A

• Add a new profile by selecting Add

• Copy the values from a selected profile into a new profile by selecting Copy

• Delete a selected profile by selecting Delete

• Expand the displayed window by selecting + (plus)

  From the expanded window, select - (minus) to return to the default window

• Display a specific profile by selecting its name in the Add/Copy/Delete window.

• Activate a specific profile by selecting the box adjacent to the profile name.

  If you select this box, the Active box in the profile menu is selected also.

Activation

Usage: Specify one of the following values:

• Static (the Ascend unit does not use flow control signals because the DCE is always connected)

• DSR Active (the DCE raises the DSR signal when it is ready)

• DSR+DCD (the DCE raises the DSR and DCD signals when it is ready)

Active (profile)

Usage:

• Select to activate the profile.

• Clear the check box to deactivate the profile.

  This is the default.

Active (route)

Usage:

• Select to specify that the route appears in the static routing table.

  This is the default.

• Clear the check box to remove the route from the routing table, and to keep the route from appearing in the static routing table.

Address

Usage: Specify an IP address in dotted-decimal format. The null address 0.0.0.0 matches all packets (this is the default).

Dependencies: The Mask parameter determines which bits of the specified address will be compared to the packet's destination address.

Address of SNMP manager to which traps are delivered

Usage: Enter the IP address of the destination. The default value is 0.0.0.0/0. Note that you can turn off traps by setting Dest=0.0.0.0 and deleting the value for Community.

Dependencies: Keep this additional information in mind:

• If you do not know the right IP address to enter, you must obtain it from the network administrator.

• The Send to field does not apply when the Ascend unit is using Combinet encapsulation.

Advertise Dialout Routes

This is intended for use when two or more Ascend units on the same network are configured with redundant profiles and routes. If one of the redundant Ascend unit units lost its dialout lines temporarily, it continued to receive outbound packets that should have been forwarded to the redundant Ascend unit. It is not necessary to use this feature if you have a single Ascend unit.

Usage: Specify one of the following values:

• Always (the default)

  Causes the Ascend unit to always advertise its IP routes. Use this setting unless you have redundant Ascend units or don't use dialout routes.

• When Trunks Up

  Causes the Ascend unit to stop advertising ("poison") its IP dialout routes if it temporarily loses the ability to dial out.

Agent Mode

Usage: Specify one of the following values.

• Disabled specifies that ATMP is not enabled.

  Disabled is the default.

• Home specifies that this unit is a home agent.

All Port Diagnostics

Usage:

• Select to enable the All Port Diagnostics privilege.

• Clear the check box to disable the All Port Diagnostics privilege.

  This is the default.

Allow as Client DNS

Usage:

• Select to enable use of client-specific DNS servers.

• Clear the check box to disable use of client-specific DNS servers.

  This is the default.

Allow dynamic address assignment for RADIUS-authenticated IP routing connections?

This applies only to RADIUS-authenticated connections in which the Ascend unit assigns an IP address from its IP address pool(s).

Usage:

• Select to send the address taken from pool #1 to the RADIUS server.

  The Framed-Address attribute in the Access-Request packet passes this IP address to the RADIUS server. If the RADIUS server allows access, it returns an Access-Accept packet that may or may not change the IP address as follows:

  • If the Framed-Address attribute in the Access-Accept packet is null, the Ascend unit requests that the caller accept the IP address derived from pool #1.

  • If the Framed-Address attribute in the Access-Accept packet contains a valid address different from the address from pool #1, the Ascend unit requests that the caller accept that address.

  • If the Ascend-Assign-IP-Pool attribute in the Access-Accept packet points to a pool other than pool #1, the Ascend unit gets an IP address from that pool and requests that the caller accept it.

  • If the server points to an empty pool, the Ascend unit tries to derive an address from the next available pool.

  • If pool #1 is not defined or empty, the Ascend unit sends a null Framed-Address to RADIUS; the Ascend RADIUS daemon ignores the Framed-Address attribute in access requests.

• Clear (the default) to not send the address assignment to the RADIUS server.

• This settings only applies if Assign Addresses is selected, Server Type is set to RADIUS or RADIUS/LOGOUT, and IP routing is enabled for the connection.

• The Pool Start and Pool Count settings in the Answer WAN options tab, or the RADIUS Ascend-IP-Pool-Define attribute, set up the range of addresses available in the pool.

• This setting requires a specially modified RADIUS daemon.

Allow only approved SNMP managers listed below

Using the Read Access Manager settings, you can restrict use of the SNMP get and get-next commands by specifying Read access for up to five addresses. In addition, using the Read-Write Manager settings, you can restrict use of the SNMP set command by specifying Read/Write access for up to five addresses.

The Ascend unit checks the version and community strings before making source IP address comparisons. The Security setting does not affect those checks.

Usage:

• Select to enable SNMP security.

  SNMP security instructs the Ascend unit that a comparison of source IP addresses must be made before SNMP commands may be executed from a manager station.

• Clear the check box to disable SNMP security.

  This is the default.

Allow Operations

Note: When the Allow Operations privilege is disabled, all other privileges are not applicable. We recommend that you disable this privilege in the Default Security profile.

Usage:

• Select to enable the Allow Operations privilege.

• Clear the check box to disable the Allow Operations privilege.

  This is the default.

Allow Telnet sessions

Usage:

• Select to allow terminal server users TELNET functionality.

• Clear the check box to prevent terminal server users from using TELNET.

  This is the default.

Always Spoof

Usage:

• Select to configure the Ascend unit to respond to repeated requests from the same MAC address).

• Clear the check box to configure the Ascend unit to ignore all but the first request.

  This is the default.

AppleTalk Router

Usage: Specify one of the following values:

• Seed

  There must be at least one seed router on a routed AppleTalk network. Seed routers communicate with other routers on the network to verify that their configuration is correct. Nonseed router communicate with seed routers to get their configuration. A Ascend unit can seed up to 32 zones.

• Non-seed router

  A non-seed router learns network number and zone information from other routers.

• Off (the default)

Area ID

Usage: Specify an area ID in dotted-decimal format. The default 0.0.0.0 represents the backbone network.

Dependencies: We recommend that you configure the local and WAN interfaces in the same area.

Area Type

The backbone area is special and always has the area number 0.0.0.0. Other areas are assigned area numbers that are unique within the autonomous system.

Note: You must set the area-type consistently on all OSPF routers within the area.

Usage: Specify one of the following values:

• Normal (the default).

  In a normal OSPF area, the router maintains information about external routes.

• Stub

  For areas that are connected only to the backbone by one ABR (that is, the area has one exit point), there is no need to maintain information about external routes. To reduce the cost of routing, OSPF supports sub areas, in which all external routes are summarized by a default route. Stub areas are similar to regular areas except that the routers do not enter external routes in the area's databases.

• StubNoDefault

  To prevent external routes from being flooded throughout the AS, you can configure areas as a stub when there is a single exit point from the area, or when the choice of exit point need not be made on a per-external-destination basis. You may need to specify a stub area with no default cost (StubNoDefault) if the area has more than one exit point.

ARP Proxy

Usage: Specify one of the following values.

• Always specifies that the Ascend unit responds to an ARP request regardless of whether a connection to the remote site is up.

• Inactive specifies that the Ascend unit responds to an ARP request only for a remote IP address specified in a Connection profile, and only if there is no connection to the remote site.

  The Ascend unit does not use a Connection profile on a RADIUS (Remote Authentication Dial In User Service) server for proxy ARP. RADIUS is a protocol by which users can have access to secure networks through a centrally managed server.

• Active specifies that the Ascend unit responds to an ARP request only if a connection to the remote site is up, regardless of whether a Connection profile exists for the link.

• Off disables proxy mode.

  Off is the default.

• Enabling Proxy Mode may prevent the Ascend unit from placing calls simply for address lookups.

ASE Tag

Usage: Specify a 32-bit hexadecimal number. The factory default is c0:00:00:00.

ASE Type

A Type-2 external metric is considered larger than any link state path. Use of type-2 external metrics assumes that routing between autonomous systems is the major cost of routing a packet, and eliminates the need for conversion of external costs to internal link-state metrics.

Usage: Specify Type-1 or Type-2.

Assign session keys to new entries

Usage:

• Select to assign session keys to all new session entries.

• Clear the check box to not assign session keys to all new session entries.

  This is the default.

ATMP Gateway

Usage:

• Select to enable the Ascend unit to send data it receives back from the home network on this connection to the mobile node.

• Clear the check box to disable this function.

Authentication

Usage: Specify one of the following values:

• None (the default) means the Ascend unit does not use an authentication protocol to validate incoming calls.

• PAP indicates the Password Authentication Protocol.

  PAP provides a simple method for a host to establish its identity in a two-way handshake. Authentication takes place only upon initial link establishment, and does not use encryption. The remote device must support PAP, and you must specify a password in the Send PW parameter.

• CHAP indicates the Challenge Handshake Authentication Protocol.

  CHAP is more secure than PAP. It provides a way to periodically verify the identity of a host using a three-way handshake and encryption. Authentication takes place upon initial link establishment; the Ascend unit can repeat the authentication process any time after the connection is made. The remote device must support CHAP, and you must specify a password in the Send PW parameter.

• PAP-TOKEN is an extension of PAP authentication.

  In PAP-TOKEN, the user making outgoing calls from the Ascend unit authenticates his or her identity by entering a password derived from a hardware device, such as a hand-held security card. The Ascend unit prompts the user for this password, possibly along with a challenge key. The NAS (Network Access Server) obtains the challenge key from a security server that it accesses through RADIUS.

  If you specify PAP-TOKEN-CHAP, you must enter a password in the Aux Send PW parameter; this password must match the password in the RADIUS entry for authenticating the call. If you do not enter identical passwords in the Aux Send PW parameter and the RADIUS entry, the Ascend unit cannot extend the MP+ call beyond a single channel.

• PAP-TOKEN-CHAP is PAP-TOKEN for the base channel with CHAP for subsequent channels.

  For multilink PPP calls where the answering unit requires security card authentication, PAP-TOKEN and PAP-TOKEN-CHAP begin identically when authenticating the first channel of an MP+ call. However, when the Ascend unit adds additional channels to the MP+ call, PAP-TOKEN requires security-card authentication for each new channel, while PAP-TOKEN-CHAP uses CHAP authentication for all new channels. CHAP authentication works automatically, without the use of a hand-held security card.

• CACHE-TOKEN begins authentication using a hand-held security card, and fills a token cache set up for you on the RADIUS server.

  CHAP authenticates your subsequent calls without using your hand-held security card. After a period of time configured in your entry in the RADIUS users file, the token cache expires and the next call you place must again be authenticated using your hand-held security card.

  If you request CACHE-TOKEN, the Send PW parameter must match the Ascend-Receive-Secret attribute in the RADIUS entry that authenticated the call. If you do not enter identical passwords in the Send PW parameter and Ascend-Receive-Secret attribute, CACHE-TOKEN calls are rejected after initial access through hand-held security card authentication.

Authentication Key

• For RADIUS, this is a string up to 22 characters. Because the Ascend unit can act both as a client to external servers and as an on-board server responding to client commands, this parameter is configured in two places for RADIUS.

• If the Ascend unit is acting as a TACACS or TACACS+ client, this is a password supplied by the Ascend unit to the server.

• If the Ascend unit is acting as a Defender client, this is a DES secret key shared between the Ascend unit and the Defender authentication server. This key is also used for authentication by the Ascend unit in its role as a Defender authentication agent.

• If the Ascend unit is acting as a SecurID client, this settings is not applicable. See SecurID DES Encryption and SecurID Node Secret for details.

Dependencies: This value of this setting depends on the setting of Server Type. If Sever Type is set to SECURID, Authentication Key is not applicable.

Authentication Key (OSPF)

Usage: Specify a string up to 9 characters for an OSPF auth-key.

Dependencies: Auth Key is not used if AuthType is None.

Authentication Type

Usage: Specify one of the following values:

• None

  Routing exchanges are not authenticated. The 64-bit authentication field in the OSPF header may contain data, but it is not examined on packet reception. When you use this setting, the Ascend unit performs a checksum on the entire contents of each OSPF packet (other than the 64-bit authentication field) to ensure against data corruption.

• Simple

  This setting requires that you specify a 64-bit field in the auth-key parameter. Each packet sent on a particular network must have the configured value in its OSPF header 64-bit authentication field. Simple is the default.

Automatically Update Local DNS Table

Usage:

• Select to enable automatic updating of the IP addresses in the local DNS table.

• Clear the check box to disable automatic updating.

  This is the default.

B

Banner

Usage: Specify the banner text. You can enter up to 84 alphanumeric characters. The default is ** Ascend Terminal Server **.

Dependencies: The Ascend unit ignores this setting if a RADIUS server supplies the login setup.

Become Default Router

Usage:

• Select to indicate the Ascend unit performing DHCP responses is the default router.

• Clear the check box to configure the Ascend unit not to advertise itself as the default router.

  This is the default.

Bit Error Rate

Usage: Specify one of the following values:

• 10^ -3 (the default)

• 10^-4

• 10^-5

Bridge Unrouted Packets

Usage:

• Select to globally enable bridging.

  When you choose this setting, the Ascend unit operates in promiscuous mode. The Ethernet controller in the Ascend unit accepts all packets and passes them up the protocol stack for a higher-level decision on whether to route, bridge, or reject them. This mode is appropriate if you are using the Ascend unit as a bridge.

• Clear the check box to globally disable bridging.

  This is the default.

  When you choose this setting, the Ethernet controller filters out all packets except broadcast packets and those explicitly addressed to the Ascend unit. This means that the Enable Bridging setting in the Connection and Answer tabs, and all settings exclusively associated with bridging, are not applicable.

  This mode significantly reduces processor and memory overhead when the Ascend unit is routing, and can result in much better performance, especially in moderate to heavily loaded networks.

• Do not confuse the Enable Bridging setting in the Answer and Connection tabs with the Bridge Unrouted Packets:

  • The Enable Bridging setting in the Answer tab applies only to connections that the Ascend unit answers.

  • The Enable Bridging setting in the Connection tab applies only to a specific connection.

  • The Bridge Unrouted Packets setting globally enables or disables bridging.

• Refer to Bridging/routing for more information about how the Ascend unit bridging and routing settings affect each other.

Buffer Characters

Usage:

• Select to enable character buffering.

• Clear the check box to disable character buffering.

  This is the default.

Buildout

Attenuation is a measure of the power lost on a transmission line or on a portion of that line. When you specify a value for Buildout, the Ascend unit applies attenuation to the T1 line, causing the line to lose power when the received signal is too strong. Repeaters boost the signal on a T1 line. If the Ascend unit is too close to a repeater, you may need to add some attenuation. Check with your carrier to determine the correct value.

Usage: Specify one of the following values:

• 0db (This is the default.)

