#

# Setting Up Routing and Bridging Links

This chapter describes how to configure a RADIUS user profile for IP routing, IPX routing, and bridging connections. The chapter contains:

Setting up a system-based IP routing connection
Setting up an interface-based IP routing connection
Setting up an IPX routing connection
Setting up a bridging connection
Setting up a DHCP connection
Setting up Network Address Translation (NAT) for LAN

## Setting up a system-based IP routing connection

This section covers the following topics:

- Before you begin

- Introducing system-based IP routing

- Overview of RADIUS attributes for IP routing

- Specifying IP routing and RIP behavior

- Requiring that a caller accept an IP address from the MAX

- Defining a pool of IP addresses for dynamic assignment

- Configuring IP redirection

- Specifying default routes on a per-user basis

- Configuring static IP routes

- Summarizing host routes in an IP address pool

### Before you begin

Before you set up system-based IP routing in RADIUS, you must set up the MAX as a router. For details, see the MAX ISP and Telecommuting Configuration Guide.

### Introducing system-based IP routing

The MAX supports system-based IP routing over PPP, MP, MP+, raw TCP, and frame relay connections. In system-based routing, the entire unit has a single IP address. You can configure IP routing along with IPX routing and protocol-independent bridging. However, you cannot bridge and route TCP/IP packets across the same connection. When you configure the MAX as an IP router, it routes IP packets at the network layer, and does not bridge them at the link layer. The MAX bridges all other protocols, unless you turn off bridging.

The MAX creates a routing table when it powers up. When you power on or reset the MAX, it adds all the routes it knows about to the table, including the following:

- Static routes from MAX IP Route profiles

- Static routes from RADIUS pseudo-user profiles

- Static routes from MAX Connection profiles

- Dynamic routes from Routing Information Protocol (RIP) updates

- Dynamic routes from Open Shortest Path First (OSPF) updates

A static route is a path from one network to another that you define in a profile. A dynamic route is a route that the MAX adds to the routing table based on updates it receives. Routers that use RIP broadcast their entire routing tables every thirty seconds, updating other routers with the most current information. OSPF routers also perform periodic updates.

The MAX cannot read some static routes at power up. These routes do not become part of the routing table until they are up and usable, and include the following:

- Routes you configure in incoming RADIUS user profiles.

  Every RADIUS user profile that specifies an explicit IP address is a static route.

- Host routes to addresses the MAX assigns dynamically from a pool.

- Routes you add using the Iproute Add terminal server command.

- Routes placed in the table by SNMP MIB II.

For complete details about IP routing and the IP routing table, see the MAX ISP and Telecommuting Configuration Guide.

### Overview of RADIUS attributes for IP routing

Table 6-1 lists the attributes relevant to IP routing.

Table 6-1. IP routing attributes

#### Attribute

#### Description

#### Possible values

Ascend-Assign-IP-Client (144)

Specifies the IP address of an Ascend unit that can use global IP address pools.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

Ascend-Assign-IP-Global-Pool (146)

Specifies the global address pool from which RADIUS should assign a user an address.

Text string. The default value is null.

Ascend-Assign-IP-Pool (218)

Specifies the address pool that incoming calls use.

Integer between 1 and 50. The default value is 1.

Ascend-Assign-IP-Server (145)

Specifies the IP address of the host running radipad.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

Ascend-Client-Gateway (132)

Specifies the default route for IP packets coming from the user on this connection.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

Ascend-IP-Direct (209)

Specifies the IP address to which the MAX redirects packets from the user.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0. This setting specifies that the MAX does not perform IP redirection.

Ascend-IP-Pool-Definition (217)

Specifies the first IP address in an IP address pool, and the number of addresses in the pool.

num is the number of the pool. The default value is 1.

first_ipaddr is the first IP address in the pool. The default value is 0.0.0.0.

max_entries is the maximum
number of entries in the pool. The default value is 0 (zero).

Ascend-Metric (225)

Specifies the virtual hop count of the route.

Integer between 1 and 15. The default value is 7.

Ascend-Route-IP (228)

Specifies whether the MAX enables IP routing for the user
profile.

Route-IP-No (0)
Route-IP-Yes (1)

The default value is Route-IP-Yes.

Framed-Address (8)

Specifies the IP address of the caller.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0. An answering user profile with this setting matches all IP addresses.

Framed-Netmask (9)

Specify the subnet mask in use for a caller.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0.

Framed-Route (22)

Specifies a static IP route for inclusion in the MAX unit's routing table.

host_ipaddr/subnet_mask`` is the IP address of a host or subnet reached by the route. The default value is 0.0.0.0/0.

router_ipaddr is the IP address of the router at the remote end of the connection. The default value is 0.0.0.0.

metric is the metric for the route. The default value is 8.

private has the value y if the route is private, or n if it is not private. The default value is n.

profile_name is the name of the outgoing user profile that uses the route. The default value is null.

preference is the preference the MAX gives the route. Routes with lower preferences take precedence over routes with large preferences. The default value is 120.

Framed-Routing (10)

Specifies whether the MAX sends RIP packets, receives RIP packets, or both.

None (0)
Broadcast (1)
Listen (2)
Broadcast-Listen (3)
Broadcast-v2 (4)
Listen-v2 (5)
Broadcast-Listen-v2 (6)

The default value is None.

### Specifying IP routing and RIP behavior

To specify IP routing and RIP behavior for a user profile, follow these steps:

1. Specify the User-Name and Password attributes, authentication attributes, and WAN
   connection attributes.

For details on setting the User-Name, Password, and authentication attributes, see Chapter 3, Setting Up RADIUS Authentication. For details on setting up WAN
connection attributes, see Chapter 4, Setting Up WAN Connections in RADIUS.

2. To turn on IP routing for the user profile, set Ascend-Route-IP=Route-IP-Yes.

3. To specify the caller's IP address, set the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   RADIUS can authenticate an incoming call by matching its IP address to one specified in the RADIUS user profile. In addition, if the remote end requires an IP address on an outgoing call, and does not assign one dynamically, you must specify it in the user profile.

   Every Connection profile and RADIUS user profile that specifies an explicit IP address is a static route.

   Note: The most common cause of trouble in establishing an IP connection is incorrect configuration of the IP address or subnet specification for the remote host or calling device.

4. To specify RIP behavior for the profile, set the Framed-Routing attribute.

   You can specify one of these values:

   - None (0) indicates that the MAX does not send or receive RIP updates.

     None is the default. Many sites turn off RIP on the WAN interface in order to avoid storing very large local routing tables. If you turn off RIP, the MAX does not listen to RIP updates across the connection. To route to other networks through that connection, the MAX must rely on static routes you specify in a pseudo-user profile. For details, see Configuring static IP routes.

   - Broadcast (1) indicates that the MAX sends RIP version 1 updates, but does not receive them.

   - Listen (2) indicates that the MAX receives RIP version 1 updates, but does not send them.

   - Broadcast-Listen (3) indicates that the MAX both sends and receives RIP version 1 updates.

   - Broadcast-v2 (4) indicates that the MAX sends RIP version 2 updates, but does not receive them.

   - Listen-v2 (5) indicates that the MAX receives RIP version 2 updates, but does not send them.

   - Broadcast-Listen-v2 (6) indicates that the MAX both sends and receives RIP version 2 updates.

   If you enable RIP to both send and receive RIP updates on the WAN interface, the MAX broadcasts its routing table to the remote network and listens for RIP updates from that network. Gradually, all routers on both networks have consistent routing tables (all of which may become quite large).

5. Because routers send RIP updates every 30 seconds, you should configure WAN
   connections that use RIP in one of these ways:

   - Set the Ascend-Idle-Limit attribute set to a value less than 30, as described in Specifying a time limit and idle connection attributes.

   - Apply a call filter for RIP updates on the WAN by setting the Ascend-Call-Filter attribute, as described in Configuring IP filters.

   If you don't carry out one of these tasks, the connection never disconnects, because RIP traffic resets the idle timer.

6. To specify the virtual hop count of the route, set the Ascend-Metric attribute.

   If there are two routes available to a single destination network, you can ensure that the MAX uses any available nailed-up channel before using a switched channel. Simply set the Ascend-Metric attribute to a value higher than the metric of any nailed-up route. The higher the value you enter, the less likely that the MAX will bring the link online. The MAX uses the lowest metric.

   For example, if a route to a station takes three hops over nailed-up lines, and
   Ascend-Metric=4 in a user profile that reaches the same station, the MAX does not bring the user's link online. However, if the link is already online, the MAX does not use the nailed-up line.

#### Host-to-router connection example

When a device connecting to the MAX is a host running PPP dial-in software, the MAX adds a host route to its routing table and functions as an IP router between its local and WAN interfaces.

A host route connection enables the dial-in host to keep its own IP address when logging into the MAX IP network. For example, in Figure 6-1, if a PC user telecommutes to one IP network and uses an ISP on another IP network, one of those connections can assign an IP address and the other can configure a host route to the PC.

