_router logread Shows the log root VA_router logread tail Shows end of the log root VA_router logread more Shows the log page by page root VA_router logre...

Page 53: ... log_size and log_type as below root VA_router uci export system package system config system main option hostname VA_router option zonename UTC option timezone GMT0 option conloglevel 8 option cronloglevel 8 option time_save_interval_hour 10 option log_hostname serial option log_ip 1 1 1 1 option log_port 514 option log_file root syslog messages option log_size 400 option log_type file The above ...

Page 54: ...in persistent storage is validated To avoid any unrecoverable errors during the process you must follow several safety steps described in this chapter On successful completion of the process you can restart the device running the new firmware 9 1 Software versions If you have software versions prior to 72 002 to upgrade firmware using the web interface go to section 9 1 2 If you have software vers...

Page 55: ...ure 27 The status page showing software version 72 002 In the Firmware Version row the first two digits of the firmware version identify the hardware platform for example LIS 15 while the remaining digits 00 72 002 show the software version 9 1 2 Upgrading router firmware for software versions pre 72 002 Copy the new firmware issued by Virtual Access to a PC connected to the router In the top menu...

Page 56: ...or Browse Note the button will vary depending on the browser you are using Select the appropriate image and then click Flash Image The Flash Firmware Verify page appears Figure 29 The flash firmware verify page Click Proceed The System Flashing page appears Figure 30 The system flashing page When the waiting for router icon disappears the upgrade is complete and the login homepage appears To verif...

Page 57: ...h operations page appears Figure 32 The flash operations page Under Flash Operations click Flash Image Only the inactive image is available to flash Select the appropriate image and then wait until image has loaded Note this process may take a while depending on the available connection speed When the image has loaded the Update Firmware page appears Figure 33 The flash firmware verify page Click ...

Page 58: ... firmware if you click OK to return to the Flash Operations page There you can manually select Made Active after reboot Then click Reboot Now in the Reboot using Active Configuration section 9 1 5 Update flash image and reboot using new image immediately option Figure 35 The firmware update page after update flash image and reboot option selected If you select Update flash image and reboot using n...

Page 59: ...event that the firmware upgrade fails the Failed verification File is most likely corrupt or similar message will appear in the Verify file integrity row No changes will be made to the system and the general message File verification failed appears 9 1 7 Verify the firmware has been upgraded successfully To check the firmware version in the top menu browse to System Flash Operations or after route...

Page 60: ...er enter which curl which atftp The output shows the available application usr bin curl ATFTP Inline command usage atftp g r LIS 15 00 72 002 image l tmp LIS 15 00 72 002 image x x x x where x x x x is the IP address of your PC g is get operation and l r are local and remote file name to store CURL Inline command usage curl tftp x x x x LIS 15 00 72 002 image o tmp LIS 15 00 72 002 image where x x...

Page 61: ...lication Note it is the user s responsibility to verify the image before starting to write image to flash process To use the image check on downloaded image enter image check tmp LIS 15 00 72 002 image In the case of any image corruption appropriate error message will be displayed Error no SquashFS filesystem after CRC d section data length 3 Error read failed expected at least 3 more bytes or oth...

Page 62: ...sh alt After a while the checksum will be calculated Calculating checksum 08761cd03e33c569873bcc24cf2b7389 7006920 LIS 15 00 72 002 This MD5 Verify and compare the checksum with the MD5 sum of the downloaded image If the checksum of the written firmware in altimage matches the one from the downloaded image in tmp then the new firmware has been programmed successfully Setup an alternative image Pro...

Page 63: ...outer s web interface and command line CLI When showing examples of the command line interface we use the host name VA_router to indicate the system prompt For example the table below displays what the user should see when entering the command to show the current configuration in use on the router root VA_router va_config sh 10 1 System information General information about software and configurat...

Page 64: ...00E0C8121215 VA_MODEL GW0000 VA_ACTIVEIMAGE image2 VA_ACTIVECONFIG config1 VA_IMAGE1VER VIE 16 00 44 VA_IMAGE2VER VIE 16 00 44 10 2 Identify your software version To check which software version your router is running in the top menu browse to Status Overview Figure 39 The status page showing a software version prior to 72 002 Figure 40 The status page showing software version 72 002 In the Firmwa...

Page 65: ...onfig1 and etc config2 Multiple configuration files exist in each folder Each configuration file contains configuration parameters for different areas of functionality in the system A symbolic link exists at etc config which always points to one of factconf config1 or config2 is the active configuration file Files that appear to be in etc config are actually in etc factconf config1 config2 dependi...

Page 66: ... format It is used internally to evaluate configuration files as shell scripts import config Imports configuration files in UCI syntax add config section type Adds an anonymous section of type section type to the given configuration add_list config section option string Adds the given string to an existing list option show config section option Shows the given option section or configuration in co...

Page 67: ...A_router etc config1 cp etc config2 etc config1 10 8 Exporting a configuration file If you have software versions prior to 72 002 to export a configuration file using the web interface go to section 10 8 1 If you have software version 72 002 or above export a configuration file using the web interface go to section 10 8 2 To export a configuration file using CLI for any software version go to sect...

Page 68: ...operations page In the Flash Operation section click the configuration file in the Contents column to download it 10 8 3 Exporting a configuration file using UCI You can view any configuration file segment using UCI To export the running configuration file enter root VA_router uci export To export the factory configuration file enter root VA_router uci c etc factconf export To export config1 or co...

Page 69: ...figuration file using the web interface for software versions pre 72 002 You can import a configuration file to the alternate configuration segment using the web interface This will automatically reboot the router into this configuration file In the top menu select System Backup Flash Firmware The Flash operations page appears Figure 43 The flash operations page Under Backup Restore choose Restore...

Page 70: ...import a configuration file to the alternate configuration segment using the web interface In the top menu select System Flash Operations The Flash operations page appears Figure 45 The flash operations page In the Operations column click Upload new Select the appropriate file Figure 46 The flash operations succeed upload configuration page If you select Flash image and do not reboot the router wi...

Page 71: ...____________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 71 of 350 10 9 3 Importing a configuration file using UCI You can import a configuration file to any file segment using UCI To import to config1 enter root VA_router uci c etc config1 import paste in config file CTRL D Note it is very important that the config file is in the correct format otherwise it will not impor...

Page 72: ... uci set system main password root VA_router uci commit system To reboot the system enter root VA_router reboot The system provides a Unix like command line Common Unix commands are available such as ls cd cat top grep tail head more and less Typical pipe and redirect operators are also available such as The system log can be viewed using any of the following commands root VA_router logread root V...

Page 73: ...current folder enter root VA_router ls bin etc lib opt sbin usr bkrepos home linuxrc proc sys var dev init mnt root tmp www For more details add the l argument root VA_router ls l drwxrwxr x 2 root root 642 Jul 16 2012 bin drwxr xr x 5 root root 1020 Jul 4 01 27 dev drwxrwxr x 1 root root 0 Jul 3 18 41 etc drwxr xr x 1 root root 0 Jul 9 2012 lib drwxr xr x 2 root root 3 Jul 16 2012 mnt drwxr xr x ...

Page 74: ...prompt To view scheduled jobs enter root VA_router crontab l 0 slaupload 00FF5FF92752 TFTP 1 172 16 250 100 69 To view currently running processes enter root VA_router ps PID Uid VmSize Stat Command 1 root 356 S init 2 root DW keventd 3 root RWN ksoftirqd_CPU0 4 root SW kswapd 5 root SW bdflush 6 root SW kupdated 8 root SW mtdblockd 89 root 344 S logger s p 6 t 92 root 356 S init 93 root 348 S sys...

Page 75: ...em UCI consists of a Command Line Utility CLI the files containing the actual configuration data and scripts that take the configuration data and apply it to the proper parts of the system such as the networking interfaces Entering the command uci on its own will display the list of valid arguments for the command and their format root VA_router lib config uci Usage uci options command arguments C...

Page 76: ...ith a text editor but for scripts GUIs and other programs working directly with UCI files export config Exports the configuration in a UCI syntax and does validation import config Imports configuration files in UCI syntax changes config Lists staged changes to the given configuration file or if none given all configuration files add config section type Adds an anonymous section of type section typ...

Page 77: ... 2 2 Export a configuration Using the uci export command it is possible to view the entire configuration of the router or a specific package Using this method to view configurations does not show comments that are present in the configuration file root VA_router uci export httpd package httpd config httpd option port 80 option home www 11 2 3 Show a configuration tree The configuration tree format...

Page 78: ...switch 0 eth1 D It is also possible to display a limited subset of a configuration root VA_router uci show network wan network wan interface network wan username foo network wan password bar network wan proto 3g network wan device dev ttyACM0 network wan service umts network wan auto 0 network wan apn hs vodafone ie 11 2 4 Display just the value of an option To display a specific value of an indiv...

Page 79: ...a_eventd va_eventd main enabled yes va_eventd main event_queue_file tmp event_buffer va_eventd main event_queue_size 128K va_eventd conn_tester 0 conn_tester va_eventd conn_tester 0 name Pinger va_eventd conn_tester 0 enabled yes va_eventd conn_tester 0 type ping va_eventd conn_tester 0 ping_dest_addr 192 168 250 100 va_eventd conn_tester 0 ping_success_duration_sec 5 va_eventd target 0 target va_...

Page 80: ...d urls etc config monitor Monitor details Basic etc config dropbear SSH server options etc config dhcp Dnsmasq configuration and DHCP settings etc config firewall NAT packet filter port forwarding etc etc config network Switch interface L2TP and route configuration etc config system Misc system settings including syslog Other etc config snmpd SNMPd settings etc config uhttpd Web server options uHT...

Page 81: ...be combined into a single list of values with the same order as in the configuration file The indentation of the option and list statements is a convention to improve the readability of the configuration file but it is not syntactically required Usually you do not need to enclose identifiers or values in quotes Quotes are only required if the enclosed value contains spaces or tabs Also it is legal...

Page 82: ...iguration files when it boots up The router is installed with a factory config that will allow it to contact Activator The autoload feature controls the behaviour of the router in requesting firmware and configuration files this includes when to start the Activation process and the specific files requested The HTTP Client uhttpd contains information about the Activator server and the protocol used...

Page 83: ...gnals the end of the autolaod sequence to Activator Activator identifies the device using the serial number of the router syntax is used to denote the serial number of the router when requesting a file The requested files are written to the alternate image or config segment You can change the settings either directly in the configuration file or via appropriate UCI set commands It is normal proced...

Page 84: ...oad main StartTimer Opt StartTimer Defines how long to wait after the boot up completes before starting activation 10 Range 0 300 secs Web Retry Timer UCI autoload main RetryTimer Opt RetryTimer Defines how many seconds to wait between retries if a download of a particular autoload entry fails 30 Range 0 300 secs Web N A UCI autoload main NumberOfRetries Opt Numberofretries Defines how many retrie...

Page 85: ...ge Opt BootUsingImage Specifies which image to boot up with after the activation sequence completes successfully Altimage Alternative image Image 1 image 1 Image 2 image 2 Entries Web Configured UCI autoload entry x Configured Opt Configured Enables the autoload sequence to process this entry 1 Enabled 0 Disabled Web Segment Name UCI autoload entry x SegmentName Opt SegmentName Defines where the d...

Page 86: ...d main BootUsingConfig altconfig autoload main BootUsingImage altimage autoload entry 0 entry autoload entry 0 Configured yes autoload entry 0 SegmentName altconfig autoload entry 0 RemoteFilename ini autoload entry 1 entry autoload entry 1 Configured yes autoload entry 1 SegmentName altimage autoload entry 1 RemoteFilename img autoload entry 2 entry autoload entry 2 Configured yes autoload entry ...

Page 87: ...e img config entry option Configured yes option SegmentName config1 option RemoteFilename vas 12 7 HTTP Client configuring activation using the web interface This section contains the settings for the HTTP Client used during activation and active updates of the device The httpclient core section configures the basic functionality of the module used for retrieving files from Activator during the ac...

Page 88: ... that uses http port 80 This can be an IP address or FQDN The syntax should be x x x x 80 or FQDN 80 Multiple servers should be separated by a space using UCI Web Secure Server IP Address UCI httpclient default SecureFileServer Opt list SecureFileServer Specifies the address of Secure Activator that uses port 443 This can be an IP address or FQDN The syntax should be x x x x 443 or FQDN 443 Multip...

Page 89: ... key etc httpclient key Range Web N A UCI ValidateServerCertificateFieldEnabled Opt ValidateServerCertificate Defines the field in the server certificate that the client should check 1 Enabled 0 Disabled Web N A UCI httpclient default ActivatorChunkyDownlo adPath Opt ActivatorChunkyDownloadPath Enables partial download activations and active updates The default value is httpclient default Activato...

Page 90: ...icateKey etc httpclient key httpclient default ActivatorChunkyDownloadPath activator partial download httpclient default ChunkSize 100k httpclient default RateLimit 2 httpclient default CAFile httpclient default IgnoreServerCertificateStatus 0 12 9 Httpclient Activator configuration using package options root VA_router uci export httpclient package httpclient config core default option Enabled yes...

Page 91: ...users user x password Opt password Specifies the user s password When entering the user password enter in plain text using the password option After reboot the password is displayed encrypted via the CLI using the hashpassword option UCI management_users user x hashpassword Opt hashpassword Note a SRP user password will be displayed using the srphash option Web n a UCI management_users user x webu...

Page 92: ...in details 12 11 Configuring the management user password using UCI The user password is displayed encrypted via the CLI using the hashpassword option root VA_router uci show management_users management_users user 0 username test management_users user 0 hashpassword 1 XVzDHHPQ SKK4geFonctihuffMjS4U0 If you are changing the password via the UCI enter the new password in plain text using the passwor...

Page 93: ...using UCI root VA_router uci show management_users management_users user 0 user management_users user 0 enabled 1 management_users user 0 username test management_users user 0 hashpassword 1 XVzDHHPQ SKK4geFonctihuffMjS4U0 management_users user 0 webuser 1 management_users user 0 linuxuser 1 management_users user 0 papuser 0 management_users user 0 chapuser 0 management_users user 0 srpuser 0 mana...