• 7.5db

• 15db

• 22.5db

C

Call Filter

By default, any packet destined for the WAN causes the Ascend unit to place a call. In addition, by default, every packet resets the idle timer, the indicator that the Ascend unit uses to know when to clear a call. When you set up a call filter, only those packets that the call filter forwards can initiate a call or reset the Preempt or Idle Timeout settings in the Answer Options General tab.

Usage: Enter a number of from 0 to 199. The number you enter depends on the whether you are applying a filter you created using the Telnet interface, or a firewall you created using Secure Access Manager (SAM).

If you are applying a filter created using the Telnet interface, enter the last 2 digits of the filter number as it appears in the Filters menu. For example, if the filter number is 90-501, specify 1 in the Call Filter parameter.

If you are applying a firewall created with SAM, add 100 to the last 2 digits of the firewall number as it appears in the Firewalls menu. For example, if the number of your firewall is 90-601, specify 101 in the Call Filter parameter. Refer to your SAM documentation for information on downloading firewalls to the Ascend unit.

The numbering scheme for filters and firewalls is:

• 0 indicates that no filtering is being used (this is the default)

• 1-99 indicates that a filter created using the Telnet interface is being used

• 100-199 indicates that a filter created using SAM is being used.

Dependencies: Keep this additional information in mind:

• If all channels of a link are nailed up (Call Type is set to Nailed in the Connection profile), the Call Placement Filter setting does not apply in both the Answer and Connection profiles.

• The Ascend unit applies a call filter after applying a data filter; only those packets that the data filter forwards can reach the call filter.

• If client bridging is in use (if Discard Rip, SAP in the Connection profile IPX Options tab is set to Client), set the Call Placement Filter to 0 (zero).

• Call Placement Filter in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its Call Placement Filter setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, Call Placement Filter does not apply in the Answer profile.

Call Type (Frame Relay)

Usage: Specify one of the following values:

• Nailed: Specifies a link that consists entirely of nailed-up channels. The Nailed setting is the default.

  For nailed links, you must use the Nailed Group setting to specify which channels are in the connection.

• Switched: Specifies a link that consists entirely of switched channels.

  For a Frame Relay connection, you must specify the Switched setting if the Ascend unit always initiates the connection to the frame relay switch; if a device at the remote end of the link initiates bridging or routing sessions, do not choose Switched.

  If you choose Switched, you must specify the bandwidth of the switched connection in the Data Service setting of the Frame Relay tab.

• The Nailed Group setting does not apply when the Call Type is set to Switched.

Circuit Name

A circuit is a permanent virtual circuit (PVC) segment that consists of two DLCI end points and possibly two Frame Relay profiles. It requires two and only two DLCI numbers: data is dropped if the circuit has only one DLCI and if more than two are defined, only two are used. Circuits are defined in two Connection profiles. Data coming in on the DLCI configured in the first Connection profile is switched to the DLCI configured in the second one.

Usage: Specify a name for the circuit, up to 16 characters. The other end-point of the PVC must specify the same name in its Circuit configuration.

Dependencies: This parameter applies only to FR_CIR-encapsulated calls.

Clear Call

Usage:

• Select to clear the call when an interactive login terminates.

• Clear the check box to configure the Ascend unit to return Telnet, rlogin, or TCP session users to the terminal server when their session terminates.

Clear screen each session

Usage:

• Select to configure the Ascend unit to clear the screen.

• Clear the check box to configure the Ascend unit not to clear the screen.

  This is the default.

Client #

Usage: Enter an IP address in dotted decimal notation. The default is 0.0.0.0. To specify that the RADIUS server can accept requests from any client, enter 255.255.255.255. A value of 0.0.0.0 disables the associated client field. At least one of the fields must contain an IP address other than 0.0.0.0 for the server to be active.

Dependencies: If the RADIUS server is not enabled, this setting does not apply.

Client Gateway

Note: The Ascend unit must have a direct route to the address you specify.

Usage: Specify the IP address of a next-hop router. The default value is 0.0.0.0; if you accept this value, the Ascend unit routes packets as specified in the routing table, using the system- wide default route if it cannot find a more specific route.

Clock Source

Note: Selecting this parameter means the specified line is eligible to be the master clock source. If more than one line is eligible, the first line to synchronize at startup is the master clock source.

Usage:

• Select to enable this line to be a possible master clock source.

  This is the default.

• Clear the check box to remove this line as a possible master clock source.

Command Prompt

Usage: Specify a string to be used as a prompt. You can specify up to 15 characters.

Community Name

Usage: Enter the community name. You can enter an alphanumeric string containing up to 31 characters. The default is [].

Dependencies: To turn off SNMP traps, leave the Community Name blank and set the address of the trap recipient to 0.0.0.0.

Comparison

Usage: Specify one of the following values:

• Don't Compare (don't make any comparison with the packet's destination port number). This is the default.

• Less Than (match destination ports that are less than the specified values).

• Equal (match destination ports that are equal to the specified values).

• Greater Than (match destination ports that are greater than the specified values).

• Not Equal (match destination ports that are not equal to the specified values).

Compress IP Header

Usage:

• Select to enable TCP/IP header (Van Jacobson) compression for both ends of the link.

  This is the default.

• Clear the check box TCP/IP header compression.

• Header Compression applies only to packets in TCP applications, such as Telnet.

• Turning on header compression is most effective in reducing overhead when the data portion of the packet is small.

Compression

Usage: Specify one of the following values:

• Stac turns on data compression.

  The Ascend unit applies the STACKER LZS compression/decompression algorithm.

• MS-Stac turns on Microsoft LZS Coherency Compression for Windows95, a proprietary compression scheme for Windows 95 only (not for Windows NT).

• None (the default) turns off data compression.

• Stacker LZS Compression (as defined in the Internet Draft of November 1995) and Microsoft LZS Coherency Compression for Windows 95 both use the same PPP option to indicate that their compression scheme is in use.

  Therefore, a router can have difficulty determining exactly which compression method a caller is requesting. Ascend units handle this ambiguity in the call by always using the compression scheme specified in the Connection profile; if there is no Connection profile, the Ascend unit uses the compression scheme specified in the Answer profile.

  If the caller requests MS-Stac and the profile does not specify MS-Stac compression, the connection seems to come up correctly, but no data is routed. If the profile is configured with MS-Stac and the caller does not acknowledge that compression scheme, the Ascend unit attempts to use standard Stac compression. If it cannot use standard Stac compression, it uses no compression at all.

• Both sides of the link must support the same type of data compression in order for it to be used.

• Compression applies only if the link uses PPP encapsulation.

  When you choose MPP encapsulation, both the dialing side and the answering side of the link must support MP+. If only one side supports MP+, the connection uses MP or standard single-channel PPP. When you choose PPP encapsulation, the connection uses only PPP.

• The Compression setting in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its Compression setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, Compression does not apply in the Answer profile.

• If the link uses Combinet encapsulation, use the Compression setting to turn data compression on or off.

Connection Profile

Usage: Select the connection profile. None is the default; this setting specifies that no Connection profile can reach the destination.

You must select a value for this setting, because you should only advertise static routes that you can reach.

Dependencies: Keep this additional information in mind.

In an IPX Route profile, you must carry out these tasks if you want static IPX routes to appear in the route table:

• Enable IPX routing in the Connection profile.

• Configure IPX on the local Ethernet network using the Protocols > IPX tab.

Contact

Usage: Enter the name of the contact person or department. You can enter up to 80 characters. An SNMP management application can read this field, but the value you enter does not affect the operation of the Ascend unit.

Cost

Usage: Specify a number greater than zero. The default is 1.

D

Data Filter

Usage: Enter a number of from 0 to 199. The number you enter depends on the whether you are applying a filter you created using the Telnet interface, or a firewall you created using Secure Access Manager (SAM).

If you are applying a filter created using the Telnet interface, enter the last 2 digits of the filter number as it appears in the Filters menu. For example, if the filter number is 90-501, specify 1 for the Data Filter.

If you are applying a firewall created with SAM, add 100 to the last 2 digits of the firewall number as it appears in the Firewalls menu. For example, if the number of your firewall is 90-601, specify 101 for the Data Filter. Refer to your SAM documentation for information on downloading firewalls to the Ascend unit.

The numbering scheme for filters and firewalls is:

• 0 indicates that no filtering is being used (this is the default)

• 1-99 indicates that a filter created using the Telnet interface is being used

• 100-199 indicates that a filter created using SAM is being used.

Dependencies: Keep this additional information in mind:

• The Ascend unit applies a call filter after applying a data filter; only those packets that the data filter forwards can reach the call filter.

• If IPX client bridging is in use (Discard RIP, SAP is set to Client in the Connection tab), set the Data Filter parameter to 0 (zero).

• Do not confuse the Filter parameter with the Data Filter parameter.

  The Filter parameter filters data packets on the Ascend unit unit's local LAN interface; the Data Filter parameter filters data packets on the Ascend unit unit's WAN interface. The WAN interface is the port on the Ascend unit that is connected to a WAN line.

• Data Filter in the Answer profile applies to incoming calls for which no Connection
  profile exists; if a Connection profile exists, its Data Filter setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, Compression does not apply in the Answer profile.

Date

Dead Interval

Usage: Specify a number. In a Connection profile, the default is 120 seconds. In the Ethernet profile, the default is 40 seconds.

Default Server

Note: If you change the value of this parameter, the change does not take effect until the next time a connection is made to the remote network specified in the NAT Profile. To make the change immediately, you must terminate the connection to the remote network and then reopen it.

Usage: Press Enter to open a text field and then type the IP address.

The address consists of four numbers of from 0 to 255, separated by periods. Enter 0.0.0.0 to disable routing of packets to a default server.

The default value is 0.0.0.0.

Press Enter again to close the text field, press Esc to exit the menu, and then confirm the change when prompted.

Note: The change does not take effect until the next time the link is brought up. To make the change immediately, bring the link down and back up.

Dependencies: Keep this additional information in mind:

• For routing of packets from a remote network to occur, the Routing parameter in the NAT menu must be set to Yes and the Lan parameter in the NAT menu must be set to Single IP Addr. Parameters in Static Mapping nn menus (where nn is a number between 01 and 10) control whether the Ascend unit routes packets from a remote network for up to 10 different TCP or UDP ports to specific servers and ports on the local network.

  • The Dst Port# and Loc Port# parameters must be set to values other than 0.

  • The address can't be 0.

• If your local network has only one server that handles all incoming packets, you can specify the server by

  • setting this parameter to the address of the server.

  • setting the Valid parameter in each of the Static Mapping nn menus to No, which disables routing of incoming packets by their destination ports.

• If the Routing parameter in the NAT menu is set to No or the Lan parameter in the NAT menu is set to Multi IP Addr, this parameter is N/A.

Default to Telnet commands

Usage:

• Select to enable users to initiate Telnet sessions by typing a hostname without preceding the hostname with the command Telnet.

• Clear the check box to require users to type the command Telnet to initiate a Telnet session.

  This is the default.

Delay Between Messages

Usage: Enter a number of from 5 to 30. The default is 10.

Dependencies: Delay Between Messages applies only if Link Mgmt is set to T1.617D and Delay to wait for messages before recording an error is set to a nonzero value.

Delay to wait for messages before recording an error

Usage: Enter 0 (zero), or a number of from 5 to 30. The default is 15.

If you specify 0 (zero), the Ascend unit does not process WAN-side Status Enquiry messages. If you specify a nonzero value, the Ascend unit uses T1.617D (a link management protocol defined in ANSI T1.617 Annex D) to monitor another Ascend unit over a nailed-up connection.

Designated Router Priority

The designated router generates an LSA (link-state advertisement) for the network and has other responsibilities in the running of the protocol. Using a designated router requires fewer adjacencies on a broadcast network, reducing the amount of routing protocol traffic and the size of the link-state database.

Adjacency is a relationship formed between selected neighboring routers for the purpose of exchanging routing information. Not every pair of neighboring routers becomes an adjacent pair.

When two routers attached to a network attempt to become the designated router, the one with the highest Priority value takes precedence. A router whose Priority is set to 0 (zero) is ineligible to become the designated router on the attached network.

Usage: Enter a priority. The default value is 5.

Destination Address

Usage: Enter the IP address of the destination.

An IP address consists of four numbers of from 0 to 255, separated by periods. If a netmask is in use, you must specify it. Separate a netmask from the IP address with a slash. The Ascend unit ignores any digits in the IP address hidden by a netmask. For example, the address 200.207.23.1/24 becomes 200.207.23.0. To specify a route to a specific host, use a mask
of 32.

The default value is 0.0.0.0/0. This default specifies all destinations for which no other route exists.

Refer to IP addresses and netmasks for detailed information about Ascend unit IP addresses.

Dependencies: Keep this additional information in mind:

• If you do not know the right IP address to enter, you must obtain it from the network administrator.

  Do not attempt to configure an IP address by guesswork!

• The IP Address does not apply when the Ascend unit is using Combinet encapsulation (Encapsulation set to Combinet).

Destination Port #

Note: If you change the value of this parameter or of any of the other parameters in a Static Mapping nn menu, the change does not take effect until the next time a connection is made to the remote network specified in the NAT Profile. To make the change immediately, you must terminate the connection to the remote network and then reopen it.

Usage: Press Enter to open a text field and then type the port number.

Enter a port number of from 1 to 65535.

Press Enter again to close the text field, press Esc to exit the menu, and then confirm the change when prompted.

Note: The change does not take effect until the next time the link is brought up. To make the change immediately, bring the link down and back up.

Dependencies: Keep this additional information in mind:

• For routing of incoming packets for a particular port to occur, the Routing parameter in the NAT menu must be set to Yes, the Lan parameter in the NAT menu must be set to Single IP Addr, the Valid parameter in the same Static Mapping nn menu must be set to Yes, and other parameters in the same Static Mapping nn menu must be set to non-null values:

  • The Loc Port# parameter must be set to a value other than 0.

  • The Loc Adrs parameter must be set to an address other than 0.0.0.0.

  If you enter 0 as the value of this parameter, you receive the message Invalid Input: Zero input is not Valid.

• The Protocol parameter in the same Static Mapping nn menu determines whether the port you specify is a TCP or UDP port.

• If the Routing parameter in the NAT menu is set to No or the Lan parameter in the NAT menu is set to Multi IP Addr, this parameter is N/A.

Detect End of Packet

Usage:

• Select to enable logical packet detection, which is controlled by the pattern given in the End Of Packet Pattern parameter.

• Clear the check box to disable logical packet detection.

  This is the default.

Dial If Link is Down

Usage:

• Select to have the Ascend unit always dial the first Connection Profile (when the WAN link is down) whenever a DHCP client requests needs a response.

• Clearing the check box configures the Ascend unit to respond to DHCP client requests according to settings already in place in the environment, such as according to the current TCP/IP settings, or settings for any other network management software in use.

  This is the default.

Dial-in Password

Usage: Press Enter to open a text field. Then, type a password of up to 20 characters The password is case sensitive. Press Enter again to close the text field.

The default is null.

