6200 series G.SHDSL.bis VPN Router is a high performance 4 ports Security Gateway providing Internet access and LAN-to-LAN application over existing copper line for small/medium office. Complying with ITU-T G.991.2 (2004) standard, 6200 series make full use of the advanced G.SHDSL.bis technology to offer data transmission rates of up to 5.696Mbps in 2-wire mode, 11.392Mbps in 4-wire mode and 22.784Mbps in 8-wire mode.
Impedance: 135 ohms LAN Port: 4-Ports 10/100M Switch supports Auto-negotiation for 10/100Base-TX and Half/Full Duplex Auto-MDIX 2-ports USB (For 6200-2W/U, 6200-4W/U and 6200-8W/U) USB Port: USB 2.0 Serial Console Port: RJ45 connector Factory Default Reset: Push Button LED: Power (Green)
Page 6
ALARM (Red) Bridging and VLAN IEEE 802.1D Transparent Learning Bridge IEEE 802.1Q and Port Based VLAN Spanning Tree Protocol (STP) Up to 2K Mac Address Routing Static routing and RIP v1/v2(RFC 1058/2453) NAT/PAT (RFC1631) NAT Application Level Gateways Skype/MSN/Yahoo Messenger (RFC2933) VoIP(SIP) pass through VPN PPTP/L2TP pass through Virtual Server...
Page 7
Configurable Idle times for timeout 802.1P Tag IPv4 TOS/DiffServ Class-based Prioritization Class-based Traffic Shaping Class-based DSCP Mark Up to 8 priority queues IP Precedence Alternation IPSec (RFC2411) up to 4 Tunnels DES/3DES/AES MD5/SHA-1 IKE/Manual Key ISAKMP (RFC 2407/2408/4306) IKE v1 (RFC 2409/4109) L2TP/PPTP Firewall SPI (Stateful Packet Inspection)
Page 8
Physical / Electrical Dimensions: 18.7 x 3.3 x 14.5cm (WxHxD) Power: 100~240VAC (via power adapter) Power Consumption: 9 watts Max Temperature: 0~40ºC Humidity: 0%~95%RH (non-condensing) Model Number list: Model Number 6200-2W 6200-4W 6200-8W 6200-2W/U 6200-4W/U 6200-8W/U Specification Maximum DSL wires...
LED status of VPN Router: LEDs Active Description The power adaptor is connected to this device SHDSL.bis line 1 connection is established LINK 1 SHDSL.bis line 1 handshake Blink Transmit or received data over SHDSL.bis link 1 SHDSL.bis line 2 connection is established LINK 2 SHDSL.bis line 2 handshake Blink...
RJ-45 for system configuration and maintenance Reset button for reboot or load factory default LAN (1,2,3,4) 10/100BaseT auto-sensing and auto-MDIX for LAN port (RJ-45) USB ports ( for 6200-2W/U, 6200-4W/U and 6200-2W/U only) G.SHDSL .Bis interface for WAN port (RJ-45) Frame Ground / Protective earth...
For 4-wire (two pair) model, Loop1 and 2 have been used. For 8-wire (four pair)model, Loop1, 2, 3 and 4 have been used. Channel A Channel B Channel C Channel D 2-wire model (6200-2W , 6200-2W/U) 2-wire mode Loop1 (4,5) 4-wire model (6200-4W , 6200-4W/U) 2-wire mode Loop1 (4,5)
Page 12
T-568A Straight-Through Ethernet Cable T-568B Straight-Through Ethernet Cable Both the T-568A and the T-568B standard Straight-Through cables are been used.
The VPN Router have four LAN ports. Those ports are auto-negotiating, auto-crossover. In 10/100Mbps Fast Ethernet, the speed can be 10Mbps or 100Mbps and the duplex mode can be half duplex or duplex. The auto-negotiating ports can detect and adjust to the optimum Ethernet speed (10/100 Mbps) and duplex mode (full duplex or half duplex) of the connected device.
The pin assignment of RJ-45 modular jack on the Console cable: Pin Number Abbrev. Description Figure DCE ready Received Line Signal Detector DTE ready Signal Ground Received Data Front View Transmitted Data Clear to Send Top View Request to Send Only for with USB ports models.
