manualshive.com logo in svg

Geneko GWR-I series, Руководство пользователя

Поделиться
Скачать
Geneko GWR-I series Скачать руководство пользователя страница 35

USER MANUAL

  

 

GWR-I Cellular Router Series

 

 

 

35 

Internet Protocol Security (IPSec) 

 

 

Internet  Protocol  Security  (IPSec)  is  a  protocol  suite  for  securing  Internet  Protocol  communication 

by authenticating and encrypting each IP packet of a data stream.  
Click 

VPN Settings 

Tab, to open the VPN configuration screen. At the 

Figure 17

 you can see IPSec Summary 

screen. This screen gathers information about settings of all defined IPSec tunnels. You can define up to 5 
Device-to-Device tunnels. Two different firmware versions of GWR-I have slightly different IPSec Advanced 
options.  
First firmware version provides single Negotiation mode: 

•

 

Main 

 
Second version has IPSec Negotiation mode options: 

•

 

Aggressive 

 

•

 

Main 

 

•

 

Base

 

 
Router is delivered with first firmware version as more reliable and secure solution. Only with this version 
you have option to define IKE retry failover mechanism and log level of IPSec system messages. 
If you cannot use IP address as a peer identifier at one side of the tunnel (private IP subnet) aggressive mode 
has to be utilized (second version)

 

 

Default firmware version (without Aggressive Mode)  

 

IPSec Summary  and  IPSec  Settings  related  with  second firmware version  are briefly displayed  in 

following figures and tables

 

 

 

Figure 15 - IPSec Summary screen for second firmware version  

 
 

VPN Settings / IPSec Summary 

Label  

Description  

 

Tunnels Used 

This is the number of IPSec tunnels being defined. 

Maximum  number  of 
tunnels 

This is the maximum number of tunnels which can be defined. 

 

No 

This filed indicates the number of the IPSec tunnel. 

Name  

Field shows the Tunnel Name that you gave to the IPSec tunnel. 

Enabled 

This  field  shows  if  tunnel  is  enabled  or  disabled.  After  clicking  on 

Start

  button, 

Содержание GWR-I series

Страница 1: ...GWR I Cellular Router Series User Manual version 1 0 date 10 08 2012 WWW INFOPULSAS LT info infopulsas lt...

Страница 2: ...tion Protocol RIP 29 RIP routing engine for the GWR I Router 31 Settings VPN Settings 33 Generic Routing Encapsulation GRE 33 GRE Keepalive 34 Internet Protocol Security IPSec 35 Default firmware vers...

Страница 3: ...GRE Tunnel configuration between two GWR I Routers 76 GRE Tunnel configuration between GWR I Router and third party router 80 IPSec Tunnel configuration between two GWR I Routers 83 IPSec Tunnel conf...

Страница 4: ...Filtering settings 52 Figure 25 DynDNS settings 53 Figure 26 Serial Port Settings initial menu 54 Figure 27 Serial Port Settings 1 PINOUT 54 Figure 28 Serial Port configuration page 56 Figure 29 Modb...

Страница 5: ...SEC configuration page III for GWR I Router 1 92 Figure 78 IPSec start stop page for GWR I Router 1 92 Figure 79 Network configuration page for GWR I Router 2 93 Figure 80 IPSEC configuration page I f...

Страница 6: ...cond firmware version 40 Table 12 IPSec Summary for first firmware version 42 Table 13 IPSec Parameters for first firmware version 46 Table 14 OpenVPN parameters 48 Table 15 IP filtering parameters 51...

Страница 7: ...rail mounting kit is part of standard equipment for GWR I series Many useful features make GWR I cellular routers a perfect solution for wide variety of industrial applications Dual SIM card support i...

Страница 8: ...upervision Extra high voltage equipment monitoring Running water gas pipe line supervision Centralized heating system supervision Environment protection data collection Flood control data collection A...

Страница 9: ...output 700mA 60VDC 1 5KV isolation GWR I202 GPRS Tri band 900 1800 1900 GPRS multi slot class 10 mobile station class B GPRS DL 85 6Kbps UL 42 8Kbps GWR I252 GPRS EDGE Quad band GSM 850 900 1800 1900M...