Dependencies: Keep this additional information in mind:

• You must specify a value for the Dial-in Password when the link uses PPP encapsulation (Encapsulation is set to PPP or MPP) and the Ascend unit uses PAP, CHAP, or CACHE-TOKEN authentication (Authentication is set to PAP, CHAP, or CACHE-TOKEN).

  When you choose MPP Encapsulation, both the dialing side and the answering side of the link must support MP+. If only one side supports MP+, the connection uses MP or standard single-channel PPP. When you choose PPP Encapsulation, the connection uses only PPP.

Dial Out Connection

Usage: Specify the Connection profile used to bring up the link to the remote bridged segment.

Dependencies: The specified Connection profile must not enable Dial On Broadcast.

Dial-out Password

Usage: Enter the password that the remote end requires the Ascend unit to send. You can enter up to 20 characters; the password is case sensitive. Leave the field blank if the remote end does not require a password.

Dependencies: Keep this additional information in mind:

• You must specify a value for the Dial Out Password when the link uses PPP encapsulation (Encapsulation is set to PPP or MPP) and the Ascend unit uses PAP, CHAP, or CACHE-TOKEN authentication (Authentication is set to PAP, CHAP, or CACHE-TOKEN).

  When you choose MPP Encapsulation, both the dialing side and the answering side of the link must support MP+. If only one side supports MP+, the connection uses MP or standard single-channel PPP. When you choose PPP Encapsulation, the connection uses only PPP.

• You must specify a value for the Dial Out Password when the link uses Combinet bridging (Encapsulation is set to COMB) and the Answer profile specifies that a password is required (Password Required is selected).

  Use only lowercase letters for the password in this instance.

Disconnect on Authentication Timeout

Because the Pipeline 220 does not support external authentication, this parameter is not applicable.

Usage:

• Select to specify that the Ascend unit not shut down cleanly, but simply hang up a PPP connection on a RADIUS timeout.

• Clear the check box to specify that the Ascend unit shuts down a call gracefully on a RADIUS timeout.

  This is the default.

DLCI

The Ascend unit receives an incoming PPP call, examines the destination address, and brings up the appropriate Connection profile to that destination, as usual. If the Connection profile specifies frame-relay encapsulation, the Frame Relay profile, and a DLCI, the Ascend unit encapsulates the packets in frame relay (RFC 1490) and forwards the data stream out to the frame relay switch using the specified DLCI. The frame relay switch uses the DLCI to route the frames. This is known as gateway mode.

Usage: Specify a number between 16 and 991. The default is 16. Ask your frame relay network administrator for the value you should enter.

Dependencies: This parameter applies only to FR and FR_CIR encapsulated calls.

Domain Name

Usage: Enter the domain name of the Ascend unit.

Down Cost

Usage: Specify a number greater than 0 and less than 16777215. The default is 16777215.

Down Metric

Usage: Specify a number of from 1 to 15. The default setting is 7. The higher the number you specify, the less likely that the Ascend unit will bring the link or route on-line.

Download

Usage:

• Select to enable the Download privilege.

• Clear the check box to disable the Download privilege.

  This is the default.

E

Edit Host Information

Usage: Specify a number from 1 to 6.

Edit Line

Usage:

• Select to enable the Edit Line privilege.

• Clear the check box to disable the Edit Line privilege.

  This is the default.

Edit Security

Note: This is the most powerful individual privilege you can assign, because it allows users to change their own privileges at will.

Caution: Do not disable this privilege in all Security profiles. If you do, you will be unable to edit any of them.

Usage:

• Select to enable the Edit Security privilege.

• Clear the check box to disable the Edit Security privilege.

  This is the default.

Edit System

Usage:

• Select to enable the Edit System privilege.

• Clear the check box to disable the Edit System privilege.

  This is the default.

Enable APP Server

Usage:

• Select to configure the Ascend unit to respond to password challenges used by the APP Server utility.

• Clear the check box to disable responses to the APP Server utility.

  Use this setting to authenticate calls through the terminal server. This is the default.

• You must set Authentication in the Dial-out options of a Connection profile to PAP-Token for the APP Server parameter to have any effect.

• The APP Server utility must be running on a UNIX or Windows workstation on the local network.

Enable AppleTalk

Usage:

• Select to enable AppleTalk routing.

• Clear the check box to disable AppleTalk routing.

  This is the default.

Enable ASBR

Usage:

• Select to configure the Ascend unit to perform normal operations related to external routes.

  This is the default and should be used for most installations.

• Clear the check box to configure the Ascend unit not to perform the standard ASBR calculations.

Enable BOOTP Relay

Usage:

• Select to configure the Ascend unit to forward BOOTP requests.

• Clear the check box to configure the Ascend unit not to forward BOOTP requests.

  This is the default.

• You must use the Server settings to specify the address of at least one BOOTP server. If you specify two BOOTP servers, the Ascend unit that forwards the BOOTP request determines when each server is used. Assigning a BOOTP server as Server 1 does not necessarily mean that server is tried first.

• For the BOOTP relay feature to work, DHCP Spoofing must be disabled.

Enable Bridging

Usage:

• Select to enable bridging.

• Clear the check box to disable bridging.

  This is the default.

Additional Dependencies:

• Bridging must be enabled on both the dialing and answering sides of the link.

  The Connection profile on the dialing side and the Answer profile on the answering side must both enable. Otherwise, the Ascend unit does not bridge the packets.

• The Enable Bridging settings in the Answer or Connection profiles do not apply if you turn off bridging in the Routing tab.

• You must enable bridging if the Connection profile specifies that the link is using the Combinet encapsulation method.

• The Enable Bridging setting in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its Enable Bridging setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, you must set enable bridging in the answering Connection profile.

• Do not confuse the Enable Bridging settings in the Answer and Connections profiles and the Bridge Unrouted Packets setting in the Protocols tab.

  • The Enable Bridging setting in the Answer profile applies only to connections that the Ascend unit answers.

  • The Enable Bridging setting in the Connection profile applies only to a specific connection.

  • The Bridge Unrouted Packets setting in the Protocols tab globally enables or disables bridging.

Enable Client DNS

Usage:

• Select to configure the Ascend unit to use client DNS servers for this connection.

• Clear the check box to configure the Ascend unit not to use client DNS servers for this connection.

  This is the default.

Enable DHCP PNP

Usage:

• Select to enable DHCP PNP.

  This is the default.

• Clear the check box to disable DHCP PNP.

Enable DHCP Spoofing

When card-based security is used, the user must interact with the Ascend unit to provide the card-based password. This interaction must occur over IP. However, the user doesn't have an IP address yet at the time when the password must be supplied.

To solve this "which came first" problem, the Ascend unit supports DHCP spoofing. DHCP spoofing works like this:

1. If there is no authenticated dial-up session and the Ascend unit receives a DHCP Discover packet, it responds with a DHCP Offer packet containing the configured IP address, netmask, and renewal time. This is quickly verified by an exchange between the client and the Ascend unit. The renewal time is limited to a few seconds to ensure that the computer gets its real address from the remote DHCP server as soon as possible.

2. The APP Server utility runs using only broadcast addresses, so that the Ascend unit does not need a real IP address and the temporary "spoofed" address is not relied upon.

3. As soon as an authenticated dial-up link exists, the Ascend unit refused to renew the spoofed address, forcing the computer to get its real address from the remote DHCP server.

• Select to enable DHCP spoofing.

• Clear the check box to disable DHCP spoofing.

  This is the default.

Enable Idle Logout

Usage:

• Specify a value of from 0 to 60. The default setting is 0 which disables automatic logout.

Enable IP Routing

Usage:

• Select to enable IP routing.

  This is the default.

• Clear the check box to disable IP routing.

• IP routing must be enabled on both the dialing and answering sides of the link.

  The Connection profile on the dialing side and the Answer profile on the answering side must both enable IP routing. Otherwise, the Ascend unit does not route IP packets.

• IP routing does not apply if the link uses Combinet encapsulation.

• The Enable IP Routing setting in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, the setting of its Enable IP Routing setting takes precedence.

• If Require Connection Profile is enabled in the Answer profile, Enable IP Routing does not apply in the Answer profile.

• For further information about bridging and routing dependencies on the Ascend unit, see Bridging/routing.

Enable List Attempts

DNS can return multiple addresses for a hostname in response to a DNS query. Unfortunately, DNS has no information about the availability of those hosts. Users typically attempt to access the first address in the list. If that host is unavailable, the connection fails and the user must initiate a new DNS query or Telnet attempt. If the login attempt occurs automatically as part of Immediate Telnet, the Ascend unit tears down the physical connection when the initial connection attempt fails.

The DNS List Attempt feature helps the Ascend unit avoid tearing down physical links by enabling the user to try one entry in the DNS list of hosts when logging in through Telnet from the terminal server or Immediate Telnet; if that connection fails, the user can try each succeeding entry.

Usage:

• Select to specify that the Ascend unit enables a user to try the next host in the DNS list if the first Telnet login attempt fails.

• Clear the check box to turn off the List Attempt feature.

  This is the default.

Enable NAT Routing

Usage:

• Select to enable NAT routing.

• Clear the check box to disable NAT routing.

  This is the default.

Enable On-Board RADIUS Server

Usage:

• Select to enable RADIUS server support.

• Clear the check box to disable RADIUS server support.

  When cleared, all other settings in the RADIUS tab are not applicable. This is the default.

Enable OSPF

Usage:

• Select to enable OSPF routing on the interface.

  Note: There is currently no spoofing for running active OSPF over dial-on-demand links, so periodic OSPF traffic will bring up the link almost continuously. OSPF is meant to run on nailed connections.

• Clear the check box to disable OSPF routing on the interface.

  This is the default.

Enable Syslog

Usage:

• Select to configure the Ascend unit to send Syslog message updates.

• Clear the check box to configure the Ascend unit not to send Syslog message updates.

  This is the default.

Enable terminal server

Usage:

• Select to enable the Ascend unit to accept incoming terminal server calls.

• Clear the check box to disable establishment of incoming terminal server sessions.

Enabled

Usage:

• Select to activate the configured filter condition.

• Clear the check box to deactivate the filter condition.

  This is the default.

Encapsulation

You can choose one of the settings listed in Table 1.

Table 1 Encapsulation settings

Setting	Description
PPP	PPP (Point-to-Point Protocol) provides a standard means of encapsulating data packets over a single-channel WAN link that a Connection profile sets up. It ensures basic compatibility with non-Ascend devices. For this setting to work, both the dialing side and the answering side of the link must support PPP.
Frame Relay	Frame Relay.
TCP-CLEAR	TCP-CLEAR establishes raw TCP connection between the Ascend unit and the host specified by the Login Host setting. Login Port gives the port number of the application running between the host and the unit that dialed into the Ascend unit. Whenever a caller is matched against a Connection profile with Encapsulation is set to TCP-CLEAR, the Ascend unit opens a raw TCP session. Setting Encapsulation to TCP-CLEAR means that the call does not negotiate any encapsulation and rejects PPP, COMB, and all other encapsulations. Only calls to the terminal server are answered by this Connection profile. Note: TCP-CLEAR encapsulation on outgoing calls requires that you enable TCP-Clear in the Answer profile.

Dependencies: Keep this additional information in mind:

Encoding

Usage: Specify one of the following values:

• AMI - Alternate Mark Inversion

  This is the default.

• B8ZS - Bipolar 8-zero Substitution

Encryption

Usage:

• Select SecurID DES to use standard DES encryption.

• Select Native SecurID Encryption to use the native encryption provided by SecurID.

End Of Packet Pattern

Usage: Enter a maximum of 64 characters as the pattern the MAX compares with incoming WAN packets to determine the end of the packet. You can enter ASCII characters and other binary data using the backslash (\) as an escape mechanism. To insert a literal backslash in the pattern, you must escape it using two backslash characters (\\). You can mix ASCII and other binary data in the pattern.

Enter an octal value followed by two backslash characters. If your pattern includes literal ASCII characters 0 through 7, you can avoid confusion by padding your escaped octal value with leading zeros to force it to be 3 octal digits long. For example, \015 represents a carriage return. You can set a hexadecimal value by entering \x followed by a 1 to 2 digit hexadecimal number. For example, \x0D represents a carriage return. Other special escape sequences are:

Escape Sequence	Description	Value
\a	Alarm	7
\b	Backspace	8
\f	Form feed	12
\n	New line	10
\r	Carriage return	13
\t	Tab	9
\v	Vertical tab	11
\\	Backslash	92
\'	Apostrophe	44
\"	Double Quote	34
\?	Wildcard	Matches any single character

• a packet is matched with pattern specified in the End of Packet Pattern parameter.

• the time specified the Packet Flush Time parameter elapses

• the data stored in the buffer has reached the value set in Max Packet Length

Error Threshold

Usage: Enter a number of from 1 to 10. The default is 3.

Dependencies: Keep this additional information in mind:

• Error Threshold applies only if Link Mgmt is set to T1.617D.

• If you turn off the Ascend unit, disconnect its WAN connection, or deselect Active in the Frame Relay tab, the setting of Error Threshold multiplied by the setting of Polling Cycles indicates the time it takes the frame relay switch to declare an inactive state.

Ethernet Address

Usage: Specify the Ethernet address of a host on the remote network segment. The Ethernet Media Access Control (MAC) address is a six-byte hexadecimal number assigned by the Ethernet hardware manufacturer.

Dependencies: The Dial Out Connection parameter must specify a Connection profile.

Event Count

Usage: Enter a number of from 1 to 10. The default is 4.

Dependencies: Event Count applies only if Link Mgmt is set to T1.617D.

Exclusive Port Routing

• The number dialed does not match the Ans Number setting in a Port profile or an Ethernet profile.

• The channel on which the call arrives has one of these groups of settings:

  • Ch n Slot is set to 0 and Ch n Prt/Grp is set to 0 (for a T1 PRI line)

  • B1 Slot is set to 0, B2 Slot is set to 0, B1 Prt/Grp is set to 0, and B2 Prt/Grp is set to 0 (for an ISDN BRI line)

Usage:

• Select to specify that the Ascend unit does not route an incoming call to any available interface; in other words, the Ascend unit drops the call.

• Clear the check box to specify that the Ascend unit routes the incoming call to the first available interface.

  This is the default.

1. The Ascend unit checks the bearer capability of the call.

   If the incoming call is a voice call and your system has at least one digital modem, the Ascend unit assigns the call to the first available digital modem. If no digital modems are available, the Ascend unit rejects the call. If no digital modems are installed, the Ascend unit treats the call as a data call.

2. The Ascend unit checks the low-layer compatibility of the call.

   If the call is an asynchronous V.110 call, the Ascend unit routes the call to the first available V.110 port. If no V.110 ports are available or installed, the Ascend unit rejects the call.

3. The Ascend unit scans all serial host ports.

   If the Ascend unit finds a serial host port that can accept an incoming call, the Ascend unit routes the call to the host port. If the Ascend unit does not support host ports, it skips this step.

