WAN Connections

This chapter covers the following topics:

Introduction to WAN connections

Local profiles

External authentication servers

Configuring PPP connections

Configuring MP connections

Configuring MP+ connections

Configuring TCP-Clear connections

Enabling modem dial-out connections

Introduction to WAN connections
Local profiles
External authentication servers
Configuring PPP connections
Configuring MP connections
Configuring MP+ connections
Configuring TCP-Clear connections
Enabling modem dial-out connections

Introduction to WAN connections

WAN connections can be synchronous or asynchronous, depending on the remote device. For example, a remote access router (such as an Ascend Pipeline) initiates a synchronous connection, while an analog modem dials an asynchronous connection.

A synchronous data link uses HDLC encoding and connects to an access router for a network-to-network link. It is initially routed as a digital call to an HDLC channel in the MAX TNT, and then to the router software. Synchronous connections use an encapsulation protocol such as Point-to-Point Protocol (PPP) or Frame Relay to deliver packets from one box to another. Synchronous connections may be multi-channel.

An asynchronous data link uses the kind of serial communications provided by a PC COM port, and is typically initiated by a dial-up modem or V.120 terminal adapter (TA) for a host-to-network or host-to-host connection. Async calls initiated by a modem are typically routed as a voice call to a digital modem in the MAX TNT, and then to the terminal-server software. Other kinds of async calls may be routed to an HDLC channel, and from there to the terminal-server software or directly to a local host.

Types of encapsulation protocols

The MAX TNT supports the following encapsulation protocols, which enable delivery of packets from one device to another across the WAN:

Point-to-Point Protocol (PPP)
Multilink Protocol (MP)
Multilink Protocol Plus (MP+ or MPP)
Unencapsulated TCP (TCP-Clear or TCP-Raw)
Frame-Relay and Frame-Relay-Circuit
V.120

Frame Relay configuration is described in Chapter 3, Frame Relay.

V.120 encapsulation is handled transparently and requires minimal configuration (for details, see Answer-Defaults profile).

Note: PPP calls use a single channel. MP calls use a static number of multiple channels, and can be used to communicate with any MP-compliant device. MP+ calls use multiple channels, which are added dynamically as needed, and can be used only between Ascend units. If you configure MP+ and the remote device does not support it, the MAX TNT attempts an MP connection. If the remote device does not support MP, the MAX TNT falls back to single- channel PPP.

Local profiles

Typically, each call must have a Connection profile (or external profile) that specifies a name and password to be used in the authentication sequence. The Answer-Defaults and Terminal-Server profiles also set parameters that affect WAN connections.

Note: This guide focuses on local Connection profiles. In most cases, you can configure equivalent settings using an external authentication server, as described in External authentication servers.

Answer-Defaults profile

The Answer-Defaults profile sets baseline values that determine whether the MAX TNT accepts certain incoming calls, so you must check the Answer-Defaults values to make sure they are set properly for your site.

Note: Answer-Defaults values are applied before the MAX TNT routes the call to a modem or HDLC channel for processing, and before it locates the caller's Connection profile. If the caller's profile contains a similar parameter with a different value, the MAX TNT uses the connection-specific value rather than the Answer-Defaults value to build the session.

The following commands open the Answer-Defaults profile and display its contents:

admin> read answer
ANSWER-DEFAULTS read

admin> list
use-answer-for-all-defaults = yes
force-56kbps = no
profiles-required = yes
clid-auth-mode = ignore
ppp-answer = { yes no-ppp-auth yes 0 none 1524 no 600 600 }
mp-answer = { yes 1 2 }
mpp-answer = { yes quadratic transmit 0 0 15 5 10 70 }
fr-answer = { yes }
tcp-clear-answer = { yes }
ara-answer = { no }
v120-answer = { yes 256 }
ip-answer = { yes yes no 1 }
session-info = { "" "" no 120 no-idle 120 0 }
framed-only = no

Default settings

By default, the Answer-Defaults profile enables all types of encapsulation and routing, and the basic call-setup parameters use the lowest common denominator settings. This is appropriate for many sites, but you might want to change the settings to fine-tune the criteria for accepting calls, or to constrain how much bandwidth is accessible to multilink PPP calls.

Requiring authentication for PPP calls

The following parameters affect authentication of answered calls. The parameters are shown with their default values:

ANSWER-DEFAULTS
      profiles-required = yes
      clid-auth-mode = ignore
      ppp-answer
            receive-auth-mode = any-ppp-auth

By default, no Calling Line ID (CLID), Dial Number Information Service (DNIS), or PPP authentication is required for incoming calls. Most sites change the Receive-Auth-Mode default to ensure authentication of PPP call before a session is established, as shown in the following example:

admin> read answer
ANSWER-DEFAULTS read

admin> set ppp receive-auth = any-ppp-auth

admin> write
ANSWER-DEFAULTS written

When you specify Any-PPP-Auth as the method of PPP authentication, the MAX TNT accepts incoming PPP calls that support any of the authentication methods, but it drops connections that do not offer any authentication protocols during LCP negotiation. For more details about PPP, CLID, and DNIS authentication, see Appendix A, Access Security Settings.

See the MAX TNT RADIUS Guide for information about Answer-Defaults settings that are useful for RADIUS-authenticated calls.

V.120 settings

V.120 terminal adapters (also known as ISDN modems) are asynchronous devices that use ITU-T V.120 encapsulation. After encapsulation processing, these calls are forwarded to the terminal server. Following are the Answer-Defaults parameters related to V.120 connections. The parameters are shown with their default settings:

ANSWER-DEFAULTS
      v120-answer
            enabled= yes
            frame-length = 256

V.120 calls are enabled by default in the Answer-Defaults profile. Frame-Length specifies the V.120 maximum transmit and receive frame sizes. The value should correspond to the settings in the TA software. The terminal adapter settings for V.120 operation that is compatible with the MAX TNT follow (refer to the manual for the V.120 device for information about how to enter them).

V.120 maximum transmit frame size = 260 bytes
V.120 maximum receive frame size = 260 bytes
Logical link ID (LLI) = 256
Modulo = 128
Line channel speed = Select 56K if the MAX TNT accepts calls from the V.120 device on a T1 line, or if you are not sure that you have 64-Kbps channel speed end-to-end.
Call placement: The MAX TNT can receive V.120 calls, but cannot place them.