Страница 10: ...twork attached devices for conditions that warrant administrative attention NTP RFC1305 The Network Time Protocol is a protocol for synchronizing the clocks of router DynDNS Dynamic DNS DDNS is a doma...

Страница 11: ...Application HTTP based Command Line Interface Serial console telnet and SSH GWR connection wizard Initial setup utility SMS Control Control the basic router functionalities by SMS Remote management an...

Страница 12: ...r Description 1 Reset red LED on the GWR I Router reset state 2 Power status green LED on Power supply Power status LED will blink when the GWR Router is in initializing state 3 Link red LED will blin...

Страница 13: ...reset to factory defaults Warm reset If the GWR I Router is having problem connecting to the Internet press and hold the reset button for a second using the tip of a pen Reset to Factory Defaults To...

Страница 14: ...inserted And finally device should have powered up external power supply NOTE Since the router is dedicated for operation in rough environments SIM card slots are located within the router chassis In...

Страница 15: ...s 15 Figure 4 Inserting the SIM card SIM card must not be changed installed or taken out while device operates This procedure is performed when power supply is not connected In order to open the route...

Страница 16: ...USER MANUAL GWR I Cellular Router Series 16 Declaration of conformity...

Страница 17: ...instructions Device configuration using web application The GWR I Router s web based utility allows you to set up the Router and perform advanced configuration and troubleshooting This chapter will e...

Страница 18: ...tton By clicking Reload previous settings will be loaded in the form Status Information The GWR I Router s Status menu provides general information about router as well as real time network informatio...

Страница 19: ...information is shown in Figure 7 Status WAN Information WAN Information Tab provides information about GPRS EDGE HSPA connection and traffic statistics WAN information menu has three submenus which pr...

Страница 20: ...USER MANUAL GWR I Cellular Router Series 20 Figure 8 WAN Information...

Страница 21: ...ry default IP address Subnet Mask The subnet mask specifies the network number portion of an IP address The GWR I Router support sub netting You must specified subnet mask for your LAN TCP IP settings...

Страница 22: ...pecifies the first of the contiguous addresses in the IP address pool IP Ending Address To This field specifies last of the contiguous addresses in the IP address pool Lease Duration This field specif...

Страница 23: ...USER MANUAL GWR I Cellular Router Series 23 Figure 10 DHCP Server configuration page...

Страница 24: ...M UMTS ISP You can setup any name for provider Authentication This field specifies password authentication protocol Select the appropriate protocol from drop down list PAP CHAP PAP CHAP Username This...

Страница 25: ...ies the time interval of advanced ping proofing Advanced ping wait for a response This field specifies the timeout for advanced ping proofing Maximum number of failed packets This field specifies maxi...

Страница 26: ...peer using PAP Require PAP Require the peer to authenticate using PAP Password Authentication Protocol authentication Refuse CHAP With this option pppd will not agree to authenticate itself to the pe...

Страница 27: ...his option pppd will not transmit LCP packets to initiate a connection until a valid LCP packet is received from the peer as for the passive option with ancient versions of pppd Append domain name App...

Страница 28: ...nside the network Routing Settings Label Description Routing Table Enable This check box allows you to activate deactivate this static route Source IP Source IP address from which portforwarding is al...

Страница 29: ...e WAN interface to inside LAN interface is done on PPP and in reverse direction on Ethernet interface Add Click Add to insert add new item in table to the GWR I Router Remove Click Remove to delete se...

Страница 30: ...ork stability guaranteeing that if one network connection goes down the network can quickly adapt to send packets through another connection Click RIP Tab to open the Routing Information Protocol scre...

Страница 31: ...able 8 RIP parameters RIP routing engine for the GWR I Router Use telnet to enter in global configuration mode telnet 192 168 1 1 2602 telnet to eth0 at TCP port 2602 To enable RIP use the following c...

Страница 32: ...ne routing protocol performance to better suit your internetwork needs Use following command to setup RIP timer router timers basic UPDATE INTERVAL INVALID TIMEOUT GARBAGE COLLECT router no timers bas...

