Summary of Contents for Dcbnet EtherSeries FT
- Page 1 F T-S eri e s E n c rypt ed E th ern et T unn el User’s Guide Revised November 6,2016 Firmware Version 2.x...
-
Page 2: Fcc Statement
FCC Statement This device complies with the limits for a Class A digital device, pursuant to Part 15 of the FCC rules. his equipment has been tested and found to comply with the limits for a Class A digital device pursuant to Part 15 of the FCC Rules. -
Page 3: Table Of Contents
ABLE OF ONTENTS FCC Statement............i RoHS...............i Chapter 1 Introduction..............6 EtherSeries FT-6602 Applications.........6 Other Features..............6 Protocols..............6 DHCP Protocol............7 Extensive Filtering.............7 802.1q VLAN............7 Upgradeable Firmware..........7 Security and Firewall Features........7 On-board Tools............7 Single-Interface operation..........7 Package Contents............7 Software Requirements..........7 FT-6602 Hardware............8 Introduction.............8 Configuration Options..........8 FT-6602 Front Panel..........8... - Page 4 Chapter 3 The Configuration Process........15 Overview................15 Using the Configuration Flexibility........15 Configuration Process Examples ........16 Change, test then save ..........16 Change, save, then reset...........16 Restore with a saved configuration......16 Note regarding saved configurations......16 Chapter 4 Configuration..............17 Overview................17 Administration..............17 Admin Password.............18 Fields...............18 Notes................18 Admin Access Control............19 Fields...............19...
- Page 5 Introduction Ethernet IP Configuration..........33 Fields...............34 Notes: ..............34 DHCP Server Configuration...........35 Fields...............35 Notes: ..............35 Ethernet PPPoE Configuration ........36 Fields...............36 Tunnel Mode..............38 Fields...............38 Encrypted Tunnel Configuration........39 Fields...............39 Server Mode Enabled:........39 Client Mode Enabled: ........39 On Failure: (Optional)........39 Notes................40 Generate Certificate Authority Key........41 Fields...............41 Notes................42 Generate Local Key............43...
- Page 6 Packet Sniffer Screen.............53 Fields...............54 Notes................54 Interface Status Screen..........55 Routing Table Screen............55 Store Configuration Screen...........56 Activate Configuration Screen........56 Tunnel Log Screen............57 Tunnel Nodes Screen.............58 Tunnel Addresses Screen..........58 DHCP Status Screen............59 PPPoE Log..............60 Chapter 5 Quick-Start Guide............61 Overview ...............61 Step 1: Setting Initial LAN1 IP address....61 Step 2: Accessing the Web Interface.......62 Step 3: Configure LAN1..........63 Step 4: Activate Changes.........63...
- Page 7 Introduction Transmit Data............71 DTR................71 Signal Ground............71 DSR................71 RTS................71 CTS................72 Ring Indicator............72 Cables................72 To PC 9-pin COM: port........72 Bridge to hub or ethernet switch......72 Appendix B Open Source Software Information......73 Introduction.............73 Obtaining the Source Code........73 Appendix C 802.1Q VLAN Tagging ..........74 Introduction.............74 VLAN Configuration Differences......74...