The following set of commands configure V.120 calls with a maximum frame size of 260 bytes:

admin> read answer-defaults
ANSWER-DEFAULTS read

admin> set v120 frame-length = 260

admin> write
ANSWER-DEFAULTS written

Note: If the user's dial-in software supports async-to-sync conversion, the Connection profile can be set for PAP or CHAP authentication and the user can access the terminal server by PPP automatic login.For recommended authentication settings for connections using terminal adapters, see Appendix A, Access Security Settings.

Terminal-Server profile

The MAX TNT terminal-server software receives asynchronous calls after they have been processed by a digital modem. These calls are typically dialed in by a modem or V.120 TA. If the caller does not send PPP packets immediately, the terminal server starts a login sequence.

For an async PPP call, the terminal server forwards the call to the router software as soon as it detects a PPP packet. For information about configuring async PPP calls, see Example of an asynchronous PPP connection.

For a login session, each user must have a Connection profile (or external profile) that specifies a name and password to be used in the terminal-server login sequence. In addition, a global Terminal-Server profile defines how these calls are authenticated, and where the call is directed following authentication. For information about both of these issues, see Appendix A, Access Security Settings and Appendix B, Network Security Settings

You must enable the terminal-server software to allow the MAX TNT to handle asynchronous calls. Following is the related parameter with its default setting:

TERMINAL-SERVER
      enabled = no

The following set of commands enables the terminal-server software:

admin> read terminal-server
TERMINAL-SERVER read

admin> set enabled = yes

admin> write
TERMINAL-SERVER written

Connection profiles

A Connection profile contains all connection-specific information, including authentication settings, compression values, filter specifications, and Telco options. The following commands create a new Connection profile and list its contents:

admin> new conn newyork
CONNECTION/newyork read

admin> list
station* = ""
active = no
encapsulation-protocol = mpp
called-number-type = national
dial-number = ""
clid = ""
ip-options = { yes yes 0.0.0.0/0 0.0.0.0/0 1 60 120 no no 0 0.0.0.0 ro+
ipx-options = { no router-peer both both no 00:00:00:00 00:00:00:00 ""+
bridging-options = { 0 no }
session-options = { "" "" no 120 no-idle 120 "" 0 }
telco-options = { ans-and-orig no off 1 no no 56k-clear 0 "" "" no no 0 }
ppp-options = { no-ppp-auth "" "" stac 1524 no 600 600 no }
mp-options = { 1 1 2 }
mpp-options = { "" quadratic transmit 1 1 15 5 10 70 }
fr-options = { "" 16 "" no "" 16 }
tcp-clear-options = { "" 0 no "" 256 20 }
ara-options = { "" 0 }
appletalk-options = { no "" 0 0 router-peer }
usrRad-options = { global 0.0.0.0 1646 "" 1 acct-base-10 }
calledNumber = ""
framed-only = no
tunnel-options = { disabled 0 "" "" 5150 "" "" }

Required settings

The Station parameter in a Connection profile specifies the name associated with a remote device. It is a required parameter (you cannot write the profile without specifying a station name).The value you specify is case sensitive, and must exactly match the name the remote device provides as part of the authentication process.

In Connection profile listings, the Station parameter is shown in italics, because it is the unique name that indexes each Connection profile. For example:

CONNECTION station
      station* = ""
      active = no

The Active parameter enables a Connection profile for use. If set to No, the MAX TNT does not use the profile.

Telco settings for nailed connections

A nailed connection is leased bandwidth between two end-points. For the details of grouping leased channels and call routing, see the MAX TNT Hardware Installation Guide.

For the most part, a nailed connection uses the same parameter settings as a switched connection. If either the MAX TNT or the far-end device resets, the nailed connection must be re-established, which typically involves authentication and other negotiations similar to a switched connection. To specify that a connection uses nailed channels, you must set the following parameters, which are shown with their default values:

CONNECTION station
      telco-options
            call-type = off
            nailed-groups = 0 



 Parameter

 Effect


 Call-Type 

 Specifies whether nailed channels are used. Off (the default) means no nailed channels. Other settings are FT1 (all nailed channels), FT1-MPP (nailed channels that can be augmented with switched channels if bandwidth is needed), and FT1-BO (a nailed connection that can use switched channels both for additional bandwidth and for a backup method of reaching the site if the nailed connection is down). 


 Nailed-Groups

Specifies the group number assigned in a line profile to nailed channels. Zero (the default) means no nailed channels. You can specify multiple groups of channels (for increased bandwidth) by separating the group numbers with a comma.

Parameter	Effect
Call-Type	Specifies whether nailed channels are used. Off (the default) means no nailed channels. Other settings are FT1 (all nailed channels), FT1-MPP (nailed channels that can be augmented with switched channels if bandwidth is needed), and FT1-BO (a nailed connection that can use switched channels both for additional bandwidth and for a backup method of reaching the site if the nailed connection is down).
Nailed-Groups	Specifies the group number assigned in a line profile to nailed channels. Zero (the default) means no nailed channels. You can specify multiple groups of channels (for increased bandwidth) by separating the group numbers with a comma.

Following is an example of configuring a nailed connection:

admin> read connection karl
CONNECTION/karl read

admin> set telco call-type = ft1

admin> set telco nailed-groups = 3,4

admin> write
CONNECTION/karl written

Session time limits

Once the MAX TNT has answered a call and established a WAN session, it uses the settings in the Session-Options subprofile of the Connection profile to apply filters or firewalls to the session's data stream and time out the session if it becomes inactive for a specified time period. Following are the relevant Session-Options parameters, shown with their default values:

CONNECTION station
      session-options
            call-filter = ""
            data-filter = ""
            filter-persistence = no
            idle-timer = 120
            ts-idle-mode = no-idle
            ts-idle-timer = 120
            max-call-duration = 0

For information about defining and applying filters and firewalls to a WAN connection, see Chapter 9, Ascend Packet Filters.

Setting a time limit for idle connections

The idle timers in the Session-Options subprofile keep track of the amount of time that passes when no data is being exchanged across the connection. You can apply a packet filter in the Session-Options subprofile to specify which packets should not be counted as part of an active data exchange. This helps to prevent routine background traffic from keeping a connection up unnecessarily.