The marked lug or terminal should be connected to the building protective earth bus. The function of protective earth does not serve the purpose of providing protection against electrical shock, but instead enhances surge suppression on the DSL lines for installations where suitable bonding facilities exist. The connector type is M3 machine screw.
The console port is a RJ-45 connector that enables a connection to a PC for monitoring and configuring the VPN Router. Use the supplied serial cable with a female DB-9 connector to serial port of PC and RJ-45 module jack connector to VPN Router’s console port.
All display screens are as same as serial console configuration. The default IP address is “192.168.0.1” and you can customerize the IP address for you application. In addition, the default Telnet function is disable. Therefore, before using this Telnet function, please enable Telnet with using Web management . This following guide is designed to lead users through Web Configuration of G.shdsl.bis VPN Router in the easiest and quickest way possible.
This section introduces the configuration and functions of the web-based management. It is an HTML-based management interface that allows users to setup and manage 6200 VPN routers. This configuration system offers all monitoring and management features which allow users to access VPN routers from anywhere on the network with a standard browser, such as, Internet Explorer or Firefox.
Quick Setup System Mode Bridge Router WAN IP WAN Netmask Protocol Disable EoA + NAT IPoA IPoA + NAT PPPoA PPP User PPP Password PPPoA Confirm Password PPP Connection Type PPPoE PPPoE Primary DNS Secondary DNS DHCP mode Disable Server Relay SHDSL.bis Mode STU-R...
Page 21
ENCAP VPI-VCI QoS Class QoS PCR QoS SCR 3.5G Backup Mode Location Manufacture Dial Number Keep-alive Interval Keep-alive Server Primary Secondary DHCP Mode Disable Server Relay DHCP Server Mode Subnet Netmask IP Range Gateway Lease Time DHCP Relay Interface Mode Entry (1~16) Enable Source IP...
Page 22
Port-Based VLAN QinQ Router Mode Not available Bridge Mode Mode Disable Mapping By VLAN By WAN Switch Port 1 ~ Port 4 Auto 100M/Full 100M/Half 10M/Full 10M/Half Static Route Destination Netmask Gateway Interface Mode Traffic Classify Mode Class ID Protocol Src IP Src Netmask Src Port...
Page 23
Passive Virtual Server Router Mode Mode Entry (1~16) Enable Description Interface Protocol Public Port Private IP/Port Bridge Mode Not available Router Mode Mode WAN I/F Host IP Bridge Mode Not available DDNS Mode Provider Host Name User Name Password IGMP IGMP Proxy / Snooping Security Firewall...
Page 24
PPTP Mode Authentication Virtual IP User Bridge Mode Not available Filter IP Filter Mode Default Policy Entry(1~16) Mode Action Protocol Source IP/ Mask Source Start/ End Port Destination IP/ Mask Destination Start/ End Port MAC Filter Mode Default Policy Entry(1~16) Mode Action Management...
Page 25
Periodic Inform Enable Periodic Inform Interval Periodic Inform Time Connection Request IP Connection Request Port Connection Request Username Connection Request Password Retry Times UPnP Mode Sys Log Remote Server Mode Remote Server Address Remote Server Port Telnet Mode Port Mode Port Refresh Time Service Port...
Page 26
Restore Users User 1~4 Name Level Password Confirm Ping IP Address Size Count Update Trace Route Host name or IP Packet Datagram Update Interval...
“Quick Setup” function guides users to setup their VPN routers step by step. This VPN Router can be set as a bridge or a router. The following sections show how to setup a bridge mode or a router mode. “System Mode” allows users to decide this VPN router should be a bridge device or a router device. “Router mode”...
Page 28
Once a user chooses “Bridge” mode, two more setups will be shown: “WAN ENCAP” and “WAN VPI/VCI”. WAN ENCAP There are two encapsulation types: VC-Mux (Virtual Circuit Multiplexing) and LLC(Logical Link Control). VC-MUX and LLC are two mechanisms for identifying the protocol carried in ATM Adaptation Layer 5 (AAL5) frames. WAN VPI/VIC There is an unique VPI and VCI value for Internet connection supported by ISP.
Page 29
WAN Section Fill up the information in the circled section in order to complete setting up your VPN router as a router device. 1. WAN IP and WAN Netmask Fill up the IP address and the netmask of WAN. 2. Protocol Nine options are available for this setup: Disable EoA + NAT...