Страница 33: ...to create VPN tunnels For example if you configure Microsoft VPN tunnels by default you use PPTP which uses GRE Solution where you can use GRE protocol You need to encrypt multicast traffic GRE tunne...

Страница 34: ...ge GRE Keepalive GRE tunnels can use periodic status messages known as keepalives to verify the integrity of the tunnel from end to end By default GRE tunnel keepalives are disabled Use the keepalive...

Страница 35: ...ion as more reliable and secure solution Only with this version you have option to define IKE retry failover mechanism and log level of IPSec system messages If you cannot use IP address as a peer ide...

Страница 36: ...ct IPSec tunnel initiating side in negotiation process Wait IPSec tunnel responding side in negotiation process Log level Set IPSec log level Delete Click on this link to delete the tunnel and all set...

Страница 37: ...USER MANUAL GWR I Cellular Router Series 37 Figure 16 IPSec Settings for second firmware version...

Страница 38: ...same encryption method Phase 1 Authentication Select a method of authentication MD5 or SHA1 The authentication method determines how the ESP packets are validated MD5 is a one way hashing algorithm th...

Страница 39: ...om Peer ID Authentication identity for one of the participant Can be an IP address or fully qualified domain name preceded by IP Address From Select SIM card over which the tunnel is established Local...

Страница 40: ...er will disconnect the tunnel so the connection can be re established Specify the interval between HELLO ACK messages how often you want the messages to be sent The default interval is 20 seconds NAT...

Страница 41: ...d IPSec tunnels Enc Auth Grp This field shows both Phase 1 and Phase 2 details Encryption method DES 3DES AES Authentication method MD5 SHA1 and DH Group number 1 2 5 that you have defined in the IPSe...

Страница 42: ...on this button to refresh the Status field in the Summary table Table 12 IPSec Summary for first firmware version To create a tunnel click Add New Tunnel button Depending on your selection the Local...

Страница 43: ...DH Group Phase 1 is used to create the SA DH Diffie Hellman is a key exchange protocol used during Phase 1 of the authentication process to establish pre shared keys There are three groups of differen...

Страница 44: ...produces a 128 bit digest SHA1 is a one way hashing algorithm that produces a 160 bit digest SHA1 is recommended because it is more secure Both ends of the IPSec tunnel must use the same Phase 2 Auth...

Страница 45: ...terval between advanced ping packets Advanced Ping Wait For A Response Advanced ping proofing timeout Maximum numbers of failed packets Set percentage of failed packets until failover action is perfor...

Страница 46: ...onger has access to the original SA s and their associated keying material Back Click Back to return on IPSec Summary screen Reload Click Reload to discard any changes and reload previous settings Sav...

Страница 47: ...creation a static key must be generated on one side and the same key must be uploaded on the opposite side Figure 19 OpenVPN example OpenVPN Label Description IP Filtering Tunnel Number Automatically...

Страница 48: ...e If you select UDP protocol whether in connect or wait mode you must specify Max Fragment Size default is 1300 bytes Renegotiate interval Specify renegotiate interval if username password is selected...

Страница 49: ...USER MANUAL GWR I Cellular Router Series 49 Figure 20 OpenVPN configuration page Figure 21 OpenVPN network topology...

Страница 50: ...er at the same time In the other words this setting allows one local user to be exposed to the Internet to use a special purpose services such as Internet gaming Video conferencing and etc It is recom...

Страница 51: ...the GWR I Router Add Click Add to insert add new item in table to the GWR I Router Remove Click Remove to delete selected item from table Demilitarized Zone Host Settings DMZ Private IP Address This c...

Страница 52: ...Series 52 IP Filtering configuration example This example configuration demonstrates how to secure a network with a combination of routers and a GWR I Router Figure 23 IP Filtering configuration examp...

Страница 53: ...DynDNS Client Service The type of service that you are using try one of dhs pgpow dyndns dyndns static dyndns custom ods easydns dyns justlinux and zoneedit Custom Server IP The server IP to connect...

Страница 54: ...e to perform serial to ethernet conversion Serial port over TCP UDP and ModbusRTU to TCP conversion Modbus gateway Initial Serial Port Settings page is shown in figure bellow By default above describe...