Following is an example of setting the idle timers to 60 seconds and specifying that only input characters reset the timer for a terminal-server session:

admin> read connection smith
CONNECTION/smith read

admin> set session idle-timer = 60

admin> set session ts-idle-mode = input-only

admin> set session ts-idle-timer = 60

admin> write
CONNECTION/smith written

The Idle-Timer and TS-Idle-Timer parameters specify how long a network or terminal-server session may remain idle before the MAX TNT drops the connection. The Idle-Timer applies to sessions where the data on the WAN is packetized and passes through the MAX TNT router.

The TS-Idle-Timer applies to sessions where the data on the WAN is not packetized and is processed by the terminal server.

Setting an absolute time limit

The value of the Max-Call-Duration parameter is the maximum number of minutes of connect time before the call is dropped. A value of zero disables the connection timer.

Following is an example of setting the maximum connect time to 60 minutes:

admin> read connection smith
CONNECTION/smith read

admin> set session max-call = 60

admin> write
CONNECTION/smith written

For a multi-channel call, the limitation is per channel rather than for the connection. The call is checked once per minute, so the actual time of the call will be slightly longer (usually less than a minute longer) than the actual time you set.

Session accounting options

The MAX TNT supports RADIUS and TACACS+ accounting. Only RADIUS accounting can be specified on a per-connection basis. Following are the relevant parameters for both RADIUS and TACACS+, shown with their default values:

EXTERNAL-AUTH
      acct-type = radius

      rad-acct-client
            acct-server-1 = 0.0.0.0
            acct-server-2 = 0.0.0.0
            acct-server-3 = 0.0.0.0
            acct-port = 0
            acct-src-port = 0
            acct-key = ""
            acct-timeout = 0
            acct-sess-interval = 0
            acct-id-base = acct-base-10

      tacplus-acct-client
            acct-server-1 = 0.0.0.0
            acct-server-2 = 0.0.0.0
            acct-server-3 = 0.0.0.0
            acct-port = 0
            acct-src-port = 0
            acct-key = ""

CONNECTIONS
      usrRad-options
            acct-type = global
            acct-host = 0.0.0.0
            acct-port = 1646
            acct-key = ""
            acct-timeout = 1
            acct-id-base = acct-base-10

Using RADIUS

You can send accounting statistics for a specific connection to the server specified in the External-Auth profile (global), the server specified in the usrRad-options subprofile (local), or both. When the accounting policy includes the local RADIUS accounting server (the one specified in a Connection profile), you can specify the server's address (Acct-Host), a UDP port on that server (Acct-Port), a password (Acct-Key), timeout, and numeric base (10 or 16).

For information about using RADIUS, see the MAX TNT RADIUS Guide.

Using TACACS+

For information about configuring the TACACS+ server for session accounting, see the TACACS+ documentation. This section shows how to configure the MAX TNT to send accounting statistics about all WAN sessions to the specified TACACS+ server. Following is an example of how to enter the parameter settings. Following that are explanations of the parameters.

admin> read external-auth
EXTERNAL-AUTH read

admin> set acct-type = tacacsplus

admin> list tacplus-acc
acct-server-1 = 0.0.0.0
acct-server-2 = 0.0.0.0
acct-server-3 = 0.0.0.0
acct-port = 0
acct-src-port = 0
acct-key = ""

admin> set acct-server-1 = 10.1.2.3

admin> set acct-server-2 = 10.2.3.4

admin> set acct-port = 5000

admin> set acct-key = ascend

admin> write
EXTERNAL-AUTH written

In the External-Auth profile, the Acct-Type parameter specifies the type of accounting to be performed: RADIUS or TACACS+.

Each acct-server-N parameter can specify the IP address of one TACACS+ server. The MAX TNT first tries to connect to server #1. If it receives no response, it tries to connect to server #2. If it receives no response from server #2, it tries server #3. If the MAX TNT connects to a server other than server #1, it continues to use that server until it fails to service requests, even if the first server has come online again.

The Acct-Port parameter specifies the destination port to use to access the server. The port specified must match the port used by the TACACS+ daemon.

The Acct-Src-Port parameter specifies the source port to use to access the server. If zero, the source port is selected from the non-privileged port range (1024-2000).

Acct-Key is an accounting access key shared with the server.

Routing and security settings

For the MAX TNT to route packets, you must configure its router software and its LAN and WAN interfaces. For details, see one or more of the following chapters:

For information about Connection profile tunnel options, see Chapter 7, Ascend Tunnel Management Protocol.

For information about network security, see Chapter 9, Ascend Packet Filters, and the appendixes of this guide.

External authentication servers

An external authentication server such as RADIUS or TACACS enables administrators to centralize management and authentication of thousands of connections, and many sites use external authentication rather than local Connection profiles. Many of the same options described here are provided in another format in RADIUS or TACACS profiles.

Using RADIUS

If you are using RADIUS authentication, note that Ascend has added features to the standard RADIUS daemon to support Ascend-specific connection features. For information about configuring WAN connections in a RADIUS profile, see the MAX TNT RADIUS Guide.

Using TACACS or TACACS+

If you are using TACACS or TACACS+, the documentation that accompanied the server software explains how to set up the server. Following are the parameters used to configure the MAX TNT to authenticate connections by means of TACACS or TACACS+:

EXTERNAL-AUTH
      tac-auth-client
            auth-server-1 = 0.0.0.0
            auth-server-2 = 0.0.0.0
            auth-server-3 = 0.0.0.0
            auth-port = 0
            auth-src-port = 0
            auth-key = ""
            auth-timeout = 0

      tacplus-auth-client
            auth-server-1 = 0.0.0.0
            auth-server-2 = 0.0.0.0
            auth-server-3 = 0.0.0.0
            auth-port = 0
            auth-src-port = 0
            auth-key = ""
            auth-reset-time = 0
            auth-timeout-time = 0
            auth-retries = 0

You can specify up to three server addresses, the TCP port to use, a password (key) required by the server, and a timeout value in seconds. In the case of TACACS+, you can also specify when to reset the primary server after a server failure, the amount of time that should elapse before an attempt to connect to a backup server, and the number of connection attempts to make. For detailed information about the parameters, see the MAX TNT Reference Guide.

Configuring PPP connections

This section shows how to configure a connection's PPP options. Following are the Connection profile parameters related to PPP configuration, shown with the default settings:

CONNECTION station
      encapsulation-protocol = ppp
      PPP-Options
            send-password = ""
            recv-password = ""
            link-compression = stac
            mru = 1524
            lqm = no
            lqm-minimum-period = 600
            lqm-maximum-period = 600 



 Parameter

 Effect


 Encapsulation-Protocol 

 Specifies PPP for single-channel Point-to-Point Protocol. Both sides of the connection must support the specified method. 