4. The Ascend unit routes the call to the first available HDLC (High Level Data Link Control) controller.

   A LAN port is physically represented by an HDLC controller. If no HDLC LAN controllers are available, or if the Ascend unit does not support LAN bridging and routing, the Ascend unit rejects the call.

External Authentication Required

Usage:

• Select to configure the Ascend unit to require a response from the authentication server.

  With this setting, the Ascend unit does not allow a user to connect when an authentication response times out. This is the default.

• Clear the check box to configure the Ascend unit not to require a response from the authentication server.

  If you choose this setting, the Ascend unit allows a user to connect when an authentication response times out. This setting assumes that a second level of authentication will take place.

F

Field Service

Usage:

• Select to enable the Field Service privilege.

• Clear the check box to disable the Field Service privilege.

  This is the default.

Filter Action:

Usage: Specify Discard Packet (the default) or Forward. If you specify Forward, the filter should specify packets you want to accept, rather than those you want to filter out.

Filter Name

Usage: Specify a name up to 16 characters long.

Formatted Login Prompt

Usage:

• Select to configure the Ascend unit to interpret carriage-return/line-feed and tab characters in the string specified as the Login Prompt.

• Clear the check box to configure the Ascend unit not to interpret the line feed/carriage return character or the tab character.

  This is the default.

Forward Type 20 Packets

Some applications (like NETBIOS) use IPX Type 20 packets to broadcast names over a network. By default, these broadcasts are not propagated over routed links (as Novell recommends) and are not forwarded over links that have less than 1 Mbps throughput.

However, some applications, like NetBIOS over IPX, will not work when they are an Ascend production as a router between Home and Work network.

Usage:

• Select to specify that the Ascend unit will propagate IPX type 20 packets.

• Clear the check box to configure the Ascend unit not to propagate IPX type 20 packets.

  This is the default.

• If the Ascend unit does not support IPX routing or if Route IPX is deselected, Handle type 20 is not applicable.

Frame Length

Usage: Specify an integer from 128 to 2048.

Framed Address Start

Usage: Specify Yes or No. The default is No.

• Select to send a second RADIUS Accounting Start record when the Framed-Address is assigned.

• Clear the check box to configure the Ascend unit not to send a second RADIUS Accounting Start record.

Frame Relay

Frame Relay Address

Usage: Press Enter to open a text field and then type the official IP address.

The address consists of four numbers of from 0 to 255, separated by periods. You must enter a valid IP address for the feature to work.

Dependencies: Keep this additional information in mind:

• In your connection profile, you must set Encaps=FR. For connection that do not use Frame Relay.

• The Routing parameter in the NAT menu must be set to Yes.

Framed Only

Usage:

• Select to reject incoming calls which use no framed protocol.

  Any caller establishing a terminal server session with the MAX is rejected.

• Clear the check box to accept incoming calls even if there is no framed protocol used.

  This is the default.

Framing Mode

Usage: Specify one of the following values:

• D4 -Superframe

  This format consists of 12 consecutive frames, separated by framing bits. The line cannot be using ISDN signaling with D4 framing; otherwise, false framing and Yellow Alarm emulation can result.

• ESF - Extended Superframe

  This format consists of 24 consecutive frames, separated by framing bits. The ISDN specification advises that you use ESF with ISDN D-channel signaling.

G

Gateway

Usage: Enter the IP address of the router.

An IP address consists of four numbers of from 0 to 255, separated by periods. The default value is 0.0.0.0. You must configure the network address of the destination station with the IP Address setting in the Connection profile; otherwise, the Ascend unit assumes that the router is on the same Ethernet interface.

Dependencies: Keep this additional information in mind:

• If you do not know the right IP address to enter, you must obtain it from the network administrator.

  Do not attempt to configure an IP address by guesswork!

• The Gateway setting does not apply when the Ascend unit is using Combinet encapsulation (Encapsulation is set to Combinet).

Generate UDP Checksums

Currently the Ascend unit uses UDP when generating queries and responses for the following protocols:

• ATMP

• SYSLOG

• DNS

• ECHOSERV

• RADIUS

• TACACS

• RIP

• SNTP

• TFTP

• Select to specify that the Ascend unit generates a UDP checksum when transmitting a UDP packet.

  Specify this setting if data integrity is of the highest concern for your environment, and having redundant checks is important; this setting is also appropriate if your UDP-based servers are located on the remote side of a WAN link that is prone to errors.

• Clear (the default) to specify that the Ascend unit does not generate a UDP checksum when transmitting a UDP packet.

  Accept this setting if you plan to use the data integrity guarantee of the Ethernet or PPP checksum only.

H

Hang up if dynamic address assignment is rejected

Usage:

• Select to require the calling station to accept an IP address it assigns from a pool.

  If the calling station rejects the assignment, the Ascend unit ends the call.

• Clear the check box to specify that the calling station can reject an IP address assignment and use its own IP address.

  This is the default.

Heartbeat Address

When it is running as a multicast forwarder, the Ascend unit is continually receiving multicast traffic. The heartbeat-monitoring feature enables the administrator to monitor possible connectivity problems by continuously polling for this traffic and generating an SNMP alarm trap if there is a traffic breakdown.

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify a multicast address to use for heartbeat monitoring.

Heartbeat Alarm Threshold

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Trap type: TRAP_ENTERPRISE
Code: TRAP_MULTICAST_TREE_BROKEN (19)
Arguments:
1) Multicast group address being monitored (4 bytes),
2) Source address of last heartbeat packet received (4 bytes)
3) Slot time interval configured in seconds (4 bytes),
4) Number of slots configured (4 bytes).
5) Total number of heartbeat packets received before the Ascend unit started sending SNMP Alarms (4bytes).

Heartbeat Port

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify a UDP port to use for heartbeat monitoring.

Heartbeat Slot Count

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify a number of seconds.

Heartbeat Slot Time

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify a number of seconds.

Heartbeat Source Address

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify an IP address.

Heartbeat Source Mask

Note: Heartbeat monitoring is optional. It is not required for multicast forwarding.

Usage: Specify a netmask.

Hello Interval

Usage: Specify a number. In a Connection profile, the default is 40 seconds. In the Ethernet profile, the default is 10 seconds.

High Bit Error Rate Alarm

The Ascend unit has an alarm relay whose contacts remain open on the back panel's alarm relay terminal block during normal operation. If you enable them, the alarm relay contacts close during loss of power, hardware failure, or a system reset. The High BER Alarm specifies whether the contacts also close when the bit-error rate exceeds the High BER setting.

Usage: Specify one of the following values:

• Select Disable Alarm to specify that the event is logged but no relay closure occurs when the bit-error rate exceeds the High BER value. This is the default.

• Select Alarm when the rate of bit errors per second exceeds: to specify that the back panel alarm relay closes when the bit-error rate exceeds the Bit Error Rate value you specify.

Home Agent Password

Usage: Enter up to 20 characters.

Dependencies: Keep this additional information in mind:

• If ATMP Mode is set to Disabled or ATMP Mode is set to Foreign, the Password setting does not apply.

Home Agent Type

Usage: Specify one of the following values.

• Yes specifies that the ATMP module attempts to send data to a mobile node.

• No specifies that the ATMP module does not attempt to send data to a mobile node.

  No is the default.

Hop Count

Usage: Enter a valid hop count from 1 to 15. A hop count of 16 is considered unreachable and is not valid for static routes.

Dependencies: For the Hop Count to apply, you must enable IPX routing in the Connection profile.

Host (accounting)

Usage: Enter the IP address of each RADIUS accounting server.

Dependencies: The Host settings do not apply when Accounting is set to None.

Host (accounting/connection profile)

Usage: Specify the IP address of an accounting server.

Hosts (authentication)

Note: The addresses must all point to hosts of the same type, as specified in the Server Type setting. If you are using Defender or SecurID authentication, only Host #1 is applicable, because the Ascend unit can access only one of those servers.

Usage: Specify an IP address in dotted-decimal format, separating the optional netmask with a slash character. The default value is 0.0.0.0; this setting indicates that no authentication server exists.

Dependencies: This parameter does not apply if authentication services are disabled.

Host Address (telnet)

Usage: Specify an IP address in dotted-decimal format. Separate the optional netmask from the address using a slash. The default value is 0.0.0.0.

Dependencies: The Ascend unit ignores this setting if a RADIUS server supplies the login setup.

Host Retries

Usage: Specify an integer. The default value is 3.

Dependencies: This setting does not apply unless Server Type specifies SECURID.

Host Text

Usage: Specify a text string for each host to be displayed in the terminal server menu.

Dependencies: The Ascend unit ignores this setting if a RADIUS server supplies the login setup.

I

ICMP Redirects

Usage: Specify one of the following values:

• Accept specifies that the Ascend unit processes incoming ICMP Redirect messages.

  Accept is the default.

• Ignore specifies that the Ascend unit drops all incoming ICMP Redirect messages.

ID Base

The Acct-Session-ID attribute is defined in section 5.5 of the RADIUS accounting specification. See the MAX RADIUS Configuration Guide for more information.

Note: Changing the value of the Acct-ID Base while accounting sessions are active results in inconsistent reporting between the Start and Stop records.

Usage: Specify one of the following values:

• 10 (decimal) specifies that the numeric base is 10. This is the default.

• 16 (hexadecimal) specifies that the numeric base is 16.

Ignore Default Route

Usage:

• Select to specify that the Ascend unit ignores updates to the default route.

• Clear the check box to specify that the Ascend unit allows updates to the default route.

  This is the default.

Include RADIUS attributes 6 and 7 in requests

Note: If this is not selected, the Ascend unit cannot differentiate between terminal server users, async PPP users that authenticate via the terminal server, and SLIP users that authenticate via the terminal server.

Usage:

• Select to specify that the Ascend unit sends RADIUS attributes 6 and 7 to the RADIUS Server in the authentication request. Use this setting if you want to control access to PPP and SLIP via the terminal server explicitly by the RADIUS response, or if you use a MERIT RADIUS server.

• Clear the check box to specify that the Ascend unit excludes attributes 6 and 7 from authentication requests.

Initial screen

Usage: Specify one of the following values:

• Command (the default) indicates the command-line interface.

• Menu indicates a menu that lists up to four Telnet hosts accessible to the interactive users.

Input Filters

Usage: Specify Input Filters or Output Filters. A list of individual filters of that type will appear below. To define an individual filter, select it in the list and click New or Edit.

Interface Address

Usage: Specify the IP address of the numbered interface.

Dependencies: This parameter does not apply if the Ascend unit does not route IP.

IP Address

Usage: Enter the IP address of a remote station or router; you can also specify a netmask.

Dependencies: Keep this additional information in mind:

• The IP Address setting on the local Ascend unit must be what the device on remote end of the link expects.

• No two calling Connection profiles should have the same IP Address.

• Setting IP Address to 0.0.0.0/0 and clearing the Station setting resets the Connection profile to its default values.

• The IP Address does not apply if the Connection profile does not have IP routing enabled.

• The IP Address does not apply when the Ascend unit is using Combinet encapsulation (Encapsulation is set to Combinet).

• If you do not know the right IP address to enter, you must obtain it from the network administrator.

IP Address (DHCP)

Usage: Enter the IP address and subnet mask for the host.

The address consists of four numbers between 0 and 255, separated by periods. Separate the subnet mask from the address with a slash. To assign an address, the IP address must be a valid IP address on the local Ethernet network. To disable address assignment, enter 0.0.0.0/0.

Dependencies: If the DHCP Spoofing and Always Spoof check boxes are not both selected, this parameter is not applicable. If you enter a value other than 0.0.0.0/0 for this parameter, you must enter a valid MAC address for the respective Host n Enet parameter. If you disable address assignment by entering 0.0.0.0/0 for this parameter, you must set the respective MAC address field to 000000000000.

IP Address Message

Usage: Specify a text string up to 20 characters. The default is IP address is:

Dependencies: IP Address message is not applicable when terminal services are disabled.

IP Gateway Message

Usage: Specify a a text message. You can enter up to 64 characters. The default is Gateway:

Dependencies: Keep this additional information in mind.

• IP Gateway Message does not apply unless you set SLIP Info to Advanced.

IP Group 1

Usage: Enter a number from 0 to 20.

Enter 0 if the IP Group 1 parameter is 0.0.0.0/0 (which disables address assignment from the pool) or if the IP Group 1 parameter specifies a DHCP spoof address. The default is 1.

Dependencies: If the DHCP Spoofing and Always Spoof check boxes are not both selected, this parameter does not apply. The IP Group 1 parameter specifies the first address in the pool. All the addresses in the pool must be on the same subnet, and the subnet must be on the local network. If you are specifying a pool, the value cannot be 0.

IP Group 2

Usage: Enter a number from 0 to 20.

Enter 0 if the IP Group 2 parameter is 0.0.0.0/0 (which disables address assignment from the pool) or if the IP Group 2 parameter specifies a DHCP spoof address. The default is 1.

Dependencies: If the DHCP Spoofing and Always Spoof check boxes are not both selected, this parameter does not apply. The IP Group 2 parameter specifies the first address in the pool. All the addresses in the pool must be on the same subnet, and the subnet must be on the local network. If you are specifying a pool, the value cannot be 0.

IP Netmask Message

Usage: Specify a a text message. You can enter up to 64 characters. The default is Netmask:

Dependencies: Keep this additional information in mind.

• IP Netmask Message does not apply unless you set SLIP Info to Advanced.

IPX Alias

You need to enter a value for this setting only if the Ascend unit operates with a non-Ascend router that uses a numbered interface. It does not apply if you are routing from one Ascend unit to another, or to a router that does not use a numbered interface.

Usage: Enter an appropriate network number. The default value is 00000000. FFFFFFFF is invalid.

Dependencies: For the IPX Alias to apply, you must enable IPX routing in the Connection profile.

IPX Bridging

Usage: Select one of the following values:

• None specifies that special IPX behavior does not take place.

  Choose this setting when the LAN on each side of the bridge has one or more IPX servers.

  None is the default.

• Client specifies that the Ascend unit discards RIP (Routing Information Protocol) and SAP (Service Advertising Protocol) periodic broadcasts at its WAN interface, but forwards RIP and SAP queries.

  The WAN interface is the port on the Ascend unit that is connected to a WAN line. RIP and SAP queries enable a client workstation to locate a NetWare server across the network. Choose this setting when both these conditions are true:

  • The local LAN has IPX clients but no servers.

  • The Ascend unit is acting as a bridge to another LAN containing only IPX servers or a combination of IPX servers and clients.

• Server specifies that the Ascend unit discards all RIP (Routing Information Protocol) and SAP (Service Advertising Protocol) periodic broadcasts and queries at its WAN interface.

  Server mode allows the Ascend unit to bring down calls during idle periods without breaking client-server or peer-to-peer connections.

  Ordinarily, when a NetWare server does not receive a reply to the watchdog session keepalive packets it sends to a client, it closes the connection. When you select Server mode, however, the Ascend unit replies to NCP watchdog requests on behalf of clients on the other side of the bridge; in other words, the Ascend unit tricks the server watchdog process into believing that the link is still active. This process is called watchdog spoofing.

