Release Notes
for OpenROUTE 5.3


These release notes are for OpenROUTE 5.3 software. They cover the following topics:

New Software Features

Known Deficiencies, Limitations, and/or Clarifications

New Software Features

This section introduces the following new software features in OpenROUTE 5.3.

Bandwidth Throttling

The Bandwidth Throttling feature allows you to control the bandwidth that synchronous WAN interfaces use to transmit or receive packets. This lets you provide different levels of bandwidth in a network.

DiffServe

The purpose of the DiffServe feature is to provide a means for IP routers and hosts to differentiate among various classes of IP traffic in order to control Quality of Service (QOS) characteristics such as latency, bandwidth, and packet dropping strategies. QOS lets you provide different service levels for different types of traffic.

In OpenROUTE 5.3 the IP Dynamic Filters (IPDF) and Bandwidth Reservation System (BRS) features are enhanced to support the DiffServe concept.

Domain Name Services (DNS)

The Domain Name Services (DNS) feature allows the router to act as a DNS client. The DNS client software allows users on your network to use a domain name, rather than an IP address, when running Ping, Telnet, or Traceroute.

Ethernet Modules on 3000 Series

Ethernet Supports Bandwidth Reservation

You can now set the Bandwidth Reservation System (BRS) over Ethernet interfaces. To display the prompt for configuring BRS over Ethernet,

1. At the Config> prompt, enter list interfaces to see a list of interfaces configured on the router. You use the interface number to configure an interface for BRS.

2. At the Config> prompt, enter network followed by the number of the interface you want to configure for BRS. For example,

Config>network 1
Ethernet interface configuration

3. At the prompt that appears, enter brs.

ETH config>brs
Bandwidth Reservation User Configuration
BRS Config <Ethernet2>

You can now set up Bandwidth Reservation as you would on any other interface.

Longer Names for PAP and CHAP Names

Names in the router relating to PAP and CHAP, such as local names, address names, modem names, and chat-script names are changed to allow up to 35 characters in a name. Previously, the limit was 23 characters.

Dial Configuration Commands

The following commands are changed at the DIAL Config <WAN#> prompt.

DIAL Config <WAN2> add address
Address name (1-35 characters)?

DIAL Config <WAN2> add modem configurable
Modem name (1-35 characters)?

DIAL Config <WAN2> modem
Modem name (1-35 characters)?

DIAL Config <WAN2> add chat-script
Chat script name?

PPP Configuration Commands

The following commands are changed at the PPP Config <NET-#> prompt.

PPP Config <NET-2> set chap local-name
Local router name? [3000router]?

PPP Config <NET-2> set pap local-name

Local router name? [3000router]?

PPP Config <NET-2> add password
Router name?

PPP Config <NET-2> add secret
Router name?

BRI Configuration Command

The following commands are changed at the BRI Config <ISDN> prompt.

BRI Config <ISDN-2> add address
Assign address name [1-35] chars?

BRI Config <ISDN-2> add accounting-entry

Assign accounting entry name []?

New IP Filter Option Allows You to Specify Placement of Profiles on an Interface

A new option is added to the IP Filter set interface command that lets you specify the position of a profile when you add the profile to the list of profiles already attached to an interface.

As the default, the software adds new profiles to the end of the list of profiles attached to the interface. By specifying the position, you can place the profile at the top of the list or after a specific profile in the list.

Syntax: set interface interface# profiles+=

after existing-profile-name new-profile-name
*
new-profile-name
Entry Description
after Places the new profile after an exiting profile.

* Places the new profile at the top of the list.

new-profile-name Places the new profile at the end of the list.

The following example places the profile firewall after the mark_local profile.

Example: set interface 2 profiles+= after mark_local firewall

Known Deficiencies, Limitations, and/or Clarifications

This section describes known deficiencies in OpenROUTE 5.3 and indicates limitations with the software.

General

GT 60 and 70 Series and routers do not have a time of day clock chip with battery backup. For time to be meaningful, you have to get the time from a nearby host or manually set the time whenever you restart the router. Use the time commands at the Config> prompt for these operations. Enter time set at restarts or set up the time configuration to poll a nearby host.

3000 Series Secure Gateway Router

In OpenROUTE 5.3, the 3000 Series supports data routing, as well as an optional analog voice module that provides up to four analog voice lines. Future releases will support digital voice modules.

CAUTION:
The voice ports on the analog voice module have
RJ-45 (8-pin) interfaces.
Inserting an RJ-11 (4-pin) connector into an RJ-45 port can damage the pins in the port.

Using an RJ-11 connector in the voice ports voids the warranty of the analog voice module.

Analog Voice

Using NAT With Voice

To run voice traffic and NAT over the Internet, you must assign a public IP address for the voice module, and that address must be visible to the Internet. You cannot hide the address behind a firewall.