 Send-Password

 The password sent to the remote device for a dial-out connection. For the details of PPP authentication, see Appendix  A, Access Security Settings. 


 Recv-Password

 The password expected from the remote device for an inbound connection. For the details of PPP authentication, see Appendix  A, Access Security Settings. 


 Link-Compression

Specifies the link-compression method to use. Both sides of the connection must specify the same compression method. 


 MRU

Specifies the Maximum Receive Units (maximum number of bytes) the MAX TNT can receive in a single packet. Typically, you should use the default of 1524 unless the far end requires a reduced size.


 LQM
LQM-Minimum-Period
LQM-Maximum-Period

 Enable the PPP Link Quality Monitoring (LQM) Protocol and specify a maximum and minimum period for generating Link-Quality-Reports.

Parameter	Effect
Encapsulation-Protocol	Specifies PPP for single-channel Point-to-Point Protocol. Both sides of the connection must support the specified method.
Send-Password	The password sent to the remote device for a dial-out connection. For the details of PPP authentication, see Appendix A, Access Security Settings.
Recv-Password	The password expected from the remote device for an inbound connection. For the details of PPP authentication, see Appendix A, Access Security Settings.
Link-Compression	Specifies the link-compression method to use. Both sides of the connection must specify the same compression method.
MRU	Specifies the Maximum Receive Units (maximum number of bytes) the MAX TNT can receive in a single packet. Typically, you should use the default of 1524 unless the far end requires a reduced size.
LQM LQM-Minimum-Period LQM-Maximum-Period	Enable the PPP Link Quality Monitoring (LQM) Protocol and specify a maximum and minimum period for generating Link-Quality-Reports.

Password authentication

For details about password authentication for PPP, MP, and MP+ connections, see Appendix A, Access Security Settings.

Link compression methods

The Link-Compression setting specifies a compression method to use for PPP-encapsulated packets transmitted and received on the connection. During the negotiation phase of the connection, both sides must agree to use the specified method. The MAX TNT supports the following types of link compression:

Stac compression uses an Ascend-modified version of draft 0 of the CCP Protocol, which predates RFC 1974. It is the compression method supported by older Ascend equipment.
Stac-9 compression uses draft 9 of the Stac LZS compression Protocol, which is described in RFC 1974. It is the compression method used by most devices, including recent Ascend equipment.
MS-Stac (Microsoft/Stac) compression is the method used by Windows95. Use this method for connections with Windows95 clients.

Link Quality Monitoring

The process of monitoring data loss on a point-to-point link is called Link Quality Monitoring (LQM). When you enable LQM in a Connection profile, the MAX TNT maintains counts of the number of packets transmitted and successfully received, and periodically transmits this information to the far-end device in a Link-Quality-Report packet. The following set of commands enables LQM for a connection, using the default six-second period for generating Link-Quality-Report packets:

admin> read conn test
CONNECTION/test read

admin> set ppp lqm = yes

admin> write
CONNECTION/test written

For an explanation of PPP LQM, see RFC 1989, PPP Link Quality Monitoring, W Simpson.

Example of a synchronous PPP connection

The connection shown in Figure 2-1 uses PPP encapsulation and Challenge Handshake Authentication Protocol (CHAP) authentication. The far-end device is a Pipeline unit with the IP address 10.2.3.31/24. The Connection profile settings enable the MAX TNT to dial out to and receive calls from the Pipeline. This is a single-channel synchronous PPP call.

Figure 2-1. Synchronous PPP connection

Following are the commands entered to configure this call, and the system's responses:

admin> new connection phani
CONNECTION/phani read

admin> set active = yes

admin> set encapsulation-protocol = ppp

admin> set dial-number = 1212

admin> set ip remote-address = 10.2.3.31/24

admin> set ppp send-auth-mode = chap-ppp-auth

admin> set ppp send-password = remotepw

admin> set ppp recv-password = localpw

admin> write
CONNECTION/phani written

Note: The Dial-Number, Send-Auth-Mode, and Send-Password parameters are used only when the connection is dialed out.

Example of an asynchronous PPP connection

The connection shown in Figure 2-2 uses PPP encapsulation and PAP or CHAP authentication. The calling device is a modem. This is a single-channel asynchronous PPP call.

Figure 2-2. Asynchronous PPP connection

Following are the commands entered to configure this Connection profile, and the system's responses:

admin> new connection carlos
CONNECTION/carlos read

admin> set active = yes

admin> set encapsulation-protocol = ppp

admin> set ppp recv-password = localpw

admin> write
CONNECTION/carlos written

Configuring MP connections

Multilink Protocol (MP) uses the encapsulation defined in RFC 1990. MP enables the MAX TNT to interact with MP-compliant equipment from other vendors to use multiple channels for a call. Both sides of the connection must support MP encapsulation.

PPP Answer-Defaults and Connection profile settings also apply to MP connections. If you configure an MP connection and the MAX TNT cannot successfully negotiate the connection, it falls back to single-channel PPP (see Configuring TCP-Clear connections).

Following are the Connection profile parameters related to MP connections. The MP options are shown with their default settings.

CONNECTION station
      encapsulation-protocol = mp
      mp-options
            base-channel-count = 1
            minimum-channels = 1
            maximum-channels = 2 



 Parameter

 Effect


 Encapsulation-Protocol 

 Specifies MP for Multilink Protocol connections. Both sides of the connection must support the specified protocol. 


 Base-Channel-Count

Specifies the base number of channels to use for a multilink PPP connection. The number of channels for an MP call is fixed for the duration of the session.


 Minimum-Channels
Maximum-Channels

 Specify the minimum and maximum number of channels available to a multi-channel PPP call.

Parameter	Effect
Encapsulation-Protocol	Specifies MP for Multilink Protocol connections. Both sides of the connection must support the specified protocol.
Base-Channel-Count	Specifies the base number of channels to use for a multilink PPP connection. The number of channels for an MP call is fixed for the duration of the session.
Minimum-Channels Maximum-Channels	Specify the minimum and maximum number of channels available to a multi-channel PPP call.