  Choose this setting when both these conditions are true:

  • The Ascend unit is acting as a bridge to a remote LAN with IPX clients, but no servers.

  • The local LAN contains only IPX servers, or a combination of IPX clients and servers.

• If you select the Server setting, you must also specify a value for the NetWare t/o parameter, indicating the maximum length of idle time during which the Ascend unit performs watchdog spoofing for NetWare connections.

• If the connection does not bridge (Bridge=No), the Handle IPX parameter does not apply (Handle IPX= N/A).

• If the encapsulation for the connection is Frame Relay (Encaps=FR), the Handle IPX parameter does not apply (Handle IPX= N/A).

• If you have not specified an IPX frame type (IPX Frame=None), the Handle IPX parameter does not apply (Handle IPX=N/A).

• We highly recommend that you set Dial Brdcast=Yes when Handle IPX=Client, and Dial Brdcast=No when Handle IPX=Server.

  When a client on the local Ethernet interface sends out broadcast packets to locate a server, and the Ascend unit must bridge these packets to another network, the Ascend unit starts up a session for each Connection Profile in which Dial Brdcast=Yes. The server need not broadcast and then dial, so set Dial Brdcast=No to keep broadcast packets from causing the Ascend unit to dial automatically.

• If the Ascend unit on one LAN sets Handle IPX=Server and the LAN on the other side of the connection has only NetWare clients, the Ascend unit on the client-only LAN should set Handle IPX=Client.

  If both LANs contain servers, both sides of the connection should set Handle IPX=None.

• Although Handle IPX=N/A if Bridge=No or IPX Frame=None, the Ascend unit automatically performs watchdog spoofing just as though you had set Handle IPX=Server; however, the Ascend unit does not filter as though you had set Handle IPX=Server.

IPX Frame Type

IPX packets can appear in more than one Ethernet frame type on an Ethernet segment. If your Ascend unit routes IPX, it can recognize only a single IPX frame type. The Ascend unit does not route other IPX frame types, and may attempt to bridge them. In addition, the Ascend unit can only route and perform watchdog spoofing for the IPX frame type you specify here.

Usage: Specify one of the following values:

• 802.3 specifies the 802.3 frame type.

  This setting indicates that IPX clients and servers on the local Ethernet cable follow the IEEE 802.3 protocol for the MAC header, also called Raw 802.3. The frame does not contain the LLC (Logical Link Control) header in addition to the MAC (Media Access
  Control) header.

  For NetWare 3.11 or earlier, select 802.3.

• 802.2 specifies the 802.2 frame type.

  This setting indicates that the IPX clients and servers on the local Ethernet cable follow the IEEE 802.2 protocol for the MAC header. The framer contains the LLC (Logical Link Control) header in addition to the MAC (Media Access Control) header.

  For NetWare 3.12 or later, select 802.2.

  802.2 is the default.

• SNAP specifies the SNAP frame type.

  This setting indicates that the IPX clients and servers on the local Ethernet network follow the SNAP (SubNetwork Access Protocol) for the MAC header. This specification includes the IEEE 802.3 protocol format plus additional information in the MAC header.

• Enet II specifies the Ethernet II frame type.

  This setting indicates that IPX clients and servers on the local Ethernet network follow the Ethernet II protocol for the MAC header.

• None disables IPX-specific features.

  If you choose this setting, the Ascend unit can bridge or route IPX, but without watchdog spoofing or the automatic RIP (Routing Information Protocol) and SAP (Service Advertising Protocol) data filters described in Handle IPX.

• Select 802.3 if Frame is set to Ethernet_802.3.

• Select 802.2 if Frame is set to Ethernet_802.2.

• Select SNAP if Frame is set to Ethernet_SNAP.

• Select Enet II if Frame is set to Ethernet_II.

IPX Network #

Usage: Enter an Ethernet network number using an 8-digit (4-byte) hexadecimal value. Specify the network number of the router at the remote end of the connection only if the router requires that the Ascend unit know its network number before connecting. You almost never need to enter a value for the IPX Net#.

The default is 00000000. If you accept the default, the Connection profile is still valid, but the Ascend unit does not advertise the route until it makes a connection to the Ethernet network.

Dependencies: IPX Net# does not apply if IPX routing is not enabled in the Protocols tab.

IPX SAP Filter

• IPX SAP Input filters apply to all SAP packets that the Ascend unit receives.

  An Input filter screens advertised services and excludes them from its service table as specified in the filter.

• IPX SAP Output filters apply to SAP response packets that the Ascend unit transmits.

  If the Ascend unit receives a SAP request packet, it applies an Output filter before transmitting the SAP response, and excludes services from the response packet as specified in the filter.

J

K

K Window Size

Usage: Specify a number of from 2 to 7. The default is 7.

L

LAN Filter

Note: Ethernet #1 specifies the filter for the first ethernet interface. Ethernet #2 specifies the filter applied to the second ethernet interface.

Usage: Specify the name of the filter. The number you enter depends on the whether you are applying a filter you created using the vt100 interface, or a firewall you created using Secure Access Manager (SAM).

If you are applying a firewall created with SAM, add 100 to the last 2 digits of the firewall number as it appears in the Firewalls menu. For example, if the number of your firewall is 90-601, specify 101. Refer to your SAM documentation for information on downloading firewalls to the Ascend unit. The numbering scheme for filters and firewalls is:

• 0 indicates that no filtering is being used (this is the default)

• 1-99 indicates that a filter created using the vt100 interface is being used

• 100-199 indicates that a filter created using SAM is being used.

Length (filters)

Offset = 2
Length = 8
Mask = 0F FF FF FF 00 00 00 F0
Value = 07 FE 45 70 00 00 00 90
Filter Action = Discard Packet
When: Comparison matches

2A 31 97 FE 45 70 12 22 33 99 B4 80 75

Usage: Specify a number of from 0 to 8 (the number of bytes to test). The default value is 0, which means the Ascend unit does not compare packet contents, so all packets match the filter.

Link Quality Monitoring

LQM is a feature that enables the Ascend unit to monitor the quality of a link. LQM counts the number of packets sent across the link and periodically asks the remote end how many packets it has received. Discrepancies are evidence of packet loss and indicate link quality problems.

LQM causes the generation of periodic link quality reports. Both ends of the link exchange these reports.

Usage:

• Select to request LQM.

• Clear the check box not to request LQM.

  This is the default.

• Both sides of the link negotiate the interval between periodic link quality reports; however, the interval must fall between the minimum interval (as set by Minimum LQM) and the maximum interval (as set by Maximum LQM).

• If LQM is disabled, the Minimum LQM and Maximum LQM settings do not apply.

• LQM applies only if for PPP encapsulated calls.

• LQM in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its LQM setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, LQM does not apply in the Answer profile.

Link this condition to the next...

Usage:

• Select to link this specification to the one immediately following it.

• Clear the check box configure the Ascend unit to consider the specification alone.

  This is the default.

Link Type

Usage: You can specify one of the settings listed in Table 7.

Table 1 Link Type settings

Setting	Description
56K	The call contains any type of data and connects to the Switched-56 data service. The only services available to lines using inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are 56K and 56KR. For most T1 PRI lines, select 56K.
56KR	The call contains restricted data, guaranteeing that the data the Ascend unit transmits meets the density restrictions of D4-framed TI lines. D4 specifies the D4 format, also known as the Superframe format, for framing data at the physical layer. This format consists of 12 consecutive frames, separated by framing bits. The call connects to the Switched-56 data service. The only services available to lines using inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are 56K and 56KR.
64K	The call contains any type of data and connects to the Switched-64 data service.

Dependencies: Keep this additional information in mind:

• If Link Type is not set to Inherit in the Dial Plan profile, the setting in the Dial Plan profile overrides the settings in the Call profile and Connection profile.

• Data services above 64 kbps are not valid for a BONDING call (Call Type is set to BONDING).

• Because FT1 calls do not include switched services, the Link Type setting lists only 56KR and 64K when Call Type is set to FT1; in this context, the Link Type setting indicates how much bandwidth the Ascend unit routes to the host for each channel in the connection.

• When Call Type is set to FT1-B&O or Call Type is set to FT1-AIM, the Link Type setting refers to the switched channels.

• You can determine the base bandwidth of a call by multiplying the value of the Base Channels setting by the value of the Link Type setting.

• Either party can request a data service that is unavailable; in this case, the Ascend unit cannot connect the call.

Link Up

Usage:

• Select to specify that the datalink comes up automatically and stays up even when the last DLCI has been removed.

• Clear the check box to specify that the datalink does not come up unless a Connection profile (DLCI) brings it up, and it shuts down after the last DLCI has been removed.

  This is the default.

• If LinkUp is selected and you manually disconnect a Frame Relay link, it will be automatically restarted. The session will also be restarted if there is a DLCI profile invoking the datalink.

Local Address

Note: If you change the value of this parameter or of any of the other parameters in a Static Mapping nn menu, the change does not take effect until the next time a connection is made to the remote network specified in the NAT Profile. To make the change immediately, you must terminate the connection to the remote network and then reopen it.

Usage: Press Enter to open a text field and then type the IP address.

The address consists of four numbers of from 0 to 255, separated by periods. Enter 0.0.0.0 to disable routing of packets.

The default value is 0.0.0.0.

Press Enter again to close the text field, press Esc to exit the menu, and then confirm the change when prompted.

Note: The change does not take effect until the next time the link is brought up. To make the change immediately, bring the link down and back up.

Dependencies: Keep this additional information in mind:

• For routing of incoming packets for a particular port to occur, the Routing parameter in the NAT menu must be set to Yes, the Lan parameter in the NAT menu must be set to Single IP Addr, the Valid parameter in the same Static Mapping nn menu must be set to Yes, and other parameters in the same Static Mapping nn menu must be set to non-null values:

  • Dst Port# and Loc Port# parameters must be set to values other than 0.

  If you enter 0 as the value of this parameter, you receive the message Invalid Input: Zero input is not Valid.

• If the Routing parameter in the NAT menu is set to No or the Lan parameter in the NAT menu is set to Multi IP Addr, this parameter is N/A.

Local DNS Table

Usage:

• Select to enable the local DNS table.

• Clear the check box to disable use of a local DNS table.

  This is the default.

Local Echo

Usage:

• Select to enable local echo.

• Clear the check box to disable local echo.

  This is the default.

Local Host

Usage: Enter the IP address of the authentication server.

Dependencies: Keep this additional information in mind:

• LocalHost applies only to outgoing calls using security card authentication.

• You must set Authentication in the Dial-out options of a Connection profile to PAP-Token and select Server for this setting to have to have any effect.

• The APP Server utility must be running on a UNIX or Windows workstation on the local network.

Local Port

Note: If you change the value of this parameter or of any of the other parameters in a Static Mapping nn menu, the change does not take effect until the next time a connection is made to the remote network specified in the NAT Profile. To make the change immediately, you must terminate the connection to the remote network and then reopen it.

Usage: Press Enter to open a text field and then type the port number.

Enter a port number of from 1 to 65535, or enter 0 to disable routing of packets. 0 is the default.

Press Enter again to close the text field, press Esc to exit the menu, and then confirm the change when prompted.

Note: The change does not take effect until the next time the link is brought up. To make the change immediately, bring the link down and back up.

Dependencies: Keep this additional information in mind:

• For routing of incoming packets for a particular port to occur, the Routing parameter in the NAT menu must be set to Yes, the Lan parameter in the NAT menu must be set to Single IP Addr, the Valid parameter in the same Static Mapping nn menu must be set to Yes, and other parameters in the same Static Mapping nn menu must be set to non-null values:

  • The Dst Port# parameter must be set to a value other than 0.

  • The Loc Adrs parameter must be set to an address other than 0.0.0.0.

  If you enter 0.0.0.0 as the value of this parameter, you receive the message Invalid Input: Zero input is not Valid.

• The Protocol parameter in the same Static Mapping nn menu determines whether the port you specify is a TCP or UDP port.

• If the Routing parameter in the NAT menu is set to No or the Lan parameter in the NAT menu is set to Multi IP Addr, this parameter is N/A.

• You cannot specify the same server and port in more than one Static Mapping nn menu.

Local UDP Port

Usage: Enter the UDP port number. Valid port numbers range from 0 to 65535. For ATMP the default value is 0 (zero); this setting indicates that this unit is not monitoring a UDP port.

Dependencies: Keep this additional information in mind:

• If ATMP Mode is set to Disabled, the UDP Port setting does not apply.

Location

Usage: Enter a description of the Ascend unit unit's location. You can enter up to 80 characters. An SNMP management application can read this field, but the value you enter does not affect the operation of the Ascend unit.

Log Call Information

• Station name

• Calling phone number

• Called phone number

• Encapsulation protocol

• Data rate (in bits per second)

• Progress code or disconnect reason

• Number of seconds before authentication

• Number of bytes or packets received during authentication

• Number of bytes or packets sent during authentication

• Length of session (in seconds)

• Number of bytes or packets received during the session

• Number of bytes or packets sent during the session

Usage: To specify that this information in recorded by syslog, select End of call. To specify that this information is not sent at all, specify Do not log calls (the default).

If some of the information is not available, that field is displayed as either a question-mark (for strings) or a zero (for numerals).

Note: Use Log Call Information only for diagnosing session problems. The use of the underlying UDP protocol provides no guaranteed delivery. Therefore, you should not use Log Call Information for billing purposes.

Log Facility Code

Usage: Specify one of the following values:

• LOG0 (the default)

• LOG1

• LOG2

• LOG3

• LOG4

• LOG5

• LOG6

• LOG7

Log Host

Usage: Specify the IP address of a UNIX syslog server.

Syslog Enabled must be checked or this parameter is not applicable

Login Host

Usage: Specify the IP address or hostname of the device.

Login Port

Usage: Specify the TCP port number on the login host. You can specify a value between 1 and 65535. The default is 1.

Login Prompt

Usage: Specify up to 15 characters. The default is "Login:".

Login Timeout

Usage: Specify between 0 and 300 seconds. The default is 300. A zero value disables the timer.

Dependencies: This parameter does not apply if terminal services are disabled.

M

MAC address

Usage: Enter the MAC address of the host's Ethernet interface. To disable address assignment, enter 000000000000.

Dependencies: If the DHCP Spoofing and Always Spoof check boxes are not both selected, this parameter is not applicable. If you enter a value other than 000000000000 for this parameter, you must enter a valid IP address for the respective Host n IP parameter. If you disable address assignment by entering 000000000000 for this parameter, you must set the respective IP address field to 0.0.0.0/0.

Management Protocol

Usage: Specify one of the following values:

• None specifies no link management.

  The Ascend unit assumes that the physical link is up and that all logical links (as defined by the DLCI and FR DLCI settings) are active on the physical link.

  None is the default.

• T1.617D specifies the link management protocol defined in ANSI T1.617 Annex D.

  Ask your service provider whether you should specify T1.617D.

• Q.933A the link management protocol defined Q.933 Annex A.