To do this, you set up a fixed address mapping for the voice module so that NAT does not translate the voice IP address. You need to assign the same address as the public outside address and the private inside address. This address must also be on the same subnet as the Internet connection.

The following example shows how to set up a fixed address mapping, where 128.185.2.2 is the IP address of the voice module.

*config
Config>PROTOCOL ip
Internet protocol user configuration
IP config>nat
Network Address Translation Configuration
NAT Config>add FIXED-IP-MAPPINGS
Interface number [1]? 3
Public outside address [0.0.0.0]? 128.185.2.2
Mask [255.255.255.255]?
Private inside address [0.0.0.0]? 128.185.2.2

The IP address of the voice module must also be different from the NAT global IP address for this no-translation to work. If they are the same, explicitly configure the NAT global IP address to be the public IP address of the Internet interface, and do not let the router automatically choose the NAT global IP address.

To check the global IP address that NAT is using, enter list nat at the NAT monitoring prompt.

*monitor
+PROTOCOL IP
IP>nat
Network Address Translation Console
NAT>LIST NAT-INTERFACE
Interface number [1]?
NAT Enabled on interface 1
Address is: 128.185.2.1 Service Table Used: Global
Current # entries: 0
Maximum # entries: 500 Global ageout: 1800 secs
TCP ageout (secs): 9000 TCP closed ageout: 30 secs

To explicitly set the global IP address of the NAT interface, use the following command.

NAT Config>SET NAT-INTERFACE IP-ADDRESS
Interface number [1]?
NAT IP address (0.0.0.0 = use automatic default) [0.0.0.0]? 128.185.2.1

Note: You cannot use unnumbered IP on a NAT interface.

DHCP Client

GTX Series

Before you install a new module in your GTX Series router, be sure that you have the appropriate router software. Router software OpenROUTE 5.3 supports the GTX1500 and GTX1000T platforms and the following modules:

Expandable Memory

The GTX Series User Guide incorrectly lists the expandable memory available for the GTX Series.

The available memory upgrade modules are 8, 16, 32, and 64 MB. Therefore, you can upgrade your GTX Series from 8 MB to 16, 24, 40, or 72.

IP Filters

Note the following information about using the isprec-= and prec-= options with the add filter or set filter commands.

IPSec

Interoperability With Cisco 2524 Routers

When running IPSec over ISDN to a Cisco 2524 router, you need to use just one B-channel.

Also, if you are using manual keys to run IPSec to a Cisco 2524 router, the Cisco console displays "hung task" and "trace" error messages. These errors do not affect operation of IPSec.

Blowfish and IPCOMP Algorithms

The OpenROUTE 5.0 and later implementations of the IPSec algorithms Blowfish and IPCOMP are not interoperable with OpenROUTE 4.0 versions of OpenROUTE IPSec software. To run the Blowfish and IPCOMP algorithms in OpenROUTE 5.3, you need to upgrade your routers from OpenROUTE 4.0 to release 5.0 or higher.

Quick Config and Unnumbered Ethernet

In Quick Config, if you assign the Ethernet interface to be unnumbered (dynamic), you cannot assign the unnumbered Ethernet interface as the default route.

When you get to the end of the IP configuration, Quick Config asks if you want to specify a default route. If you answer yes, Quick Config asks if you want to use an unnumbered or dynamic interface. If you answer yes and select a non-PPP interface, Quick Config tells you that you must use an unnumbered PPP interface, and gives the example of Interface #0 (the Ethernet) as an unnumbered PPP interface.

To work around this problem, answer no when Quick Config asks if you want to specify a default route. When you finish running Quick Config, go to the IP Config> prompt and use the add route command to set up the default route.

QuickWeb

QuickWeb allows you to add user accounts that use the challenge/response method of authentication. However, you cannot log into QuickWeb using a challenge/response. You can log into this type of account only at a CLI prompt. You can access the CLI from QuickWeb by clicking the CLI via Telnet button.

SDSL Module

At slower SDSL line speeds (160Kbps and 208Kbps), it can take several minutes for the SDSL module to come up and be available for data traffic. SDSL DSLAMs can take several minutes to begin the speed training process with the SDSL module. Once the speed training is complete, the activation process can take an additional two minutes before the interface is declared as Up. This is an inherent characteristic of the SDSL technology being deployed.

Because of the length of activation time, if the cable to the SDSL module is pulled during the activation process, it can take up to two minutes for the router to detect the pulled cable and drop out of the activation. If the DSLAM reissues its activation sequence before the SDSL module has dropped out, the SDSL module misses the activation sequence, and must wait for the DSLAM to issue its next activation sequence.



Copyright © 2000, Nx Networks. All rights reserved.