Setting the base channel count

When a call is received, the MAX TNT authenticates the first (base) channel of the call and then uses the parameters in the caller's Connection profile to determine the maximum and minimum settings. The base channel count for an MP call must be greater than or equal to the minimum count and less than or equal to the maximum count. For optimum performance, both sides of a connection should set the Base-Channel-Count, Minimum-Channel-Count, and Maximum-Channel-Count parameters to the same values.

Example of an MP connection

For example, the MP connection shown in Figure 2-3 is allocated two channels:

Figure 2-3. Multilink Protocol (MP) connection

Following are the commands entered to configure this Connection profile, and the system's responses:

admin> new connection kory
CONNECTION/kory read

admin> set active = yes

admin> set encapsulation-protocol = mp

admin> set dial-number = 1212

admin> set ip remote-address = 10.10.1.2/29

admin> set ppp send-auth-mode = chap-ppp-auth

admin> set ppp send-password = remotepw

admin> set ppp recv-password = localpw

admin> set mp base-channel-count = 2

admin> write
CONNECTION/kory written

Send-Password is the password sent to the remote device for a dial-out connection, and Recv-Password is the password expected from the remote device for an inbound connection.

Configuring MP+ connections

Multilink Protocol Plus (MP+) uses PPP encapsulation with Ascend extensions, as described in RFC 1934. MP+ enables the MAX TNT to connect to another Ascend unit through multiple channels. The criteria for adding or dropping a link are part of the Ascend extensions, and are supported only by Ascend equipment.

PPP and MP Answer-Defaults and Connection profile settings also apply to MP+ connections. To specify the base channels of an MP+ connection, you must configure the MP-Options subprofile (see Configuring MP connections).

Following are the Connection profile parameters, shown with default values for MP+ options:

CONNECTION station
      encapsulation-protocol = mpp
      mpp-options
            aux-send-password = ""
            dynamic-algorithm = quadratic
            bandwidth-monitor-direction = transmit
            increment-channel-count = 1
            decrement-channel-count = 1
            seconds-history = 15
            add-persistence = 5
            sub-persistence = 10
            target-utilization = 70

Encapsulation-Protocol specifies MPP for Multilink Protocol Plus connections. Both sides of the connection must support the specified protocol (that is, they must both be Ascend units).

How the MAX TNT adds bandwidth

To add bandwidth on demand, the MAX TNT dials additional connections and inverse multiplexes those channels into the call.

Note: For information about configuring per-channel add-on numbers that enable the MAX TNT to add bandwidth on demand, see the MAX TNT Hardware Installation Guide.

The MAX TNT can reject the request to add bandwidth if there are no more channels available at one or both ends, or if the network is congested. Under either of those conditions, the two ends enter bandwidth-addition-lockout mode, in which neither side can request bandwidth. The restriction prevents both ends from continually trying to add new channels unsuccessfully. The MAX TNT and the Ascend unit at the other end automatically remove the lockout restriction when the condition that caused the lockout changes. Changes typically result from plugging in a new switched-service line, reconfiguration of the line profile, or a switched-service congestion timeout. Once the lockout is removed, either end is free to add bandwidth.

Monitoring bandwidth usage

The MAX TNT uses the Bandwidth-Monitor-Direction parameter to determine the criteria for adding or subtracting bandwidth from the connection. Bandwidth-Monitor-Direction specifies whether criteria for adding or dropping links apply to traffic received across the link, transmitted across the link, or both. If both sides of the link have Bandwidth-Monitor-Direction set to None, DBA is disabled.

Specifying bandwidth increments

You can add channels one at a time or, if the MAX TNT is configured for parallel dialing, in multiples. To configure the unit for parallel dialing, set the Parallel-Dialing parameter in the System profile. For example, the following command shows that Parallel-Dialing is set to 2 (the default), which enables two concurrent dial-out calls:

admin> get system parallel
parallel-dialing = 2

In a Connection profile, the MAX TNT uses the following parameters to determine the number of channels to add or subtract from the connection at one time:


Parameter	Effect
Increment-Channel-Count	Specifies the number of channels the MAX TNT can add at one time, subject to the setting of the Parallel-Dialing parameter in the System profile.
Decrement-Channel-Count	Specifies the number of channels the MAX TNT can subtract at one time, dropping the newest channels first.

Specifying the utilization rate that forces a request for bandwidth

To determine when to change the bandwidth allocated to a connection, the MAX TNT uses the following parameter settings:


Parameter	Effect
Seconds-History	Specifies a number of seconds to use as the basis for calculating average line utilization (ALU).
Target-Utilization	Specifies a percentage of line utilization (default 70%) to use as a threshold when determining when to add or subtract bandwidth.
Dynamic-Algorithm	Specifies an algorithm for calculating average line utilization (ALU) over a certain number of seconds (Seconds-History). Quadratic (the default) gives more weight to recent utilization samples than to older samples within Seconds-History. The weighting grows at a quadratic rate. Linear gives more weight to recent utilization samples than to older samples within Seconds-History. The weighting grows at a linear rate. Constant gives equal weight to all utilization samples.

Specifying how long the utilization rate should persist

To determine how long the utilization rate should persist, the MAX TNT uses the following parameter settings:


Parameter	Effect
Add-Persistence	Specifies the number of seconds for which ALU must persist beyond the Target-Utilization threshold before the MAX TNT adds bandwidth.
Sub-Persistence	Specifies the number of seconds for which the ALU must persist below the Target-Utilization threshold before the unit subtracts bandwidth.

ALU spikes

The values for Seconds-History, Add-Persistence, and Sub-Persistence should smooth out spikes in bandwidth utilization that last for a shorter time than it takes to add capacity. Over T1 lines, the MAX TNT can add bandwidth in less than ten seconds. Over ISDN lines, the unit can add bandwidth in less than five seconds.

Telco charges

Once the MAX TNT adds bandwidth, there is typically a minimum usage charge, after which billing is time-sensitive. The Sub-Persistence value should be at least equal to the minimum duration charge plus one or two billing time increments. Typically, billing is done to the next multiple of six seconds, with a minimum charge for the first thirty seconds.

Adding or subtracting channels too quickly (less than 10-20 seconds apart) leads to many short duration calls, each of which incurs the carrier's minimum charge. In addition, adding or subtracting channels too quickly can affect link efficiency, because the devices on either end have to retransmit data when the link speed changes.