  Ask your service provider whether you should specify Q.933A.

Manager N (Read Access)

Usage: Enter the IP address of a host running an SNMP manager. The default value is 0.0.0.0; this setting indicates no host.

Dependencies: SNMP security must be enabled for the Manager settings to have any effect. If SNMP security is enabled, only SNMP managers at the IP addresses you specify can execute the SNMP get and get-next commands.

Manager N (Read-Write Access)

Usage: Enter the IP address of a host running an SNMP manager. The default setting is 0.0.0.0; this setting indicates no host.

Dependencies: SNMP security must be enabled for Manager settings to have any effect. If SNMP security is enabled, only SNMP managers at the IP addresses you specify can execute the SNMP set command.

Mask (filters/address)

The Ascend unit applies the mask to the address using a logical AND after the mask and address are both translated into binary format. The mask hides the portion of the address that appears behind each binary 0 (zero) in the mask. A mask of all zeros (the default) masks all bits, so all addresses are matched. A mask of all ones (255.255.255.255) masks no bits, so the full address to a single host is matched.

Usage: Specify a mask in IP netmask (dotted-decimal) format. The default is 0.0.0.0.

Match only established TCP connections

Usage:

• Select to configure the Ascend unit to consider, for this filter condition, only packets that are part of established TCP connections.

• Clear the check box to configure the Ascend unit to consider all packets for this filter condition.

Max Packet Length

Usage: Enter a value of from 1 to 8192. If End Of Packet Detection=Yes and a packet has not been matched, the buffered data is flushed to TCP once the number of bytes specified in Max Packet Length is cleared.

Dependencies: Max Packet Length does not apply except when Encaps=TCP-CLEAR in the Connection profile. Buffering a large packet size will impact the overall performance of the system, and may run the risk of running out of memory.

Max PPP Packet

Usage: The default setting is 1524; you should accept this default unless the device at the remote end of the link cannot support it.

If the administrator of the remote network specifies that you must change this value, type a number of from 1 to 1524. For a Frame Relay profile, type a value of from 128 to 1600.

Dependencies: Keep this additional information in mind:

• The MRU setting applies to any link using PPP encapsulation.

  When you choose MPP encapsulation, both the dialing side and the answering side of the link must support MP+. If only one side supports MP+, the connection uses MP or standard single-channel PPP. When you choose PPP encapsulation, the connection uses only PPP.

• MRU in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its MRU setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, MRU does not apply in the Answer profile.

Maximum ATMP Tunnels

Usage: Specify an integer. The default is 0 (zero). If you accept the default, the unit does not enforce a limit.

Dependencies: This parameter is not applicable unless the Ascend unit is configured as an ATMP home agent in gateway mode.

Maximum Period

Usage: Enter a number of from 0 to 600. The default is 600.

Dependencies: Keep this additional information in mind:

• If Link Quality Monitoring is disabled, the Maximum LQM does not apply.

• Maximum LQM in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its Maximum LQM setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, Maximum LQM does not apply in the Answer profile.

Mbone Profile

Usage: Enter the name of the Connection profile to the MBONE interface. If no name is specified, the Ascend unit assumes the presence of a multicast router on its Ethernet interface.

Dependencies: Keep this additional information in mind:

• This is available only in the IP-only release for the Ascend unit 4000 (load mhpt1bip.bin).

• MBone Profile is not available if Multicast Forwarding is disabled.

• The specified Connection profile must be resident. (It cannot be accessed via a RADIUS or TACACS server.)

Member Timeout

Usage: Specify a value from 60 seconds to 65535 seconds. The default is 3600 seconds (six minutes).

Dependencies: This parameter is not applicable unless Multicast Forwarding is enabled.

Metric

The specified metric is a virtual hop count. The actual hop count includes the metric of each switched link in the route.

If two routes have the same preference value, the Ascend unit chooses the route with the lowest metric. If you enable RIP (Routing Information Protocol) across the WAN in a Connection profile or an Answer profile, the hop count for the route can differ from the value of the Metric parameter in the Route profile because the Ascend unit always uses the lower hop count.

Usage: Press Specify a number of from 1 to 15. The default setting is 7. The higher the number you specify, the less likely that the Ascend unit will bring the link or route on-line.

Dependencies: Keep this additional information in mind:

• The Metric setting in an Answer profile or a Connection profile does not apply to bridged connections, such as Combinet links (for which Encapsulation is set to COMB).

• In the Answer profile, the Metric setting does not apply if IP routing is disabled or Use Answer as Default is disabled.

• If you enable RIP across the WAN in a Connection profile or an Answer profile, the hop count for the route can differ from the value of the Metric setting in the Route tab because the Ascend unit always uses the lower hop count.

• The hop count includes the metric of each switched link in the route.

Minimum Period

Usage: Enter a number of from 0 to 600. The default is 600.

Dependencies: Keep this additional information in mind:

• If Link Quality Monitoring is disabled, the Minimum LQM does not apply.

• Minimum LQM in the Answer profile applies to incoming calls for which no Connection
  profile exists; if a Connection profile exists, its Minimum LQM setting takes precedence.

• If Require Connection Profile is selected in the Answer profile, Minimum LQM does not apply in the Answer profile.

Module Name

Usage: Specify a value containing up to 16 characters.

Maximum Receive Unit

Usage: Specify a value equal to or less than 1532 (the default).

• You should accept this default unless the device at the far end of the link cannot support it, in which case you can specify a lower number.

Multicast Client

Usage:

• Select to configure the Ascend unit to enable multicast client functionality.

  When enabled, the Ascend unit sends IGMP (Internet Group Management Protocol) queries across this interface every 60 seconds and receives responses from or forwards messages for multicast clients.

• Clear the check box to configure the Ascend unit not to support multicast clients on this interface.

Multicast Forwarding

When multicasting is enabled in the Ascend unit, it builds a multicast forwarding table. Based on IGMP messages it exchanges, the Ascend unit creates new group memberships or refreshes existing ones in its multicast forwarding table. When the Ascend unit receives IP multicast packets from its MBONE interface, it checks its multicast forwarding table and forwards the packets to its multicast clients according to group membership.

When you enable Forwarding, the multicast subsystem reads the values in the Multicast tab and begins to forward multicast packets. If you modify a multicast value, you must re-enable forwarding to force a read of the new value.

• Select to enable multicast forwarding.

  When Multicast Forwarding is enabled, the Ascend unit appears to an MBONE router as a multicast client, which receives IGMP queries from the router and responds to them using IGMP. To dial-in clients, it appears as a multicast router, which sends IGMP queries and forwards multicast traffic.

• Clear the check box to disable multicast forwarding.

  This is the default.

N

N2 Retransmission Count

Usage: Specify a number of from 2 to 15. The default value is 10. A higher value increases the probability of a correct transfer of data. A lower value allows for quicker detection of a permanent error condition.

Name (profiles)

When a user calls the Ascend unit and Authentication has been set to a value other than None in the Answer Options > Authentication tab, the Ascend unit asks for a username and password; if the user enters the username and password specified in the User profile, the Ascend unit uses the Answer profile parameters to establish the connection.

If the username and password do not match the values of the Name and Password parameters in the User profile, the Ascend unit disconnects the user.

Usage: Enter a name of up to 31 characters.

Name (Security)

The Default Security profile is activated for all users who Telnet into the unit or access the terminal server interface in another way, and it is activated for the console whenever the unit is reset. The Default profile should have minimal permissions.

The Full Access profile has full privileges to all operations. It should be reserved for the super-user login: yourself and anyone else who will be reconfiguring the Ascend unit, testing lines, dialing remote locations, resetting the unit, upgrading system software, and so forth.

Usage: Specify a name up to 24 characters. The default value is null.

Name (SNMP)

Usage: Enter a name, up to 31 characters.

Name (System)

The Ascend unit sends the name to the remote device whenever it establishes a PPP link, or an AIM or BONDING call. Always enter a system name to identify the Ascend unit.

When the Ascend unit receives a PPP or MP+ call from an Ascend unit, it tries to match the caller's Name to the value of the Station field in some Connection. If the Ascend unit finds a match and authentication is turned on, the Ascend unit then tries to match the Password the caller enters to the Password in that same Connection. If the Ascend unit does not find a match, and RADIUS is enabled, the Ascend unit tries to match the caller's Name and Password to a username and password in the RADIUS users file.

Usage: Enter a name up to 16 characters.The default is null.

Note: Because the Ascend unit uses the Name in the Information tab for authentication, you must type it exactly as the remote network expects it. In this case, Name is case sensitive.

NAT Connection Profile

Usage: Press Enter to open a text field and type the name of an existing connection profile that contains information to use for all your NAT calls (incoming and outgoing).

Net Address (source)

Note: Either the source or destination address, or both, must be specified.

Usage: Specify a valid, 8-digit, hexadecimal IPX network address of from 00000000 to FFFFFFFF.

Net Address (destination)

Note: Either the source or destination address, or both, must be specified.

Usage: Specify a valid, 8-digit, hexadecimal IPX network address of from 00000000 to FFFFFFFF.

Network

Usage: Enter the unique 4-byte hexadecimal number provided by your network administrator. The values 00000000 and ffffffff are not valid.

Dependencies: For the Network parameter to apply, you must enable IPX routing in the Connection profile.

Network Address

Usage: Specify the IP address of a host on a remote bridged segment of the local IP network. If a netmask is in use on the network, you must specify it. Separate a netmask from the IP address with a slash. The default value is 0.0.0.0/0. For more information on IP addresses on the Ascend unit, refer to IP addresses and subnet masks.

Dependencies: Ethernet Address and Dial Out Connection values must also be specified.

Network Number

The Ascend unit assigns an address to a workstation when it connects to the Ascend unit; it derives the address from the network number.

Usage: Enter an IPX network number using an 8-digit (4-byte) hexadecimal value. The default is 00000000. The number you specify must be unique within your wide area IPX network, and must match the configuration of other routers on the local Ethernet network.

When you accept the default setting of 00000000, the Ascend unit learns its IPX network number from other routers on the Ethernet network. If you enter a value other than 0 (zero), the Ascend unit becomes the "seeding" router and sets its IPX network number for the other routers on the Ethernet network.

Dependencies: If the Ascend unit does not support IPX routing or if Route IPX is deselected, the LAN Network Number setting does not apply.

Network Start

Usage: Specify a starting network range for AppleTalk nodes. The valid range is from 1 to 65199. All seed routers on the same network must have the same value for the start and end of the network number range.

Network End

Usage: Specify an ending network range for AppleTalk nodes. The valid range is from 1 to 65199. All seed routers on the same network must have the same value for the start and end of the network number range.

New NAS Port ID

Usage: Specify one of the following settings:

• Yes specifies that the Ascend unit recognizes the format that specifies a shelf, slot, line, and channel number. This format is the one recognized by the MAX TNT.

• No specifies that the Ascend unit recognizes the five-digit format that specifies the type of service in use, and the line and channel number.

  This is the default.

No Trunk Group Alarm

The Ascend unit has an alarm relay whose contacts remain open on the back panel's alarm relay terminal block during normal operation. If you enable them, the alarm relay contacts close during loss of power, hardware failure, or a system reset. The No Trunk Alarm setting enables you to specify whether the contacts also close when all T1 PRI lines go out of service.

Usage: Specify one of the following values:

• Select Disable Alarm to specify that no relay closure occurs, though the Ascend unit records the loss of all lines in the system log. This is the default.

• Select Alarm when all trunks go out of service to specify that the back panel alarm relay closes when all trunks go out of service.

Node

Usage: Enter the node number of the server. Typically, a server running NetWare 3.11 or later has a node number of 0000000000001.

Dependencies: For the Node parameter to apply, you must enable IPX routing in the Connection profile.

Node Address (source)

Usage: Specify a valid, 12-digit, hexadecimal IPX node address of from 000000000000 to FFFFFFFFFFFF.

Node Address (destination)

Specify a valid, 12-digit, hexadecimal IPX node address of from 000000000000 to FFFFFFFFFFFF.

NodeSecret

Note: After the SecurID server sets the value of this parameter, if you later reset the parameter to null, you must reinitialize the interface to the Ascend unit in the SecurID server by using the "Client Edit" menu selection in the ACE server's "sdadmin" utility. Then, the server sends a new NodeSecret at the next successful authentication.

Usage: The initial value must be null (the default). After the first SecurID authentication occurs, the value is set by the server.

Dependencies: This setting does not apply unless Server Type specifies SECURID.

O

Offset

Filter Action = Discard
Byte Offset = 2
Comparison = 8
Pre-Comparison Mask = 0F FF FF FF 00 00 00 F0
Compare To = 07 FE 45 70 00 00 00 90
Filter If Packets Are = Equal

2A 31 97 FE 45 70 12 22 33 99 B4 80 75

Usage: Specify a number from 0 to 8 (the number of starting bytes to ignore). The default is 0, which indicates no offset.

Dependencies: If the current filter is linked to the previous one, the offset starts at the endpoint of the previous segment.

On loss of serial port DTR

• Select to enable automatic logout.

• Clear the check box to disable automatic logout.

  This is the default.

OSPF Adv.Type

Usage: Specify one of the following values:

• Type-1 instructs the Ascend unit to import the pool addresses into OSPF as external Type-1 routes. This value is the default.

• Type-2 instructs the Ascend unit to import the pool addresses into OSPF as external Type-2 routes.

• Internal instructs the Ascend unit to import the pool addresses into OSPF as Intra-area routes.

OSPF ASE Weight

Usage: Specify a number from 0 to 255. The default is 100. Zero is the default for connected routes (such as the Ethernet). The value of 255 means "Don't use this route."

Note: These are the default preferences for other types of routes:

• 10-OSPF routes

• 30-routes learned from ICMP redirects

• 100-routes learned from RIP

• 100-static routes

OSPF Weight

Usage: Specify a number from 0 to 255. The default is 10. The default for connected routes (such as the Ethernet) is 0. The value of 255 means "Don't use this route."

Note: These are the default preferences for other types of routes:

• 30-routes learned from ICMP redirects

• 100-routes learned from RIP

• 100-static routes

Output Cost

With the exception of links to stub networks, the output cost must always be non-zero. A link with a cost of 0xFFFFFF (16777215) is considered non-operational.

In a static route, the interpretation of this cost depends on the type of external metrics set in the ASE Type parameter. If the Ascend unit is advertising type 1 metrics, OSPF can use the specified number as the cost of the route. Type 2 external metrics are an order of magnitude larger. Any type 2 metric is considered greater than the cost of any path internal to the AS (autonomous system).

Usage: Specify a number greater than 0 and less than 16777215. The default is 1 on the Ethernet interface and 10 on the WAN links.

Output Filters

Specify Input Filters or Output Filters. A list of individual filters of that type will appear below. To define an individual filter, select it in the list and click New or Edit.

Own Port Diagnostics

Usage:

• Select to enable the Own Port Diagnostics privilege.

• Clear the check box to disable the Own Port Diagnostics privilege.