Страница 55: ...indicates the end of transmission The default is 1 Flow control Flow control manages data flow between devices in a network to ensure it is processed efficiently Too much data arriving before a devic...

Страница 56: ...Save button to save your changes back to the GWR I Router and activate deactivate serial to Ethernet converter Table 17 Ser2IP parameters Click Serial Port Tab to open the Serial Port Configuration s...

Страница 57: ...op bit follows the data and parity bits in serial communication It indicates the end of transmission The default is 1 Flow control Flow control manages data flow between devices in a network to ensure...

Страница 58: ...transmission Valid stop bits are 1 and 2 The default is 1 Flow control Flow control manages data flow between devices in a network to ensure it is processed efficiently Too much data arriving before a...

Страница 59: ...settings related to Serial Port 2 are equivalent to the Serial Port 1 settings The only difference is in type of connector and serial port standard Namely serial port 2 supports RS232 and RS485 4W sta...

Страница 60: ...ntaining following string PPP RECONNECT After the command is executed router sends a confirmation SMS with OK if the command is executed without errors or ERROR if something went wrong during the exec...

Страница 61: ...between sending an SMS alert on input change to LOW or setting up the digital output HIGH or LOW High Action1 Action2 Setup required action when router detects high level on digital input It is possib...

Страница 62: ...Router Only for information purpose Location This field specifies location of the GWR I Router Only for information purpose Save Click Save button to save your changes back to the GWR I Router Reload...

Страница 63: ...outer New Password Enter a new password for GWR I Router Your password must have 20 or fewer characters and cannot contain any space Confirm Password Re enter the new password to confirm it Save Click...

Страница 64: ...ging parameters Sync Clock With Client Date and time setting on the basis of PC calendar Time Protocol Choose the time protocol Time Server Address Time server IP address Time Zone Select your time zo...

Страница 65: ...on If you need to download the latest version of the GWR I Router firmware please visit Geneko support site Follow the on screen instructions to access the download page for the GWR I Router If you ha...

Страница 66: ...eed to import the configuration file that you previously exported Figure 38 Export Import the configuration on the router Import Configuration File To import a configuration file first specify where y...

Страница 67: ...ettings Only use this feature if you wish to discard all the settings and preferences that you have configured Click Default Setting to have the GWR I Router with default parameters Keep network setti...

Страница 68: ...e Interface Label Description CLI Settings Enable Enable or disable CLI CLI on Telnet SSH Serial View Mode Username Login name for View mode View Mode Password Password for View mode Confirm Password...

Страница 69: ...sername Specify the username Password Specify the password Save Click Save to save your changes back to the GWR I Router Reload Click Reload to discard any changes and reload previous settings Table 2...

Страница 70: ...net mask GWR I router s Ethernet port and GPRS EDGE HSPA network connection Selecting this option you can configure parameters for LAN and WAN interface Figure 45 Connection Wizard Initial Step Select...

Страница 71: ...on When you select one of the routers from the list and click Next you will get to the following screen Figure 47 Connection Wizard LAN Settings If you selected to configure LAN and WAN interface clic...

Страница 72: ...interface Management Simple Management Protocol SNMP SNMP or Simple Network Management Protocol is a network protocol that provides network administrators with the ability to monitor the status of the...

Страница 73: ...load previous settings Save Click Save button to save your changes back to the GWR I Router and enable disable SNMP Table 26 SNMP parameters Management Logs Syslog is a standard for forwarding log mes...

Страница 74: ...nt The default is 514 You can specify port by marking on user defined and specify port you want Syslog data to be sent User defined Set manually port number Default Use standard port number for this s...

Страница 75: ...ges Use SIM card with a dynamic static IP address obtained from Mobile Operator Note the default gateway may show or change to an address such as 10 0 0 1 this is normal as it is the GSM UMTS provider...

Страница 76: ...TS APN Type For GSM UMTS networks GWR I Router connections may require a Custom APN A Custom APN allows for various IP addressing options particularly static IP addresses which are needed for most VPN...