Example of an MP+ configuration

The connection in Figure 2-4 uses MP+ encapsulation with CHAP authentication and configures Dynamic Bandwidth Allocation between the MAX TNT and a MAX unit. (The far-end device must be an Ascend unit.)

Figure 2-4. Multilink Protocol Plus (MP+) connection

Following are the commands entered to configure this connection, and the system's responses:

admin> new connection moshoula
CONNECTION/moshoula read

admin> set active = yes

admin> set encapsulation-protocol = mpp

admin> set dial-number = 9-1-333-555-1212

admin> set ip remote-address = 10.10.10.64/24

admin> set ppp send-auth = chap-ppp-auth

admin> set ppp send-password = remotepw

admin> set ppp recv-password = localpw

admin> set mp base-channel-count = 2

admin> list mpp
aux-send-password = ""
dynamic-algorithm = quadratic
bandwidth-monitor-direction = transmit
increment-channel-count = 1
decrement-channel-count = 1
seconds-history = 15
add-persistence = 5
sub-persistence = 10
target-utilization = 70

admin> set bandwidth-monitor-direction = transmit-recv

admin> set increment-channel-count = 2

admin> set seconds-history = 30

admin> set add-persistence = 10

admin> write
CONNECTION/moshoula written

For information about an MP+ call that uses a combination of nailed and switched channels, see Example of a nailed MP+ connection.

Example of a nailed MP+ connection

A connection that uses MP+ encapsulation can specify a certain number of nailed channels as the base connection, and add switched channels as needed by using the DBA algorithms. For details about DBA, see Configuring MP+ connections.

An FT1-MPP connection starts as a nailed connection but can use switched channels either to increase the bandwidth as needed or to provide a backup if the nailed channels go down. The maximum number of channels for the FT1-MPP connection is either the Maximum-Channel-Count for the connection or the number of nailed channels in the specified group, whichever is greater.

The base channels of an FT1-MPP connection are nailed. When a nailed channel is temporarily down, the MAX TNT polls continuously while trying to reestablish that connection. If an outbound packet arrives while the nailed connection is still down, the unit replaces the nailed channel with a switched channel, even if the call is on line with more than the minimum number of channels.

In addition to the DBA parameters in the MPP-Options subprofile (described in Configuring MP+ connections), the following parameters are relevant to an FT1-MPP connection:

CONNECTION station
      telco-options
            answer-originate = ans-and-orig
            call-type = off
            nailed-groups = 0
            ft1-caller = no 



 Parameter

 Effect


 Answer-Originate

Specifies whether the system can use this profile to answer incoming calls, dial out, or both. Together, the Answer-Originate and FT1-Caller parameters specify that the MAX TNT is the designated caller for the switched part of the connection.


 Call-Type 

 Specifies whether nailed channels are used. FT1-MPP means nailed channels that can be augmented with switched channels. 


 Nailed-Groups

Specifies the group number assigned in a line profile to nailed channels. Zero (the default) means no nailed channels. You can specify multiple groups of channels (for increased bandwidth) by separating the group numbers with a comma. 


 FT1-Caller

Specifies whether the system can initiate calls on fractional T1 to add switched channels to a nailed MPP connection. Because bandwidth is added on the basis of calculations made at both ends of the connection, make sure that only one end of the connection can originate calls for FT1-MPP calls.

Parameter	Effect
Answer-Originate	Specifies whether the system can use this profile to answer incoming calls, dial out, or both. Together, the Answer-Originate and FT1-Caller parameters specify that the MAX TNT is the designated caller for the switched part of the connection.
Call-Type	Specifies whether nailed channels are used. FT1-MPP means nailed channels that can be augmented with switched channels.
Nailed-Groups	Specifies the group number assigned in a line profile to nailed channels. Zero (the default) means no nailed channels. You can specify multiple groups of channels (for increased bandwidth) by separating the group numbers with a comma.
FT1-Caller	Specifies whether the system can initiate calls on fractional T1 to add switched channels to a nailed MPP connection. Because bandwidth is added on the basis of calculations made at both ends of the connection, make sure that only one end of the connection can originate calls for FT1-MPP calls.

If you modify the Connection profile for an FT1-MPP connection, most changes become active only after the call is brought down and then back up, because the connection is primarily a nailed one. However, if you add a group number to the Nailed-Groups parameter and write the modified profile, the additional channels become available immediately.

After the MP+ (switched) part of the connection is configured as usual, the Telco-Options subprofile in this example is configured as follows:

admin> read connection moshoula
CONNECTION/moshoula read

admin> list telco
answer-originate = ans-and-orig
callback = no
call-type = off
nailed-groups = 1
ft1-caller = no
force-56kbps = no
data-service = 56k-restricted
call-by-call = 0
billing-number = ""
transit-number = ""
expect-callback = no
dialout-allowed = no

admin> set answer-originate = originate-only

admin> set ft1-caller = yes

admin> set call-type = ft1-mpp

admin> set nailed-groups = 1,2

admin> write
CONNECTION/moshoula written

Configuring TCP-Clear connections

The MAX TNT does not process packet encapsulation for a TCP-Clear connection. The connection's data is redirected immediately to a specified host, where encapsulation processing is assumed to occur. These connections often use a proprietary encapsulation method, or encapsulation performed by an application running on top of TCP.

You can configure TCP-Clear for a specific connection, as described in this section. Or, you can enable it globally by using TCP service in immediate mode, as described in Appendix B, Network Security Settings.

Required settings

Following are the required TCP-Clear parameters, shown with their default values:

CONNECTION station
      encapsulation-protocol = tcp-raw
      ppp-options
            recv-password = localpw
      tcp-clear-options
            host = ""
            port = 0 



 Parameter

 Effect


 Encapsulation-Protocol 

 Specifies TCP-Raw for a TCP-Clear connection.


 Recv-Password

 The password expected from the remote device for an inbound connection. For the details of PPP authentication, see Appendix  A, Access Security Settings. 


 Host

 Specifies the DNS name or IP address of the host to which the incoming data will be forwarded (up to 31 characters). 


 Port

 Specifies the destination TCP port on the named host. A port number of zero (the default) means any port.

Parameter	Effect
Encapsulation-Protocol	Specifies TCP-Raw for a TCP-Clear connection.
Recv-Password	The password expected from the remote device for an inbound connection. For the details of PPP authentication, see Appendix A, Access Security Settings.
Host	Specifies the DNS name or IP address of the host to which the incoming data will be forwarded (up to 31 characters).
Port	Specifies the destination TCP port on the named host. A port number of zero (the default) means any port.