Page 30
Two sets of DNS addresses can be stored in DNS section. DHCP Mode Choose whether DHCP mode should be disabled or enabled. If the DHCP mode should be enabled, decide the mode should be “Server” or “Relay”. This section is only available when the protocol is PPPoA, PPPoA + NAT, PPPoE, or PPPoE + NAT.
Page 31
In this section, you are able to set PPP user, PPP password, and PPP connection type. In addition, the connection type can be set as either “Always on” or “On demand”. There are two SHDSL.bis modes: STU-C and STU-R. “STU-C” means the terminal of central office (CO) and “STU-R” means customer premise equipment (CPE).
Page 32
In both “Bridge” mode and “Router” mode, the IP address and subnet mask of LAN should be provided. “Default Gateway” allows users to fill up the gateway IP address in both “Bridge” mode and “Router” mode.
Network section allows users to setup the following functions. 1. SHDSL 2. Interfaces 3. 3.5G Backup 4. DNS 5. DHCP 6. NAT Please check the sections for detail information on how to use these functions. 1. Mode: You are able to change your VPN router’s mode to STU-R or STU-C in here. 2.
Page 34
● The table above indicates the model number and its corresponding available wire numbers. For example: 6200-2W and 6200-2W/U (2-wire model) can select 2-wire line type only. 6200-4W and 6200-4W/U (4-wire model) can select 2-wire and 4-wire line types. 6200-8W and 6200-8W/U (8-wire model) can select 2-wire, 4-wire or 8-wire line types.
6. Line Probe You are able to choose to disable or enable “Line Probe” function for adpative mode of data rate. When “Line Probe” function is enabled, the system will search on the best connection based on the value of “Max Base Rate” automatically.
Page 36
In the last section of this page, you can define the IP address of the default gateway and the size of MTU. The router supports UBR, CBR, VBR-rt and VBR-nrt. UBR (Unspecified Bit Rate) is the simplest service provided by ATM networks. There is no guarantee of anything. It is a primary service used for transferring Internet traffic over the ATM network.
SCR (Substained Cell Rate): The sustained rate at which you expect to transmit data, voice and video. Consider SCR to be the true bandwidth of a VC and not the lone-term average traffic rate. This function is for 6200-2W/U, 6200-4W/U and 6200-8W/U.
will recognize it automatically, no additional setup procedure required. Only one Internet connection (3G/3.5G wireless / DSL wired) can be used at the same time. At first, DSL wired Internet connection will be selected, and use wireless connection (3G/3.5G) as backup. For example, if you connect 3G/3.5G modem card with VPN Router when you’re using wired Internet connection, when DSL wired connection dropped and 3G/3.5G wireless connection will start up.
Dynamic Host Configuration Protocol (DHCP) is a communication protocol that lets network administrators to manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network. Using the Internet Protocol, each machine that can connect to the Internet needs a unique IP address. When an organization sets up its computer users with a connection to the Internet, an IP address must be assigned to each machine.
network to a different IP address known within another network. One network is designated the inside network and the other is the outside. Typically, a company maps its local inside network addresses to one or more global outside IP addresses and reverse the global IP addresses of incoming packets back into local IP addresses. This ensure security since each outgoing or incoming request must go through a translation process, that also offers the opportunity to qualify or authenticate the request or match it to a previous request.
VLAN is for Bridge mode only. VLAN (Virtual Local Area Network) allows a physical network to be partitioned into multiple logical networks. Devices on a logical network belong to one group. A device can belong to more than one group. With VLAN, a device cannot directly talk to or hear from devices that are not in the same group.
Page 43
Click the 802.1Q Tag-Based VLAN to configure the VPN Router. In 802.1q, the VLAN information is written into the Ethernet packet itself. Each packet carries a VLAN ID (Virtual LAN ID), called a tag. This allows VLANs to be configured across multiple switches. Note that it’s possible for VLAN tags to be stripped by H/W and/or S/W.
Page 44
according to the PVID (port VLAN) port definition. Typically, most switches today have all ports are set to a default PVID of 1. When a tagged frame arrives at a switch port the tag is respected. A VID defines the member of a port group. A packet can only travel inside a member port when the member port is part of a VID port group.