Page 94: ... Page 94 of 350 12 15 Configuring user access to specific web pages To specify particular pages a user can view add the list allowed_pages Examples are listallowed_pages admin status The user can view admin status page only listallowed_pages admin system flashops The user can view flash operation page only To specify monitor widgets only enter listallowed_pages monitor widgetname Example widget na...

Page 95: ...rface on a GW1000 router This section describes how to configure an Ethernet interface on a GW1000 including configuring the interface as a DHCP server adding the interface to a firewall zone and mapping the physical switch ports 13 1 Configuration packages used Package Sections network interface route alias firewall zone dhcp dhcp 13 2 Configuring an Ethernet interface using the web interface To ...

Page 96: ...an create new and edit existing interfaces here ATM Bridges ATM bridges expose encapsulated Ethernet in AAL5 connections as virtual Linux network interfaces which can be used in conjunction with DHCP or PPP to dial into the provider network 13 3 Interface overview editing an existing interface To edit an existing interface from the interface tabs at the top of the page select the interface you wis...

Page 97: ...ple interfaces UCI network if name type Opt type If you select this option then the new logical interface created will act as a bridging interface between the chosen existing physical interfaces Empty Bridge Configures a bridge over multiple interfaces Web Cover the following interface UCI network if name ifname Opt ifname Physical interface name to assign to this logical interface If creating a b...

Page 98: ...he IPv4 address of the interface This is optional if an IPv6 address is provided Web IPv4 netmask UCI network if name netmask Opt netmask Subnet mask to be applied to the IP address of this interface Web IPv4 gateway UCI network if name gateway Opt gateway IPv4 default gateway to assign to this interface optional Web IPv4 broadcast UCI network if name broadcast Opt broadcast Broadcast address This...

Page 99: ...k if name macaddr Opt macaddr Override the MAC address assigned to this interface Must be in the form hh hh hh hh hh hh where h is a hexadecimal number Web Override MTU UCI network if name mtu Opt mtu Defines the value to override the default MTU on this interface 1500 1500 bytes Range Web Use gateway metric UCI network if name metric Opt metric Specifies the default route metric to use for this i...

Page 100: ...s_map_ingress VLAN priority code point to socket buffer mapping Multiple priority mappings are entered with a space between them when using UCI Example network if name vlan_qos_map_ingress 1 2 2 1 Web skb priority to VLAN PCP mapping UCI network if name vlan_qos_map_egress Opt list vlan_qos_map_egress Socket buffer to VLAN priority code point mapping Multiple priority mappings are entered with a s...

Page 101: ... aliasing is associating more than one IP address to a network interface You can assign multiple aliases 13 3 3 1 IP alias packages used Package Sections Network alias 13 3 3 2 Configuring IP alias using the web To use IP Aliases enter a name for the alias and click Add This name will be assigned to the alias section for this IP alias In this example the name ethalias1 is used Figure 54 The IP Ali...

Page 102: ...addr Opt ipaddr Defines the IP address for the IP alias Web IPv4 Netmask UCI network alias name netmask Opt netmask Defines the netmask for the IP alias Web IPv4 Gateway UCI network alias name gateway Opt gateway Defines the gateway for the IP alias Table 27 Information table for IP Alias general setup page 13 3 3 4 IP aliases advanced settings Figure 56 The IP Aliases advanced settings section We...

Page 103: ...up and advanced 13 3 4 2 DHCP server general setup Figure 58 The DHCP server general setup section Web Field UCI Package Option Description Web Ignore interface UCI dhcp dhcp x ignore Opt ignore Defines whether the DHCP pool should be enabled for this interface If not specified for the DHCP pool then default is disabled i e dhcp pool enabled 0 Disabled 1 Enabled Web n a UCI dhcp dhcp x start Opt s...

Page 104: ...cp_option Opt list dhcp_option Defines additional options to be added for this dhcp pool For example with list dhcp_option 26 1470 or list dhcp_option mtu 1470 you can assign a specific MTU per DHCP pool Your client must accept the MTU option for this to work Options that contain multiple vales should be separated by a space Example list dhcp_option 6 192 168 2 1 192 168 2 2 No options defined Syn...

Page 105: ... 10 10 10 1 network ethalias1 netmask 255 255 255 0 network ethalias1 gateway 10 10 10 10 network ethalias1 bcast 10 10 10 255 network ethalias1 dns 8 8 8 8 firewall zone 0 zone firewall zone 0 name lan firewall zone 0 input ACCEPT firewall zone 0 output ACCEPT firewall zone 0 forward ACCEPT firewall zone 0 network lan newinterface root VA_router uci show dhcp dhcp dhcp 0 dhcp dhcp dhcp 0 start 10...

Page 106: ...2 list vlan_qos_map_ingress 2 1 config alias ethalias1 option proto static option interface newinterface option ipaddr 10 10 10 1 option netmask 255 255 255 0 option gateway 10 10 10 10 option bcast 10 10 10 255 option dns 8 8 8 8 root VA_router uci export firewall package firewall config zone option name lan option input ACCEPT option output ACCEPT option network lan newinterface root VA_router u...

Page 107: ... RX bytes 428 428 0 B TX bytes 2986 2 9 KiB eth0 Link encap Ethernet HWaddr 00 E0 C8 12 12 15 inet addr 192 168 100 1 Bcast 192 168 100 255 Mask 255 255 255 0 inet6 addr fe80 2e0 c8ff fe12 1215 64 Scope Link UP BROADCAST RUNNING MULTICAST MTU 1500 Metric 1 RX packets 6645 errors 0 dropped 0 overruns 0 frame 0 TX packets 523 errors 0 dropped 0 overruns 0 carrier 0 collisions 0 txqueuelen 1000 RX by...

Page 108: ...0 c8ff fe12 1215 64 Scope Link UP BROADCAST RUNNING MULTICAST MTU 1500 Metric 1 RX packets 7710 errors 0 dropped 0 overruns 0 frame 0 TX packets 535 errors 0 dropped 0 overruns 0 carrier 0 collisions 0 txqueuelen 1000 RX bytes 647933 632 7 KiB TX bytes 80978 79 0 KiB 13 5 2 Route status To show the current routing status enter root VA_router route n Kernel IP routing table Destination Gateway Genm...

Page 109: ...ition has been enabled This allows the GW1000 router to remain powered on after the vehicle has stopped The time delay between ignition off and power down is configurable Routers for ignition sense applications are supplied with a power lead with 3 connectors for 12V permanent 12V switched ignition sense and ground 14 1 Configuration packages used Package Sections vapowermond main 14 2 Configuring...

Page 110: ...0 infinite Web field Enable Scripts UCI vapowermond main voltage_sense_scripts_enable Opt voltage_sense_scripts_enable Execute scripts upon detection of power loss restoration 0 Disabled Range 0 1 Web field Voltage On Script UCI vapowermond main voltage_on_script Opt voltage_on_script Script to execute on detection of power on usr bin powermon_voltage_on sh Web field Voltage Off Script UCI vapower...

Page 111: ...r monitor advanced settings 14 3 Configuring vapowermond using the command line 14 3 1 UCI root VA_router uci show vapowermond vapowermond main vapowermond vapowermond main enabled 1 vapowermond main timeout 30 vapowermond main voltage_sense_scripts_enable 0 vapowermond main voltage_on_script usr bin powermon_voltage_on sh vapowermond main voltage_off_script usr bin powermon_voltage_off sh vapower...

Page 112: ...____________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 112 of 350 14 4 Ignition sense diagnositcs 14 4 1 Monitoring Vapowermond status using the command line interface To view status information about the current ignition sense state enter root VA_router cat sys class gpio gpio29 value 1 1 for ignition on 0 for ignition off ...

Page 113: ...nterfaces and different subnets You can manually configure lease time as well as setting static IP to host mappings Domain Name Server DNS is responsible for resolution of IP addresses to domain names on the internet Dnsmasq is the application which controls DHCP and DNS services Dnsmasq has two sections one to specify general DHCP and DNS settings and one or more DHCP pools to define DHCP operati...

Page 114: ..._______________________________________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 114 of 350 Figure 62 The DHCP and DNS page ...

Page 115: ...ocal Opt local Specifies the local domain Names matching this domain are never forwarded and are resolved from DHCP or host files only lan Range Web Local Domain UCI dhcp dnsmasq 0 domain Opt domain Specifies local domain suffix appended to DHCP names and hosts file entries lan Range Web Log Queries UCI dhcp dnsmasq 0 logqueries Opt logqueries Writes received DNS requests to syslog 0 Disabled 1 En...

Page 116: ...e given DHCP leases will be stored The DHCP lease file allows leases to be picked up again if dnsmasq is restarted tmp dhcp leas es Store DHCP leases in this file Range Web Ignore resolve file UCI dhcp dnsmasq 0 noresolv Opt noresolv Defines whether to use the local DNS file for resolving DNS 0 Use local DNS file 1 Ignore local DNS file Web Resolve file UCI dhcp dnsmasq 0 resolvfile Opt resolvfile...

Page 117: ...ttings Figure 64 The TFTP settings section Web Field UCI Package Option Description Web Enable TFTP Server UCI dhcp dnsmasq 0 enable_tftp Opt enable_tftp Enables the TFTP server 0 Disabled 1 Enabled Web Enable TFTP Server UCI dhcp dnsmasq 0 tftp_root Opt tftp_root Defines root directory for file served by TFTP Web Enable TFTP Server UCI dhcp dnsmasq 0 dhcp_boot Opt dhcp_boot Defines the filename o...

Page 118: ...s Figure 65 The advanced settings page Web Field UCI Package Option Description Web Filter private UCI dhcp dnsmasq 0 Opt boguspriv Enables disallow option for forwarding reverse lookups for local networks This rejects reverse lookups to private IP ranges where no corresponding entry exists in etc hosts 1 Enabled 0 Disabled Web Filter useless UCI dhcp dnsmasq 0 filterwin2k Opt filterwin2k Enables ...

Page 119: ...order of the resolve file 1 Enabled 0 Disabled Web Bogus NX Domain override UCI dhcp dnsmasq 0 bogusnxdomain Opt list bogusnxdomain A list of hosts that supply bogus NX domain results When using UCI multiple servers should be entered with a space between them Empty list Range Web DNS server port UCI dhcp dnsmasq 0 port Opt port Listening port for inbound DNS queries 53 Set to 0 to disable DNS func...

Page 120: ...I n a Opt n a Displays the remaining lease time Table 37 Information table for active leases section 15 2 6 Static leases Use static leases to assign fixed IP addresses and symbolic hostnames to DHCP clients Static leases are also required for non dynamic interface configurations where only hosts with a corresponding lease are served Click Add to add a new lease entry Figure 67 The static leases s...

Page 121: ...ists all available options their default value as well as the corresponding dnsmasq command line option These are the default settings for the common options root VA_router uci show dhcp dhcp dnsmasq 0 dnsmasq dhcp dnsmasq 0 domainneeded 1 dhcp dnsmasq 0 boguspriv 1 dhcp dnsmasq 0 filterwin2k 0 dhcp dnsmasq 0 localise_queries 1 dhcp dnsmasq 0 logqueries 1 dhcp dnsmasq 0 rebind_protection 1 dhcp dn...

Page 122: ...outer uci show dhcp config dnsmasq option domainneeded 1 option rebind_protection 1 option rebind_localhost 1 option local lan option domain lan option authoritative 1 option readethers 1 option leasefile tmp dhcp leases list interface lan list server 1 2 3 4 list server 4 5 6 7 list rebind_domain test1 domain list rebind_domain tes2 domain option logqueries 1 option resolvfile tmp resolv1 conf au...

Page 123: ...type present in the etc config dhcp file to cover the LAN interface You can disable a lease pool for a specific interface by specifying the ignore option in the corresponding section A minimal example of a dhcp section is shown below root VA_router uci show dhcp lan dhcp lan dhcp dhcp lan interface lan dhcp lan start 100 dhcp lan limit 150 dhcp lan leasetime 12h dhcp lan ignore 0 root VA_router uc...

Page 124: ...h list dhcp_option 26 1470 or list dhcp_option mtu 1470 you can assign a specific MTU per DHCP pool Your client must accept the MTU option for this to work No options defined Syntax Option_number option_value Web n a UCI dhcp pool_name dynamicdhcp Opt dynamicdhcp Defines whether to allocate DHCP leases 1 Dynamically allocate leases 0 Use etc ethers file for serving DHCP leases Web n a UCI dhcp poo...

Page 125: ...es User Manual Issue 1 9 Page 125 of 350 16Configuring VLAN 16 1 Maximum number of VLANs supported Virtual Access routers support up to 4095 VLANs 16 2 Configuration package used Package Sections Network 16 3 Configuring VLAN using the web interface 16 3 1 Create a VLAN interface To configure VLAN using the web interface in the top menu select Network Interfaces Click Add new interface The Create ...

Page 126: ... and netmask DHCP Client Address and netmask are assigned by DHCP Unmanaged Unspecified IPv6 in IPv4 RFC4213 Used with tunnel brokers IPv6 over IPv4 Stateless IPv6 over IPv4 transport GRE Generic Routing Encapsulation protocol IOT L2TP Layer 2 Tunnelling Protocol PPP Point to Point Protocol PPPoE PPP over Ethernet PPPoATM PPP over ATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT st...

Page 127: ...configuration with fixed address and netmask DHCP Client Address and netmask are assigned by DHCP Unmanaged Unspecified IPv6 in IPv4 RFC4213 Used with tunnel brokers IPv6 over IPv4 Stateless IPv6 over IPv4 transport GRE Generic Routing Encapsulation protocol IOT L2TP Layer 2 Tunnelling Protocol PPP Point to Point Protocol PPPoE PPP over Ethernet PPPoATM PPP over ATM LTE UMTS GPRS EV DO CDMA UMTS o...

Page 128: ...t of DNS server IP addresses optional Table 41 Information table for VLAN general settings 16 3 3 Firewall settings VLAN Use this section to select the firewall zone you want to assign to the VLAN interface Select unspecified to remove the interface from the associated zone or fill out the create field to define a new zone and attach the interface to it Figure 70 Firewall settings page When you ha...