Figure 6-1. Host-to-router IP connection

In this example, the PC is running PPP software and the TCP/IP stack and has an ISDN modem card. The PPP software includes settings like these:

    Username=Emma
    Accept Assigned IP=N/A (or No)
    IP address=10.8.9.10
    Netmask=255.255.255.255
    Default Gateway=N/A (or None)
    Name Server=10.7.7.1
    Domain suffix=abc.com
    VAN Jacobsen compression ON

You set up the RADIUS user profile in this way:

    Emma Password="m2dan", User-Service=Framed-User

         Framed-Protocol=PPP,

         Ascend-Route-IP=Route-IP-Yes,

         Framed-Address=10.8.9.10,

         Framed-Netmask=255.255.255.255,

         Framed-Routing=None,

         Ascend-Metric=2,

         Framed-Compression=Van-Jacobson-TCP-IP,

         Ascend-Idle-Limit=20

#### Router-to-router connection example

When the device connecting to the MAX is an IP router that belongs to an IP network, the connection results in a route to that remote network or subnet. In this example, the MAX is connected to a corporate IP network and needs a switched connection to another company that has its own IP configuration. Figure 6-2 shows the network diagram.

Figure 6-2. A router-to-router IP connection

To configure the site A MAX for a connection to site B, set up the RADIUS user profile in this way:

    PipelineB Password="m2dan", User-Service=Framed-User

              Framed-Protocol=MPP,

              Ascend-Route-IP=Route-IP-Yes,

              Framed-Address=10.8.9.10,

              Framed-Netmask=255.255.252.0,

              Framed-Routing=Broadcast,

              Ascend-Metric=2,

              Framed-Compression=Van-Jacobson-TCP-IP,

              Ascend-Idle-Limit=20

### Requiring that a caller accept an IP address from the MAX

To require that a caller accept an IP address from the MAX, follow these steps:

1. To specify that the MAX try to assign an IP address to a calling device, set Assign Adrs=Yes in the Ethernet > Answer menu.

The MAX asks the device to accept an assigned address. The address can be a static address or a dynamic address.

- Static address

  You specify a static address using the LAN Adrs parameter in a Connection profile or by the Framed-Address attribute in a RADIUS user profile.

- Dynamic address

  A dynamic address comes from the pool of addresses set by the Pool #n Start and Pool #n Count parameters in the MAX configuration interface, by the Ascend-IP-Pool-Definition attribute in RADIUS, or both. An IP address pool you set up in RADIUS overrides an IP address pool you set up in the MAX configuration interface only if you designate the two pools by the same number.

  If the calling end accepts the IP address, the MAX sets the LAN Adrs parameter (in a Connection profile) or Framed-Address attribute (in a RADIUS user profile) to the assigned address. If a static address is already set in a Connection profile or RADIUS user profile, it overrides any IP address from an IP address pool.

Note: In some TCP/IP implementations, when the workstation needs the MAX to set the IP address, you must set the workstation's address to 0.0.0.0. Setting the address to any other value tells the workstation to use that value and notify the MAX.

2. To require a calling station to accept an IP address from the MAX, set Pool Only=Yes in the Ethernet\>Mod Config\>WAN Options menu.

This setting requires the calling station to accept a static address (specified in a Connection profile or RADIUS user profile), or a dynamic address. If the calling station rejects the assignment, the MAX ends the call.

If you set Pool Only=No, the MAX accepts the IP address the caller specifies.

3. In the RADIUS user profile, configure a static address or specify an IP address pool from which users will receive IP addresses.

   To configure a static IP address, set the Framed-Address and Framed-Netmask attributes. To configure an IP address pool and specify the pool an incoming caller should use, follow the instructions in Defining a pool of IP addresses for dynamic assignment.

### Defining a pool of IP addresses for dynamic assignment

When the device connecting to the MAX is a host running PPP dial-in software, the MAX adds a host route to its routing table. If the host belongs to its own IP network, the MAX must have a Connection profile or RADIUS user profile stating the host's address and using a 32-bit subnet mask. If the host does not belong to an IP network, the MAX can add it to the local IP network by assigning a local address from a designated pool of addresses. You can designate a pool of addresses on the MAX or in RADIUS.

A pool is a range of contiguous IP addresses on your local network. The MAX chooses an address from these pools and assigns it to an incoming call when Assign Adrs=Yes in the Ethernet > Answer menu, or when the calling station requests an address assignment. Assigning an address to a device is called performing dynamic IP. Dynamic IP can apply when the calling end is a station. However, if the calling end is a router, that router usually rejects attempts to perform dynamic IP.

By default, each MAX handles dynamic IP address allocation individually from a pool of addresses pre-assigned to each MAX. However, you can also set up your system to allocate IP addresses to callers from a global pool of addresses among many units.

If you need to define more than ten pools of addresses, you must use RADIUS. An IP address pool you set up in RADIUS overrides an IP address pool you set up in the MAX configuration interface only if you designate the two pools by the same number.

When you assign a pool of addresses, make sure that you do not include addresses that are in use. Although the MAX will inform you of a configuration error if you try to specify a pool whose addresses overlap or conflict with an existing pool, it does not have an automatic protection against including an address in a pool that is already in use elsewhere. If you allocate IP addresses on a separate IP network or subnet, other IP hosts on the local network need to know about the route to that new network or subnet.

#### Before you begin

Before you create IP address pools in RADIUS, you must perform these tasks using the MAX configuration interface:

1. To specify that the MAX try to assign an IP address to a calling device, set Assign Adrs=Yes in the Ethernet > Answer menu.

2. To require calling stations to accept an IP address from the MAX, set Pool Only=Yes in the Ethernet \> Mod Config \> WAN Options menu.

   If the calling station rejects the assignment, the MAX ends the call.

For details on how these parameters work with RADIUS, see Requiring that a caller accept an IP address from the MAX.

#### Configuring MAX-specific IP address pools in RADIUS

To define MAX-specific pools of IP addresses for dynamic assignment to callers, follow these steps:

1. Create the first line of a RADIUS pseudo-user profile using the User-Name, Password, and User-Service attributes.

You create a pseudo-user to store information that the MAX can query-in this case, in order to store IP address pool information. Specify the first line of a pseudo-user profile in this format:

    Pools-unit_name Password="Ascend", User-Service=Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile.

2. To define one or more address pools, set the Ascend-IP-Pool-Definition attribute.

The Ascend-IP-Pool-Definition attribute has this format:

    Ascend-IP-Pool-Definition="num first_ipaddr max_entries"

Table 6-2 describes each Ascend-IP-Pool-Definition argument.

Table 6-2. Ascend-IP-Pool-Definition arguments

#### Argument

#### Description

num

Indicates the number of the pool. The default value is 1.

Specify pool numbers starting with 1, unless you have defined pools in the MAX interface using the Pool #n Start and Pool #n Count parameters and do not wish to override these settings. In this case, for the num argument, specify the highest number of an address pool on the MAX + 1.

For example, if you have set up address pools 1 through 5 on the MAX, specify pool numbers starting with 6 in RADIUS.

first_ipaddr

Specifies the first IP address in the address pool. The address you indicate should not accept a subnet mask, because it always becomes a host route. The default value is 0.0.0.0.

max_entries

Specifies the maximum number of IP addresses in the pool. The MAX assigns addresses sequentially, from first_ipaddr`` on, up to the limit of addresses specified by max_entries. The default value is 0 (zero).

1. In each RADIUS user profile requiring dynamic addressing for dial-in users, set the Ascend-Assign-IP-Pool attribute to specify the address pool from which RADIUS should assign each user an address.

If you set Ascend-Assign-IP-Pool=0, RADIUS chooses an address from any pool that has one available.

Do not set the Framed-Address attribute. If you do, the MAX requires the caller to use the static IP address the attribute specifies.

##### MAX-specific address pools example

Figure 6-3 shows a MAX connected to a dial-in host with a modem and PPP software. The remote host requests a dynamic IP address, and the MAX provides one.

Figure 6-3. An IP routing connection with dial-in host requiring dynamic IP addressing

The RADIUS pseudo-user file contains the IP pool definitions. In this example, you create two IP address pools for the MAX to use. Address pool #1 contains a block of 7 IP addresses from 10.1.0.1 to 10.1.0.7. Address pool #2 contains a block of 48 IP addresses from 10.2.0.1 to 10.2.0.48.

    Pools-MAX Password="Ascend", User-Service=Dialout-Framed-User

        Ascend-IP-Pool-Definition="1 10.1.0.1 7",

        Ascend-IP-Pool-Definition="2 10.2.0.1 48"

In the user profile, the host requests an address from address pool #1:

    Emma Password="m2dan", User-Service=Framed-User

         Framed-Protocol=PPP,

         Ascend-Route-IP=Route-IP-Yes,

         Ascend-Metric=2,

         Framed-Routing=None,

         Ascend-Assign-IP-Pool=1

#### Configuring global IP address pools shared by several MAX units

To define global IP address pools that several MAX units share, follow these steps:

1. Install radipad, as described in Installing radipad for global IP pools.

2. Create the first line of a pseudo-user profile called Radipa-Hosts in this format:

    Radipa-Hosts Password="Ascend", User-Service=Dialout-Framed-User

You create a pseudo-user to store information that the MAX can query-in this case, in order to store the IP addresses of Ascend units that can use global IP pools, and the IP address of the host running radipad. The RADIUS daemon reads this pseudo-user profile before connecting to the host running radipad.