Page 45
Ports in the same VLAN group share the same frame broadcast domin thus increase network performance through reduced boardcast traffic. VLAN groups can be modified at any time by adding, moving or changing ports without any re-cabling. Before enabling VLANs for the VPN Router, you must first assign each port to the VLAN group(s) in which it will participate.
Page 46
Port Overlapping – Port overlapping can be used to allow access to commonly shared network resources among different VLAN groups, such as file servers or printers. Untagged VLANs – Untagged (or static) VLANs are typically used to reduce broadcast traffic and to increase security. A group of network users assigned to a VLAN form a broadcast domain that is separate from other VLANs configured on the VPN Router.
changed to another VLAN without manual reconfiguration. As with other VLAN approaches, the packets forwarded using this method do not leak into other VLAN domains on the network. After a port has been assigned to a VLAN, the port cannot send to or receive from devices in another VLAN. For example, The default setting is all ports connected which means all ports can communicate with each other.
Page 48
Total of 16 rules are allowed for users to setup.
“Switch” function allows users to setup each LAN port individually. 5 options are available for a LAN port. Auto 100M/Full 100M/Half 10M/Full 10M/Half A static route is one that is manually installed by your network administrator. This is a very efficient way to transfer data from one subnet to another despite the fact that this type of route is manually intensive.
The opposite of a static route is a dynamic route. Dynamic routes are created by routing protocols. Static routes have advantages and disadvantages as compares to dynamic routes. Advantages of Static Routes Static routes are easier to configure No need for overhead on the routing protocol As long as you have a tight IP mask, this offers you reliable security Disadvantages of Static Routes In order to make changes in the network, you have to manually configure the route...
Page 52
VLAN Tag Priority uses the tag field information which has been inserted into an Ethernet frame. If a port has an 802.1Q-compliant device attached (such as this modem), these tagged frames can carry VLAN membership information. IEEE 802.1Q Tagged Frame for Ethernet:...
Page 53
User priority is giving eight ( 2 = 8 ) priority levels. The default value is 0, indicating normal treatment. Priority Level Traffic Type 0 (default) Best Effort Background Spare Excellent Effort Controlled Load Video, less than 100 milliseconds latency and jitter Voice, less than 10 milliseconds latency and jitter Network Control Each Priority level can be set queue from 0 to 3.
Page 54
The following figure illustrates the DS field: The DSCP value used to identify 64 levels (2 =64) of service determines the forwarding behavior that each packet gets across the DiffServ network. Based on the marking rule different kinds of traffic can be marked for different priorities of forwarding.
Page 55
Reliability Normal Reliability High The standardized DiffServ field of the packet is marked with a value so that the packet receives a particular forwarding treatment at each network node. RFC 2597 defines the assured forwarding (AF) classes. There are four AF classes, AF1x through AF4x. Within each class, there are three drop probabilities.
Page 56
Low-Latency Data AF21,AF22, 010010 (18), 010100 (20), Transactional applications, database AF23 010110 (22) access, interactive data applications High-Throughput Data AF11,AF12, 001010 (10), 001100 (12), Bandwidth channels AF13 001110 (14) Standard (Best Effort) DF (CS0) 000000 (0) Undifferentiated applications Low-Priority Data 001000 (8) Mirror service, remote backups, etc (LBE)
Traffic policing can propagates bursts. When the traffic rate reaches the configured maximum rate, excess traffic is dropped (or remarked). The result is an output rate that appears as a saw-tooth with crests and troughs. In contrast to policing, traffic shaping retains excess packets in a queue and then schedules the excess for later transmission over increments of time.
(RFC2453). It can set the specified interface (LAN, WAN1 to WAN8) to passive mode. On passive mode interface, all receiving packets are processed as normal and rip does not send either multicast or unicast RIP packets. This feature allows you to make servers on your LAN accessible to Internet users. Normally, Internet users would not be able to access a server on your LAN because:- (1) Your server does not have a valid external IP address.
UDP (User Datagram Protocol) offers only a minimal transport service (non-guaranteed datagram delivery) and gives applications direct access to the datagram service of the IP layer. UDP is used by applications that do not require the level of service of TCP or that wish to use communications services (e.g., multicast or broadcast delivery) not available from TCP.