Page 129: ... configure VLANs through CLI The VLAN configuration file is stored on etc config network uci export network package network config interface vlan100 option proto static option ifname eth0 100 option monitored 0 option ipaddr 192 168 100 1 option netmask 255 255 255 0 option gateway 192 168 100 10 option broadcast 192 168 100 255 option dns 8 8 8 8 Modify these settings by running uci set parameter...

Page 130: ...e criteria parameters 17 1 QoS configuration overview A minimal QoS configuration usually consists of One interface section Some rules allocating packets to at least two buckets Configuration of the buckets 17 2 Configuration packages used Package Sections qos interface classgroup class classify 17 3 Configuring QoS using the web interface Browse to the router s IP address and login Select Network...

Page 131: ...nables or disables QoS interface 1 Enabled 0 Disabled Web Classification group UCI qos interface classgroup Opt classgroup Creates a mapping before previously created classgroup and interface to which it should be assigned to Web Calculate overhead UCI qos interface overhead Opt overhead Decreases upload and download ratio to prevent link saturation Web Half duplex UCI qos interface halfduplex Opt...

Page 132: ...ource host Web Destination host UCI Opt Destination host Web Service UCI Opt Selectable service Web Protocol UCI Opt Protocol to classify Web Ports UCI Opt Upload speed kbits sec Web Number of bytes UCI Opt Number of bytes for bucket Table 43 Information table for classification rules 17 4 Configuring QoS using UCI You can also configure QoS using UCI The configuration file is stored on etc config...

Page 133: ...ch it should be assigned to Web Calculate overhead UCI qos interface overhead Opt overhead Decrease upload and download ratio to prevent link saturation Web Half duplex UCI qos interface halfduplex Opt halfduplex Enables or disables half duplex operation 1 Enabled 0 Disabled Web Download speed UCI qos interface download Opt download Download speed limit in kbits sec Web Upload speed UCI qos interf...

Page 134: ...tsize 1500 Opt packetsize Specifies packet size for the class in bytes UCI qos Normal avgrate 30 Opt avgrate Average rate for this class value in of bandwidth in UCI qos Normal priority 5 Opt priority Specifies priority for the class in UCI qos Express class Opt Express Specifies class name UCI qos Express packetsize 1000 Opt packetsize Specifies packet size for the class in bytes UCI qos Express ...

Page 135: ... classify 0 target Express Opt target Specifies target class UCI qos classify 0 proto udp Opt proto Specifies protocol 17 5 Example QoS configurations config interface ADSL option classgroup Default option enabled 1 option overhead 1 option download 900 option upload 245 config classgroup Default option classes Express Normal option default Normal config class Normal option packetsize 1500 option ...

Page 136: ...etwork configuration shows how to configure VLAN priorities for specific interfaces VLANs root VA_router uci export network package network config va_switch option eth0 A E option eth1 B F option eth2 C G option eth3 D option eth4 H config interface VLAN_1 option type bridge option proto static option ipaddr 10 1 28 99 option netmask 255 255 0 0 option ifname eth0 eth4 config interface VLAN_2 opti...

Page 137: ...lan_qos_map_egress 0 1 The above sample configuration specifies that any frames on VLAN2 VLAN3 and VLAN4 will be processed or have their PCP value adjusted according to QoS values set VLAN1 VLAN1 is an untagged VLAN so there are no 802 1Q tags on the frames VLAN2 Any frames received on VLAN2 destined to VLAN2 with PCP priority of 1 will be forwarded without altering the priority it will be still s...

Page 138: ...ighest priority and 0 is the lowest These queues prioritise 802 1Q tagged frames as they are received on the port these are hardware defined When 802 1Q frames are received on the port they are processed according to the above queues on arrival even if not defined in the configuration Then if value vlan_qos_map_ingress is configured you can modify the PCP priority for egress if the frame was to be...

Page 139: ...ls are not used or they are not configured for such subnets They can be created based on outgoing interface or next hop IP address 19 1 Configuration package used Package Sections network route 19 2 Configuring static routes using the web interface In the top menu select Network Static Routes The Routes page appears Figure 75 The routes page In the IPv4 Routes section click Add Web Field UCI Packa...

Page 140: ...ackage Option Description Web Interface UCI network route 1 interface Opt interface Specifies the logical interface name of the parent or master interface this route belongs to It must refer to one of the defined interface sections Web target UCI network route 1 target Opt target Specifies the route network IP address or subnet in CIDR notation Eample 2001 0DB8 100 F00 BA3 1 64 Web Gateway UCI net...

Page 141: ... example a route named myroute will be network myroute To define a named route using UCI enter network name_your_route route network name_your_route interface lan To define a named route using package options enter config route name_your_route option interface lan 19 5 IPv4 routes using UCI The command line example routes in the subsections below do not have a configured name root VA_router uci sh...

Page 142: ...option interface lan option target 2 2 2 2 option netmask 255 255 255 255 option gateway 192 168 100 1 option metric 1 option mtu 1500 19 7 IPv6 routes using UCI root VA_router uci show network network route 1 route network route 1 interface lan network route 1 target 2001 0DB8 100 F00 BA3 1 64 network route 1 gateway 2001 0DB8 99 1 network route 1 metric 1 network route 1 mtu 1500 19 8 IPv6 route...

Page 143: ..._______________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 143 of 350 19 9 Static routes diagnostics 19 9 1 Route status To show the current routing status enter root VA_router route n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192 168 100 0 255 255 255 0 U 0 0 0 eth0 Note a route will only be displayed in the routing table when the int...

Page 144: ...between gateway hosts each with its own router in a network of autonomous systems BGP is often the protocol used between gateway hosts on the internet The routing table contains a list of known routers the addresses they can reach and a cost metric associated with the path to each router so that the best available route is chosen 20 1 Configuration package used Package Sections bgpd routing peer r...

Page 145: ... UCI bgpd bgpd asn Opt asn Defines the ASN for the local router Type in the ASN Blank Range 1 4294967295 Web Network UCI bgpd bgpd network Opt list network Sets the list of networks that will be advertised to neighbours in prefix format 0 0 0 0 0 Separate multiple networks by a space using UCI Ensure the network prefix matches the one shown in the routing table See Routes section below Table 46 In...

Page 146: ...atches AS path Route Metric Matches route metric BGP Community Matches BGP community Web Match value UCI bgpd ROUTEMAP match Opt match Defines the value of the match type Format depends on the Match Type selected In the case of IP address and BGP Community values the match value is parsed as a list of items to match Web Set Option UCI bgpd ROUTEMAP set_type Opt set_type Defines the set option to b...

Page 147: ... of the neighbour Web Autonomous System Number UCI bgpd peer 0 asn Opt asn Sets the ASN of the remote peer Blank Range 1 4294967295 Web Route Map UCI bgpd peer 0 route_map Opt route_map Sets route map name to use with this neighbour Web Route Map Direction UCI bgpd peer 0 route_map_in Opt route_map_in Defines the direction the route map should be applied 1 In 0 Out Table 48 Information table for B...

Page 148: ...68 101 1 32 bgpd ROUTEMAP set_type ip next hop bgpd ROUTEMAP set 192 168 101 2 32 To change any of the above values use UCI set command 20 4 Configuring BGP using packages options root VA_router uci export bgpd package bgpd config routing bgpd option enabled yes option router_id 3 3 3 3 option asn 1 list network 11 11 11 0 29 list network 192 168 103 1 32 config peer option route_map_in yes option...

Page 149: ..._______________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 149 of 350 20 5 View routes statistics To view routes statistics in the top menu click Status Routes The routing table appears Figure 80 The routing table To view routes via the command line enter root support route n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10 1 0 0 0 0 0 0 2...

Page 150: ... a WiFi interface using the web interface To create a new WiFi interface via the web interface in the top menu click Network Wifi The Wireless overview page appears Figure 81 The wireless overview page Click Add to create a new WiFi interface The Wireless Network configuration page appears The Wireless Network configuration page consists of two sections Section Description Device Configuration Con...

Page 151: ...ed Settings HT mode country code distance optimization fragmentation threshold and RTS CTS threshold 21 2 1 1 Device configuration general setup Figure 82 The device configuration general setup section Web Field UCI Package Option Description Web Wireless network UCI wireless radio0 disabled Opt disanabled Enable or disables a wireless 1 Disables Wifi interface 0 Enables Wifi interface Web Channel...

Page 152: ...se 802 11g n Select the wireless protocol to use 802 11a n Select the wireless protocol to use Web HT mode UCI wireless radio0 htmode Opt country HT mode options 20MHz specifies the channel width in 802 11 40MHz 2nd channel below specifies the channel width in 802 11 40MHz 2nd channel above specifies the channel width in 802 11 Web Country Code UCI wireless radio0 country Opt country Sets the coun...

Page 153: ...uration The interface configuration section is used to configure the network and security settings It has three sub sections Section Description General Setup Identification network and mode settings Wireless Security Encryption cipher and key security settings MAC Filter MAC address filter settings 21 2 2 1 Interface configuration general setup Use this section to configure the interface name mod...

Page 154: ...wds Client WDS sta wds Web Mode UCI wireless wifi iface 0 bssid Opt bssid Defines the BSSID value Only displayed if using client ad hoc or client wds modes Web Network UCI wireless wifi iface 0 network Opt network The network the wireless interface is attached to If using an existing interface select the appropriate network Select unspecified to not attach to any network or fill out the create fie...

Page 155: ...pt key1 Specifies the first wireless key authentication phrase Web Key 2 UCI wireless wifi iface 0 key2 Opt key2 Specifies the second wireless key authentication phrase Web Key 3 UCI wireless wifi iface 0 key3 Opt key3 Specifies the third wireless key authentication phrase Web Key 4 UCI wireless wifi iface 0 key4 Opt key4 Specifies the fourth wireless key authentication phrase Web Radius Authentic...

Page 156: ...sted in the text field allow Allow all except listed Allows everything but the MAC address listed in the text field deny Web MAC List UCI wireless wifi iface 0 maclist Opt list maclist Defines the MAC addresses to use Multiple MAC address should be separated by a space if using UCI MAC must be in the format hh hh hh hh hh hh Table 53 Information table for interface configuration MAC filter section...

Page 157: ...pears In the Interface Overview page click Edit on the Ethernet interface that will be bridged into the router s WiFi AP The Common Configuration page appears It has four sections This configuration only uses the Physical Settings section Figure 87 The physical settings section in the common configuration page Web Field UCI Package Option Description Web Bridge Interfaces UCI network lan type Opt ...

Page 158: ... a new Ethernet interface using package options root VA_router uci export network package network config interface newwifilan option proto static option ipaddr 192 168 111 1 option netmask 255 255 255 0 root VA_router uci export wireless package wireless config wifi device radio0 option type mac80211 option channel 11 option phy phy0 option hwmode 11ng option htmode HT20 list ht_capab SHORT GI 40 ...

Page 159: ... wireless radio0 channel 11 wireless radio0 phy phy0 wireless radio0 hwmode 11ng wireless radio0 htmode HT20 wireless radio0 ht_capab SHORT GI 40 TX STBC RX STBC1 DSSS_CCK 40 wireless radio0 txpower 17 wireless radio0 country US wireless wifi iface 0 wifi iface wireless wifi iface 0 device radio0 wireless wifi iface 0 mode ap wireless wifi iface 0 disabled 1 wireless wifi iface 0 ssid Test_AP wire...

Page 160: ...b TX STBC list ht_capab RX STBC1 list ht_capab DSSS_CCK 40 option txpower 17 option country US config wifi iface option device radio0 option mode ap option disabled 1 option ssid Test_AP option network lan option encryption psk option key secretkey 21 4 4 AP mode on an existing Ethernet interface using UCI root VA_router uci show network network lan interface network lan ifname eth0 network lan pr...

Page 161: ...id Test_AP wireless wifi iface 0 network lan wireless wifi iface 0 encryption psk wireless wifi iface 0 key secretkey 21 5 Creating a WiFi in Client mode using the web interface A WiFi network in Client mode receives a wireless network from another WiFi AP Configure the Wifi network in Client mode as described in the above section Configuring a WiFi interface selecting a new interface for the Wire...

Page 162: ... Generic Routing Encapsulation protocol IOT L2TP Layer 2 Tunnelling Protocol PPP Point to Point Protocol PPPoE PPP over Ethernet PPPoATM PPP over ATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem Table 55 Information table for interfaces WClient page When you have clicked Save and Apply the router will restart the network package It may take up to one minute for conne...

Page 163: ...ion psk2 option key testtest 21 6 2 Client modem using UCI root VA_router uci show network network new interface network WCLIENT proto dhcp 21 6 2 1 uci show wireless root VA_router uci show wireless wireless radio0 wifi device wireless radio0 type mac80211 wireless radio0 channel 11 wireless radio0 phy phy0 wireless radio0 hwmode 11ng wireless radio0 htmode HT20 wireless radio0 ht_capab SHORT GI ...

Page 164: ...nnection using the web interface Note if you are creating multiple mobile interfaces simply repeat the steps in this chapter for each interface Multiple interfaces are required for dual SIM or multiple radio module scenarios Configuring static routes and or Multi WAN can be used to manage these interfaces In the top menu select Network Interfaces The Interfaces Overview page appears 22 2 1 Create ...

Page 165: ...er 2 Tunnelling Protocol PPP PPPoE PPPoATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem Web Create a bridge over multiple interfaces UCI network 3G type Opt type Enables bridge between two interfaces Not relevant when configuring a mobile interface 0 Disabled 1 Enabled Web Cover the following interface UCI network 3G ifname Opt ifname Select interfaces for bridge con...

Page 166: ...UCI network 3G proto Opt proto Protocol type Select LTE UMTS GPRS EV DO Option Description Static Static configuration with fixed address and netmask DHCP Client Address and netmask are assigned by DHCP Unmanaged Unspecified GRE IOT L2TP Layer 2 Tunnelling Protocol PPP PPPoE PPPoATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem Web Service Type UCI network 3G service ...