- For the Ascend-Assign-IP-Client attribute, specify the IP address of an Ascend unit that can use global IP address pools.

The default value is 0.0.0.0. You can specify multiple instances of this attribute. At present, the MAX does not use the list of radipad client units. If no Ascend-Assign-IP-
Client attribute is present, the list of client units defaults to those present in the RADIUS clients file.

- For the Ascend-Assign-IP-Server attribute, specify the IP address of the host running
  radipad.

  The default value is 0.0.0.0. Only one instance of this attribute can appear in the profile. The default value is a place-holder only. You must specify a valid IP address for radipad to work.

- Create the first line of another RADIUS pseudo-user profile using this format:

      Global-Pool-name Password="Ascend", User-Service=Dialout-Framed-User

  name is a designation for any class of users you want to define.

- To define one or more address pools, set the Ascend-IP-Pool-Definition attribute.

  The Ascend-IP-Pool-Definition attribute has this format:

  Ascend-IP-Pool-Definition="num first_ipaddr max_entries"

  For information on each Ascend-IP-Pool-Definition argument, see Table 6-2.

- In each RADIUS user profile requiring dynamic addressing for dial-in users, set the Ascend-Assign-IP-Global-Pool attribute to specify the global address pool from which RADIUS should assign each user an address.

  Specify the name of the pseudo-user profile containing the global IP pool definitions. The Ascend unit tries to allocate an address from the pools in order, and chooses an address from the pool with the first available IP address.

  Do not set the Framed-Address attribute. If you do, the MAX will require the caller to use the static IP address the attribute specifies.

  At startup, the MAX syslog notes RADIUS requests to release any RADIUS-allocated IP addresses. Some versions of the RADIUS server timeout the request, resulting in one of these log messages:

      RADIUS release global-pool address

      RADIUS release all global-pool addresses

  ##### Global IP pools example

  In this example, two MAX units are connected to several dial-in clients. The global IP pool configuration consists of these elements:

  - A pseudo-user profile containing the IP address of the host running radipad

  - A pseudo-user profile contains the global IP pool definitions

  - A user profile containing a pointer to the pseudo-user profile containing the pool definitions

  In this example, radipad is running on a host at IP address 10.4.0.1. The Radipa-Hosts pseudo-user profile looks like this one:

      Radipa-Hosts Password="Ascend", User-Service=Dialout-Framed-User

          Ascend-Assign-IP-Server=10.4.0.1

  The global pools pseudo-user profile looks like this one:

      Global-Pool-CA Password="Ascend", User-Service=Dialout-Framed-User

          Ascend-IP-Pool-Definition="1 10.1.0.1 7",

          Ascend-IP-Pool-Definition="2 10.2.0.1 48"

          Ascend-IP-Pool-Definition="3 10.3.0.1 49"

  The profile creates three global IP address pools for the MAX units to use. Address pool #1 contains a block of 7 IP addresses from 10.1.0.1 to 10.1.0.7. Address pool #2 contains a block of 48 IP addresses from 10.2.0.1 to 10.2.0.48. Address pool #3 contains a block of 49 addresses from 10.3.0.1 to 10.3.0.49.

  In the user profile, the user requests an address from a pool specified in the Global-Pool-CA pseudo-user profile:

      Emma Password="m2dan", User-Service=Framed-User

           Framed-Protocol=PPP,

           Ascend-Route-IP=Route-IP-Yes,

           Ascend-Metric=2,

  Framed-Routing=None,

           Ascend-Assign-Global-IP-Pool=Global-Pool-CA

  ### Configuring IP redirection

  You can configure a RADIUS user profile to automatically redirect incoming IP packets to a specified host on the local IP network. When you specify IP redirection, the MAX bypasses all internal routing and bridging tables, and simply sends all packets it receives on a connection's WAN interface to the specified IP address. IP redirection does not affect outbound packets.

  To set up IP redirection, follow these steps:

  1. Specify the User-Name and Password attributes, authentication attributes, and WAN
     connection attributes.

  For details on setting the User-Name, Password, and authentication attributes, see Chapter 3, Setting Up RADIUS Authentication. For details on setting up WAN
  connection attributes, see Chapter 4, Setting Up WAN Connections in RADIUS.

  2. To specify the caller's IP address, set the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

  3. Set Ascend-Route-IP=Route-IP-Yes.

  4. Set Ascend-Bridge=Bridge-No.

  5. Set Ascend-IP-Direct to the IP address to which the MAX redirects packets from the user.

     For example, to specify that the MAX redirects packets to IP address 10.2.3.11, specify this setting:

     Ascend-IP-Direct=10.2.3.11

  6. Set Framed-Routing=None.

     Ascend-IP-Direct connections typically turn off RIP. If you configure the connection to receive RIP, the MAX keeps all RIP packets from the remote end and forwards them to the IP address you specify.

  7. Ensure that Framed-Protocol is not set to COMB or FR.

  Note: Do not set Ascend-IP-Direct and Ascend-FR-Direct in the same user profile. If you do, an error occurs.

  #### IP direct example

  This example shows IP redirection specified for a PPP link.

  Figure 6-4. Directing incoming IP packets to one local host

  In Figure 6-4, the MAX redirects incoming packets from site B to the host at IP address 10.2.3.11. The user profile looks like this one:

      Emma Password="m2dan", User-Service=Framed-User

                Framed-Protocol=PPP,

                Framed-Address=10.8.9.10,

                Framed-Netmask=255.255.252.0,

                Ascend-Route-IP=Route-IP-Yes,

                Ascend-Bridge=Bridge-No,

                Ascend-IP-Direct=10.2.3.11,

                Ascend-Metric=2,

                Framed-Routing=None,

                ...

  ### Specifying default routes on a per-user basis

  You can specify the default route for IP packets coming from a user in each RADIUS user profile. When you do so, the MAX routes IP packets in this way:

  1. The MAX consults its routing table to find a next-hop address.

  2. If the next hop is the default route for the system (destination 0.0.0.0), the Ascend unit uses the per-user default address as a next hop instead of the system-wide default route.

     The unit also uses the per-user default if the normal routing logic fails to find a route and there is no system-wide default route.

  This feature applies to routing all packets the MAX receives on an interface using a given profile, regardless of the specific IP source address. Therefore, you can use this feature when the profile belongs to another access router and all hosts behind that router use the default gateway. The MAX unit handles packets from other users or from the Ethernet normally. In addition, this feature does not alter the global routing table.

  To configure a per-user route, follow these steps:

  1. Configure the RADIUS user profile with a User-Name and Password on the first line.

  2. On the second or succeeding lines, set the Ascend-Client-Gateway attribute to the IP address of the next hop router.

     Enter the IP address in dotted decimal notation. The default value is 0.0.0.0. If you accept this value, the Ascend unit routes packets as specified in the routing table, using the system-wide default route if it cannot find a more specific route.

     The Ascend unit must have a direct route to the address you specify. The direct route can take place via a profile or an Ethernet connection. If the Ascend unit does not have a direct route, it drops the packets on the connection. When you diagnose routing problems with a profile using this feature, an error in a per-user gateway address is not apparent from inspection of the global routing table.

  For example, if you specify Ascend-Client-Gateway=10.0.0.3 in the profile "Berkeley", IP packets from the user with destinations through the default route go through the router at 10.0.0.3.

  ### Configuring static IP routes

  A static route is a path from one network to another. This path specifies the destination network and the router to use to get to that network. For routes that must be reliable, you can configure more than one path, in which case the MAX chooses the route to use based on an assigned metric.

  A dynamic route can overwrite a static route to the same network if the dynamic route's metric is lower than that of the static route. However, dynamic routes age. If the MAX does not receive updates for a route, the route eventually expires. In this case, the hidden static route reappears in the routing table.

  In RADIUS, you can create a static route in one of two ways:

  - In a pseudo-user profile containing one or more explicit routes

  - In a user profile specifying a WAN connection

  When the MAX has a RADIUS user profile that defines a static route to the same destination as one of the MAX unit's IP Route profiles or a RADIUS pseudo-user profile, the metric in the RADIUS user profile overrides the metric in the other profiles, but only when the RADIUS user connects.

  For example, suppose a MAX has a static route to network 1.10.1.10 with a metric of 10. A user profile in RADIUS has a metric of 7 in a static route to the same network. When the route is not connected, the MAX routing table indicates that the route has a metric of 10. When the route is connected, the MAX routing table indicates that the route has a metric of 7, with an `r` in the flags column to indicate that the route came from RADIUS. Furthermore, the old route with a metric of 10 remains in the routing table, with an asterisk (*) in the flags column, indicating that it is a hidden route.