Following are commands entered to configure a TCP-clear connection to a host named sparky on TCP port 23, and the system's responses:

admin> new conn tcpapp1
CONNECTION/tcpapp1 read

admin> set active = yes

admin> set encaps = tcp-raw

admin> set ppp recv-password = remotepw

admin> set tcp host = sparky

admin> set tcp port = 23

admin> write
CONNECTION/tcpapp1 written

Performance enhancements for TCP-Clear calls

TCP-Clear dialup sessions that do not require V.120 processing can be buffered and transmitted as TCP packets rather than as a continuous data stream, which increases performance for these connections. In addition, unless V.120 processing is required, TCP-Clear WAN data is sent directly to the HDLC interface rather than to the terminal-server subsystem. (If V.120 processing is required, the call is processed by the terminal server, as in previous releases.) The system does not collect session statistics for TCP-Clear calls that make use of these performance enhancements.

Parameters for setting up packet buffering

Following are the Connection profile parameters relevant to TCP-Clear packet buffering. The parameters are shown with their default values:

CONNECTION
      tcp-clear-options
            detect-end-of-packet = no
            end-of-packet-pattern = ""
            flush-length = 256
            flush-time = 20 



 Parameter

 Effect


 Detect-End-of-Packet 

 Specifies whether the MAX TNT buffers incoming WAN data. If set to Yes, after the dialup session has been authenticated, the MAX TNT begins buffering incoming WAN data until it receives the specified End-of-Packet-Pattern, or until it reaches the specified timeout (Flush-Time) or maximum packet length (Flush-Length), whichever comes first. If Detect-End-of-Packet is set to No (the default), none of the related parameters apply.


 Flush-Length

 Specifies the maximum number of bytes to buffer. Valid values are from 1 to 8192. The default value is 256. (Note that buffering large packets consumes more system resources.) If the system has buffered the specified number of bytes without matching the End-of-Packet-Pattern, it flushes the buffer by writing the data to TCP.


 Flush-Time

 Specifies a timer in milliseconds. Valid values are from 1 to 1000. The timer begins counting down on received of the first byte of buffered data. If the specified number of msecs has elapsed without matching the End-of-Packet-Pattern, the system flushes the buffer by writing the data to TCP.


 End-of-Packet-Pattern

 Defines a character pattern that signals the end of a packet. When the MAX TNT matches this pattern in the buffered data, it immediately flushes the buffer by writing all data up to and including the pattern out to TCP. Note that data may be written before a match occurs based on a specified timeout (Flush-Time) or maximum packet length (Flush-Length).

Parameter	Effect
Detect-End-of-Packet	Specifies whether the MAX TNT buffers incoming WAN data. If set to Yes, after the dialup session has been authenticated, the MAX TNT begins buffering incoming WAN data until it receives the specified End-of-Packet-Pattern, or until it reaches the specified timeout (Flush-Time) or maximum packet length (Flush-Length), whichever comes first. If Detect-End-of-Packet is set to No (the default), none of the related parameters apply.
Flush-Length	Specifies the maximum number of bytes to buffer. Valid values are from 1 to 8192. The default value is 256. (Note that buffering large packets consumes more system resources.) If the system has buffered the specified number of bytes without matching the End-of-Packet-Pattern, it flushes the buffer by writing the data to TCP.
Flush-Time	Specifies a timer in milliseconds. Valid values are from 1 to 1000. The timer begins counting down on received of the first byte of buffered data. If the specified number of msecs has elapsed without matching the End-of-Packet-Pattern, the system flushes the buffer by writing the data to TCP.
End-of-Packet-Pattern	Defines a character pattern that signals the end of a packet. When the MAX TNT matches this pattern in the buffered data, it immediately flushes the buffer by writing all data up to and including the pattern out to TCP. Note that data may be written before a match occurs based on a specified timeout (Flush-Time) or maximum packet length (Flush-Length).

Defining an End-of-Packet pattern

The character pattern you specify as the value of the End-of-Packet-Pattern parameter can be up to 64 characters long. It can contain both ASCII characters and other binary data using the backslash (\) as an escape mechanism. To insert a literal backslash in the pattern, escape it by entering two backslash characters (\\).

To insert a 1 to 3 digit octal number, escape the value using the single backslash. (To avoid confusion between the literal ASCII characters 0 through 7 and an octal value, you can pad the octal value with leading zeros.) For example, the following pattern represents a carriage return (octal 15):

\015

To insert a 1 or 2 digit hexadecimal number in the pattern, precede the number with \x. For example, the following pattern represents a carriage return (hex 0D):

\x0D

Other special escape sequences are shown below:


Escape Sequence	Description	Value
\a	Alarm	7
\b	Backspace	8
\f	Form feed	12
\n	New line	10
\r	Carriage return	13
\t	Tab	9
\v	Vertical tab	11
\\	Backslash	92
\'	Apostrophe	44
\"	Double Quote	34
\?	Wildcard	Matches any single character

Example of a TCP-Clear configuration with packet buffering

In the following example, a caller named Jim dials into the MAX TNT running an application that uses an encapsulation method that must be decoded by a local host named sparky. The data stream from the incoming call is sent directly to that host.

Figure 2-5. TCP-Clear connection to a local host

The following procedure shows an example of how to set up a TCP-clear connection to a host named sparky on TCP port 23, where the MAX TNT buffers packets before transmitting them. The End-of-Packet-Pattern is set to three hexadecimal numbers.

admin> read connection tcpapp2
CONNECTION/tcpapp2 read

admin> set active = yes

admin> set encaps = tcp-raw

admin> set ppp recv-password = remotepw

admin> list tcp-clear
host = ""
port = 0
detect-end-of-packet = no
end-of-packet-pattern = ""
flush-length = 256
flush-time = 20

admin> set host = sparky

admin> set port = 23

admin> set detect-end-of-packet = yes

admin> set end-of-packet-pattern = \xfe\xfd\xfe

admin> set flush-length = 16

admin> write
CONNECTION/tcpapp2 written

Enabling modem dial-out connections

If Modem Direct-Access is enabled in the Terminal-Server profile, users can dial out over the MAX TNT 56K modems. The direct-access server uses the Telnet protocol, rather than a raw TCP connection, for communicating with client processes. This means that any client process wishing to use this service to transmit or receive binary data must, at a minimum, escape outgoing IAC (0xFF) characters, handle escaped incoming IAC characters, and strip out incoming Telnet options. For a description of the Telnet protocol and how it differs from a raw TCP connection, see RFCs 854 and 855.