Page 167: ...tor exactly To see the current operator using SSH enter the command cat var state mobile or using the web mobile stats page at Status Mobile Stats 0 Long character format 1 Short character format 2 PLMN code Web SIM UCI network 3G sim Opt sim Defines which SIM is used on this interface 1 SIM 1 2 SIM 2 any Automatically detect Web APN UCI network 3G apn Opt apn APN name of Mobile Network Operator W...

Page 168: ...___________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 168 of 350 22 2 1 2 Mobile interface advanced settings Figure 91 The advanced settings tab ...

Page 169: ...ied metric Lower number metrics are used first when route is up 0 Range Web Use DNS servers advertised by peer UCI network 3G peerdns Opt peerdns If unchecked the advertised DNS server addresses are ignored 0 Use static DNS 1 Use advertised DNS Web Use custom DNS servers UCI network 3G dns Opt dns Specify DNS server Only available if Use DNS servers advertised by peer is unselected When multiple D...

Page 170: ...lowing previous options in child interfaces gre option local_interface lt2p option src_ipaddr iot option wan1 wan2 6in4 option ipaddr 6to4 option ipaddr Table 58 Information table for general set up page 22 2 1 3 Mobile interface firewall settings Use this section to select the firewall zone you want to assign to the interface Select unspecified to remove the interface from the associated zone or ...

Page 171: ...nual Issue 1 9 Page 171 of 350 22 3 2 Package options root VA_router package network config interface 3G option proto 3g option monitored 0 option auto 1 option sim any option defaultroute 1 option service auto option apn test apn option username username option password password 22 4 Diagnositcs 22 4 1 Mobile status via the web To view mobile connectivity information in the top menu select Status...

Page 172: ...m_slot 1 mobile 3g_1_1_1 sim_in yes mobile 3g_1_1_1 imsi 240016005892879 mobile 3g_1_1_1 registered 1 Home network mobile 3g_1_1_1 reg_code 1 mobile 3g_1_1_1 registered_pkt 1 Home network mobile 3g_1_1_1 reg_code_pkt 1 mobile 3g_1_1_1 area FFFE mobile 3g_1_1_1 cell 189150A mobile 3g_1_1_1 tech 7 mobile 3g_1_1_1 technology E UTRAN mobile 3g_1_1_1 operator 0 0 Vodafone 7 mobile 3g_1_1_1 sim1_iccid 8...

Page 173: ... The Mobile Manager feature allows you to configure SIM settings Basic settings Enable SMS configure SIM pin code select roaming SIM collect ICCCIDs and set IMSI CDMA Configure Preferred Roaming List options Callers Configure callers that can use SMS Option available only for Telit CE910 SL module 23 1 Configuration package used Package Sections mobile Main Calllers Roaming template 23 2 Configuri...

Page 174: ...de for SIM 2 Blank Range Depends on the SIM provider Web HDR Auto User ID UCI mobile main hdr_userid Opt hdr_userid AN PPP user ID Supported on Cellient CDMA modem only Blank Range Depends on the CDMA provider Web HDR Auto User Password UCI mobile main hdr_password Opt hdr_password AN PPP password Supported on Cellient CDMA modem only Blank Range Depends on the CDMA provider Web n a UCI mobile mai...

Page 175: ... 15 digits Web MOB_TERM_HOME registration flag UCI mobile main cdma_mob_term_home_registration_flag Opt cdma_mob_term_home_registration_flag The MOB_TERM_HOME registration flag 0 Disabled 1 Enabled Web MOB_TERM_FOR_SID registration flag UCI mobile main cdma_mob_term_for_sid_registration_flag Opt cdma_mob_term_for_sid_registration_flag The MOB_TERM_FOR_SID registration flag 0 Disabled 1 Enabled Web...

Page 176: ...Default 0 0 Web SID NID pairs UCI mobile main cdma_sid_nid_pairs Opt cdma_sid_nid_pairs Allows specification of SID NID pairs this takes the form SID1 NID1 SID2 NID2 Format SID1 0 65535 NID 0 65535 Default 0 65535 Table 60 Information table for mobile manager CDMA settings When you have made your changes click Save Apply and then reboot 23 3 Configuring mobile manager using UCI The following examp...

Page 177: ...t_iccids yes config caller option name vasupport option number 353871234567 option enabled yes option respond yes config caller option name vasupport1 option number 353872345678 option enabled yes option respond yes 23 4 Configuring a roaming interface template via the web interface For more information on Roaming Interface Template configuration read the chapter Automatic Operator Selection 23 5 ...

Page 178: ... 16 29 11 user notice VirtualAccess mobile 1737 Queue sms to 353879876543 hello 23 6 Sending SMS from the router You can send an outgoing message via the command line using the following syntax sendsms 353879876543 hello root VirtualAccess Aug 10 16 29 1 user notice VirtualAccess mobile 1737 Queue sms to 353879876543 hello 23 7 Sending SMS to the router The router can accept UCI show and set comma...

Page 179: ...ce state pings to an ICMP target signal level checks using signal threshold RSCP threshold and ECIO threshold option values A fail for any of the above health checks results in a fail After a configurable number of health check failures Multi WAN will move to the next highest priority interface Multi WAN will optionally stop the failed interface and start the new interface if required In some circ...

Page 180: ...nding on timer set by ifup_retry_sec 0 Disabled 1 Enabled Web Alternate Mode UCI multiwan config alt_mode Opt alt_mode Enables or disables alternate mode for Multi WAN If enabled the router will use an alternate interface after reboot 0 Disabled 1 Enabled Table 61 Information table for multi WAN page When you have enabled Multi WAN you can add the interfaces that will be managed by Multi WAN for e...

Page 181: ..._____________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 181 of 350 Figure 97 Example interface showing failover traffic destination as the added multi WAN interface ...

Page 182: ...ted then multiwan does not send a ping health check to the icmp_host otherwise a ping is sent as normal to the icmp_host By default the conntrack_hosts is checked if the health interval is greater than 5 minutes This time threshold currently cannot be manipulated Conntrack is generally used to limit the traffic sent on a GSM network Default Conntrack checks for traffic from icmp_host IP when healt...

Page 183: ...he minimum signal strength in dBm before considering if the interface fails signal health check Uses the value stored for sig_dbm in mobile diagnostics 115 Disabled Range 46 to 115 dBm Web RSCP Threshold dBm UCI multiwan wan rscp_threshold Opt rscp_threshold Specifies the minimum RSCP signal strength in dBm before considering if the interface fails signal health check Uses the value stored for rsc...

Page 184: ...terfaces when using multiple WAN interfaces simultaneously Figure 98 The multi WAN traffic rules page 24 4 Configuring Multi WAN using UCI Multi WAN UCI configuration settings are stored on etc config multiwan Run UCI export or show commands to see multiwan UCI configuration settings A sample is shown below root VA_router uci export multiwan package multiwan config multiwan config option preempt y...

Page 185: ...n wan health_recovery_retries 5 multiwan wan priority 2 multiwan wan manage_state yes multiwan wan exclusive_group 0 multiwan wan ifup_retry_sec 36000 multiwan wan icmp_hosts disable multiwan wan timeout 3 multiwan wan icmp_interval 1 multiwan wan timeout 3 multiwan wan icmp_count 1 multiwan wan conntrack_hosts disable multiwan wan signal_threshold 111 multiwan wan rscp_threshold 90 multiwan wan e...

Page 186: ...ce ADSL option health_interval 10 option icmp_hosts dns option timeout 3 option health_fail_retries 3 option health_recovery_retries 5 option priority 1 option manage_state yes option exclusive_group 0 option ifup_retry_sec 300 option ifup_timeout_sec 40 config interface Ethernet option health_interval 10 option icmp_hosts dns option timeout 3 option health_fail_retries 3 option health_recovery_re...

Page 187: ... restart if that fails enable Enable service autostart disable Disable service autostart When troubleshooting make sure that the routing table is correct using route n Ensure all parameters in the multi WAN package are correct The name used for multi WAN interfaces must be identical including upper and lowercases to the interface name defined in the network configuration To check the names and set...

Page 188: ...ltiwan package is used to run failover between interfaces Typically these auto generated interfaces are sorted by signal strength Details for these interfaces are provided in the mobile package When you have created the interfaces Multi WAN manages the operation of primary predefined and failover auto created interfaces Multi WAN periodically does a health check on the active interface A health ch...

Page 189: ... time set by multiwan option ifup_timeout continue to step 2 Otherwise go to step 4 2 A health check is periodically done on the PMP interface as determined by the multiwan option health_interval If the health check fails for the number of retries multiwan option health_fail_retries disconnect the PMP interface 3 Connect the first auto generated interface 4 If the interface connects within the tim...

Page 190: ...re 100 The create interface page Web Field UCI Package Option Description Web Name of the new interface UCI network 3g_s sim number _ short operator name Opt 3g_s sim number _ short operator name Type the name of the new interface Type the interface name in following format 3g_s sim number _ short operator name Where sim number is number of roaming SIM 1 or 2 and short operator name is first four ...

Page 191: ...anaged Unspecified IPv6 in IPv4 RFC4213 IPv4 tunnels that carry IPv6 IPv6 over IPv4 IPv6 over IPv4 tunnel GRE Generic Routing Encapsulation IOT L2TP Layer 2 Tunnelling Protocol PPP Point to Point Protocol PPPoE Point to Point Protocol over Ethernet PPPoATM Point to Point Protocol over ATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem Web Create a bridge over multiple ...

Page 192: ...ocol over ATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem Web Service Type UCI network x service Opt service Service type that will be used to connect to the network gprs_only Allows GSM module to only connect to GPRS network lte_only Allows GSM module to only connect to LTE network cdma Allows GSM module to only connect to CDMA network auto GSM module will automati...

Page 193: ..._____________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 193 of 350 25 2 1 4 Set multi WAN options for primary predefined interface On the web interface go to Network Multi Wan The Multi WAN page appears Figure 102 The multi WAN page In the WAN Interfaces section type in the name of the Multi WAN interface Click Add The Multi WAN page appears ...

Page 194: ...bles multiwan 0 Disabled 1 Enabled Web Preempt UCI multiwan config preempt Opt preempt Enables or disables pre emption for multiwan If enabled the router will keep trying to connect to a higher priority interface depending on timer set 0 Disabled 1 Enabled Web Alternate Mode UCI multiwan config alt Opt alt Enables or disables alternate mode for multiwan If enabled the router will use an alternate ...

Page 195: ...is generally used to limit the traffic sent on a GSM network Default Conntrack checks for traffic from icmp_host IP when health_interval is greater than 5 minutes Disable Conntrack disabled Custom Specifies an IP other than the icmp_host for conntrack to track Web Health Monitor ICMP Timeout UCI multiwan x timeout Opt timeout Sets ping timeout in seconds Choose the time in seconds that the health ...

Page 196: ... Range 46 to 115 dBm Web RSCP Threshold dBm UCI multiwan x rscp_threshold Opt rscp_threshold Specifies the minimum RSCP signal strength in dBm before considering if the interface fails signal health check Uses the value stored for rscp_dbm in mobile diagnostics 115 Disabled Range 46 to 115 dBm Web ECIO Threshold dB UCI multiwan x ecio_threshold Opt ecio_threshold Specifies the minimum ECIO signal ...

Page 197: ...d UCI Package Option Description Web SMS Enable UCI mobile main sms Opt sms Enables SMS no Disabled yes Enabled Web Collect ICCIDs UCI mobile main init_get_iccids Opt init_get_iccids Enables or disables integrated circuit card identifier ICCID s collection functionality If enabled then both SIM 1 and SIM 2 ICCIDs will be collected otherwise it will default to SIM 1 This will be display under mobil...

Page 198: ...tion Description Web Name UCI mobile caller 0 name Opt name Name assigned to the caller Web Number UCI mobile caller 0 number Opt number Number of the caller allowed to SMS the router Add in specific caller numbers or use the wildcard symbol Web Enable UCI mobile caller 0 enabled Opt enabled Enables or disables incoming caller ID 0 Disabled 1 Enabled Web Respond UCI mobile caller 0 respond Opt res...

Page 199: ..._________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 199 of 350 25 2 3 Roaming interface template Figure 105 The roaming interface template page ...

Page 200: ...s_only Allows GSM module to only connect to 3G network gprs_only Allows GSM module to only connect to GPRS network cdma Allows GSM module to only connect to cdma network Web APN UCI mobile roaming_template 0 apn Opt apn APN name of Mobile Network Operator Web PIN UCI mobile roaming_template 0 pincode Opt pincode SIM card s PIN number Web PAP CHAP username UCI mobile roaming_template 0 username Opt...

Page 201: ...cified in the priority field for the PMP interface 0 Range Web Minimum ifup interval UCI multiwan wan ifup_retry_sec Opt ifup_retry_sec Not used for a roaming interface 300 Retry primary interface every 300 seconds Range Web Interface Start Timeout UCI mobile roaming_template 0 ifup_timeo ut_sec Opt ifup_timeout Specifies the time in seconds for interface to start up If it is not up after this per...

Page 202: ...health checks after expiration of the ifup_retry_sec timer Follow the instructions in the section above for creation of the PMP interface multi WAN and Mobile Manager roaming interfaces The only change in configuration compared to the PMP roaming pre empt enabled scenario is that you must disable the pre empt option in the multi WAN package 25 2 4 1 Set multi WAN options for pre empt disabled To d...

Page 203: ...ailures Multi WAN will disconnect the failed interface and attempt to connect to the next best roaming interface 25 2 6 Set options for automatically created interfaces failover In the top menu on the web interface page select Services Mobile Manager The Mobile Manager page appears There are three sections Basic settings Configure SMS select roaming SIM and collect ICCCIDs Callers Configure caller...

Page 204: ...e manager basic settings 25 2 6 2 Caller settings Web Field UCI Package Option Description Web Name UCI mobile caller 0 name Opt name Name assigned to the caller blank range Web Number UCI mobile caller 0 number Opt number Number of the caller allowed to SMS the router Add in specific caller numbers or use the wildcard symbol blank range Web Enable UCI mobile caller 0 enabled Opt enabled Enables o...