  This is the default.

P

Packet characters

Usage: Specify an integer of from 0 to 500. The default value is 0 (zero).

Packet Flush Time

Usage: Enter a number of from 1 to 1000 to specify the number of milliseconds between the time the MAX receives the first byte of data and flushes that data to TCP. After receiving the first byte of data, the MAX attempts to match the pattern specified in End Of Packet Pattern with the incoming WAN data stream. During this time, the MAX buffers the incoming data up to the limit specified in Max Packet Length. If there is no match, the MAX flushes the buffered data to TCP when the Packet Flush Time elapses.

Dependencies: Packet Flush Time does not apply except when Encaps=TCP-CLEAR in the Connection profile.

Packet wait time

Usage: Specify an integer of from 0 to 600 milliseconds. The default value is 0 (zero).

Dependencies: If your application is so specialized that it demands you use this setting, be sure to take into account your modem speeds when calculating its value. This setting does not apply if terminal services are disabled.

Password (Security profile)

Note: A user who knows the password to the Full Access level will be able to perform any operation on the Ascend unit, including changing the configuration. The Full Access password is set to "Ascend" by default. It is important that you change this default and assign your own password to the Full Access Security profile.

Usage: Specify a password, up to 20 characters.

Password (Terminal Server)

Usage: Specify a password up to 20 characters. The password is case-sensitive. The default value is null.

Polling Cycles

Usage: Enter the number of polling cycles that you want the Ascend unit to wait. You can specify a number from 1 to 255. If you specify 1, the Ascend unit requests a full status report every polling cycle. The default is 6.

Dependencies: Polling Cycles applies only if Link Mgmt is set to T1.617D.

Port:

Usage: Specify one of the following values:

• Ignore (don't make any comparison with the packet's source port number).

  This is the default.

• Equal (match source ports that are equal to the specified values).

• Not = to (match source ports that are not equal to the specified values).

• Greater than (match source ports that are greater than the specified values).

• Less than (match source ports that are less than the specified values).

Port # (filters)

Usage: Specify a number of from 0 to 65535. The default setting (zero) indicates that the Ascend unit disregards the port in this filter. Port 25 is reserved for SMTP; that socket is dedicated to receiving mail messages. Port 20 is reserved for FTP data messages, port 21 for FTP control sessions, and port 23 for Telnet.

Dependencies: The Comparison parameter determines how the specified value will be compared to a destination port number in a packet.

PPP

Dependencies: Keep this additional information in mind:

• The PPP parameter does not apply to RADIUS logins.

• In the Answer profile, the PPP setting does not affect incoming MP+ calls.

PPP Delay

Usage: Specify a number of seconds of from 1 to 60. The default is 5 seconds.

PPP Direct

Usage: Select to start PPP/LCP negotiation immediately after an async PPP session is initiated.

PPP Information when session begins

Usage: Specify one of the following values:

• None (no message will be displayed when a PPP session starts up).

• Mode (the start-up message will display "PPP Mode").

• Session (the start-up message will display "PPP Session"). This is the default.

Preference Weight

When choosing which routes to put in the routing table, the router first compares the Preference values, preferring the lower number. If the Preference values are equal, the router compares the Metric values, using the route with the lower Metric.

Usage: Enter a number of from 0 to 255. Zero is the default for connected routes (such as the Ethernet). The value of 255 means "Don't use this route;" this value is meaningful only for Connection Profiles. Press Enter again to close the text field.

Dependencies: These are the default values for different types of routes:

• Routes learned from OSPF=10

• Routes learned from ICMP Redirects=30

• Routes learned from RIP=100

• Static routes from IP address pools, RADIUS authentication, and the terminal server iproute add command=100

Primary Client DNS

Usage: Specify the IP address of a DNS server to be used for all connections that do not have a DNS server defined. The default value is 0.0.0.0.

Primary DNS

Usage: Enter the IP address of the primary domain name server. The default value is 0.0.0.0. Accept this default if you do not have a domain name server.

Primary Server (WINS)

Usage: Enter an IP address in dotted decimal notation. The default is 0.0.0.0.

Dependencies: Primary Server applies only to Telnet and raw TCP connections running under the Ascend unit unit's terminal server interface.

Priority

Usage: Specify a number. The default value is 5.

Private Address

Usage: Specify Yes or No.

• Yes makes the route private. The Ascend unit does not advertise the route.

• No means the route is advertised via routing protocols.

  This is the default.

Private Route

Usage:

• Select to disable advertising.

  The Ascend unit does not advertise the IP address in RIP updates that it sends.

• Clear the check box to enable advertising.

  The Ascend unit advertises the IP address in RIP updates that it sends. This is the default.

• The Private Address setting does not apply if the Connection profile does not have IP routing enabled.

• The Private Address setting in a Connection profile does not apply to bridged connections, such as Combinet links (Encapsulation set to Combinet).

Profile

Usage: Specify the name of a configured Frame Relay profile. This is the string assigned in the Frame Relay button > Name parameter, specified exactly including case changes.

Prompt

If authentication occurs through a local Connection profile and not through a RADIUS server, the third-login-prompt is not displayed. If the connection is RADIUS-authenticated, the information entered by the user at the third prompt (up to 80 characters) is passed to the server. What the RADIUS server does with this information depends upon how the server is configured.

Usage: Specify up to 20 characters for the third prompt. The default is null.

With this example setting, the terminal server displays these prompts for a RADIUS-authenticated login:

Login: 

Password: 

Password2>>

Protocol #

Usage: Specify a protocol number of from 0 to 255. The default setting of 0 (zero) causes the Ascend unit to disregard the protocol number when applying the filter.

Protocol

Note: If you change the value of this parameter or of any of the other parameters in a Static Mapping nn menu, the change does not take effect until the next time a connection is made to the remote network specified in the NAT Profile. To make the change immediately, you must terminate the connection to the remote network and then reopen it.

Usage: Press Enter to toggle between the choices, press Esc to exit the menu, and then confirm the change when prompted.

• TCP specifies that the Dst Port# and Loc Port# parameters in the same Static Mapping nn menu are TCP port numbers.

• TCP is the default.

• UDP specifies that the Dst Port# and Loc Port# parameters in the same Static Mapping nn menu are UDP port numbers.

  Note: The change does not take effect until the next time the link is brought up. To make the change immediately, bring the link down and back up.

Proxy Network Addresses

Usage: Enter an 8-digit hexadecimal IPX network number.

Dependencies: This parameter is N/A if IPX SAP Proxy =Off.

Q

R

RADIUS attributes required to identify a new session

Usage: Specify one of the following values:

• Any (the default)

  Any Attribute can be used to identify the session. If multiple attributes are sent, the order in which they are checked is (1) session key, (2) session id, (3) user name, (4) IP address.

• Session

  Only the session key attribute is checked for identification.

• All

  All Attributes that are applicable must be present and pass validation before any operation is performed on the connection. For example, if a session has a user name, IP address, session id and session key, than all four attributes must be sent. As another example, if a session has a user name, session id and session key, than these attributes must be sent; the IP address is not required.

RADIUS Remote Configuration

Usage: Select to retrieve this configuration information from RADIUS.

Rate Limit

In the Protocols tab, the rate limit applies to multicast clients on the Ethernet.

For high-bandwidth data, voice, and audio multicast applications, the transmitting device may send more packets across a connection than available bandwidth can handle. If the Ascend unit is the receiving device under extremely high loads, high priority packets will be less likely to be dropped than low priority packets. Priority is determined by UDP port ranges.

Table 2 UDP port ranges and packet priority

UDP Port Range	Type of Traffic	Priority
0-16384	Unclassified	Lowest (50)
16384-32768	Audio	Highest (70)
32768-49152	Whiteboard	Medium (60)
49152-65536	Video	Low (55)

Usage: Enter the number of seconds. The default value is 5. If it is set to 0, no rate limiting is applied.

Dependencies: Rate Limit has no effect when applied to the MBONE interface

Read Community Name

SNMP security is implemented with the community name sent with each request. Ascend supports two community names: one with read-only access to the MIB (the Read Comm setting), and the other with read/write access to the MIB (the R/W Comm setting).

Usage: Enter the community name that the Ascend unit uses for authenticating the SNMP management station. You can enter up to 16 alphanumeric characters. The default is Public.

Read-Write Community

Usage: Enter the community name that the Ascend unit will use for authenticating the SNMP management station. You can enter letters and numbers, up to a limit of 16 characters. The default is Write.

Note: To enable Read-Write functionality, you need to check the box to the left of Read- Write Community.

Receive Authentication

Usage: Specify one of the following values:

• None specifies that the Ascend unit does not use an authentication protocol to validate incoming calls.

  None is the default.

• PAP specifies that the Ascend unit uses the Password Authentication Protocol, a PPP authentication protocol.

  PAP provides a simple method for a host to establish its identity in a two-way handshake. Authentication takes place only upon initial link establishment, and does not use encryption. The remote device must support PAP.

• CHAP specifies that the Ascend unit uses the Challenge Handshake Authentication Protocol, a PPP authentication protocol.

  CHAP is more secure than PAP. CHAP provides a way to periodically verify the identity of a host using a three-way handshake and encryption. Authentication takes place upon initial link establishment; the Ascend unit can repeat the authentication process any time after the connection is made. The remote device must support CHAP.

• MS-CHAP specifies that the Ascend unit uses Microsoft CHAP (MS-CHAP) format.

  The Ascend unit only supports the Windows NT version of MS-CHAP, DES and MD4 encryption. With you select this option, the Ascend unit will only continue authentication if the remote peer also supports MS-CHAP authentication.

• Either specifies that the Ascend unit can use either PAP, CHAP, or MS-CHAP.

  The Ascend unit will allow authentication if the remote peer can authenticate using any of the designated authentication schemes. When you select Either, the Ascend unit first requests authentication using CHAP, the more secure protocol. If the dial-in call rejects the request (or doesn't acknowledge it), the Ascend unit then requests PAP authentication. If the dial-in call rejects the PAP request, the Ascend unit then tries MS-CHAP authentication. The Ascend unit terminates the link and drops the call if MS-CHAP is not accepted.

• The link must use PPP encapsulation.

• If you choose PAP or CHAP, you must also specify a password using Recv PW in a Connection profile, or Auth Host on an authentication server.

• When you set Receive Authentication to PAP, CHAP, or Either, the Ascend unit can determine the IP address of a caller, even if the caller does not specify an address; the Ascend unit derives the IP address from the Connection profile or RADIUS server that authenticates the call.

Renewal Time

Usage: Enter a number of from 3 to 65535. The default is 10.

Dependencies: The DHCP Spoofing and Spoof Adr parameters must be configured for this feature to work.

Require Connection Profile

Usage:

• Select to reject incoming calls for which there isn't a Connection profile or no entry on a remote authentication server.

  For an ARA connection, selecting Require Connection Profile prohibits Guest access.

• Clear the check box to accept incoming calls even if there is Connection profile or a remote authentication entry.

  This is the default.

• The source IP address of the caller matches the IP Address setting in a local Connection profile.

  In this case, encapsulation is set to MPP or PPP.

• The source name of the caller matches the Station setting in a local Connection profile; or, the source name of the caller matches the User-Name attribute in a RADIUS Users profile or a TACACS authentication entry.

  In this case, encapsulation is set to MPP or PPP, and Authentication is set to PAP or CHAP.

• The source MAC address of the caller matches the Station setting in a local Connection profile; or, the source MAC address of the caller matches the User-Name parameter in a RADIUS Users profile.

  In this case, encapsulation is set to Combinet.

• Require Connection Profile does not apply to terminal server calls.

• If you get incoming PPP bridging calls (where Route IP is cleared) and Require Connection Profile is selected, you must also specify that the Ascend unit authenticate incoming calls using PAP or CHAP (Authentication is set to PAP or CHAP).

  A Connection profile cannot match a PPP bridging call except through the name of the caller that PAP or CHAP authentication provides.

Reset

Usage: To perform a system reset, follow these steps:

1. Select the Reset button.

   The Ascend unit prompts you to confirm that you want to perform the reset.

2. Confirm the reset.

3. The Ascend unit resets approximately sixty seconds after you confirm the reset.

   In addition to clearing calls, the Ascend unit performs a series of POSTs. The POST display appears.

   If you do not see the POST display, press Ctrl-L.

   While the yellow CON LED on the front panel remains solidly lit, the Ascend unit checks system memory, configuration, and line connections. If the Ascend unit fails any of these tests, the CON LED remains lit or blinks.

   When the tests are complete, this message appears:

   Power-On Self Test PASSED

4. Press any key to display the Main Edit menu.

Reset Authentication on Timeout

Because the Pipeline 220 does not support external authentication, this parameter is not applicable.

Usage: Specify an integer representing the number of seconds. The default is 0 (zero), which specifies that the Ascend unit does not return to using the primary RADIUS authentication server.

Dependencies: Unless you have specified at least one authentication host, this parameter does not apply.

Retransmit Interval

Usage: Specify a number greater than zero. The default is 5.

RIP

Note: Ascend recommends that all routers and hosts run RIP-v2 instead of RIP-v1. The IETF has voted to move RIP version 1 into the "historic" category and its use is no longer recommended.

Usage: Specify one of the following values:

• Off specifies that the Ascend unit does not transmit or receive RIP updates. Off is the default.

• Recv-v2 indicates that the Ascend unit receives RIP-v2 updates on the interface but does not send RIP updates.

• Send-v2

  This setting indicates that the Ascend unit transmits RIP-v2 updates on the interface but does not send RIP updates.

• Both-v2 means the Ascend unit sends and receives RIP-v2 updates on the interface.

• Recv-v1 indicates that the Ascend unit receives RIP-v1 updates on the interface but does not send RIP updates.

• Send-v1

  This setting indicates that the Ascend unit transmits RIP-v1 updates on the interface but does not send RIP updates.

• Both-v1 means the Ascend unit sends and receives RIP-v1 updates on the interface.

• RIP does not apply if the Connection profile does not have IP routing enabled.

• RIP in the Answer profile applies to incoming calls for which no Connection profile exists; if a Connection profile exists, its RIP Version setting takes precedence.

RIP ASE Type

Usage: Specify one of the following values:

• Type1 is a metric expressed in the same units as the link-state metric (the same units as interface cost).

• Type2 is considered larger than any link-state path.

  Type 2 is the default. It assumes that routing between autonomous systems is the major cost of routing a packet, and eliminates the need for conversion of external costs to internal link-state metrics.

RIP Policy

Usage: Specify one of the following values:

• Split Horizon specifies the split horizon policy.

  The Ascend unit does not propagate routes back to the subnet from which they were received.

• Poison Reverse selects the poison reverse policy.

  The Ascend unit propagates routes back to the subnet from which they were received, but with a metric of 16.

  Poison Reverse is the default.