-
Page 8: Chapter 1 Introduction
This chapter provides an overview of the EtherSeries FT Ethernet Tunnel Bridge’s features and capabilities. ongratulations on the purchase of your new EtherSeries FT Encrypted Ethernet Bridge. This is a simple, easily configured tunneling device containing up to three Ethernet interfaces. -
Page 9: Dhcp Protocol
Configuration FIPS 140-2 The FT series uses a FIPS certified encryption module. AES is used for the bulk data encryption. SHA1 is used for signing and RSA 2048 for key exchange and authentication. A USB memory device is used for certificate information storage. -
Page 10: Software Requirements
Software Requirements The bridge supports IP and associated protocols such as UDP, ICMP, PPPoE, DHCP, multi-cast, and any protocol built upon IP or TCP/IP. It also bridges any valid Ethernet protocol. The initial IP address may be entered using any terminal or terminal emulation software on a PC. A standard web browser ( Internet Explorer or Firefox are recommended.) may be used for configuration once the bridge is configured with a valid IP address. -
Page 11: Introduction
Configuration FT-6602 Specific The FT-6600 family consists of various models with different internal hardware or firmware options. The FT-6602 includes three ethernet ports . Introduction The FT-6602 model bridge contains three ethernet interfaces. It is often connected directly to an Ethernet WAN connection using a public high speed network, DSL modem, or Cable modem. -
Page 12: Rear Panel Ethernet Connectors
Rear Panel Ethernet Connectors The three 10/100BaseT connectors are auto-sensing Rear Panel USB Connectors There are two USB connectors. They are interchangeable, and only the first one that senses a USB device connection is activated. These are used only for a “certificate authority” USB memory device. -
Page 13: Ft-6630 Specific - Two High Performance Ports
Configuration FT-6630 Specific – Two High Performance Ports The FT-6600 family consists of various models with different internal hardware or firmware options. The FT-6630 includes two 10/100/1000BaseT High Performance Ethernet ports. The FT-6630 is no longer available and is replaced with the FT-6632 Introduction The FT-6630 bridge contains two gigabit Ethernet ports and is normally used at the head end to support multiple remote FT products. - Page 14 FT-6632 Specific – Two High Performance Ports The FT-6600 family consists of various models with different internal hardware or firmware options. The FT-6632 includes two 10/100/1000BaseT High Performance Ethernet ports. Introduction The FT-6632 bridge contains two gigabit Ethernet ports and may be used at the head end to support multiple remote FT products or for high performance links.
-
Page 15: Chapter 2 Installation
Configuration Chapter 2 Installation This Chapter details the installation process for the EtherSeries Bridge. Overview The bridge is normally configured using a web browser directed to its address. If the default address of 192.168.0.1 is appropriate for your local network, then plug it in and simply direct your web browser to the bridge (without using a proxy) and continue with configuration. - Page 16 Welcome to the FT-6602 v1.00 To start the Setup Program, login with the name: setup localhost login: setup Login Screen 4. The Bridge will reboot pausing at a login screen. For initial setup, enter the login name “setup” in lower case letters. No password is required. 5.
-
Page 17: Connect The Ethernet Cable
Configuration Saving Configuration. Do not cycle power... Setup complete. After rebooting the system, you will be able to configure the unit from a Web Browser. Use the URL https://205.166.54.173 rebooting system. 9. The bridge will now reboot. 2. Connect the Ethernet Cable Connect a LAN cable from your hub or switch to Ethernet Port A. -
Page 18: Enter Your Configuration
4. Enter Your Configuration Initial Main Menu From this index screen, you can select a section on the left and will be taken to configuration screens for each bridge subsystem. 5. Minimum Configuration The minimum configuration items required for basic LAN-to-LAN bridging are: Secure side ethernet configuration. -
Page 19: The Configuration Process
Configuration Chapter 3 The Configuration Process This Chapter describes the configuration management process on the FT-6602 bridge using a Web Browser. Overview The FT-6602 bridge contains a quite flexible configuration management system. By using this system correctly, after initial configuration, one can remotely configure the bridge, save copies of that configuration to a PC, make configuration changes for later activation, and remote transfer firmware upgrades to the bridge. -
Page 20: Configuration Process Examples
Configuration Process Examples Change, test then save Make configuration changes, test them with activate, then save them with save. This is the most commonly used method for changing the bridge configuration. It allows you to test the configuration prior to saving it. If, during the testing, you notice an abnormality; you can reset the bridge to return to the last good configuration. -
Page 21: Chapter 4 Configuration
Chapter 4 Configuration This Chapter describes configuration screens and some configuration hints for the EtherSeries FT-6602 Bridge Overview The FT-6602 bridge is configured using forms displayed on a web browser. In this chapter, we illustrate all entry forms, and describe their use. This is not a tutorial on IP, bridging, or routing. Familiarity with IP and related information is required before you can configure any ethernet product. -
Page 22: Admin Password
Admin Password Admin Password Screen The FT-6602 web server screens are available ONLY via the secure side of the bridge. Access to the FT-6602 Web Server is protected requires a secure web browser using https:// . The Administration screen allows you to change the user name and password for the bridge administrator. -
Page 23: Admin Access Control
Configuration Admin Access Control Administrative Access Control Screen Access Control allows you to place further restrictions on access to the FT's internal web server. Fields Web Server Port This is the TCP Port to use for the FT's internal Web Server. Typically it is set to port 443. However you may set it to any value between 1 and 65535. -
Page 24: Notes
Respond to Ping This item allows you to block ping requests to the FT. Ping is a valuable tool for diagnosing network problems, but can also become a security problem. Disabling ping causes the FT to not respond to ping requests for one of its IP addresses. -
Page 25: Set Clock
Configuration Set Clock Set Clock Screen This form allows you to set the FT's clock. The setting will take effect when you press submit.. Fields Year Year in the range 2000 to 2035. Month Numeric value of month in the range 1 to 12. Day of month in the range 1 to 31. -
Page 26: Create Web Certificates
Create Web Certificates Create Web Certificates This form will allow you to install two x509 certificates into the tunnel's secure web server. One certificate is used to identify the web server. The second is used to verify the identity of the web browser. To install these certificates, insert the USB Flash drive that contains the previously generated certificate files into the... - Page 27 Configuration - You will be prompted for your Master Password. The Master password is for protecting your web browser's certificates. If this is the first time you have imported a certificate, you will be asked to create a password. - Select the file "dcbweb/wbrowser.p12" from the USB drive. - You will be prompted for the password used encrypt the certificate.