Page 205: ...late page Web Field UCI Package Option Description Web Interface Signal Sort UCI mobile roaming_template 0 sort_sig_st rength Opt sort_sig_strength Sorts interfaces by signal strength priority so those that have a better signal strength will be tried first Web Roaming SIM UCI mobile main roaming_sim Opt roaming_sim Sets which slot to insert roaming SIM card 1 SIM slot 1 2 SIM slot 2 Web Firewall Z...

Page 206: ... mobile roaming_template 0 health_int erval Opt health_interval Sets the period to check the health status of the interface The Health Monitor interval will be used for interface state checks ping interval signal strength checks Web Health Monitor ICMP Host s UCI mobile roaming_template 0 icmp_host s Opt icmp_hosts Specifies target IP address for ICMP packets Disable Disables the option DNS server...

Page 207: ...nimum signal strength in dBm before considering if the interface fails signal health check Uses the value stored for sig_dbm in mobile diagnostics 115 dBm Disabled range 46 to 115 dBm Table 71 Information table for roaming interface template When you have configured your settings click Save Apply 25 2 7 1 Set multi WAN operation From the top menu select Network Multi Wan The Multi WAN page appears...

Page 208: ... the network configuration file enter root VA_router uci export network package network config interface loopback option ifname lo option proto static option ipaddr 127 0 0 1 option netmask 255 0 0 0 config interface lan option ifname eth0 option proto static option ipaddr 192 168 100 1 option netmask 255 255 255 0 config interface 3g_s1_voda option auto 0 option proto 3g option service umts optio...

Page 209: ...mts network 3g_s1_voda apn test IE network 3g_s1_voda username test network 3g_s1_voda password test network 3g_s1_voda sim 1 network 3g_s1_voda operator vodafone IE 25 3 1 2 Roaming interface configuration The roaming interface configurations are stored in the mobile package etc config mobile To view the mobile configuration file enter root VA_router uci export mobile config mobile main option sm...

Page 210: ...ds no mobile caller 0 caller mobile caller 0 name Test mobile caller 0 number mobile caller 0 enabled yes mobile caller 0 respond yes mobile roaming_template 0 roaming_template mobile roaming_template 0 roaming_sim 1 mobile roaming_template 0 firewall_zone wan mobile roaming_template 0 apn test IE mobile roaming_template 0 username test mobile roaming_template 0 password test mobile roaming_templa...

Page 211: ...ion health_fail_retries 3 option health_interval 3 option timeout 1 option icmp_hosts disable option priority 10 option exclusive_group 3g option signal_threshold 95 option ifup_retry_sec 350 option ifup_timeout_sec 180 option manage_state 1 To view the uci command of package multiwan enter root VA_router uci show multiwan multiwan config multiwan multiwan config enabled 1 multiwan config preempt ...

Page 212: ...vailable values are 0 Disabled 1 Enabled 25 4 Configuring no PMP roaming using UCI The roaming interface configuration file is stored in the mobile package etc config mobile To view the mobile package enter root VA_router uci export mobile package mobile config mobile main option sms yes option roaming_sim 1 option debug 1 config caller option name Eval option number option enabled yes option resp...

Page 213: ...name Eval mobile caller 0 number mobile caller 0 enabled yes mobile caller 0 respond yes mobile roaming_template 0 roaming_template mobile roaming_template 0 roaming_sim 1 mobile roaming_template 0 firewall_zone wan mobile roaming_template 0 apn stream co uk mobile roaming_template 0 username default mobile roaming_template 0 password void mobile roaming_template 0 service umts mobile roaming_temp...

Page 214: ...an config option enabled yes option preempt no option alt_mode no To see multiwan package via uci enter root VA_router uci show multiwan multiwan config multiwan multiwan config enabled yes multiwan config preempt no multiwan config alt_mode no 25 5 Automatic operator selection diagnostics via the web interface 25 5 1 Checking the status of the Multi WAN package When interfaces are auto created th...

Page 215: ...__________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 215 of 350 Figure 111 The interface overview page To check the status of the interface you are currently using in the top menu click Status The Interface Status page appears Scroll down to the bottom of the page to view Multi WAN Stats Figure 112 The status page multi WAN status section page ...

Page 216: ...__________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 216 of 350 25 6 Automatic operator selection diagnostics via UCI To check interfaces created in the multi WAN package enter root VA_router cat var const_state multiwan Figure 113 Example of output from the command cat var const_stat multiwan To check interfaces created in the network package enter root VA_router cat va...

Page 217: ...____________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 217 of 350 Figure 114 Example of output from the command cat var const_state network ...

Page 218: ...___________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 218 of 350 To check the status of the interface you are currently using enter root VA_router cat var const_state_ mobile Figure 115 Example of output from the command cat vat const_state_ mobile ...

Page 219: ...ad the chapter Dynamic Multipoint Virtual Private Network DMVPN The number of IPSec tunnels supported by Virtual Access routers is not limited in any way by software the only hardware limitation is the amount of RAM installed on the device 26 1 Configuration package used Package Sections strongswan general connection secret 26 2 Configuring IPSec using the web interface To configure IPSec using th...

Page 220: ...ith any new automatically keyed connection using an ID from a different IP address deemed to replace all old ones using that ID Participant IDs normally are unique so a new automatically keyed connection using the same ID is almost invariably intended to replace an old one 0 Disabled 1 Enabled replace Identical to Yes keep Rejects new IKE SA and keep the duplicate established earlier Web Cache CRL...

Page 221: ...g with PSK authentication is less secure method than main mode and should be avoided 0 Disabled 1 Enabled Web Name UCI strongswan connection X name Opt name Specifies a name for the tunnel Web Autostart Action UCI strongswan connection X auto Opt auto Specifies when the tunnel is initiated start On start up route When traffic routes this way add Loads a connection without starting it ignore Ignore...

Page 222: ...ublic IP address of the remote peer Web Local ID UCI strongswan connection X localid Opt localid Defines the local peer identifier Web Remote ID UCI strongswan connection X remoteid Opt remoteid Defines the remote peer identifier Web Local LAN IP Address UCI strongswan connection X locallan Opt locallan Defines the local IP of LAN Web Local LAN IP Address Mask UCI strongswan connection X locallanm...

Page 223: ...remoteproto Restricts the connection to a single protocol on the remote side Web Remote Port UCI strongswan connection X remoteport Opt remoteport Restricts the connection to a single port on the remote side Web Authby UCI strongswan connection X authby Opt authby Defines how the two secure gateways should authenticate Note using aggressive mode along with PSK authentication is unsecure and should...

Page 224: ...ec settings Figure 119 The IPSec connections settings Web Field UCI Package Option Description Web XAuth Identity UCI strongswan connection X xauth_identity Opt xauth_identity Defines Xauth ID Web IKE Algorithm UCI strongswan connection X ike Opt ike Specifies the IKE algorithm to use The format is encAlgo authAlgo DHGroup encAlgo 3des aes128 aes256 serpent twofish blowfish authAlgo md5 sha sha2 D...

Page 225: ... and a WAN ADSL interface called dsl and wanted to use one of these interfaces for this IPSec connection you would use wan adsl Web IKE Life Time UCI strongswan connection X ikelifetime Opt ikelifetime Specifies how long the keyring channel of a connection ISAKMP or IKE SA should last before being renegotiated 3h Timespec 1d 3h 25m 10s Web Key Life UCI strongswan connection X keylife Opt keylife S...

Page 226: ...ction X dpdtimeout Opt dpdtimeout Defines the timeout interval after which all connections to a peer are deleted in case of inactivity 150s Timespec 1d 2h 25m 10s Web n a UCI strongswan connection X inherit_child Opt inherit_child Defines whether the existing phase two IPSEC SA is maintained through IKE rekey for this tunnel This is normally set to match the behaviour on the IPSEC headend 0 Delete...

Page 227: ...crettype Specifies the authentication mechanism to be used by the two peers Psk Preshared secret Pubkey Public key signatures Rsasig RSA digital signatures Ecdsasig Elliptic Curve DSA signatures Xauth Extended authentication Web Secret UCI strongswan secret X secret Opt secret Defines the secret Table 77 Information table for IPSec secrets settings 26 3 Configuring IPSec using UCI 26 3 1 Common se...

Page 228: ...swan connection 0 auto start uci set strongswan connection 0 type tunnel uci set strongswan connection 0 remoteaddress 100 100 100 100 uci set strongswan connection 0 localid 192 168 209 1 uci set strongswan connection 0 remoteid 100 100 100 100 uci set strongswan connection 0 locallan 192 168 209 1 uci set strongswan connection 0 locallanmask 255 255 255 255 uci set strongswan connection 0 remote...

Page 229: ... modp1024 option esp 3des md5 option waniface wan option dpdaction hold 26 3 3 Shunt connection If the remote LAN network is 0 0 0 0 0 then all traffic generated on the local LAN will be sent via the IPSec tunnel This includes the traffic destined to the router s IP address To avoid this situation you must include an additional config connection section Commands touch etc config strongswan uci add...

Page 230: ... how the local end point of the tunnel proves its identity to the remote end point A sample secret section which could be used with the connection section in Connection Settings is shown below Commands to add a secret for psk auth touch etc config strongswan uci add strongswan secret uci set strongswan secret 0 enabled yes uci set strongswan secret 0 localaddress 192 168 209 1 uci set strongswan s...

Page 231: ...oteaddress 100 100 100 100 uci set strongswan secret 1 secret xauth uci set strongswan secret 1 secrettype XAUTH uci commit This will create the following output config secret option enabled yes option idtype userfqdn option userfqdn testxauth option remoteaddress 100 100 100 100 option secret xauth option secrettype XAUTH 26 4 Configuring an IPSec template for DMVPN via the web interface To confi...

Page 232: ...t uniqueids Defines whether a particular participant ID should be kept unique with any new automatically keyed connection using an ID from a different IP address deemed to replace all old ones using that ID Participant IDs normally are unique so a new automatically keyed connection using the same ID is almost invariably intended to replace an old one 0 Disabled 1 Enabled replace Identical to Yes k...

Page 233: ...17 GW1000 Series User Manual Issue 1 9 Page 233 of 350 26 4 2 Configure connection settings Scroll down to view the connection settings section If you want to create a DMVPN you do not need to configure all settings as the DMVPN will automatically create them using the template Leave the following sections blank Remote GW Address Local ID Remote Id Local LAN IP Address Local LAN IP Address Mask Re...

Page 234: ...______________________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 234 of 350 Figure 122 The connections settings section ...

Page 235: ...ection X type Opt type Defines the type of IPSec connection tunnel Connection uses tunnel mode transport Connection uses transport mode pass Connection does not perform any IPSec processing drop Connection drops all the packets Web Remote GW Address UCI strongswan connection X remoteaddress Opt remoteaddress Sets the public IP address of the remote peer Leave blank for DMVPN Web Local ID UCI stron...

Page 236: ... authby Defines how the two secure gateways should authenticate Note using aggressive mode along with PSK authentication is unsecure and should be avoided Pubkey For public key signatures Rsasig For RSA digital signatures ecdsasig For Elliptic Curve DSA signatures Psk Using a preshared key xauthrsasig Enables eXtended Authentication XAuth with addition to RSA signatures xauthpsk Using extended aut...

Page 237: ... and a WAN ADSL interface called dsl and wanted to use one of these interfaces for this IPSec connection you would use wan adsl Web IKE Life Time UCI strongswan connection X ikelifetime Opt ikelifetime Specifies how long the keyring channel of a connection ISAKMP or IKE SA should last before being renegotiated 3h Timespec 1d 3h 25m 10s Web Key Life UCI strongswan connection X keylife Opt keylife S...

Page 238: ...ent if no other traffic is received 30s Timespec 1d 2h 25m 10s Web DPD Timeout UCI strongswan connection X dpdtimeout Opt dpdtimeout Defines the timeout interval after which all connections to a peer are deleted in case of inactivity 150s Timespec 1d 2h 25m 10s Table 79 Information table for IPSec connections settings 26 4 3 Configure secrect settings Each tunnel requires settings to configure how...

Page 239: ...tings 26 5 Configuring an IPSec template to use with DMVPN The following example shows how to configure an IPSec connection template to use with DMVPN Commands touch etc config strongswan uci set strongswan general general uci set strongswan general enabled yes uci set strongswan general strictcrlpolicy no uci set strongswan general uniqueids yes uci set strongswan general cachecrls yes uci set st...

Page 240: ... uci set strongswan secret 0 secrettype psk uci set strongswan secret 0 secret secret This will create package strongswan config general general option enabled yes option strictcrlpolicy no option uniqueids yes option cachecrls yes option nattraversal yes config connection option enabled yes option name dmvpn option type transport option localproto gre option remoteproto gre option ike aes sha1 mo...

Page 241: ... underscore for example dmvpn_213 233 148 2 26 7 IPSec diagnostics using UCI 26 7 1 IPSec configuration To view IPSec configuration via UCI enter root VA_router uci export strongswan To restart strongSwan enter root VA_router etc init d strongswan restart 26 7 2 IPSec status 26 7 3 To view IPSec status enter root VA_router ipsec statusall Security Associations 1 up 0 connecting dmvpn_89_101_154_15...

Page 242: ...ystem is a chained processing filter where packets pass through various rules The first rule that matches is executed often leading to another rule chain until a packet hits either ACCEPT or DROP REJECT Accepted packets pass through the firewall Dropped packets are prohibited from passing Rejected packets are also prohibited but an ICMP message is returned to the source host A minimal firewall con...

Page 243: ...efaults input Opt input Default policy for the INPUT chain Accept Accepted packets pass through the firewall Reject Rejected packets are blocked by the firewall and ICMP message is returned to the source host Drop Dropped packets are blocked by the firewall Web Output UCI firewall defaults output Opt output Default policy for the Output chain Accept Accepted packets pass through the firewall Rejec...