Details of your DDNS account (Host name, Name, password) must then be entered and saved on this screen. The device will then automatically ensure that you current IP address is recorded by the DDNS service provider from the internet, users will now be able to connect to your Virtual Servers using your Domain name. IGMP (Internet Group Management Protocol) proxy can be used to implement multicast routing.
Page 61
X’mas tree scan: It can send a TCP frame to a remote device with the URG, PUSH, and FIN flags set. This is called a Xmas tree scan because of the alternating bits turned on and off in the flags byte, much like the lights of a Christmas tree.
Page 62
attack. Smurf attack: The Smurf attack is a way of generating a lot of computer network traffic to a victim host. That is a type of denial-of-service attack. A Smurf attack involves two systems. The attacker sends a packet containing a ICMP echo request (ping) to the network address of one system.
A VPN (Virtual Private Network) provides a secure connection between 2 points, over an insecure network. The Secure is called a VPN Tunnel. The VPN Router supports three main type of VPN: IPsec, L2TP and PPTP. IPsec is a near-ubiquitous VPN security standard, designed for use with TCP/IP networks. It works at the packet level, and authenticates and encrypts all packets traveling over the VPN Tunnel.
Page 64
Enable This indicates whether or not the policy is currently enabled. Use the Enable/Disable to toggle the state the selected policy. Policy name The name of the policy. When creating a policy, you should select a suitable name.
Page 65
Example: Configuring a IPSec LAN-to-LAN VPN Connection Network Configuration and Security Plan Branch Office Head Office Local Network ID 192.168.0.0/24 192.168.1.0/24 Local Router IP 69.1.121.30 69.1.121.3 Remote Network ID 192.168.1.0/24 192.168.0.0/24 Remote Router IP 69.1.121.3 69.1.121.30 IKE Pre-shared Key 12345678 12345678 VPN Connection Type Tunnel mode...
Page 66
Example: Configuring a IPSec Host-to-LAN VPN Connection L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol used to support VPNs. It doesn’t provide any encryption or confidentiality by itself; it relies on an encryption protocol that it passes within the tunnel to provide privacy. L2TP allows a PPP session to travel over multiple links and networks.
Page 67
Both office LAN networks must in different subnet with LAN to LAN application. Functions of Pre-shared Key, VPN Connection Type and Security Algorithm must be identically set up on both sides. PPTP( Point-to-Point Tunneling Protocol)is a private network of computers that uses the public Internet to connect some nodes.
Page 68
Example: Configuring a Remote Access PPTP VPN Dial-out Connection A company’s office establishes a PPTP VPN connection with a file server located at a separate location. The router is installed in the office, connected to a couple of PCs and Servers. Example: Configuring a PPTP LAN-to-LAN VPN Connection The branch office establishes a PPTP VPN tunnel with head office to connect two private networks over the Internet.
Page 69
Configuring PPTP VPN in the Head Office The IP address 192.168.1.254 will be assigned to the router located in the branch office. Please make sure this IP is not used in the head office LAN. Configuring PPTP VPN in the Branch Office The IP address 69.1.121.33 is the Public IP address of the router located in head office.
Remote VPN Endpoint The IP address of the remote VPN end point (Gateway or client) Source IP Address(es) / Destination IP Address(es): This is the Address-Filter used to allow or block traffic to/from...
Page 71
particular IP address(es). Selecting the Subnet Mask of the IP address range you wish to allow/block the traffic to or form; set IP address and Subnet Mask to 0.0.0.0 to inactive the Address-Filter rule. Protocol: It is the packet protocol type used by the application, select among from TCP or UDP or both of TCP/UDP. Source Port: This Port or Port Ranges defines the port allowed to be used by the Remote/WAN to connect to the application.
Page 72
In computer networking, MAC Filtering refers to a security access control methodology whereby the 48-bit address(XX:XX:XX:XX:XX:XX) assigned to each network device is used to determine access to the network. MAC addresses are uniquely assigned to each network device, so using MAC filtering on a network permits and denies network access to specific devices through the use of black lists and white lists.
Time synchronization is an essential element for any business, which relies on the IT system. The reason for this is that these systems all have clock that is the source of timer for their filing or operations. Without time synchronization, these system’s clocks vary and cause the failure of firewall packet filtering schedule processes, compromised security, or virtual server working in wrong schedule.