  #### Specifying static IP routes in a pseudo-user profile

  When you disable RIP in a RADIUS user profile (Framed-Routing=None), the MAX does not listen to RIP updates across that connection. To route to other networks through that connection, the MAX must rely on static routes you define in a RADIUS pseudo-user profile.

  If you configure the MAX with a subnet address on a backbone network using the IP Adrs parameter in the Ethernet\>Mod Config\>Ether Options menu, you must set up a static route to the backbone router on the main network. If you do not, the MAX can only see the subnets to which it directly connects.

  You cannot create static routes for dynamically assigned IP addresses, because the actual route to those addresses changes with each dynamic assignment.

  To set up static IP routes in a RADIUS pseudo-user profile, follow these steps:

  1. Create the first line of a pseudo-user profile using the User-Name, Password, and
     User-Service attributes.

  You create a pseudo-user profile to store information that the MAX can query-in this case, in order to store IP routing information. You can configure pseudo-users for both global and MAX-specific configuration control of IP dialout routes. The MAX adds the unit-specific dialout routes in addition to the global dialout routes.

  For a unit-specific IP dialout route, specify the first line of a pseudo-user profile in this format:

      Route-unit_name-num Password="Ascend", User-Service=Dialout-Framed-
      User

  For a global IP dialout route, specify the first line of a pseudo-user profile in this format:

      Route-num Password="Ascend", User-Service=Dialout-Framed-User

  unit_name`` is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

- For each pseudo-user profile, specify one or more routes using the Framed-Route attribute.

  The Framed-Route attribute has this format:

      Framed-Route="host_ipaddr[/subnet_mask] router_ipaddr

      metric [private] [profile_name][preference]"

  You should limit each profile to about 25 routes-that is, you should specify up to 25 settings for the Framed-Route attribute. The MAX fetches information from each pseudo-user profile in order to initialize its routing table.

  Table 6-3 describes each Framed-Route argument.

  Table 6-3. Framed-Route arguments

#### Syntax element

#### Description

host_ipaddr/subnet_mask

Indicates the IP address of the destination host or subnet reached by the route. The default value is 0.0.0.0/0.

If the address includes a subnet mask, the remote router specified by router_ipaddr`` is a router to that subnet, rather than to a whole remote network. To specify the entire remote network, do not specify a subnet mask.

router_ipaddr

Specifies the IP address of the router at the remote end of the connection. The default value is 0.0.0.0.

The 0.0.0.0 address is a wildcard entry the MAX replaces with the caller's IP address. When RADIUS authenticates a caller and sends the MAX an Access-Accept message with a value of 0.0.0.0 for router_ipaddr, the MAX updates its routing tables with the Framed-Route value, but substitutes the caller's IP address for the router. This setting is especially useful when RADIUS cannot know the IP address of the caller because the IP address comes from an address pool.

metric

Indicates the metric for the route. If the MAX has more than one possible route to a destination network, it chooses the one with the lower metric. The default value is 8.

private

Specifies y if the route is private, or n if it is not private. If you specify that the route is private, the MAX does not disclose the existence of the route when queried by RIP or another routing protocol. The default value is n.

profile_name

Indicates the name of the outgoing user profile that uses the route. The default value is null.

preference

Specifies the preference that the MAX gives the route.

Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds IP dialout routes to the routing table in this way:

1. RADIUS looks for profiles having the format Route-unit_name-1, where unit_name is the system name.

2. If at least one profile exists, RADIUS loads all existing profiles with the format
   Route-unit_name-num to initialize the IP routing table.

   The variable num`` is a number in a sequential series, starting with 1.

3. The MAX queries Route-unit_name-1, then Route-unit_name-2, and so on, until it receives an authentication reject from RADIUS.

4. RADIUS loads the global configuration profiles.

   These configurations have the format Route-num.

5. The MAX queries Route-1, then Route-2, and so on, until it receives an authentication reject from RADIUS.

##### Static IP route configuration example

The network diagram in Figure 6-5 shows a remote network that does not have its own Connection profile or RADIUS user profile, but can be reached through an existing RADIUS user profile.

Figure 6-5. A two-hop connection that requires a static route when RIP is off

In Figure 6-5, if RIP is disabled in the RADIUS user profile for site B, the MAX must have a static route like this one to route to site C:

    Route-1 Password="Ascend", User-Service=Dialout-Framed-User

            Framed-Route="10.4.5.0/22 10.9.8.10 1 n inu-out"

#### Specifying static IP routes in a dial-in user profile

Every Connection profile and RADIUS user profile that specifies an explicit IP address is a static route. For details on creating an implicit static route in a dial-in profile, see Specifying IP routing and RIP behavior.

In addition, you might wish to update the MAX unit's routing tables when connecting to a user whose profile specifies User-Service=Framed-User. In this case, you can set the Framed-Route attribute in an incoming user profile to specify the user's IP address and subnet mask with the host_ipaddr and /subnet_mask`` arguments. The route you specify in this manner exists only during the time the call is online. However, when you enter a nonzero router address for the router_ipaddr argument that is different from the caller's address, the static route of a dial-in framed-user persists even after the connection goes offline.

### Summarizing host routes in an IP address pool

By default, the MAX adds dynamically assigned IP addresses to the routing table as individual host routes. However, to reduce the size of routing table advertisements, you can summarize the entire pool. When you do so, the router advertises a single route for the network you define in an address pool, rather than individual host routes for each address. The MAX routes packets to a valid host address, and rejects packets with an invalid host address.

#### Before you begin

Before setting up the pool summary feature in RADIUS, set Pool Summary=Yes in the Ethernet > Mod Config > WAN Options menu.

#### Configuring host route summaries in RADIUS

To set up the pool summary feature, follow these steps:

1. Using the Ascend-IP-Pool-Definition attribute, make sure that each and every address pool is network aligned.

For an address pool to be network aligned, these conditions must apply:

- The first address in the pool must be the first host address.

  The value first_ipaddr - 1 determines the network alignment-that is, the zero address on the subnet. first_ipaddr specifies the first IP address in the pool for the Ascend-IP-Pool-Definition attribute.

- The maximum number of entries you specify with the max_entries argument of Ascend-IP-Pool-Definition must be two less than the total number of addresses in the pool.

  The value max_entries + 2 determines the total number of addresses in the subnet. You can calculate the subnet mask based on this total.

For example, suppose you have this specification for Ascend-IP-Pool-Definition:

Ascend-IP-Pool-Definition="1 10.12.253.1 62"

Because first_ipaddr=10.12.253.1, the network alignment address is 10.12.153.0 (first_ipaddr - 1).

Because max_entries=62, you must specify a subnet mask for 64 addresses (max_entries + 2). The subnet mask for 64 addresses is 255.255.255.192. (Note that 256-64=192). The Ascend notation for a 255.255.255.192 subnet mask is /26.

The resulting address pool network is 10.12.253.0/26. This address and subnet mask become the first values you specify for the Framed-Route attribute in step 3.

For instructions on setting up address pools, see Defining a pool of IP addresses for dynamic assignment.

2. Create the first line of a pseudo-user profile containing static routes using the User-Name, Password, and User-Service attributes.

You can configure pseudo-users for both global and MAX-specific configuration control of IP routes. The MAX adds the unit-specific routes in addition to the global routes.

For a unit-specific IP route, specify the first line of a pseudo-user profile in this format:

    Route-unit_name-num Password="Ascend", User-Service=Dialout-Framed-User

For a global IP route, specify the first line of a pseudo-user profile in this format:

    Route-num Password="Ascend", User-Service=Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the name parameter in the System profile. num is a number in a sequential series, starting at 1.

3. For each Framed-Route attribute, specify the host address and subnet mask for a summarized address pool.

The Framed-Route attribute has this format:

    Framed-Route="host_ipaddr[/subnet_mask] router_ipaddr
    metric [private] [profile_name][preference]"

For the host_ipaddr`` argument, specify the address of the summarized network. For the subnet_mask argument, specify the associated subnet mask.

4. For the router_ipaddr argument, specify the router address for each summarized network.

Because the MAX creates a host route for every address assigned from the pools, and because host routes override subnet routes, the MAX routes packets whose destination matches an assigned IP address from the pool. However, because the MAX advertises the entire pool as a route, and only privately knows which IP addresses in the pool are active, a remote network might improperly send the MAX a packet to an inactive IP address.

The router address handles all IP addresses not assigned to users. When the MAX receives a packet whose IP address matches an unused IP address in a pool, it either returns the packet to the sender with an ICMP reject message, or simply discards the packet.

To enable the router to handle packets with destinations to invalid hosts on the summarized network, you must specify one of these internal interfaces as the router_ipaddr argument.

- The reject interface (rj0)

  The reject interface has an IP address of 127.0.0.2. When you specify this address as the router to the destination pool network, the MAX rejects packets to an invalid host on that network, appending an ICMP host unreachable message.