Page 244: ...y by software the only hardware limitation is the amount of RAM installed on the device 27 2 2 1 Firewall zone general settings Figure 126 The firewall zone general settings Web Field UCI Package Option Description Web name UCI firewall zone label name Opt name Sets the unique zone name Maximum of 11 characters allowed Note the zone label is obtained by using the uci show firewall command and is o...

Page 245: ...es Forward rules for a zone describe what happens to traffic passing between different interfaces within that zone Accept Accepted packets pass through the firewall Reject Rejected packets are blocked by the firewall and ICMP message is returned to the source host Drop Dropped packets are blocked by the firewall Web Masquerading UCI firewall zone label masq Opt masq Specifies whether outgoing zone...

Page 246: ...ubnets are allowed Web Restrict Masquerading to given destination subnets UCI firewall zone label masq_dest Opt masq_dest Limits masquerading to the given destination subnets Negation is possible by prefixing the subnet with Multiple subnets are allowed Multiple IP addresses subnets should be separated by a space Example option masq_dest 1 1 1 1 2 2 2 0 24 Web Force connection tracking UCI firewal...

Page 247: ...eb Field UCI Package Option Description Web Allow forward to destination zones UCI firewall forwarding label dest Opt dest Allows forward to other zones Enter the current zone as the source Enabling this option puts two entries into the firewall file destination and source UCI firewall forwarding label src Opt src Web Allow forward from source zones UCI firewall forwarding label dest Opt dest Allo...

Page 248: ...starting from 0 Web Protocol UCI firewall redirect label proto Opt proto Defines layer 4 protocol to match incoming traffic tcp udp Match either TCP or UDP packets tcp Match TCP packets only udp Match UDP packets only Web Source UCI firewall redirect label src Opt src Specifies the traffic source zone It must refer to one of the defined zone names When using the web interface this is set to WAN in...

Page 249: ...p port for the redirect traffic Web Enable UCI firewall redirect label enabled Opt enabled Specifies if this redirect should be enabled or disabled 0 Disabled 1 Enabled Table 85 Information table for firewall port forward settings The defined redirects can be sorted into a specific order to be applied More specific rules should be placed first After the redirect is created and saved to make change...

Page 250: ...all redirect label reflection Opt reflection Enable or disable NAT reflection for this redirect 0 reflection disabled 1 reflection enabled Web Extra arguments UCI firewall redirect label extra Opt extra Passes extra arguments to IP tables This is useful to specify additional match options like m policy dir in for IPSec The arguments are entered as text strings Table 86 Information table for port f...

Page 251: ...s This option is only valid when ICMP is selected as the protocol ICMP types can be listed as either type names or type numbers Note for a full list of valid ICMP type names see the ICMP Options table below Web Source zone UCI firewall rule label src Opt src Specifies the traffic source zone must refer to one of the defined zone names For typical port forwards this is usually WAN Web Source MAC ad...

Page 252: ...ffix Example 3 hour Web n a UCI firewall rule label limit_burst Opt limit_burst Sets maximum initial number of packets to match This number gets recharged by one every time the limit specified above is not reached up to this number Web n a UCI firewall rule label recent Opt recent Sets number of allowed connections within specified time This command takes two values e g recent 2 120 will allow 2 c...

Page 253: ...e icmp esp ah sctp or all or it can be a numeric value representing one of these protocols or a different one A protocol name from etc protocols is also allowed The number 0 is equivalent to all Dest Specifies the traffic destination zone must refer to one of the defined zone names If specified the rule applies to forwarded traffic else it is treated as input rule dest_ip Match incoming traffic di...

Page 254: ...d ACCEPT Note this command is only required if there is no defaults section 27 3 2 Firewall zone settings To set up a firewall zone enter uci add firewall zone uci set firewall zone 1 name lan uci set firewall zone 1 input ACCEPT uci set firewall zone 1 output ACCEPT uci set firewall zone 1 forward ACCEPT uci set firewall zone 1 network lan1 wifi_client uci set firewall zone 1 family any uci set f...

Page 255: ... set firewall redirect 1 dest_port 2005 uci set firewall redirect 1 enabled 1 27 3 5 Firewall traffic rules To set traffic rules enter uci add firewall rule uci set firewall rule 1 enabled 1 uci set firewall rule 1 name Allow_ICMP uci set firewall rule 1 family any uci set firewall rule 1 proto ICMP uci set firewall rule 1 icmp_type any uci set firewall rule 1 src wan uci set firewall rule 1 src_m...

Page 256: ...0 ba3 64 option target ACCEPT Similarly the following rule is automatically treated as IPv4 only config rule option src wan option dest_ip 88 77 66 55 option target REJECT Rules without IP addresses are automatically added to iptables and ip6tables unless overridden by the family option Redirect rules port forwards are always IPv4 since there is no IPv6 DNAT support at present 27 5 Implications of...

Page 257: ...ion tracking By default the firewall will disable connection tracking for a zone if no masquerading is enabled This is achieved by generating NOTRACK firewall rules matching all traffic passing via interfaces referenced by the firewall zone The purpose of NOTRACK is to speed up routing and save memory by circumventing resource intensive connection tracking in cases where it is not needed You can c...

Page 258: ...anner because it is not using default port 22 config redirect option name ssh option src wan option proto tcpudp option src_dport 5555 option dest_ip 192 168 1 100 option dest_port 22 option target DNAT option dest lan 27 7 3 Source NAT SNAT Source NAT changes an outgoing packet destined for the system so that is looks as though the system is the source of the packet Define source NAT for UDP and ...

Page 259: ...estination port forwarding This usage is similar to SNAT but as the destination IP address is not changed machines on the destination network need to be aware that they ll receive and answer requests from a public IP address that is not necessarily theirs Port forwarding in this fashion is typically used for load balancing config redirect option src wan option src_dport 80 option dest lan option d...

Page 260: ...a forward rule rejecting traffic from LAN to WAN on the ports 1000 1100 config rule option src lan option dest wan option dest_port 1000 1100 option proto tcpudp option target REJECT 27 7 9 Denial of service protection rule The example below shows a sample configuration of SSH DoS attack where if more than two SSH connections are attempted within 120 seconds every further connection will be droppe...

Page 261: ...addr 10 1 28 122 option netmask 255 255 0 0 option ifname eth1 eth3 12 option ipv4_rp_filter 1 27 7 11 Simple DMZ rule The following rule redirects all WAN ports for all protocols to the internal host 192 168 1 2 config redirect option src wan option proto all option dest_ip 192 168 1 2 27 7 12 Transparent proxy rule external The following rule redirects all outgoing HTTP traffic from LAN through ...

Page 262: ...e below redirects all outgoing HTTP traffic from LAN through a proxy server listening at port 3128 on the router itself config redirect option src lan option proto tcp option src_dport 80 option dest_port 3128 27 7 14 IPSec passthrough This example enables proper forwarding of IPSec traffic through the WAN AH protocol config rule option src wan option dest lan option proto ah option target ACCEPT ...

Page 263: ...l management After a configuration change to rebuild firewall rules enter root VA_router etc init d firewall restart Executing the following command will flush all rules and set the policies to ACCEPT on all standard chains root VA_router etc init d firewall stop To manually start the firewall enter root VA_router etc init d firewall start To permanently disable the firewall enter root VA_router e...

Page 264: ..._____________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 264 of 350 To direct the output to a file for later inspection enter root VA_router FW_TRACE 1 fw reload 2 tmp iptables lo ...

Page 265: ...r_memory monitor_process pass system trapreceiver usm_user view The SNMP application has several configuration sections System and Agent Configures the SNMP agent Com2Sec Maps SNMP community names into an arbitrary security name Group Assigns community names and SNMP protocols to groups View and Access Creates views and sub views of the whole available SNMP tree and grants specific access to those...

Page 266: ...dress es and port s on which the agent should listen udp tcp port address Web Enable Authentication Traps UCI snmpd agent 0 authtrapenabled Opt authtrapenabled Enables or disables SNMP authentication trap 0 Disabled 1 Enabled Note this is the SNMP poll authentication trap to be set when there is a community mismatch Web Enable Link State Notification UCI snmpd agent 0 link_updown_notify Opt link_u...

Page 267: ...estrictions Web Community UCI snmpd com2sec x community Opt community Specifies the community string being presented in the request Table 91 Information table for Com2Sec settings 28 2 3 Group settings Group settings assign community names and SNMP protocols to groups Figure 135 The group settings section Web Field UCI Package Option Description Web Group UCI snmpd group x group Opt group Specifie...

Page 268: ...snmpd view x viewname Opt viewname Specifies an arbitrary view name Typically it describes what the view shows Web Type UCI snmpd view x type Opt type Specifies whether the view lists oids that are included in the view or lists oids to be excluded from the view in which case all other oids are visible apart from those ones listed included excluded Web OID UCI snmpd view x oid Opt oid OID to be inc...

Page 269: ...n number being used in the request any v1 v2c and usm are supported v1 SNMP v1 v2v SNMP v2 usm SNMP v3 any Any SNMP version Web Level UCI snmpd access x level Opt level Specifies the security level For SNMP v1 and SNMP v2c level must be noauth noauth auth priv Web Prefix UCI snmpd access x prefix Opt prefix Prefix specifies how context above should be matched against the context of the incoming pd...

Page 270: ... use in trap messages for this host Table 95 Information table for trap receiver settings 28 2 7 Inform receiver Inform receiver settings define a notification receiver that should be sent SNMPv2c INFORM notifications Figure 139 The inform receiver settings page Web Field UCI Package Option Description Web Host UCI snmpd informreceiver x host Opt host Host address Can be either an IP address or an...

Page 271: ...Name Backup Access 4 config agent option agentaddress UDP 161 option authtrapenabled 1 option link_updown_notify 1 Another sample agent configuration shown below causes the agent to listen on UDP port 161 TCP port 161 and UDP port 9161 on only the interface associated with the localhost address config agent option agentaddress UDP 161 tcp 161 9161 localhost 28 3 3 com2sec settings The following sa...

Page 272: ...om2sec public option secname ro option source default option community public config com2sec private option secname rw option source localhost option community private 28 3 4 Group settings The following example specifies that a request from the security name ro using snmp v1 v2c or USM User Based Security Model for SNM P v3 are all mapped to the public group Similarly requests from the security n...

Page 273: ...ccess read all snmpd grp_1_access write none snmpd grp_1_access notify none snmpd grp_1_access group public snmpd grp_2_v1 group snmpd grp_2_v1 version v1 snmpd grp_2_v1 group public snmpd grp_2_v1 secname ro snmpd grp_2_v2c group snmpd grp_2_v2c version v2c snmpd grp_2_v2c group public snmpd grp_2_v2c secname ro snmpd grp_2_usm group snmpd grp_2_usm version usm snmpd grp_2_usm group public snmpd ...

Page 274: ...ttings using package options config group public_v1 option group public option version v1 option secname ro config group public_v2c option group public option version v2c option secname ro config group public_usm option group public option version usm option secname ro config group private_v1 option group private option version v1 option secname rw config group private_v2c option group private opt...

Page 275: ...snmpd mib2 viewname mib2 snmpd mib2 type included snmpd mib2 oid iso org dod Internet mgmt mib 2 28 3 5 2 View settings using package options config view all option viewname all option type included option oid 1 config view mib2 option viewname mib2 option type included option oid iso org dod Internet mgmt mib 2 28 3 6 Access settings The following example shows the public group being granted read...

Page 276: ...ix exact option read all option write all option notify all 28 3 7 SNMP traps settings 28 3 7 1 SNMP trap using UCI snmpd trapreceiver 0 trapreceiver snmpd trapreceiver 0 host 1 1 1 1 161 snmpd trapreceiver 0 version v1 snmpd trapreceiver 0 community public SNMP trap using package options for SNMPv1 or v2c trap receivers config trapreceiver option host IPADDR PORT option version v1 v2c option comm...

Page 277: ...er should the Master become unavailable This process allows the virtual router IP address es on the LAN to be used as the default first hop router by end hosts The advantage gained from using VRRP is a higher availability default path without requiring configuration of dynamic routing or router discovery protocols on every end host Two or more routers forming the redundancy cluster are configured ...

Page 278: ... the VRRP cluster is to operate For example lan The interface name is taken from the package network Web Track Interfaces UCI vrrp g1 track_iface Opt track_iface Sets one or more WAN interfaces that VRRP should monitor If a monitored interface goes down on the Master VRRP router it goes into Fault state and the Backup VRRP router becomes the Master Web IPSec connection UCI vrrp g1 ipsec_connection...

Page 279: ...ethod This field may be left blank if no authentication is required Web Virtual IP UCI vrrp g1 virtual_ipaddr Opt virtual_ipaddr Sets the virtual IP address and mask in prefix format For example 11 1 1 99 24 All co operating VRRP routers serving the same LAN must be configured with the same virtual IP address Web GARP UCI vrrp g1 garp_delay_sec Opt garp_delay_sec Sets the Gratuitous ARP message se...

Page 280: ... Series User Manual Issue 1 9 Page 280 of 350 Or enter uci show vrrp vrrp main vrrp vrrp main enabled yes vrrp g1 vrrp_group vrrp g1 enabled yes vrrp g1 interface lan1 vrrp g1 track_iface lan vrrp g1 init_state BACKUP vrrp g1 router_id 1 vrrp g1 priority 115 vrrp g1 advert_int_sec 2 vrrp g1 password secret vrrp g1 virtual_ipaddr 10 1 10 150 16 vrrp g1 garp_delay_sec 5 vrrp g1 ipsec_connection Test...

Page 281: ...IPSec configuration to the physical interface This reduces the number of lines of configuration required for a VPN development For example for a 1000 site deployment DMVPN reduces the configuration effort at the hub from 3900 lines to 13 Adding new peers spokes to the VPN requires no changes at the hub Better scalability of the network Dynamic IP addresses can be used at the peers site Spokes can ...

Page 282: ...N interface ADSL 3G and initiate main mode IPSec in transport mode to the hub After an IPSec tunnel is established spokes register their NHRP membership with the hub GRE tunnels come up Hub caches the GRE tunnel and real IP addresses of each spoke When spoke1 wants to talk to spoke2 it sends an NHRP resolution request to the hub The hub checks its cache table and forwards that request to spoke2 Sp...