Страница 77: ...ion 10 251 49 3 select HOST from drop down menu if you want to use host name as peer identifier KeepAlive enable no Period none Retries none Press ADD to put GRE tunnel rule into GRE table Press Save...

Страница 78: ...connection WAN Settings Tab If disconnected please click Connect button Click VPN Settings GRE to configure GRE tunnel parameters Enable yes Local Tunnel Address 10 10 10 2 Local Tunnel Netmask 255 2...

Страница 79: ...s 79 Figure 58 Routing configuration page for GWR I Router 2 Optionally configure IP Filtering and TCP service port settings to block any unwanted incoming traffic On the device connected on GWR I rou...

Страница 80: ...t has two paths to the remote physical interface and the tunnel interface running through the tunnel This tunnel could then transmit unroutable traffic such as NetBIOS or AppleTalk The GWR I Router us...

Страница 81: ...5 ip route 10 1 1 0 255 255 255 0 tunnel0 The GWR I Router Sample Configuration Click Network Tab to open the LAN NETWORK screen Use this screen to configure LAN TCP IP settings Configure IP address a...

Страница 82: ...Figure 61 GRE configuration page Configure GRE Route Click Routing on Settings Tab Parameters for this example are Destination Network 10 2 2 0 Netmask 255 255 255 0 Figure 62 Routing configuration p...

Страница 83: ...ve internet access GSM UMTS APN Type For GSM UMTS networks GWR I Router connections may require a Custom APN A Custom APN allows for various IP addressing options particularly static IP addresses whic...

Страница 84: ...ct button Click VPN Settings IPSEC to configure IPSEC tunnel parameters Click Add New Tunnel button to create new IPSec tunnel Tunnel parameters are Add New Tunnel Tunnel Name test Enable true IPSec S...

Страница 85: ...vanced Negotiation Mode Aggressive Compress Support IP Payload Compression Protocol IPComp false Dead Peer Detection DPD false NAT Traversal true Send Initial Contact true Figure 65 IPSEC configuratio...

Страница 86: ...Security page to initiate IPSEC tunnel Figure 68 IPSec start stop page for GWR I Router 1 On the device connected on GWR I router 1 setup default gateway 10 0 10 1 The GWR I Router 2 configuration Cl...

Страница 87: ...ase 1 DH group Group 2 Phase 1 Encryption 3DES Phase 1 Authentication MD5 Phase 1 SA Life Time 28800 Perfect Forward Secrecy true Phase 2 DH group Group 2 Phase 2 Encryption DES Phase 2 Authentication...

Страница 88: ...Figure 70 IPSEC configuration page I for GWR I Router 2 Figure 71 IPSec configuration page II for GWR I Router 2 NOTE If option NAT Traversal is selected Aggressive mode is predefined Figure 72 IPSec...

Страница 89: ...e of negotiation in IPSec tunnel configuration process Main mode Considering this both routers will be in main mode and there will not be displayed option for Negotiation mode in IPSec configurations...

Страница 90: ...group Group 2 Phase 1 Encryption 3DES Phase 1 Authentication MD5 Phase 1 SA Life Time 28800 Perfect Forward Secrecy true Phase 2 DH group Group 2 Phase 2 Encryption DES Phase 2 Authentication MD5 Phas...

Страница 91: ...USER MANUAL GWR I Cellular Router Series 91 Figure 75 IPSEC configuration page I for GWR I Router 1 Figure 76 IPSEC configuration page II for GWR I Router 1...

Страница 92: ...de of IPSec tunnel which sends requests for establishing of the IPSec tunnel If connection mode Wait is selected that indicates side of IPSec tunnel which listens and responses to IPSec establishing r...

Страница 93: ...sconnected please click Connect button Click VPN Settings IPSEC to configure IPSEC tunnel parameters Click Add New Tunnel button to create new IPSec tunnel Tunnel parameters are Add New Tunnel Tunnel...

Страница 94: ...er Enable IKE failover false Enable Tunnel Failover false Advanced Compress Support IP Payload Compression Protocol IPComp false Dead Peer Detection DPD false NAT Traversal true Send Initial Contact t...