-
Page 28: Fields
Your browser should now be able to communicate with the server. It is normal to get a "Domain Name Mismatch" warning when you connect to the server. However, you should not get a "Website Certified by an Unknown Authority" or an "Untrusted Website" warning. If you do, it indicates that certificate presented by the device does not match the one stored in your web browser and that you may be communicating with an imposter device. -
Page 29: Install Certificates
Configuration Install Certificates Install Web Certificates This form will allow you to install two x509 certificates into the tunnel's secure web server. One certificate is used to identify the web server. The second is used to verify the identity of the web browser. To install these certificates, insert the USB Flash drive that contains the previously generated certificate files into the... -
Page 30: Fields
- You will be prompted for the password used encrypt the certificate. Enter the same password you used when you generated the certificates. Server Certificate - Select the "Web Sites" tab. - Press the "Import" button. - Select the file "dcbweb/wserver.pem" from the USB drive. - After import, highlight the server's certificate. -
Page 31: Set Clock
Configuration Set Clock Set Clock Screen This form allows you to set the FT's software clock. The setting will take effect when you submit the page. Storing or activating the changes is not needed. Fields Year Year in the range 2000 to 2035. Month Numeric value of month in the range 1 to 12. -
Page 32: Set All Defaults
Set All Defaults Set All Defaults Screen This form will allow you to set all bridge parameters to their default value. Before you "Activate Changes", you should configure the interface that you are using to access the tunnel. Otherwise, all interfaces except Ethernet-A will be disabled and Ethernet-A will be configured with the IP address of 192.168.0.1. -
Page 33: Fields
Configuration This form will allow you to copy the FT-6602’s configuration to a file on your PC. You can also use the form to transfer a configuration file from your PC to the bridge. The configuration is stored on the PC in an encrypted file. -
Page 34: Firmware Upgrade
Firmware Upgrade Firmware Upgrade Screen This form will allow you to load new firmware into the FT-6602. The firmware will be saved to non- volatile memory, replacing the current firmware. The firmware file larger than 7 Mbytes. It may several minutes to upload the file. Fields ... -
Page 35: System Reboot
Configuration System Reboot System Reboot Screen This form will allow you to reboot the FT-6602. If you have configuration changes that have not been saved to non-volatile memory, they will be lost. This is the method to revert back to the previously stored configuration. Fields ... -
Page 36: Version Information Screen
Version Information Screen Version Information Screen This screen displays current firmware and hardware version information as well as some copyright notices. LAN 1 Ethernet Mode LAN 1 Ethernet Mode Screen The FT-6602 contains three ethernet interfaces. LAN 1 may be disabled or enabled, and the speed/duplex configured. In addition, LAN 2 and LAN 3 may be also be configured for PPPoE. -
Page 37: Fields
Configuration Fields LAN 1 Enable or disable Lan 1. The default is enabled. Speed/Duplex Select 100 MB or 10 MB and half or full duplex, AUTO. The default is AUTO. Notes: Ethernet IP Configuration Ethernet Configuration Screen The FT-6602 contains three Ethernet interfaces. LAN 1 is always a local, secure side of the tunnel. The public network interface may be either LAN 2 or LAN 3. -
Page 38: Fields
Fields Configure IP The interface can be configured automatically using DHCP or statically. If you choose to use DCHP, there must be a DHCP server running on the network segment and the other fields are ignored. IP Address an IP address is a numeric identifier given to an interface. -
Page 39: Dhcp Server Configuration
Configuration DHCP Server Configuration DHCP Server Configuration Screen The FT-6602 may also provide DHCP services to clients on it's ethernet interfaces. Fields DHCP Server Enable/Disable a DHCP Server on the interface. Addresses will be dynamically assigned from the following pool in response to DHCP Client requests. ... -
Page 40: Ethernet Pppoe Configuration