Page 283: ...th the source of the packet Hub sends an NHRP registration reply with a NAT extension to spoke1 The NAT extension informs spoke1 that it is behind the NAT ed device Spoke1 registers its pre and post NAT address When spoke1 wants to talk to spoke2 it sends an NHRP resolution request to the hub Hub checks its cache table and forwards that request to spoke2 Spoke2 caches spoke1 s GRE pre and post NAT...

Page 284: ...nterface The DMVPN section contains fields required to configure the parameters relative to the DMVPN Hub These are used for DMVPN tunnels such as GRE tunnels GRE tunnel remote IP DMVPN Hub IP and password 30 5 1 DMVPN general settings In the top menu select Network DMVPN The DMVPN page appears There are two sections General and DMVPN Hub Settings Figure 143 The DMVPN general section Web Field UCI...

Page 285: ...terface on the hub For example if the mask is 255 255 0 0 the length will be 16 Web DMVPN Hub IP Address UCI dmvpn interface X nhs_ip Opt nhs_ip Configures the physical IP address for the DMVPN hub Web NHRP Authentication UCI dmvpn interface X cisco_auth Opt cisco_auth Enables authentication on NHRP The password will be applied in plaintext to the outgoing NHRP packets Maximum length is 8 characte...

Page 286: ...c connections page In the Name column the syntax contains the IPSec name defined in package dmvpn and the remote IP address of the hub or the spoke separated by an underscore for example dmvpn_213 233 148 2 To check the status of DMVPN in the top menu click Status DMVPN Figure 146 The NBMA peers page To check DMVPN status enter opennhrpctl show Status ok Interface gre GRE Type local Protocol Addre...

Page 287: ... with local route local_addr Local destination IP or off NBMA subnet Protocol Address Tunnel IP address NBMA Address Pre NAT IP address if NBMA NAT OA Address is present or real address if NAT is not present NBMA NAT OA Address Post NAT IP address This field is present when Address is translated in the network Flags up Can send all packets registration ok unique Peer is unique used Peer is kernel ...

Page 288: ...e 1 9 Page 288 of 350 You can check DMVPN status using UCI commands opennhrpctl show Status ok Interface gre GRE Type local Protocol Address 11 11 11 7 32 Alias Address 11 11 11 3 Flags up Interface gre GRE Type local Protocol Address 11 11 11 3 32 Flags up Interface gre GRE Type cached Protocol Address 11 11 11 2 32 NBMA Address 178 237 115 129 NBMA NAT OA Address 172 20 38 129 Flags used up Expi...

Page 289: ...ne for each serial port depending on the device Each Terminal Server session has an IP endpoint and an associated specific serial port You can configure the IP endpoint of each Terminal Server session to be a TCP server each session is listening on a unique port TCP client Terminal Server makes a TCP connection to external TCP server UDP endpoint Terminal Server forwards data between a UDP stream ...

Page 290: ...able Enables detailed debug logging 0 Disabled 1 Enabled Web Syslog severity UCI tservd main log_severity Opt log_severity Determines the syslog level Events up to this priority will be logged 0 Emergency 1 Alert 2 Critical 3 Error 4 Warning 5 Notice 6 Informational 7 Debug Web Log RX TX UCI tservd main debug_rx_tx_enable Opt debug_rx_tx_enable Enables logging data transfers 0 Disabled 1 Enabled T...

Page 291: ...work 256 256 bytes Range 0 2048 Web Network Forwarding Timeout ms UCI tservd port 0 fwd_timeout Opt fwd_timeout Forwarding timeout in milliseconds serial to network 30 30 ms Range 0 10000 Web Network Forwarding Timer Mode UCI tservd port 0 fwd_timer_mode Opt fwd_timer_mode Forwarding timer mode serial to network Idle Timer is re started on each received data Aging Timer started on the first Rx Web...

Page 292: ...l When either side TCP socket closes the main terminal server client re connects to the normal IP destination and the server proxy returns to listening for another connection from the far end 0 Disabled 1 Enabled Web Disable Remote Client s Local Echo Telnet option UCI tservd port 0 disable_echo Opt disable_echo Set to 1 to send IAC WILL ECHO Telnet option to remote client forcing it to disable lo...

Page 293: ...___________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 293 of 350 Figure 149 The serial section fields portmode RS232 and usb serial disabled ...

Page 294: ... port 0 parity Opt parity Serial device parity 0 None 1 Even 2 Odd 3 Space Web Stop Bits UCI tservd port 0 stops Opt stops Serial device number of stop bits 1 Range 1 2 Web Flow Control UCI tservd port 0 fc_mode Opt fc_mode Serial flow control mode 0 None 1 RTS CTS 2 XON XOFF Web RS485 Termination UCI tservd port 0 rs485_line_termination Opt rs485_line_termination Enables or disable RS485 terminat...

Page 295: ... echo suppression timeout in milliseconds 20 Range Web n a UCI tservd port 0 v23_tx_rampdown Opt v23_tx_rampdown Defines the time in milliseconds it takes the V23 transmitter to rampdown carrier from peak to zero 30 Range Web n a UCI tservd port 0 v23_tx_maxfill Opt v23_tx_maxfill Defines the maximum transmit queue fill level in bytes 127 Range 0 255 Web Atmel USB serial card UCI tservd port 0 is_...

Page 296: ...ge Inverted clock data transmitted on rising edge Only displayed if Atmel USB serial card is enabled 0 Normal 1 Invert Web RX MSBF UCI tservd port 0 sync_rx_msbf Opt sync_rx_msbf Defines whether most significant bit is received first Only displayed if Atmel USB serial card is enabled 0 Receive least significant bit first 1 Receive most significant bit first Web TX MSBF UCI tservd port 0 sync_tx_ms...

Page 297: ...e Defines the value of idle character decimal to transmit in case of tranmit underrun In HDLC mode this configures inter frame fill 0 Tranmit 0 in HDLC mode 126 Transmit flags in HDLC mode 255 Tranmit 1 in HDLC mode Range 0 255 Web n a UCI tservd port 0 v23_inband_carrier_sign alling Opt v23_inband_carrier_signalling Enables signalling of carrier by sending special characters 0 Disabled 1 Enabled ...

Page 298: ...bled 951 Range 1 65535 Web Remote IP 1 UCI tservd port 0 remote_ip1 Opt remote_ip1 Destination peer IP 1 address 0 0 0 0 Range IPv4 address Web Remote IP 2 UCI tservd port 0 remote_ip2 Opt remote_ip2 Destination peer IP 2 address Only displayed if Transport Mode is TCP 0 0 0 0 Range IPv4 address Web Enable TCP Keepalives UCI tservd port 0 tcp_keepalives_enabl ed Opt tcp_keepalives_enabled Enable o...

Page 299: ...iseconds to start reconnecting after setting DTR low 5000 5 seconds Range 0 10000 Web UDP Keepalive Interval UCI tservd port 0 udpKaIntervalMs Opt udpKaIntervalMs Defines time in milliseconds to send UDP keepalives empty UDP packets when no data to send Only displayed if transport mode is UDP 0 Disabled Range 0 65535 Web UDP Keepalive Count UCI tservd port 0 udpKaCount Opt udpKaCount Defines the m...

Page 300: ...n remote_ip1 0 0 0 0 option remote_ip2 0 0 0 0 31 6 Terminal Server diagnostics The tservd process has to be running otherwise diagnostics options for terminal server will not be available 31 6 1 Checking Terminal Server process To check if Terminal Server is running enter root VA_router ps grep tservd 1264 root 1032 S tservd 1769 root 1496 S grep tservd If Terminal Server is running it will be sh...

Page 301: ...v disgnostics Command syntax tserv show stats show statistics tserv clear stats clear statistics tserv show serial show serial interface status tserv send serial0 data send data to serial port 0 tserv start capture N N port number 0 to 3 start capturing rx serial data tserv print capture N N port number 0 to 3 print captured rx serial data tserv show serial txlog hex Port length Port port cfg inde...

Page 302: ...______________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 302 of 350 tserv show userial version show USB serial card firmware version tserv show userial cpld status show USB serial card CPLD programming status tserv upgrade userial initiate upgrade of the USB serial card tserv quit terminate termserv process ...

Page 303: ...Opt enabled Enables Terminal on the router 0 Disabled 1 Enabled Web not available UCI terminal console device Opt device String value point at the tty device in dev folder None Defalut string Device name e g ttySC0 to use serial port 0 Web not available UCI terminal console speed Opt speed Set the speed of serial connection 115200 Defalut range Supported port speed Web not available UCI terminal c...

Page 304: ...rminal config terminal ttySC0 option enabled 0 option device ttySC0 option speed 115200 option type vt100 option flowcontrol 1 32 5 Terminal diagnostics 32 5 1 Checking Terminal entry in inittab To check if Terminal configuration is running enter the following and confirm the line referring to the device name is present and looks similar to the last line below root VA_router cat etc inittab sysini...

Page 305: ... web interface To create GRE interfaces through the web interface in the top menu select Network Interfaces There are three sections in the Interfaces page Section Description Interface Overview Shows existing interfaces and their status You can create new and edit existing interfaces here Port Map In this section you can map device ports to Ethernet interfaces Ports are marked with capital letter...

Page 306: ...CP Client Address and netmask are assigned by DHCP Unmanaged Unspecified IPv6 in IPv4 RFC4213 Used with tunnel brokers IPv6 over IPv4 Stateless IPv6 over IPv4 transport GRE Generic Routing Encapsulation protocol IOT L2TP Layer 2 Tunnelling Protocol PPP Point to Point protocol PPPoE PPP over Ethernet PPPoATM PPP over ATM LTE UMTS GPRS EV DO CDMA UMTS or GPRS connection using an AT style 3G modem We...

Page 307: ...guration general setup Figure 152 The GRE common configuration page Web Field UCI Package Option Description Web Protocol of the new interface UCI network if name proto Opt proto Shows the protocol the interface will operate on GRE should be currently selected Web Tunnel IP Address UCI network if name ipaddr Opt ipaddr Configures local IP address of the GRE interface Web Mask Length UCI network if...

Page 308: ...to be linked with the GRE tunnel interface optional Web Remote IP address UCI network if name remote_ip Opt remote_ip For point to point tunnels specifies Remote IP address Web TTL UCI network if name ttl Opt ttl Sets Time To Live value on the interface 128 Range Web Tunnel key UCI network if name key Opt key Sets GRE tunnel ID key optional Usually an integer Web MTU UCI network if name mtu Opt mt...

Page 309: ...nabled Table 108 Information table for GRE advanced settings 33 2 3 GRE connection firewall settings Use this section to select the firewall zone you want to assign to this interface Select unspecified to remove the interface from the associated zone or fill out the create field to define a new zone and attach the interface to it Figure 154 GRE firewall settings Click Save and Apply This will save...

Page 310: ...VA_router uci show network network tunnel1 interface network tunnel1 proto gre network tunnel1 monitored 0 network tunnel1 ipaddr 172 255 255 2 network tunnel1 mask_length 24 network tunnel1 local_interface wan network tunnel1 remote_ip 172 255 255 100 network tunnel1 ttl 128 network tunnel1 key 1234 network tunnel1 mtu 1472 network tunnel1 auto 1 33 5 GRE configuration using package options root ...

Page 311: ... 68 66 54 Bcast 10 68 66 55 Mask 255 255 255 252 inet6 addr fe80 21e 10ff fe1f 0 64 Scope Link UP BROADCAST RUNNING MULTICAST MTU 1500 Metric 1 RX packets 81 errors 0 dropped 0 overruns 0 frame 0 TX packets 127 errors 0 dropped 0 overruns 0 carrier 0 collisions 0 txqueuelen 1000 RX bytes 8308 8 1 KiB TX bytes 12693 12 3 KiB gre Tunnel1 Link encap UNSPEC HWaddr 0A 44 42 36 DB B0 00 48 00 00 00 00 0...

Page 312: ... addr fe80 5efe a44 4236 64 Scope Link UP RUNNING MULTICAST MTU 1472 Metric 1 RX packets 7 errors 0 dropped 0 overruns 0 frame 0 TX packets 7 errors 0 dropped 0 overruns 0 carrier 0 collisions 0 txqueuelen 0 RX bytes 912 912 0 B TX bytes 8GRE route status To show the current GRE route status enter root VA_router route n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface...

Page 313: ... group of receivers that expresses an interest in receiving a particular data stream The receivers the designated multicast group are interested in receiving a data stream from the source They indicate this by sending an Internet Group Management Protocol IGMP host report to their closest router in the network The routers are then responsible for delivering the data from the source to the receiver...

Page 314: ...for PIM global settings 34 3 2 Interfaces configuration Figure 156 The interfaces configuration section Web Field UCI Package Option Description Web Enabled UCI pimd interface x enabled Opt enabled Enables multicast management of the given interface by the PIM application 0 Disabled 1 Enabled Web Interface UCI pimd interface x interface Opt interface Selects the interface to apply PIM settings to ...

Page 315: ...nfig pimd To view the configuration file enter uci export pimd root VA_router etc config1 uci export pimd package pimd config routing pimd option enabled yes config interface option enabled yes option interface lan option ssm yes option igmp yes config interface option enabled yes option interface wan option ssm yes option igmp no Alternatively enter uci show pimd root VA_router etc config1 uci sh...

Page 316: ...__________________________________________ _____________________________________________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 316 of 350 pimd interface 1 ssm yes pimd interface 1 igmp no To change any of the above values use uci set command ...

Page 317: ...three types of object Forwardings Rules that define what kind of events should be generated For example you might want an event to be created when an IPSec tunnel comes up or down Targets Define the targets to send the event to The event may be sent to a target via a syslog message a snmp trap or email Connection testers Define methods to test the target is reachable IP connectivity to a server an...

Page 318: ...s the methods to test a connection that are currently supported Type Description link Checks if the interface used to reach the target is up ping Pings the target And then assumes there is connectivity during a configurable amount of time Table 112 Event system supported connection tester methods 35 6 Configuring the event system using the web interface Configuring the event system using the web i...