- The black-hole interface (bh0)

  The black-hole interface has an IP address of 127.0.0.3. When you specify this address as the router to the destination pool network, the MAX silently discards packets to an invalid host on that network.

5. Set the metric argument to 0.

6. Set the private argument to n for No.

7. Set the profile_name argument to the name of the pseudo-user profile.

8. If you want to specify a preference other than the default value of 120, set the preference.

For example, to set up a static route for address pool network 10.12.253.0/26 with a reject interface, enter this setting in a pseudo-user profile called Summary:

    Framed-Route="10.12.253.0/26 127.0.0.2 0 n Summary 130"

## Setting up an interface-based IP routing connection

All Ascend products implement system-based routing, in which the entire unit has a single IP address. For systems that have a single backbone connection, system-based routing is the simplest way to configure the MAX.

An alternative form of routing is called interface-based routing. With interface-based routing, each physical or logical interface on the unit has its own IP address. In some situations, it is useful to number some of the interfaces- in other words, to have the MAX operate partially as a system-based router and partially as an interface-based router. Reasons for using numbered interfaces include troubleshooting nailed-up point-to-point connections and forcing routing decisions between two links going to the same final destination. More generally, interface-based routing allows the MAX to operate more as a multi-homed Internet host behaves.

You can now configure each link in RADIUS as numbered (interface-based) or unnumbered (system-based). If no interfaces are numbered, the MAX operates as a purely system-based router.

If a MAX is using a numbered interface, you should be aware of these features:

- IP packets that the MAX generates and sends to the remote address have an IP source address corresponding to the numbered interface, not to the default (Ethernet) address of the MAX.

- During authentication of a call the MAX places using a numbered interface, the MAX reports the address of the interface as its IP address.

- The MAX adds all numbered interfaces listed in Connection profiles and RADIUS user profiles to its routing table.

- The MAX accepts IP packets whose destination is a numbered interface listed in a Connection profile or a RADIUS user profile, considering them to be destined for the MAX itself.

  The packet may actually arrive over any interface, and the numbered interface corresponding to the packet's destination address need not be in the active state.

### Before you begin

Before you carry out the tasks outlined in this section, be sure to set up the WAN connection, specifying system-based IP routing attributes. For information on configuring a WAN connection, see Chapter 4, Setting Up WAN Connections in RADIUS. For information on configuring system-based IP routing, see Setting up a system-based IP routing connection.

### Overview of RADIUS attributes for interface-based routing

Table 6-4 lists the RADIUS attributes you set for interface-based routing.

Table 6-4. RADIUS attributes for interface-based routing

#### Attribute

#### Description

#### Possible values

Ascend-IF-Netmask (153)

Specifies the subnet mask in use for the local numbered interface.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

Ascend-PPP-Address (253)

Specifies the IP address of the MAX as reported to the calling unit during PPP IPCP negotiations.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

Ascend-Remote-Addr (154)

Specifies the IP address of the link's remote interface to the WAN.

IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255.

The default value is 0.0.0.0.

### Configuring interface-based routing in RADIUS

This section provides some guidelines on configuring interface-based routing in RADIUS.

#### If both the system and interface addresses are known

If you are adding interface-based routing to a MAX with system-based routing already configured, follow these steps:

1. To specify the IP address of the MAX, set the Ascend-PPP-Address attribute.

2. To specify the subnet mask in use for the local interface, specify the Ascend-IF-Netmask attribute.

3. To specify the remote interface address, set the Ascend-Remote-Addr attribute.

When you save these specifications and the MAX is running, these events take place:

1. The MAX generates host routes to both Framed-Address and Ascend-Remote-Addr.

The Ascend-Remote-Addr appears in the routing table as the next hop to Framed-Address.

2. The MAX generates a route the remote system's subnet, showing the Ascend-Remote- Addr value as the next hop.

3. An incoming PPP, MP, or MP+ call must report its IP address as the Ascend-Remote-Addr attribute (rather than the Framed-Address attribute)-that is, the caller must be using a numbered interface, and its interface address must agree with the Ascend-Remote-Addr value on the receiving side.

If you want to create static routes to hosts at the remote end, you can use the Ascend-Remote-Addr or Framed-Address value as the next hop (gateway) field.

#### If only the interface address is known

You can omit the remote side's system address from the profile and use interface-based routing exclusively. If the remote system is on a backbone network that the administrator may periodically reconfigure, you might want to refer to the remote system only by its interface address. Follow these steps:

1. To specify the IP address of the MAX, set the Ascend-PPP-Address attribute.

2. To specify the subnet mask in use on the local interface, set the Ascend-IF-Netmask attribute.

3. Accept the default address of 0.0.0.0 for the Ascend-Remote-Addr attribute.

   Note that the Framed-Address attribute must always have a value, so if the only known address is the interface address, specify it using the Framed-Address attribute rather than the Ascend-Remote-Addr attribute.

If the Framed-Address attribute specifies the remote system address, the following events take place:

1. The MAX creates a host route to Framed-Address.

2. The MAX creates a route to the subnet of the remote interface.

3. An incoming PPP, MP, or MP+ call must report its IP address as Framed-Address.

#### If you do not specify the remote interface address

If interface-based routing is in use and the local interface is numbered, the remote address will usually be known. In practice, administrators at both sites must agree upon the subnet. It is possible, but not recommended, to number the local interface, omitting the interface address of the remote site and using only its system address. In this case, do not use the remote interface address in any static routes.

When a local interface is numbered but no corresponding remote interface address exists, the remote interface must have an address on the same subnet as the local, numbered interface. RADIUS rejects incoming PPP calls if the user profile numbers the local interface and the remote caller supplies an address not on the same subnet.

## Setting up an IPX routing connection

This section covers the following topics:

- Before you begin

- Introducing IPX routing

- Overview of RADIUS attributes for IPX routing

- Specifying IPX routing

- Configuring static IPX routes

### Before you begin

Before you set up an IPX routing connection in RADIUS, carry out these tasks in the MAX configuration interface:

1. Set up the MAX as a router.

2. In the Ethernet > Answer > PPP Options menu, set the Recv Auth parameter to PAP, CHAP, MS-CHAP, or Either.

   Unlike an IP routing configuration, in which the MAX uniquely identifies the calling device by its IP address, an IPX routing configuration does not include a built-in way to uniquely identify callers. For this reason, you must use PAP, CHAP, or MS-CHAP password authentication, unless you configure IP routing in the same RADIUS user profile.

For details on carrying out these tasks, see the MAX ISP and Telecommuting Configuration Guide.

### Introducing IPX routing

The MAX supports IPX routing between sites that run Novell NetWare version 3.11 or later. The MAX operates as an IPX router with one interface on the local Ethernet and the other across the WAN. It supports IPX routing over PPP, MP, MP+, and frame relay connections. Each RADIUS user profile that sets up an IPX connection is an IPX WAN interface.

NetWare servers broadcast Service Advertising Protocol (SAP) packets every 60 seconds to make sure that routers (such as the MAX) know about their services. Each router builds a SAP table with an entry for each service advertised by each known server. The router uses the SAP table to respond to client queries.

When a NetWare client sends a SAP request to locate a service, the MAX consults its SAP table and replies with its own hardware address and the internal address of the requested server. The client can then transmit packets whose destination address is the internal address of the server. When the MAX receives those packets, it consults its IPX RIP table. If it finds an entry for that destination address, it brings up the connection or forwards the packet across the active connection.

For complete information on IPX routing, see the MAX ISP and Telecommuting Configuration Guide.

### Overview of RADIUS attributes for IPX routing

Table 6-5 lists the attributes relevant to IPX routing.

Table 6-5. IPX routing attributes

#### Attribute

#### Description

#### Possible values

Ascend-IPX-Alias (224)

Specifies the network number the MAX assigns to a point-to-point link.

You need to specify a value for this attribute only if the MAX operates with a non-Ascend router that uses a numbered interface. It does not apply if you are routing from one MAX to another, or to a router that does not use a numbered interface.

8-digit (4-byte) hexadecimal value. The default value is 00000000.

Ascend-IPX-Peer-Mode (216)

Specifies whether the caller is an Ethernet client with its own IPX network address, or a dial-in PPP client.

IPX-Peer-Router (0)
IPX-Peer-Dialin (1)

The default value is IPX-Peer-Router.

Ascend-IPX-Route (174)

Specifies a static route to an internal network of a NetWare server.

profile_name specifies the RADIUS user profile to use to reach the network. The default value is null.

network# indicates the unique internal network number of a NetWare server. The default value is 00000000.

node# specifies the node number of the NetWare server. The default value is 0000000000001.

socket# specifies the socket number of the NetWare server. The default value is 0000.

server_type specifies the SAP service type of the NetWare server. The default value is 0000.

hop_count indicates the distance to the destination network in hops. The default value is 1.

tick_count specifies the distance to the destination network in IBM PC clock ticks (one-eighteenth of a second). The default value is 12.

server_name indicates the name of an IPX server. The default value is null.