You can enable direct access to the 56K modems by setting the following parameters, which are shown with their default values:

TERMINAL-SERVER
      dialout-configuration
            enabled = no
            direct-access = no
            port-for-direct-access = 5000
            password-for-direct-access = ""
            security-for-direct-access = none

Note: To enable modem access, you must set both the Enabled and the Direct-Access parameters to Yes in the Terminal-Server profile.


Parameter	Effect
Enabled	Controls whether modem dialout of any kind is allowed. If set to No, none of the other parameters in the Dialout-Configuration subprofile apply.
Direct-Access	Enables the direct-access dialout feature. If set to Yes, users can Telnet to a particular port on the MAX TNT to get immediate dialout service. The port number configured as the Port-for-Direct-Access tells the MAX TNT that all Telnet sessions to port want direct-access to a modem. If set to No, the remaining parameters in the Dialout-Configuration subprofile do not apply.
Port-for-Direct-Access	Specifies the TCP port for immediate dialout service. Must be set to an integer from 5000 to 32767 if Direct-Access is enabled. The default setting is 5000.
Security-for-Direct-Access	Specifies the type of security used for Direct-Access. See Password-protecting modem dialout access(next).
Password-for-Direct-Access	The password (up to 64 characters) used for Global mode authentication. If Security-for-Direct-Access is not set to Global, this parameter is ignored.

Password-protecting modem dialout access

The Security-for-Direct-Access setting in the Terminal-Server Dialout-Configuration subprofile determines whether the modems are password protected for dial-out access, and what type of protection to use. By default, Security-for-Direct-Access is set to None, so no password is initially required. Ascend recommends that you change this default setting.

Global password protection

If you set Security-for-Direct-Access to Global, the Password-for-Direct-Access parameter must specify a password (up to 64 characters). When a user initiates a Telnet session to the specified port, the system prompts for the assigned Password-for-Direct-Access. All users accessing modems supply the same global password.

TERMINAL-SERVER
      dialout-configuration
            password-for-direct-access = global-password
            security-for-direct-access = global

User-level password protection

If you set Security-for-Direct-Access to User, for example:

TERMINAL-SERVER
      dialout-configuration
            password-for-direct-access = ""
            security-for-direct-access = user

the following Connection profile parameters are used to authenticate Direct-Access use. The parameters are shown with the default settings:

CONNECTION station
      station = ""
      ppp-options
            recv-password = ""
      telco-options
            dialout-allowed = no 



 Parameter

 Effect for a Direct-Access dial-out


 Station

 When a user initiates a Telnet session for Direct-Access, the system prompts for a user name and matches the user's input to a Connection profile (or RADIUS profile). 


 Recv-Password

 If the user's input to the user-name prompt matches the Station parameter setting, the system prompts for a password, which must match the setting of this parameter. 


 Dialout-Allowed

 If the user-name and password match up, the system checks that Dialout-Allowed is set to Yes, and if it is, provides access to one of its modems.

Parameter	Effect for a Direct-Access dial-out
Station	When a user initiates a Telnet session for Direct-Access, the system prompts for a user name and matches the user's input to a Connection profile (or RADIUS profile).
Recv-Password	If the user's input to the user-name prompt matches the Station parameter setting, the system prompts for a password, which must match the setting of this parameter.
Dialout-Allowed	If the user-name and password match up, the system checks that Dialout-Allowed is set to Yes, and if it is, provides access to one of its modems.

Example of enabling direct-access with global password

The following commands set up Direct-Access dialout on TCP port 5028 with a Global security:

admin> read terminal-server
TERMINAL-SERVER read

admin> list dialout-configuration
enabled = no
direct-access = no
port-for-direct-access = 5000
password-for-direct-access = ""
security-for-direct-access = none

admin> set enabled = yes

admin> set direct-access = yes

admin> set port = 5028

admin> set password = pizza

admin> set security = global

admin> write
TERMINAL-SERVER written

With this configuration, a user dials out on a MAX TNT modem as follows:

Telnet to the MAX TNT, specifying the Direct-Access port number on the command line. For example:
When prompted for a password, enter the Password-for-Direct-Access.
Use the standard Rockwell AT commands to dial out on the modem, just as if using a modem connected directly to a workstation. For example:
To terminate the session with the modem, terminate the Telnet session.

Example of enabling direct-access with user password

The following commands set up Direct-Access dialout on TCP port 5000 with User security:

admin> read terminal-server
TERMINAL-SERVER read

admin> list dialout-configuration
enabled = no
direct-access = no
port-for-direct-access = 5000
password-for-direct-access = ""
security-for-direct-access = none

admin> set enabled = yes

admin> set direct-access = yes

admin> set security = user

admin> write
TERMINAL-SERVER written

The following example shows how to configure a Connection profile for dial out:

admin> new connection kevin
CONNECTION/kevin read

admin> set ppp recv-password = kpassword

admin> set telco dialout-allowed = yes

admin write
CONNECTION/kevin written

With this configuration, the user named Kevin dials out on a MAX TNT modem as follows:

Telnet to the MAX TNT, specifying the Direct-Access port number on the command line. For example:
Enter your user name at the system prompt:
Enter your password at the system prompt:
Use the standard Rockwell AT commands to dial out on the modem, just as if using a modem connected directly to a workstation. For example:
To terminate the session with the modem, terminate the Telnet session.

techpubs@eng.ascend.com

Default settings

Connection profiles

Required settings

Parameter

Effect

Session time limits

Using RADIUS

Parameter

Effect

Password authentication

Link Quality Monitoring

Parameter

Effect

Setting the base channel count

Parameter

Effect

Parameter

Effect

Parameter

Effect

Parameter

Effect

Parameter

Effect

Performance enhancements for TCP-Clear calls

Parameter

Effect

Defining an End-of-Packet pattern

Escape Sequence

Description

Value

Parameter

Effect

User-level password protection

Parameter

Effect for a Direct-Access dial-out

Example of enabling direct-access with global password

Example of enabling direct-access with user password