Page 319: ... be stored before being processed Default file is tmp event_buffer tmp event_buffer Range UCI va_eventd main event_queue_size Opt event_queue_size Maximum size of the event queue in bytes Default value is 128k 128K 128 kilobytes Range Table 113 Information table for event settings main section 35 7 2 Va_eventd forwarding Forwardings are section rules that define what kind of events should be gener...

Page 320: ...tion enabled 1 option className ethernet option eventName LinkUp option severity warning critical option target syslog1 35 7 5 Forwarding table options UCI Package Option Description UCI va_eventd forwarding label enabled Opt enabled Enables or disables event generation 0 Disabled 1 Enabled UCI va_eventd forwarding label className Opt className Only generate events with the given className Availab...

Page 321: ...on Table 114 Information table for event system forwarding rules 35 7 6 Va_eventd connection testers There are two types of connection testers ping connection tester and link connection tester Multiple connection testers can be defined and each forwarding section can be given a label for identification For example To define a connection tester label of Tester1 using package options enter config co...

Page 322: ...ster label enabled Opt enabled Enable this connection tester 0 Disabled 1 Enabled UCI va_eventd conn_tester label type Opt type Set to ping for a ping connection tester ping Ping connection tester link Link connection tester UCI va_eventd conn_tester label ping_dest_addr Opt ping_dest_addr IP Address to ping UCI va_eventd conn_tester label ping_source Opt ping_source Source IP Address of the pings...

Page 323: ...tion tester 0 Disabled 1 Enabled UCI va_eventd conn_tester label type Opt type Set to link for a link connection tester ping Ping connection tester link Link connection tester UCI va_eventd conn_tester label link_iface Opt link_iface Interface name to check Table 116 Information table for link connection tester settings 35 7 7 Supported targets There are four possible targets Syslog target Email t...

Page 324: ...tion enabled 1 option type syslog option tcp_syslog 0 option target_addr 192 168 0 1 514 option conn_tester pinger option snmp_version 3 35 7 7 4 Syslog target table options UCI Package Option Description UCI va_eventd target label name Opt name Name of the target This is to be used in the forwarding section UCI va_eventd target label enabled Opt enabled Enable this target 0 Disabled 1 Enabled UCI...

Page 325: ...l target using UCI va_eventd target 0 target va_eventd target 0 name email1 va_eventd target 0 enabled 1 va_eventd target 0 type email va_eventd target 0 smtp_addr smtp site com 587 va_eventd target 0 smtp_user john_smith site com va_eventd target 0 smtp_password secret word va_eventd target 0 use_tls 0 va_eventd target 0 tls_starttls 0 va_eventd target 0 tls_forcessl3 0 va_eventd target 0 timeout...

Page 326: ...get syslog Syslog target email Email target snmptrap SNMP target exec Exec target UCI va_eventd target label smpt_addr Opt smtp_addr IP address or FQDNand port of the SMTP server to use Format x x x x port or fqdn port UCI va_eventd target label smtp_user Opt smtp_user Username for smtp authentication UCI va_eventd target label smtp_password Opt smtp_password Password for smtp authentication UCI v...

Page 327: ...arget using UCI va_eventd target 0 target va_eventd target 0 name snmp1 va_eventd target 0 enabled 1 va_eventd target 0 type snmptrap va_eventd target 0 target_addr 192 168 0 1 va_eventd target 0 agent_addr 192 168 0 4 va_eventd target 0 conn_tester pinger SNMP target using package options config target option name snmp1 option enabled 1 option type snmptrap option community public option target_a...

Page 328: ...en an exec target receives an event it executes a shell command 35 7 8 4 Exec target using UCI va_eventd target 0 target va_eventd target 0 name logit va_eventd target 0 enabled 1 va_eventd target 0 type exec va_eventd target 0 cmd_template logger t eventer eventName 35 7 8 5 Exec target using package options config target option name logit option enabled 1 option type exec option cmd_template log...

Page 329: ...ad value internal 2 EventdConfigWarn warning p1 p2 p3 has bad value internal 3 EventdConfigUnknown informat p1 p2 field p3 is no internal 4 EventdSystemErr error p1 p2 p3 p4 p5 internal 5 EventdSystemWarn error p1 p2 p3 p4 p5 internal 6 EventdUpAndRunning informat internal 7 EventdStopped warning p1 mobile 1 SIMin notice SIM card p1 inserted mobile 2 SIMout notice SIM card p1 removed mobile 3 Link...

Page 330: ... warning Telnet login attempt bad passwo auth 7 BadUserLuCI warning LuCI login attempt bad username auth 8 BadPasswordLuCI warning LuCI login attempt bad password auth 9 LoginSSH notice SSH login user p2 from p3 auth 10 LogoffSSH notice SSH logoff user p1 due to auth 11 LoginConsole notice Console login user p1 on p2 auth 12 LogoffConsole notice Console logoff on p1 auth 13 LoginTelnet notice Teln...

Page 331: ...2 disconnected wifi 4 WiFiStationDetached notice WiFi station p2 disconnected wifi 5 WiFiStationAttachFailed notice WiFi station p2 failed to con wifi 5 WiFiStationAttachFailed notice WiFi station p2 failed to con ppp 1 LinkUp informat PPP for interface p2 protoco ppp 2 LinkDown informat PPP for interface p2 protoco ppp 3 ConnEstablished informat PPP connection for interface p adsl 1 LinkUp notice...

Page 332: ...orward the l2tp event CannotFindTunnel with a severity between debug and critical to a syslog server Forward all mobile events with a severity between notice and critical to a SNMP trap manager Execute logger t eventer eventName when an Ethernet event occurs Forward all auth events via email Connection to the SNMP and syslog server is checked by sending pings Connection to the smtp server is verif...

Page 333: ...config forwarding option enabled yes option className auth option target email config conn_tester option name mon_server option enabled 1 option type ping option ping_dest_addr 192 168 100 254 option ping_source eth0 option ping_success_duration_sec 10 config conn_tester option name smtp_server option enabled 1 option type link option link_iface eth0 config target option name syslog option enabled...

Page 334: ...yes option tls_starttls no option tls_forcessl3 no option timeout_sec 10 option from y example com option to z example com option subject_template severityName eventName option body_template eventName class subclass happened option conn_tester smtp_server config target option name snmp option enabled yes option type snmptrap option community public option target_addr 192 168 100 254 option agent_a...

Page 335: ...ckets received transmitted and the difference between them Packet loss average max and min Signal strength average max and min Online time Temperature average max and min The SLA Report Manager can build reports from a list of selected routers presenting a range of statistics over extended periods of time Note as well as configuring Monitor for SLA you must configure each router To configure the r...

Page 336: ...llowing options TFTP HTTP HTTPS Enter in the relevant Server Address and the TFTP Server Port number to match Figure 158 The device settings fields 36 4 Viewing graphs When the router has started to send SLA statistics to the Monitoring platform default graphs are displayed on the SLA Reporting screen To view the graphs for one specific network interface select the relevant interface from the drop...

Page 337: ..._______________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 337 of 350 Figure 160 Graphs showing per hour data To view raw data click each graph to produce the following information Figure 161 Raw data information from each graph To change the range of the graph click zoom Figure 162 Altered range of graph information ...

Page 338: ...If the scroll bar represents less than a period of one day you can also specify the start and end times to display on the graphs When you have selected a range with the scroll bar click Go to get statistics for that period Figure 163 Graph showing specified start and end times The following graphs can be displayed Packets received transmitted and the difference between them Packet loss average max...

Page 339: ...ings interface Click Statistics A drop down menu appears The menu has the following options Create Report Edit Report Remove Report Statistics Settings 36 5 1 Create a report Select Create Report Enter the relevant parameters Report name Frequency of report Assigned devices SLA Report Elements The selected frequency of report determines how often SLA reports will be generated by the Monitor3 Repor...

Page 340: ...____ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 340 of 350 To assign devices to the report click Change Figure 166 Assign devices to a report After clicking Change the select devices page appears this allows you to select which devices are to be members of the report Figure 167 Sample from the select devices page Click Continue and then add SLA report elements Figure 168 Add repo...

Page 341: ...ror Count Average Signal Strength Average Error Count Max Signal Strength Max Error Count Min Signal Strength Min Bytes Transmitted Bytes Received Bytes Transmitted over Received Online time Temperature Min Temperature Max Temperature Average Select a graph name and then select a relevant range from the following options Year Month Week Day Click Add and when you have selected all graphs click Sav...

Page 342: ...ery week and so on 36 5 2 2 Default SLA element settings The Default SLA Element settings control range and graphs Range Sets what the default range will be when a new user is created Graph Selects whteher each report element is displayed as a graph or in tabular data form The view of SLA data is customisable per user These default values set how graphs appear when you use SLA for the first time Y...

Page 343: ...P version 3 Table 121 Information table for reporting device commands The table below shows options that are relevant only if you have selected SNMP version 3 Web Field UCI Package Option Description UCI monitor main snmp_uname Opt snmp_uname Specifies uname Blank Default value String UCI monitor main snmp_auth_pass Opt snmp_auth_pass snmpv3 authentication password UCI monitor main snmp_auth_proto...

Page 344: ...n 2c monitor v3 keepalive monitor v3 enable yes monitor v3 interval_min 1 monitor v3 monitor_ip 172 16 250 100 monitor v3 dev_reference TEST monitor v3 snmp_version 3 monitor v3 snmp_uname TEST monitor v3 snmp_auth_pass vasecret monitor v3 snmp_auth_proto MD5 monitor v3 snmp_priv_pass vasecret monitor v3 snmp_priv_proto DES root VA_router uci export monitor package monitor config keepalive main op...

Page 345: ...______________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 345 of 350 list monitor_ip 172 16 250 100 option dev_reference TEST option snmp_version 3 option snmp_uname TEST option snmp_auth_pass vasecret option snmp_auth_proto MD5 option snmp_priv_pass vasecret option snmp_priv_proto DES config interface_stats stats option enabled yes option bin_period 1m option bin...

Page 346: ...sk of uploading statistics to Monitor 2 The Virtual Access router monitors UDP keepalive packets It creates and stores statistics in bins These statistics are uploaded every hour to the Monitor server Figure 171 The SLA function This section describes how to configure SLA on a router For information on how to configure Monitor for SLA reporting read the previous section Configuring SLA on Monitor ...

Page 347: ...ce UCI slad main interface Opt interface Specifies the interface on which traffic should be monitored Web Destination Host IP Address UCI slad main_destination_host_ip_address Opt destination_host_ip_address Specifies the destination IP address for the keepalive packets that are originated on the LAN Web Destination UDP port UCI slad main destination_udp_ip_address Opt destination_udp_ip_address S...

Page 348: ...ci export slad or uci show slad uci export slad package slad config slad main option enable yes option roundtrip_timeout_msec 5000 option interface lan option destination_host_ip_address 10 1 1 2 option destination_udp_port 53 option bin_restart_period_msec 3600000 option max_bin_count 73 uci show slad slad main slad slad main enable yes slad main roundtrip_timeout_msec 5000 slad main interface la...

Page 349: ...newest N Shows the newest valid bin range YYYYMMDDHH YYYYMMDDHH Shows all bins that match specified time range Type the command sla current To show current statistics enter root VA_router sla current Bin valid no Start time 01 01 1970 03 34 00 End time n a Pkts In 1 Pkts Out 1 Bytes In 15 Bytes Out 15 Pkts OK 1 Pkts Fail 0 Last Round Trip 1 ms Min Last Trip 1 ms Max Round Trip 1 ms Avg Round Trip ...

Page 350: ..._______________________________________________________________________ Virtual Access 2017 GW1000 Series User Manual Issue 1 9 Page 350 of 350 Bytes Out 90 Pkts OK 6 Pkts Fail 0 Last Round Trip 0 ms Min Last Trip 1 ms Max Round Trip 1 ms Avg Round Trip 1 ms Min GSM signal quality 63 dBm Max GSM signal quality 63 dBm Avg GSM signal quality 63 dBm Availability 100 00 ...

Reviews:

No comments

Related manuals for GW1032

Cabletron Systems SmartSwitch Router User'S Reference Manual preview
SmartSwitch Router
Brand: Cabletron Systems Pages: 338
H3C SR8800 IM-FW-II Command Reference Manual preview
SR8800 IM-FW-II
Brand: H3C Pages: 107
3Com MSR 50 Series Safety Information Manual preview
MSR 50 Series
Brand: 3Com Pages: 12
H3C S9500 Series Operating Manual preview
S9500 Series
Brand: H3C Pages: 16
H3C H3C S3600 Series Datasheet preview
H3C S3600 Series
Brand: H3C Pages: 10
H3C MSR 930 Installation Manual preview
MSR 930
Brand: H3C Pages: 42
H3C MSR 800 Installation, Quick Start preview
MSR 800
Brand: H3C Pages: 2
H3C H3C S7500E Series Instruction Manual preview
H3C S7500E Series
Brand: H3C Pages: 34
H3C MSR Series Manual preview
MSR Series
Brand: H3C Pages: 33
H3C CR16000-F Configuration Manual preview
CR16000-F
Brand: H3C Pages: 14
H3C MSR 3600 Hardware Information And Specifications preview
MSR 3600
Brand: H3C Pages: 56
H3C H3C S7500E Series Configuration Manual preview
H3C S7500E Series
Brand: H3C Pages: 112
H3C S3100-52P Command Manual preview
S3100-52P
Brand: H3C Pages: 15
H3C SR8800 IM-FW-II Manual preview
SR8800 IM-FW-II
Brand: H3C Pages: 5
H3C H3C S7500E Series Installation Manual preview
H3C S7500E Series
Brand: H3C Pages: 50
H3C MSR810 Manual preview
MSR810
Brand: H3C Pages: 37
H3C CR16000-F Installation, Quick Start preview
CR16000-F
Brand: H3C Pages: 4
H3C MSR 20-1X Quick Start preview
MSR 20-1X
Brand: H3C Pages: 5

Brands by name

Popular brands

Load more brands