Ethernet PPPoE Configuration Ethernet PPPoE Configuration Screen LAN 2 and LAN 3 interfaces may be configured to use PPPoE by using the Ethernet Mode screen. This screen is only displayed for those interfaces that have the mode configured to PPPoE. Fields ... - Page 41 Configuration Local IP Each side of a PPPoE connection will have an IP address. This is the IP address to use for the local PPPoE device. With PPPoE, you will normally leave this field blank and the PPPoE server will automatically assign an IP address upon connection.
-
Page 42: Tunnel Mode
Tunnel Mode Tunnel Mode Screen The FT-6602 may be configured as either a server, client, or both. FT-6602 clients connect to the server, so the server's IP address must be visible to the client either directly, or through a port-forwarding firewall. Fields Tunnel Mode Select the operating mode of the tunnel, either client, server or both. -
Page 43: Encrypted Tunnel Configuration
Configuration Encrypted Tunnel Configuration Tunnel Configuration Screen Some fields on this screen do not display if the associated mode is not selected. Fields Server Mode Enabled: Listen-to Port The TCP/IP port to listen to when server mode is enabled. Secondary Listen-to Port A secondary TCP/IP port to listen to when server mode is enabled. -
Page 44: Notes
The host name or IP address of the server tunnel. That is the address this client will connect to. Port The TCP/IP port to connect to when client mode is enabled. The server must be listening on this port Via Interface Which network interface to use when connecting to the server. -
Page 45: Generate Certificate Authority Key
Configuration Generate Certificate Authority Key Generate CA Key The tunnel makes use of certificates (public-key cryptography) to identify and authenticate the endpoints. Before you can generate endpoint certificates (local keys), you first need to create a Certificate Authority (CA). The CA will be stored on a USB Flash Drive (supplied with the FT-6602). You can think of this USB Flash Drive as being your master CA key. -
Page 46: Notes
Country Code ● The country code given to the certificate. It is 2 characters in length, limit to alph-numeric characters. State/Province ● The State or Province name given to the certificate. It may be 1 to 64 characters in length, limit to alph-numeric characters. -
Page 47: Generate Local Key
Configuration Generate Local Key Generate Local Key The tunnel makes use of certificates (public-key cryptography) to identify and authenticate the endpoints. Before you can generate endpoint certificates (local keys), you first need to create a Certificate Authority (CA). The CA will be stored on a USB Flash Drive (supplied with the FT-6602). You can think of this USB Flash Drive as being your master CA key. -
Page 48: Notes
CA Password ● The Certificate Authority (CA) Key is password protected. You must enter the same password used with the CA was generated. . Notes Advanced Tunnel Configuration Advanced Tunnel Configuration Screen Fields Idle Disconnect Time Setting a time enables an idle disconnect timer. If no packets are received from a remote tunnel for the specified amount of time, the TCP/IP connection with that remote tunnel is closed. -
Page 49: Notes
Configuration Duplicate Client Names This option only applies to the server tunnel. When set to no, the server will only allow one instance of a client, based on it name, to be connect Filter All Connections Bridge filters (Ethernet, IP, UDP, and TCP) are normally applied only to the packets traveling in from the local Ethernet toward a remote tunnel. -
Page 50: Fields
Please note that Ethernet filtering is only applied to packets traveling in from the local Ethernet toward a remote tunnel. For Ethernet frames tagged an 802.1Q protocol ID, the protocol ID of the original frame will be used for comparison. Fields ... -
Page 51: Fields
Configuration IP filters are used to limit the Ethernet packets sent from the local tunnel to a remote tunnel. This level of filtering is performed on IP(0800) and ARP(0806) packets by comparing the destination and source addresses against a table of rules. To use IP filtering, you first select a default rule. -
Page 52: Udp Address Filters Screen
UDP Address Filters Screen UDP Address Filters Screen UDP filters are used to limit the UDP packets sent from the local tunnel to a remote tunnel. This level of filtering is performed on the Destination Port Number. It would typically be used to eliminate certain types of UDP broadcasts. -