Страница 95: ...e version used in this scenario also provides options for Connection mode of IPSec tunnel If connection mode Connect is selected that indicates side of IPSec tunnel which sends requests for establishi...

Страница 96: ...s 96 Figure 83 IPSec start stop page for GWR I Router 1 Click Wait button and after that Start button on Internet Protocol Security page to initiate IPSEC tunnel On the device connected on GWR I route...

Страница 97: ...to hostname with DynDNS service for synchronization with DynDNS server SIM card must have internet access GSM UMTS APN Type For GSM UMTS networks GWR I Router connections may require a Custom APN A C...

Страница 98: ...Time 28800 Perfect Forward Secrecy true Phase 2 DH group Group 2 Phase 2 Encryption 3DES Phase 2 Authentication SHA1 Phase 2 SA Life Time 3600 Preshared Key 1234567890 Local Group Setup Local Security...

Страница 99: ...MANUAL GWR I Cellular Router Series 99 Figure 86 IPSEC configuration page I for GWR I Router Figure 87 IPSec configuration page II for GWR I Router Figure 88 IPSec configuration page III for GWR I Ro...

Страница 100: ...domain lookup Keyring that defines wildcard pre shared key crypto keyring remote pre shared key address 0 0 0 0 0 0 0 0 key 1234567890 ISAKMP policy crypto isakmp policy 10 encr 3des authentication p...

Страница 101: ...ssh line vty 5 15 access class 23 in privilege level 15 login local transport input telnet ssh end Use this section to confirm that your configuration works properly Debug commands that run on the Cis...

Страница 102: ...custom APN should also support mobile terminated data that may be required in most site to site VPNs The GWR I Router configuration Click Network Tab to open the LAN NETWORK screen Use this screen to...

Страница 103: ...Security Gateway Type IP Only IP Address 150 160 170 1 Remote ID Type Custom Custom Peer ID 150 160 170 1 Remote Security Group Type IP IP Address 10 10 10 0 Subnet Mask 255 255 255 0 IPSec Setup Keyi...

Страница 104: ...USER MANUAL GWR I Cellular Router Series 104 Figure 92 IPSEC configuration page I for GWR I Router Figure 93 IPSec configuration page II for GWR I Router...

Страница 105: ...94 IPSec configuration page III for GWR I Router Click Start button on Internet Protocol Security page to initiate IPSEC tunnel Figure 95 IPSec start stop page for GWR I Router On the device connected...

Страница 106: ...uration Step1 Create New Tunnel Interface Click Interfaces on Network Tab Figure 96 Network Interfaces list Bind New tunnel interface to Untrust interface outside int with public IP addresss Use unnum...

Страница 107: ...Advanced tab Figure 98 AutoKey Advanced Gateway Click New button Enter gateway parameters Gateway name TestGWR Security level Custom Remote Gateway type Dynamic IP address because your GWR I router ar...

Страница 108: ...Defined custom Phase 1 proposal pre g2 3des sha Mode Agressive must be aggressive because of NAT Nat Traversal enabled Click Return and OK Figure 100 Gateway advanced parameters Step 3 Create AutoKey...

Страница 109: ...ateway Predefined Choose VPN Gateway from step 2 Figure 102 AutoKey IKE parameters Click Advanced button Security level User defined custom Phase 2 proposal pre g2 3des sha Bind to Tunnel interface tu...

Страница 110: ...igure 103 AutoKey IKE advanced parameters Step 4 Routing Click Destination tab on Routing menu Click New button Routing parameters are IP Address 192 168 10 0 24 Gateway tunnel 3 tunnel interface from...

Страница 111: ...trust to trust zone Source Address 192 168 10 0 24 Destination Address 10 10 10 0 24 Services Any Click OK Figure 105 Policies from untrust to trust zone Click Policies in main menu Click New button f...

Страница 112: ...USER MANUAL GWR I Cellular Router Series 112 Figure 106 Policies from trust to untrust zone...

Страница 113: ...ndow or to another location within the facility can result in optimum reception Another way of increasing throughput is by physically placing the device on the roof of the building in an environmental...

Отзывы:

Нет отзывов

Бренды по названию

Популярные бренды

Загрузить еще бренды