Ascend-IPX-Route (174)

Specifies a static route to an external network.

route-only is an idenfier to inform the MAX that this is a route to an external destination IPX network.

network # indicates the unique external destination network number.

transit_number is an intermediate route between the MAX and the destination network. The MAX must know how to route to this intermediate network.

Ascend-Route-IPX (229)

Indicates whether the MAX enables IPX routing for the user profile.

Route-IPX-No (0)
Route-IPX-Yes (1)

The default value is Route-IPX-No.

### Specifying IPX routing

To specify IPX routing, follow these steps:

1. In the RADIUS user profile, specify the User-Name and Password attributes and WAN connection attributes.

For details on setting the User-Name and Password attributes, see Chapter 3, Setting Up RADIUS Authentication. For details on setting up WAN connection attributes, see Chapter 4, Setting Up WAN Connections in RADIUS.

2. To turn on IPX routing for the user profile, set Ascend-Route-IPX=Route-IPX-Yes.

3. If the MAX operates with a non-Ascend router that uses a numbered interface, set the Ascend-IPX-Alias attribute to specify a network number for the link.

4. To specify whether the caller is a dial-in PPP client or an Ethernet client with its own IPX network address, set the Ascend-IPX-Peer-Mode attribute.

   Dial-in clients do not belong to an IPX network, so you must assign them an IPX network number. When you do so, a dial-in client can establish a routing connection with the MAX. To provide an IPX network number, you must define a virtual IPX network using the IPX Pool# parameter in the MAX configuration interface. The MAX advertises the route to this virtual network and assigns it as the network address for dial-in clients.

   For the Ascend-IPX-Peer-Mode attribute, specify one of these settings:

   - IPX-Peer-Router (0) indicates that the calling device is on the Ethernet network and has its own IPX address.

     This setting is the default.

   - IPX-Peer-Dialin (1) indicates that the caller is a dial-in NetWare client that incorporates PPP software and dial-out hardware, but has no Ethernet interface.

     This setting causes the MAX to assign the caller an IPX address using the value of the IPX Pool# parameter on the MAX. If the client does not supply its own unique node number, the MAX assigns a unique node number as well. The MAX does not send IPX RIP and SAP advertisements across the connection and ignores IPX RIP and SAP advertisements it receives from the remote end. However, it does respond to IPX RIP and SAP queries it receives from dial-in clients.

#### Dial-in client connection example

In this example, a NetWare client dials into a corporate IPX network that supports both servers and clients (Figure 6-6).

Figure 6-6. A dial-in NetWare client requiring dynamic IPX network assignment

In this example, the MAX is connected to a corporate NetWare LAN and the dial-in client has a modem, NetWare client software, and PPP dial-up software. This example assumes that the IPX Pool# attribute has been set in the Ethernet\>Mod Config\>Ether Options menu. To configure the MAX to accept a connection from the PC dial-in user, enter these specifications:

    NetWareClient1 Password="m2dan", User-Service=Framed-User

              Framed-Protocol=PPP,

              Ascend-Route-IPX=Route-IPX-Yes,

              Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

              ...

### Configuring static IPX routes

After the MAX unit clears its IPX RIP and SAP tables during a reset or power cycle, it adds the static routes upon initialization. Each static IPX route contains all the information necessary to reach one NetWare server on a remote network. When the MAX receives an outbound packet for that server, it finds the corresponding RADIUS user profile and dials the connection.

Most sites configure only a few IPX routes and rely on IPX RIP for most other connections. If you have servers on both sides of the WAN connection, we recommend that you define a static route to the remote site even if your environment requires dynamic routes. If you have one static route to a remote site, it should specify a master NetWare server that knows about many other services. NetWare workstations can then learn about other remote services by connecting to that remote NetWare server. If the MAX does not receive IPX RIP broadcasts from a remote unit, you should configure a static route to at least one server on that network.

You must manually update static routes whenever the administrator at the remote end removes the specified server or updates its address. You do not need to create IPX routes to servers that reside on the local Ethernet network.

To set up static IPX routes in RADIUS, follow these steps:

1. Create the first line of a pseudo-user profile using the User-Name, Password, and
   User-Service attributes.

You create a pseudo-user profile to store information that the MAX can query-in this case, in order to store IPX routing information. You can configure pseudo-users for both global and MAX-specific configuration control of IPX dialout routes. The MAX loads the unit-specific dialout routes in addition to the global dialout routes.

For a unit-specific IPX dialout route, specify the first line of a pseudo-user profile in this format:

    IPXRoute-unit_name-num Password="Ascend", User-Service=Dialout-Framed-User

For a global IPX dialout route, specify the first line of a pseudo-user profile in this format:

    IPXRoute-num Password="Ascend", User-Service=Dialout-Framed-User

unit_name`` is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

2. For each pseudo-user profile, specify one or more routes using the Ascend-IPX-Route attribute.

When you define a static route to an internal network, the Ascend-IPX-Route attribute has the following format:

    Ascend-IPX-Route="profile_name network# [node#] [socket#] [server_type] [hop_count] [tick_count] [server_name]"

Limit each profile to about 25 routes-that is, you should specify up to 25 settings for the Ascend-IPX-Route attribute. The MAX fetches information from each pseudo-user profile in order to gather routing information.

Table 6-6 describes each Ascend-IPX-Route argument.

Table 6-6. Ascend-IPX-Route arguments

#### Argument

#### Description

profile_name

Specifies the RADIUS user profile to use to reach the network. The default value is null.

network#

Indicates the unique internal network number of the NetWare server. The default value is 00000000.

node#

Specifies the node number of the NetWare server. The default value is 0000000000001-the typical node number for a NetWare file server.

socket#

Indicates the socket number of the NetWare server. Typically, NetWare file servers use socket 0451. The default value is 0000.

The number you specify must be a well-known socket number. Services that use dynamic socket numbers may use a different socket each time they load. To bring up a connection to a remote service that uses a dynamic socket number, specify a master server that uses a well-known socket number.

server_type

Specifies the SAP service type of the NetWare server. NetWare file servers have SAP service type 0004. The default value is 0000.

hop_count

Indicates the distance to the destination network in hops. The default value is 1.

tick_count

Specifies the distance to the destination network in IBM PC clock ticks (one-eighteenth of a second). This value is for round-trip timer calculation and for determining the nearest server of a given type.The default value is 12.

server_name

Indicates the name of an IPX server. The default value is null.

When you define a static route to an internal network, the Ascend-IPX-Route attribute has the following format:

    Ascend-IPX-Route= "route-only network# transit_network#"

Table 6-7 describes each Ascend-IPX-Route argument.

Table 6-7. Ascend-IPX-Route arguments

#### Argument

#### Description

network #

Indicates the unique external network number. The default value is 00000000.

transit_network #

Indicates an intermediate network:

- Between the MAX and the destination network.

- To which the MAX knows how to route.

Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds IPX dialout routes to the routing table in this way:

1. RADIUS looks for profiles having the format IPXRoute-unit_name-1, where
   unit_name is the system name.

2. If at least one profile exists, RADIUS loads all existing profiles having the format
   `IPXRoute`-unit_name-num`` to initialize the IPX routing table.

   The variable num is a number in a sequential series, starting with 1.

3. The MAX queries `IPXRoute`-unit_name-1, then `IPXRoute`-unit_name-2, and so on, until it receives an authentication reject from RADIUS.

4. RADIUS loads the global configuration profiles.

   These configurations have the form IPXRoute-num.

5. The MAX queries IPXRoute-1, then IPXRoute-2, and so on, until it receives an authentication reject from RADIUS.

#### Static IPX route configuration examples

The first example defines a unit-specific IPX route. The second example defines a global IPX route.

    IPXRoute-CA-1 Password="Ascend", User-Service=Dialout-Framed-User

            Ascend-IPX-Route="def 6 7 8 9 10"

    IPXRoute-1 Password="Ascend", User-Service=Dialout-Framed-User

            Ascend-IPX-Route="abc 1 2 3 4 5 "

## Setting up a bridging connection

This sections covers the following topics:

- Before you begin

- Introducing bridging

- Overview of special IPX bridging requirements

- Overview of RADIUS bridging attributes

- Specifying protocol-independent bridging

- Configuring bridge entries

### Before you begin

Before you set up a bridging connection in RADIUS, you must set up the MAX as a bridge. For details, see the MAX ISP and Telecommuting Configuration Guide.

### Introducing bridging

The MAX uses bridging to provide connectivity for protocols other than IP and IPX, although you can also use bridging to join segments of an IP or IPX network. Because a bridging connection forwards packets at the link layer, it does not distinguish between protocol types and requires no protocol-specific configuration.

When you configure the MAX for bridging, it accepts all packets on the Ethernet network and forwards only those that do not have a physical address on the local Ethernet segment, or that have a broadcast address. A physical address is a unique, hardware-level address associated with a specific network controller. A device's physical address is also called its Media Access Control (MAC) address. A broadcast address is recognized by multiple nodes on a network. All devices on the same network receive packets with the same address (FFFFFFFFFFFF on Ethernet).