RIP Summary

Summarizing means that when the Ascend unit has a route to a subnet, it advertises a route to all the subnets in a network of the same class. For example, if the Ascend unit has a routing table entry to 200.5.8.13/28, it advertises a route to 200.5.8.0, because 200.5.8.13/28 is part of a class C network. When the Ascend unit does not summarize information, it advertises each route in its routing table "as-is;" in our example, the Ascend unit advertises a route only to 200.5.8.13.

RIP is defined without consideration for subnetting; entries in a RIP packet do not include a subnet mask. Therefore, the recipient of such updates must know or assume information about subnet masks. To work around this standard RIP behavior, the Ascend unit includes the RIP Summary setting. You can set this to specify that the Ascend unit modify RIP to advertise implied subnet information.

Usage:

• Select to specify that the Ascend unit summarizes subnet information when advertising routes outside its own network, but does not summarize subnet information when advertising routes inside its own network.

  For example, suppose the Ascend unit has an IP address of 200.8.143.5/28 and advertises across the WAN to a router that has the address 200.8.143.31/28. Even though the Ascend unit and the recipient are on different subnets, they are on the same network; therefore, no summarization takes place. The routes are sent "as-is."

  This is the default.

• Clear the check box to specify that the Ascend unit never summarizes subnet information.

  When you disable RIP Summary, the recipient must know the subnet mask to apply to each route.

• RIP Summary applies only to RIP version 1 and has no affect on RIP version 2 advertisements.

• RIP Summary does not affect host routes.

  Suppose the Ascend unit has a routing table entry to 200.8.143.5/32. Regardless of whether routes are summarized, this route is advertised as 200.8.143.5.

RIP Tag

Usage: Specify a 32-bit hexadecimal number. The default is c0000000.

Dependencies: RIP Tag does not apply if the Ascend unit does not route OSPF.

RIP Updates

When an Ascend unit is connected to a Ascend unit, the Ascend unit sends all of its RIP and SAP entries to the Ascend unit at connection time. If the Ascend unit is on a very large IPX network, this could cause the Ascend unit to run out of memory.

As an alternative to maintaining these large routing tables locally, the Ascend unit may have a static IPX route to the corporate network and disable IPX RIP. Either end of the WAN link may disable or fine-tune IPX RIP behavior.

Usage: Specify one of the following values:

• Both indicates that the device will both send and receive RIP updates on this WAN link.

  Both is the default.

• Send means the device will send RIP updates but will not receive them.

• Recv means the device will receive RIP updates but will not send them.

• Off means the device will neither send nor receive IPX RIP updates on this WAN link.

RIP Weight

When choosing which routes to put in the routing table, the router first compares the Rip Preference values, preferring the lower number. If the Rip Preference values are equal, the router compares the Metric values, using the route with the lower Metric.

Usage: Enter a number of from 0 to 255. The default value is 100. Zero is the default for connected routes (such as the Ethernet). The value of 255 means "Don't use this route."

Dependencies: These are the default values for other types of routes:

• Routes learned from OSPF are 10

• Routes learned from ICMP Redirects are 30

• Static routes from IP address pools, RADIUS authentication, and the terminal server iproute add command are 100

• Static routes in an IP Route profile or Connection profile are 100

Route IP

Usage:

• Select to enable IP routing.

• Clear the check box to disable IP routing.

Route IPX

• Establish IPX routing

• Forward IPX packets

• Generate RIP and SAP packets

• Interpret incoming RIP and SAP packets

• Select to enable the Ascend unit to perform IPX routing functions.

  This is the default.

• Clear the check box to disable the Ascend unit from performing IPX routing functions.

  You may want to diable IPX routing if your network uses a protocol other than IPX, or if your IPX network maintains such large RIP and SAP tables that the Ascend unit is spending too much time maintaining them.

• The Route IPX setting in the Protocol tab determines whether the Ascend unit routes IPX.

• The setting of Route IPX does not affect watchdog spoofing in IPX bridging.

• If you deselect Route IPX while a WAN connection routing IPX exists, the Ascend unit does not tear down the connection, but no further IPX traffic can take place on the connection.

• If Route IPX is not selected, none of the settings in the IPX tab apply.

  You can still configure IPX routes using the IPX Routes tab. However, the routes have no effect until Route IPX is selected in the Protocol tab.

• Refer to Bridging/routing for more information about bridging and routing on the Ascend unit.

S

2nd Domain Name

Usage: Specify a secondary domain name. You can enter up to 63 characters.

2nd IP Address

One use of this setting is to advertise routes that would not otherwise be advertised. For example, suppose both the Ascend unit and Router2 have a route to the network 200.0.2.0. Both are on the same subnet. The device with the lower hop count to the destination network sends all the traffic destined for that network.

Now, suppose the Ascend unit has 2nd Address set to 200.0.2.9/28 and Router2 has 2nd Address set to 200.0.2.10/28 on the same subnet. The Ascend unit assumes that all subnets in the 200.0.2.0 network have the same subnet mask (/28). In addition, the Ascend unit has an address for a router at 200.0.2.129/28 and Router2 has an address for a router at 200.0.2.65/28. Because the Ascend unit and Router2 assume that /28 is the subnet mask, the Ascend unit routes traffic only to the 200.0.2.129/28 subnet and Router2 routes traffic only to the 200.0.2.65/28 subnet. The traffic to the 200.0.2.0 network is thereby shared.

Using the 2nd Address setting also provides an easy way to change the IP address of the Ascend unit. When all routers know the Ascend unit by both its IP Address value and its 2nd Address value, you can safely turn off 2nd Address and put the new address in IP Address.

Usage: Enter the IP address of the Ascend unit on the remote subnet.

The address consists of four numbers of from 0 to 255, separated by periods. Use a slash to separate the optional netmask from the address. The IP address must be a valid address on the remote subnet. The default value is 0.0.0.0/0.

Dependencies: Keep this additional information in mind:

• If you do not know the right IP address to enter, you must obtain it from the network administrator.

  Do not attempt to configure an IP address by guesswork!

• Do not use 2nd Address to force interface-based routing; it is not designed as a second WAN address. To implement interfaced-based routing use the IF Address setting in the Connection tab.

SAP

When an Ascend unit is connected to a Ascend unit, the Ascend unit sends all of its RIP and SAP entries to the Ascend unit at connection time. If the Ascend unit is on a very large IPX network, this could cause the Ascend unit to run out of memory.

As an alternative to maintaining these large service tables locally, the Ascend unit may create static service table entries and turn off IPX SAP. Either end of the WAN link may disable or fine-tune IPX SAP behavior.

Usage: Specify one of the following values:

• Both indicates that the device will both send and receive SAP updates on this WAN link.

  Both is the default.

• Send means the device will send SAP updates but will not receive them.

• Recv means the device will receive SAP updates but will not send them.

• Off means the device will neither send nor receive IPX SAP updates on this WAN link.

SAP Home Server Proxy

SAP proxy mode is recommended when only NetWare clients (not servers) are on the Ethernet side of Ascend unit.

Note: If the Ascend unit running in SAP proxy mode has NetWare servers on its Ethernet, it stores the relevant SAP entries for those servers and advertises them across the WAN interface as a normal SAP broadcast.

Usage: Press Enter to toggle between Yes and No.

• Yes enables proxy mode.

• No disables proxy mode.

  No is the default.

SAP Reply

Usage:

• Select to specify that the home agent will reply to the mobile node's Nearest Server Query if it knows about a server on the Home Network.

• Clear the check box to configure the home agent to tunnel the mobile node's request to the home network.

Secondary Client DNS

Usage: Specify the IP address of a secondary DNS server to be used for all connections that do not have a DNS server defined. The default value is 0.0.0.0.

Secondary DNS

Usage: Enter the IP address of the secondary domain name server. The default value is 0.0.0.0. Accept this default if you do not have a secondary domain name server.

Dependencies: Secondary DNS applies only to Telnet and raw TCP connections running under the Ascend unit unit's terminal server interface.

Secondary Server (WINS)

Usage: Enter an IP address in dotted decimal notation. The default is 0.0.0.0.

Dependencies: Secondary Server applies only to Telnet and raw TCP connections running under the Ascend unit unit's terminal server interface.

Secret Key

Usage: Specify the text of the shared secret. The value you specify must match the value assigned in the RADIUS clients file or the TACACS+ configuration file.

Secure Terminal Server

Usage:

• Select to drop the connection if no login host is specified for a terminal-server connection whose immediate service is set to TCP or Telnet.

• Clear to allow the incoming user will have access to the terminal-server interface instead.

Security

Usage: Specify one of the following values:

• None (the default).

  Passwords and user names are not required for terminal server access.

• Partial.

  Passwords or user names (or both) are requested in terminal mode, but not in menu mode. If an interactive user toggles between terminal mode and command mode, a password and user name will be required upon entry to command mode.

• Full.

  Passwords or user names (or both) are required to enter the terminal server in both command mode and menu mode.

Server 1 and 2 (BOOTP)

Usage: Enter the IP address of the BOOTP server.

Dependencies: Keep this additional information in mind.

• If you specify two BOOTP servers, the Ascend unit that relays the BOOTP request determines when each server is used. Assigning a BOOTP server as Server 1 does not necessarily mean that server is tried first.

Server Port

• If the Ascend unit is acting as a RADIUS client, this is the UDP destination port to use for authentication. The UDP port used by RADIUS daemons is specified in the /etc/services file (UNIX).

• If the Ascend unit is acting as a TACACS or TACACS+ client, it specifies the UDP destination port to use for authentication (49 by default).

• If the Ascend unit is acting as a RADIUS server, this is the UDP port to use for the on-board RADIUS server. (The on-board server is a mechanism that allows the Ascend unit to respond to messages from the radius daemon, as described in the MAX RADIUS Configuration Guide.) It is set to 1700 by default.

• If the Ascend unit is acting as a Defender client, this is the TCP port to use to communicate with the server. It is set to 2626 by default.

• If the Ascend unit is acting as a SecurID client, this is the TCP port to use to communicate with the server. It is set to 5500 by default.

Usage: Specify the port number used by the server.

Server Type

Usage: Specify one of the following values:

• None (the default) to disable the use of an authentication server.

• TACACS

  Access a TACACS server. TACACS supports PAP, but not CHAP authentication.

• TACACS+

  Access a TACACS+ server. TACACS+ supports PAP, but not CHAP authentication and provides more extensive accounting statistics and a higher degree of control than TACACS authentication.

• RADIUS

  Access a RADIUS server. In a RADIUS query, the Ascend unit provides a user ID and password to the server. If the validation succeeds, the server sends back a complete profile; this profile specifies routing, packet filtering, destination-specific static routes, and usage restrictions for the user. RADIUS supports PAP and CHAP, and terminal server validation.

• RADIUS/LOGOUT

  This setting is identical to RADIUS, except that when you select radius-logout, the Ascend unit sends a request to the RADIUS server to initiate logout when the session ends.

• Defender

  Access a Digital Pathways Defender authentication server.

• SECURID

  Access a SecurID ACE server.

Dependencies: Keep this additional information in mind:

• You must enter a server address in an Auth Host field.

• The link must use PPP or MP+ encapsulation (Encapsulation is set to PPP or Encapsulation is set to MPP).

• If you request PAP or CHAP, you must also specify a password using Dial Out Password in a Connection profile.

• If you request PAP-TOKEN-CHAP, you must specify an MP+ Password; this password must match the password in the RADIUS entry for authenticating the call.

  If you do not enter identical passwords in the MP+ Password setting and the RADIUS entry, the Ascend unit cannot extend the MP+ call beyond a single channel.

• If you request CACHE-TOKEN, the Dial Out Password must match the Ascend-Receive-Secret attribute in the RADIUS entry that authenticated the call.

  If you do not enter identical passwords in the Dial Out Password and Ascend-Receive-Secret attribute, CACHE-TOKEN calls are rejected after initial access through hand-held security card authentication.

• On a nailed-up link (Dial In/Out is set to Nailed), you must set Dial-in Password and Dial-out Password to the same value at both ends of the connection; that is, Dial-in Password at the local and remote ends, and Dial-out Password at the local and remote ends, must all contain the same value.

• PAP-TOKEN and PAP-TOKEN-CHAP require configuration of a SAFEWORD or ACE entry in the NAS's RADIUS users file with the caller's name.

  See the Ascend unit RADIUS Supplement for details.

• For information on prompting the user for his or her password at the Ascend unit unit's terminal server, see the description of the set password command in the Ascend unit ISP & Telecommuting Configuration Guide.

• For information on prompting for a password at a host, see APP Server, APP Host, and APP Port settings.

• Dial on Broadcast must be enabled when a PC on the same Ethernet as the Ascend unit runs APPSRVR1 or APPSRVR2 to open a connection protected by security-card authentication.

Server Key #

On incoming requests from the client, the authenticator field is computed in the same way as that stated in the RADIUS accounting draft. An MD5 hash is performed on the packet with the shared secret appended and the authenticator field zeroed out. The resulting 16-byte digest is copied into the authenticator field. The RADIUS server sends this packet minus the appended secret.

On responses from the server, an MD5 hash is performed on the packet with the request's authenticator inserted and the shared secret appended. The resulting 16-byte digest is copied into the authenticator field. This packet minus the appended secret is sent to the client.

Usage: Enter a string containing the shared secret. You can enter up to 20 characters. For security purposes, the string is hidden when the value is displayed. The default is null.

Dependencies: If Server is not selected, this setting does not apply.

Server Port (APP Server)

Usage: Enter a UDP port number. Valid port numbers range from 0 to 65535. The default value is 0, which indicates that no UDP port is being monitored by the APP server.

Dependencies: Keep this additional information in mind:

• The Server Port settings applies only to outgoing calls using security card authentication.

• You must set Authentication in the Dial-out options of a Connection profile to PAP-Token and select Server for this setting to have any effect.

• The APP Server utility must be running on a UNIX or Windows workstation on the local network.

Server Name

• In an IPX Routes Profile, the Server Name parameter specifies the name of an IPX server.

• In an IPX SAP Filters Profile, the Server Name parameter specifies the name of a NetWare server to be excluded from or included in the Ascend unit's service table.

IPX Routes Profile

IPX SAP Filter Profile

Dependencies: For the Server Name parameter to apply in an IPX Route Profile, you must enable IPX routing in the Connection Profile by setting Route IPX=Yes.

Service

Usage: Specify one of the following values:

• None (no immediate service). This is the default.

• Telnet

  Initiate an immediate Telnet connection to the Immediate Host address. If the Immediate Port parameter is specified, use that Telnet port number.

• Raw-TCP

  Initiate an immediate TCP connection to the Immediate Host address. If the Immediate Port parameter is specified, use that port number.

Session Timer

When set for RADIUS/LOGOUT authentication, this setting specifies the interval at which session reports will be sent to the RADIUS/LOGOUT authentication server. For example, if you want the Ascend unit to send Session Events at one-minute (60-second) intervals, set the authentication Type to RADIUS/LOGOUT and Session Timer to 60.

Usage: When setting the timer for RADIUS accounting, specify a number from 1 to 10. The default value in the Ethernet profile is 0. The default in a Connection profile is 1.