Service: Enable Time Server 1, Time Server 2 and Time Server 3: All of the time server around the world can be used but suggest using the time server nearby to your country. You can set up maximum three time server on here. Time Zone: Select the time difference between UTC(Universal Time Coordinated, formerly known as GMT, Greenwich Mean Time) and your time zone from the drop-down list box.
3.7.3. TR-069 (short for Technical Report 069) is a DSL Forum technical specification entitled CPE WAN Management Protocol (CWMP). It defines an application layer protocol for remote management of end-user devices. As a bidirectional HTTP based protocol it provides the communication between CPE (customer premises equipment) and ACS (Auto Configuration Servers).
by the CPE for validating the certificate from the ACS when using certificate-based authentication. ACS User Name Username used to authenticate the CPE when making a connection to the ACS using the CPE WAN Management Protocol. This username is used only for HTTP-based authentication of the CPE. ACS Password Password used to authenticate the CPE when making a connection to the ACS using the CPE WAN Management Protocol.
Syslog is a standard method of centralizing various logs. You can use a syslog server to store your servers logs in a remote location for later perusal or long-term storage. To send logs to the LOG server, you must configure the other servers from your network to send logs to that server. 1.
SSH (or Secure Shell) is a protocol that can be used to log into a remote machine (your Virtual Server) and provide secure encrypted communications between your VON Router and your local computer. All of the commands you would use in a Telnet client, you can use in an SSH client. The only difference is that the communication is made via encrypted channels to and from your VPN Router.
There will display general system information including: Hardware and Software MCSV, software version, chipset, firmware version, Host Name, System Time and System Up Time. MCSV: MCSV is the Manufacture's Concurrent Software Version. This version is the original factory version and remains even after upgrading the router in the field.
If the VPN router have connected to remote side, it can also show the performance information of remote side. Click Clear CRC can clear the CRC error count. This information shows all eight WAN interface. Routing tables contain a list of IP address. Each IP address identifies a remote router (or other network gateway) that the local router is configured to recognize.
This table shows the interface statistics. Octet is a group of 8 bits, often referred to as a byte. Packet is a formatted block of data carried by a packet mode computer networks, often referred to the IP packet. InOctets The field shows the number of received bytes on this port InPactets The field shows the number of received packets on this port...
Upgrade Firmware Click the “Browser” button and browse to the location on your PC where you stored the firmware upgrade. Select the upgrade file. There name will appear in the Upgrade file field. Click the “Upgrade” button to commence the firmware upgrade. This configuration tool has three functions: load Factory Default, Restore Configuration, and Backup Configuration.
Page 87
After configuration, suggest using the function to backup your router parameters in the PC. Select the Backup Configuration and then press Apply. Browse the place of backup file name or put the name. Then press OK. The router will automatically backup the configuration. If you don’t put the file name, the system will use the default: config1.log...
Sometime the configuration crushed occasionally. It will help you to recover the backup configuration easily. Click Apply after selecting Restore Configuration. Browse the route of backup file then press Apply. Brower the place of restore file name or put the name. Then press OK.
Level Administrator Normal Guest This is the default administrator ID and password is “root”. It is highly recommended that you change these for security purpose. Name: Type the new User Name (“root” is the default name when shipped) Level: Administrator, Normal and Guest Password: Type the existing password (“root”...
It is also possible for ping packets to be lost in transit, causing ping to report a host as unavailable when in fact it is available but unreachable. One cause of lost or dropped packets is extreme levels of traffic. In general, ping utilities will be unusable on heavily-loaded networks.
Abbrev. Full Term Meaning Ethernet-over-ATM EoA protocol is commonly used to carry data between local area networks that use the Ethernet protocol and wide-area networks that use the ATM protocol. Many telecommunications industry networks use the ATM protocol. ISPs who provide DSL services often use the EoA protocol for data transfer with their customers' DSL modems.
Page 92
PPPoA / PPPoE PPPoA (point-to-point protocol over ATM) and PPPoE (point-to-point protocol over Ethernet) are authentication and connection protocols used by many service providers for broadband Internet access. These are specifications for connecting multiple computer users on an Ethernet local area network to a remote site through common customer premises equipment, which is the telephone company's term for a modem and similar devices.
Need help?
Do you have a question about the 6200-2W and is the answer not in the manual?
Questions and answers