The MAX is a transparent bridge (also called a learning bridge). As the MAX forwards a packet, it notes the packet's source address and creates a bridge table that associates node addresses with a particular interface. Figure 6-7 shows the physical addresses of some nodes on the local Ethernet and at a remote site. The MAX at site A acts as a bridge.

Figure 6-7. Bridging configuration

The MAX at site A gradually learns addresses on both networks by looking at each packet's source address, and it develops a bridge table like this one:

    0000D801CFF2              SITEA

    080045CFA123              SITEA

    08002B25CC11              SITEA

    08009FA2A3CA              SITEB

If the MAX receives a packet whose destination MAC address is not on the local network, it first checks its internal bridge table. If it find the packet's destination MAC address, the MAX dials the connection and bridges the packet. If it does not find the address, the MAX checks for active sessions that have bridging enabled. If one or more active bridging links are up, the MAX forwards the packet across all active sessions that have bridging enabled.

The MAX associates a Connection profile or RADIUS user profile with a bridging link either because the remote caller used the profile to dial the link, or because the profile matched an incoming call. You can also specify static bridge table entries in RADIUS pseudo-user profiles.

### Overview of special IPX bridging requirements

IPX bridging has special requirements for facilitating NetWare client-server logins across the WAN, and for preventing IPX RIP and SAP broadcasts from keeping a bridged connection up indefinitely. To specify special IPX bridging behavior, you use the Ascend-Handle-IPX attribute.

For the Ascend-Handle-IPX attribute to have any effect, the IPX Frame parameter in the MAX configuration interface must specify the IPX frame type in use. Your setting for Ascend-Handle-IPX depends upon your bridging configuration. The following sections describe different types of bridging configurations.

#### Bridging when only the local network supports NetWare clients

If the local Ethernet supports NetWare clients only and no NetWare servers, the bridging connection should enable a local client to bring up the WAN connection by querying (broadcasting) for a NetWare server on a remote network. However, the connection should not stay up indefinitely based on RIP or SAP broadcasts. If your configuration matches this one, set Ascend-Handle-IPX=Handle-IPX-Client.

#### Bridging when only the local network supports NetWare servers

If the local network supports NetWare servers (or a combination of clients and servers) and the remote network supports NetWare clients only, the bridging connection should enable the MAX to respond to NCP watchdog requests for remote clients, but bring down inactive connections whenever possible. To accomplish this task, set Ascend-Netware-timeout=30 (for example), and Ascend-Handle-IPX=Handle-IPX-Client.

#### Bridging when both sides of the link support NetWare servers

If NetWare servers reside on both sides of the WAN connection, we strongly recommend that you use an IPX routing configuration instead of bridging IPX. If you bridge IPX in this type of environment, client-server logins are lost when the MAX brings down an inactive WAN connection.

#### IPX routing and bridging on the same connection

When you enable IPX routing for a connection, the MAX routes only one packet frame type for IPX packets across that connection. For example, if the IPX frame type is 802.3, the MAX routes only 802.3 packets. If some NetWare servers on the local network use a different frame type, such as 802.2, the MAX bridges those packets if you enable bridging, or discards them if you do not.

If IPX Frame=802.3 on the MAX, the settings you make in RADIUS have the following effects:

- If Ascend-Route-IPX=Route-IPX-Yes and Ascend-Bridge=Bridge-No in the RADIUS user profile, the MAX routes only 802.3 IPX packets, and drops all other packets.

- If Ascend-Route-IPX=Route-IPX-Yes and Ascend-Bridge=Bridge-Yes in the RADIUS user profile, the MAX routes 802.3 IPX packets and bridges all other packets, including IPX packets in other frame types.

  For example, if the MAX receives an IPX packet in the 802.2 packet frame, it uses the physical address in that packet to bridge it across all active bridging sessions.

### Overview of RADIUS bridging attributes

Table 6-8 lists the bridging attributes.

Table 6-8. Bridging attributes

#### Attribute

#### Description

#### Possible values

Ascend-Bridge (230)

Enables or disables protocol-
independent bridging for the call.

Bridge-No (0)
Bridge-Yes (1)

The default value is Bridge-No.

Ascend-Bridge-Address (168)

Specifies the IP address and associated MAC address of a device on a remote LAN to which the MAX can form a bridging connection. Also specifies the name of the dialout profile the MAX uses to bring up the connection.

MAC_address`` specifies the destination device's hardware address. The default value is 000000000000.

profile_name specifies the dialout profile that brings up the connection.

IP_address specifies the destination device's IP address. The default value is 0.0.0.0.

Ascend-Handle-IPX (222)

Specifies how the MAX handles NCP watchdog requests on behalf of IPX clients during IPX bridging.

Handle-IPX-None (0)
Handle-IPX-Client (1)
Handle-IPX-Server (2)

The default value is Handle-IPX-None.

Ascend-Netware-timeout (223)

Sets how long in minutes the MAX responds to NCP watchdog requests on behalf of IPX clients on the other side of an offline IPX bridging connection.

Integer between 0 and 65535. The default value is 0 (zero).

### Specifying protocol-independent bridging

To specify that bridging is available to a user profile, follow these steps:

1. Specify the User-Name and Password attributes, authentication attributes, and WAN
   connection attributes.

The most common cause of trouble when setting up a bridging connection is specifying the wrong name for the MAX or the remote device. You must specify the name of the remote device or user exactly as it appears remotely, including case changes, dashes, and underscores.

For details on setting the User-Name, Password, and authentication attributes, see Chapter 3, Setting Up RADIUS Authentication. For details on setting up WAN
connection attributes, see Chapter 4, Setting Up WAN Connections in RADIUS.

2. To turn on bridging for the user profile, set Ascend-Bridge=Bridge-Yes.

3. To turn off IPX routing, set Ascend-Route-IPX=Route-IPX-No.

4. To specify special IPX bridging behavior, set the Ascend-Handle-IPX attribute.

   For details on the appropriate setting for your environment, see Overview of special IPX bridging requirements. Note that if Ascend-Route-IPX=Route-IPX-Yes in the RADIUS user profile, the Ascend-Handle-IPX attribute acts as though it is set to Handle-IPX-Server.

5. If you set Ascend-Handle-IPX=Handle-IPX-Server, set the Ascend-Netware-timeout attribute to indicate the maximum length of idle time during which the MAX performs watchdog spoofing for NetWare connections.

#### IPX client bridge example (local clients)

In Figure 6-8, the local Ethernet supports NetWare clients, and the remote network supports both NetWare servers and clients.

Figure 6-8. An example IPX client bridging connection

To configure the MAX in this example, you might use a profile like this one:

    MAX1 Password="m2dan", User-Service=Framed-User

         Framed-Protocol=PPP,

         Ascend-Route-IPX=Route-IPX-No,

         Ascend-Bridge=Bridge-Yes,

         Ascend-Handle-IPX=Handle-IPX-Client,

         Ascend-Netware-timeout=30

#### IPX server bridge example (local servers)

In Figure 6-9, the local network supports a combination of NetWare clients and servers, and the remote network supports clients only.

Figure 6-9. An example IPX server bridging connection

To configure the MAX in this example, you might use a profile like this one:

    MAX1 Password="m2dan", User-Service=Framed-User

         Framed-Protocol=PPP,

         Ascend-Route-IPX=Route-IPX-No,

         Ascend-Bridge=Bridge-Yes,

         Ascend-Handle-IPX=Handle-IPX-Server,

         Ascend-Netware-timeout=30

### Configuring bridge entries

To set up bridge entries in RADIUS for the bridge table, follow these steps:

1. Create the first line of a pseudo-user profile using the User-Name, Password, and
   User-Service attributes.

You create a pseudo-user profile to store information that the MAX can query-in this case, in order to store bridging information. For a unit-specific bridge profile, specify the first line of a pseudo-user profile in this format:

    Bridge-unit_name-num Password="Ascend", User-Service=
    Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

2. For each pseudo-user profile, specify one or more bridge entries using the Ascend-Bridge- Address attribute.

The Ascend-Bridge-Address attribute has this format:

Ascend-Bridge-Address="MAC_address profile_name IP_address"

Table 6-9 describes Ascend-Bridge-Address arguments.

Table 6-9. Ascend-Bridge-Address arguments

#### Argument | #### Description
--- | ---
MAC_address | Specifies a MAC address in standard 12-digit hexadecimal format (yyyyyyyyyyyy) or in colon-separated format (yy:yy:yy:yy:yy:yy). If the leading digit of a colon-separated pair is 0 (zero), you do not need to enter it. That is, :y is the same as :0y. The default value is 000000000000.
profile_name | Specifies the name of the dialout profile the MAX uses to bring up the connection. You can specify either a Connection profile or a RADIUS user profile. The MAX looks for a local profile first.
IP_address | Specifies an IP address in dotted decimal notation. The default value is 0.0.0.0.