Page 53: Notes
Configuration Notes Please note that UDP filtering is only applied to packets traveling in from the local Ethernet toward a remote tunnel. UDP filtering is performed after IP Filtering. Any packets discarded by IP filtering will not reach UDP filtering. TCP Address Filters Screen TCP Address Filters Screen TCP filters are used to limit the TCP packets sent from the local tunnel to a remote tunnel. -
Page 54: Notes
Low Destination Port This field specifies the Low Destination Port Number in an inclusive range. If you only wish to specify one port number, place that port number in both the low and high field. High Destination Port This field specifies the High Destination Port Number in an inclusive range. -
Page 55: Notes
Configuration Notes Ping Screen Ping Screen Ping will send four ICMP echo requests to the specified host. It will wait approximately 16 seconds for a response. Fields Host IP address of the target host. If hostname DNS is enabled, you may use a hostname. ... -
Page 56: Traceroute Screen
Traceroute Screen Traceroute Screen Traceroute displays the route that a packet will take to reach another host. This is performed by sending UDP packets to port 33434 with progressively larger Time-to-Live values and listening for ICMP TIME- EXCEEDED responses from the bridges along the way. Fields Host IP address of the target host. -
Page 57: Packet Sniffer Screen
Configuration Packet Sniffer Screen Packet Sniffer Screen The Packet Sniffer allows you to take a snapshot of the network traffic passing through an interface. Fields ● Interface Which interface to use. On a PPPoE interface, You will not see low-level PPP traffic on the PPPoE connection, only the payload traffic. -
Page 58: Interface Status Screen
Interface Status Screen Status Screen The Interface Status screen shows port status and packet counters for each interface on the FT. It displays counters that are useful in diagnosing network connectivity problems. Routing Table Screen Routing Table Screen The Routing Table screen shows all routes configured in the FT. -
Page 59: Store Configuration Screen
Configuration Store Configuration Screen Store Configuration Screen The Store configuration screen is used to store the current configuration to non-volatile memory. This does not activate configuration changes. Configuration changes are made to a temporary area. They may be “activated” using the Activate Changes screen, in which case they will become immediately active, overwriting the pre-existing configuration for the duration of this session;... -
Page 60: Tunnel Log Screen
Activate Configuration Screen The Activate configuration screen is used to activate the current changes. Configuration changes are made to a temporary area. These changes will become immediately active, overwriting the pre-existing configuration for the duration of this session. Changes may be “stored” using the store configuration screen, in which case they will be written to non-volatile memory and used at the next reset or power-up. -
Page 61: Tunnel Nodes Screen
Configuration Tunnel Nodes Screen Tunnel Nodes Screen The Tunnel Nodes Screen displays currently connected remote nodes. These nodes are other FT-6602 units that have authenticated with this unit. Tunnel Addresses Screen Tunnel Addresses Screen The Tunnel Addresses Screen displays the MAC address, interface location, number of packets passed, and time of the last packet received from tunneled nodes. -
Page 62: Dhcp Status Screen
DHCP Status Screen DHCP Status Screen The DHCP Client Log Screen displays recent history of DHCP client activity. -
Page 63: Pppoe Log
Configuration PPPoE Log PPPoE Log Screen The PPPoE Log screen displays recent PPPoE activity. -
Page 64: Chapter 5 Quick-Start Guide
Chapter 5 Quick-Start Guide This Chapter explains how to configure the FT-6602 for use. Overview This quick-start guide will walk you through the minimum steps necessary to setup a pair of FT-6602s to tunnel a private network over a public network. It will not go into detail, but will touch upon the steps and the order they should be performed. -
Page 65: Step 2: Accessing The Web Interface
Troubleshooting You can change the LAN1 IP address and reset the FT-6602 to defaults through the COM port. The COM port operates at 9600 baud, 8 data, 1 stop, no parity, no flow control. You will need a null-modem cable to connect a PC COM port. To enter serial setup mode, attach the serial cable and press <enter>... -
Page 66: Step 3: Configure Lan1
make changes to the form, then press the “submit” button to send the changes to the FT-6602. If you navigate to a different form without submitting it first, any changes will be lost. As you go through the forms, you will notice that the each configuration item is hyper-linked. Clicking the hyper-link will take you to a help page describing the configuration item in more detail. -
Page 67: Step 7: Configure Lan3
Troubleshooting Step 7: Configure LAN3 If you have a secondary Internet connection it can be used as backup link. Configure LAN3 in the same manner as LAN2. Otherwise, navigate to the LAN3 – Mode form and disable it. Step 8: Tunnel – Generate CA Key This step will only be performed once. -
Page 68: Step 10: Tunnel - Mode
correctly. Upon error, it may be necessary to remove the USB drive, wait 5 or so seconds, then reinsert the drive. Remove the USB Flash drive and store it in a safe place. You will need it in the future if you plan to add more client FT-6602 devices to your server. - Page 69 Troubleshooting...
-
Page 70: Chapter 6 Troubleshooting
Chapter 6 Troubleshooting This chapter outlines some problems that may occur during installation or operation and some possible solutions to them. If you follow the suggested troubleshooting steps and the EtherSeries bridge still does not function properly, please contact your dealer for further advice. Hardware Problems Before anything else, check that all cables are wired correctly and properly connected. -
Page 71: Other Problems
Troubleshooting In some cases, “smart” hubs and switches must be power-cycled to clear their internal ARP cache. This is often a problem on test bench setups where IP addresses are moved between different equipment or a unit is moved between ethernet switch receptacles. Other Problems P: Can’t run the initial configuration program using a serial cable connection. -
Page 72: Appendix A Specifications
Appendix A Specifications FT-6602 Bridge Specifications Flash Memory: DRAM: LAN 1 Interface: 10/100/BaseT, Autosense LAN 2 Interface: 10/100/BaseT, Autosense LAN 3 Interface: 10/100/BaseT, Autosense OS: uCLinux Power: 7-20 VDC 4 watts average, 6 watts maximum or Optional power supplies. - Page 73 Specifications Default IP address: 192.168.0.1 Authentication with built-in database using certificates Browser Management port: 443 SSL Operational Temperature 0C to +50C FT-6632 Bridge Specifications Encryption: AES 128, 192, or 256 bit LAN Interfaces: 10/100/1000BaseTx, Autosense X2 ...
-
Page 74: Control Signal Operation
RS-232 PIN Assignments – Management Port The RS-232 port wiring is identical to a standard PC 9 pin DE-9P COM: port. It operates as a DTE device. The chart below details signal directions and names. Serial Port Pin Assignments Signal Name Type Carrier Detect (DCD) Receive (Rx) -
Page 75: Cts
Specifications Input. Ring Indicator Not used Cables Commonly used cable connections: To PC 9-pin COM: port This null-modem crossover cable is easily constructed by combining a “PC-Direct” adapter hood and a “Remote-PC” adapter hood along with a straight through 10BaseT cable. This cable is used for configuration and is provided with the bridge. -
Page 76: Open Source Software Information
Appendix B Open Source Software Information Some models of the FT bridge were designed in conjunction with Open Source Linux software. Introduction Some models of the FT bridge were designed and programmed with Open Source Linux software in mind. The core Linux operating system is uClinux, available from http://www.uclinux.org . -
Page 77: 802.1Q Vlan Tagging
Specifications Appendix C 802.1Q VLAN Tagging The FT-6602 supports bridging of 802.1Q VLAN packets. Introduction The FT-6602 supports bridging 802.1Q Tagged Ethernet. An application for this is shown below (using ET-6600 units as an example) where two 802.1Q VLAN switches are being tunneled across the Internet. VLAN Configuration Differences The default configuration for the FT is for Standard Ethernet.
Need help?
Do you have a question about the EtherSeries FT and is the answer not in the manual?
Questions and answers