Each Ascend-Bridge-Address setting specifies the IP address and associated MAC address of a device on a remote LAN to which the MAX can form a bridging connection. When your MAX receives an ARP request for one of the IP addresses you specify, the MAX replies with the corresponding MAC address and uses the specified profile to bring up a connection to that address. Because the MAX replies to these ARP requests as if the IP devices were local, you must have user profiles that bridge IP packets to each device.

Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds bridging entries to the bridge table in this way:

1. RADIUS looks for profiles having the format Bridge-unit_name-num, where unit_name is the system name and num is a number in a sequential series, starting with 1.

2. RADIUS loads the data to create the bridging tables.

#### Bridge profile configuration examples

This example creates two bridging table entries.

    Bridge-Ascend-1 Password="Ascend", User-Service=Dialout-Framed-User

            Ascend-Bridge-Address="2:2:3:10:11:12 Prof1 1.2.3.4 1",

            Ascend-Bridge-Address="2:2:3:13:14:15 Prof2 5.6.7.8 2"

## Setting up a DHCP connection

When you set up a Dynamic Host Configuration Protocol (DHCP) connection in a RADIUS user profile, the MAX can assign a dynamic IP address to a remote DHCP client over a bridged connection. The MAX becomes a DHCP server.

For example, if a group of DHCP clients reside on a LAN connected to a Pipeline, and the Pipeline connects to the MAX over a bridged PPP connection, the MAX can assign dynamic IP addresses to any of the DHCP clients on the remote LAN (Figure 6-10).

Figure 6-10. Pipeline connected to DHCP clients

The RADIUS server holds the configuration information the MAX uses to identify and authenticate each DHCP client.

When the DHCP client requests an address, the MAX allocates an IP address from one of its IP address pools and assigns it to the client for 30 minutes. The client must renew the IP address assignment after the 30-minute period expires. In its local memory, the MAX keeps track of all IP addresses it has assigned. Therefore, it loses the entries for current, unexpired IP address assignments when you reset it.

A client may hold an unexpired IP address assignment when you reset the MAX. After the reset, the MAX may assign that address to a new client. These duplicate IP addresses cause network problems until the first assignment expires or one of the clients reboots.

### Overview of DHCP attributes

Table 6-10 lists the DHCP attributes.

Table 6-10. DHCP attributes

#### Attribute

#### Description

#### Possible values

Ascend-DHCP-Pool-Number (148)

Specifies the address pool that incoming calls use.

Integer between 1 and the number of defined IP address pools. The default value is 0 (zero), which represents the first defined IP address pool.

Ascend-DHCP-Reply (147)

Specifies whether the MAX processes DHCP packets and acts as a DHCP server on this connection.

DHCP-Reply-No (0)
DHCP-Reply-Yes (1)

The default value is DHCP-Reply-No.

### Configuring a DHCP connection

To configure a DHCP connection, follow these steps:

1. Set up one or more IP address pools in a RADIUS pseudo-user profile.

For details, see Defining a pool of IP addresses for dynamic assignment.

2. Configure a bridging connection in a RADIUS user profile.

   For details, see Setting up a bridging connection.

3. In the RADIUS user profile, set Ascend-DHCP-Reply=DHCP-Reply-Yes.

   This setting enables DHCP functionality.

4. In the RADIUS user profile, set the Ascend-DHCP-Pool-Number attribute.

   Specify the number of the IP address pool the MAX uses when allocating a dynamic IP address to this connection. You can specify a number between 1 and the number of IP pools defined on the MAX. The default value is 0 (zero). When you accept the default, the MAX uses the first defined IP address pool.

## Setting up Network Address Translation (NAT) for LAN

Access to public networks requires the use of an official IP address that is unique across the entire network. Typically, a central authority assigns a range of addresses, and a local administrator distributes them. If access to a public network is not necessary, the local manager can assign addresses as he or she sees fit, even if the addresses are not official or belong to another company.

Because the supply of addresses is rapidly diminishing, a company may not be able to get official addresses for its entire network. Other sites may already have unofficial addresses, but now need access to the Internet, where an official address is required. For these reasons, you need a facility to borrow an official address and dynamically translate between the local and official addresses.

NAT for LAN allows a Pipeline to connect a LAN to another network even if the devices on the LAN do not have valid addresses for the remote network. The Pipeline translates between the local network addresses and the remote network addresses.

When you enable NAT for LAN, the Pipeline attempts to perform IP address translation on all packets it receives. The Pipeline has no notion of what may or may not be official addresses on the LAN. The Pipeline acts as a DHCP client on behalf of all hosts on the LAN and relies on the MAX unit (acting as the DHCP server) to provide addresses suitable for the remote network from its IP address pool. On the local network, the Pipeline and the hosts all have local addresses on the same network, and use them only for local communication between the hosts and the Pipeline over the Ethernet.

Figure 6-11 illustrates a basic NAT for LAN setup.

Figure 6-11. NAT for LAN setup

In Figure 6-11, the Pipeline itself does not have an address on the remote network. Therefore, clients can gain access to the Pipeline only from the local network, not from the WAN.

When the first client on the LAN requests access to the remote network, the Pipeline gets the address through PPP negotiation. When subsequent clients request access to the remote network, the Pipeline asks for an IP address from the MAX using a DHCP request packet. In return, the MAX sends an address to the Pipeline from its IP address pool. The Pipeline uses the dynamic addresses it receives from the MAX to translate IP addresses on behalf of local clients.

As it receives packets on the LAN, the Pipeline determines whether the source IP address has a corresponding translated address. If so, the Pipeline translates the packet, and forwards it out the WAN. If the Pipeline has not assigned a translated address (and one is not pending), the Pipeline issues a new DHCP request for this IP address. While waiting for the MAX to offer an IP address, the Pipeline drops corresponding source packets. For packets it receives from the WAN, the Pipeline checks the destination address against its table of translated addresses. If the destination address exists and is active, the Pipeline forwards the packet. If the destination address does not exit, or is not active, the Pipeline drops the packet.

The MAX typically offers IP addresses for a limited duration, but the Pipeline automatically renews the lease on these addresses. If the connection to the remote server goes down, all leased addresses are considered revoked. Therefore, TCP connections do not persist across calls.

In some installations, the MAX handles both NAT for LAN DHCP requests and ordinary DHCP requests. In this situation, if the ordinary DHCP clients are connecting to the MAX over a non-bridged connection, you must have a separate DHCP server to handle these requests.

### Before you begin

If you use RADIUS to authenticate users, and you do not authenticate users that request DHCP, set Use Answer as Default=Yes in the Answer profile. If you set Use Answer as Default=No, the MAX cannot act as a DHCP server for these clients.

### Configuring the Pipeline for NAT for LAN

For details on configuring NAT on the Pipeline, consult the Pipeline documentation.

### Configuring the MAX for NAT for LAN

To configure the MAX for NAT for LAN, you can specify settings in an Answer profile, a Connection profile, or a RADIUS user profile. This section describes how to set up a RADIUS user profile. For information on setting up an Answer profile or a Connection profile, see the MAX ISP and Telecommuting Configuration Guide.

To configure NAT for LAN in RADIUS, you use the attributes listed in Table 6-11.

Table 6-11. NAT for LAN attributes

#### Attribute

#### Description

#### Possible values

Ascend-DHCP-Pool-Number (148)

Specifies the address pool to use for allocating an IP address to a NAT for LAN client on this connection.

Integer between 1 and the number of defined IP address pools. The default value is 0 (zero), which represents the first defined IP address pool.

Ascend-DHCP-Reply (147)

Specifies whether the MAX processes DHCP packets and acts as a DHCP server on this connection.

DHCP-Reply-No (0)
DHCP-Reply-Yes (1)

The default value is DHCP-Reply-No.

Ascend-DHCP-Maximum-Leases

Specifies the maximum number of dynamic addresses the MAX can assign to NAT for LAN clients using this connection

Integer between 1 and 254. The default value is 4.

To set up NAT for LAN for a MAX in a RADIUS user profile, follow these steps:

1. Set up one or more IP address pools in a RADIUS pseudo-user profile.

For details, see Defining a pool of IP addresses for dynamic assignment.

2. Set up routing or bridging in RADIUS.

   For information on setting up routing, see Setting up a system-based IP routing connection. For information on setting up bridging, see Setting up a bridging connection.

3. To enable DHCP functionality, set Ascend-DHCP-Reply=DHCP-Reply-Yes.

   - For a bridged connection, the MAX responds to all DHCP requests.

   - For a non-bridged connection, the MAX responds only to NAT for LAN DHCP packets.

4. Set the Ascend-DHCP-Pool-Number attribute.

   Specify the number of the IP address pool the MAX uses when allocating a dynamic IP address to a NAT client on this connection. You can specify a number between 1 and number of IP pools defined on the MAX. The default value is 0 (zero). When you accept the default, the MAX uses the first defined IP address pool.

5. Set the Ascend-DHCP-Maximum-Leases attribute to specify the maximum number of addresses that the MAX can give to the Pipeline.

   You can specify a value between 1 and 254. The default value is 4.

Copyright © 1998, Ascend Communications, Inc. All rights reserved.