Administration HiPath 3000/5000 V7 IP systems

3000sb4.fm
For internal use only HiPath 3000/5000 in the LAN Network
HG 1500 V3.0
4.5.9.2 Network Address Translation (NAT)
Network Address Translation (NAT) is the conversion of IP addresses in the LAN for the Internet.
HG 1500 V3.0 provides NAT for Internet connections via a second Ethernet interface as
well as for PPP connections via B channels.
As far as the Internet is concerned, the entire LAN appears to be a single IP address and can
therefore use a common dial-up connection to an ISP, for example. Additionally, direct IP attacks
from the Internet on terminals in the LAN are not possible.
NAT can be enabled and disabled in the HG 1500 V3.0. Certain services – such as VoIP or video
telephony – embed subscribers’ IP addresses in their data packets, however, instead of just
noting them in the packet headers. They are only compatible with NAT within a VPN.
4.5.9.3 Access Protection
A variety of security functions are available to prevent unauthorized usage:
Checking Caller Numbers
Connections from the PSTN can be checked against a list of known users using the caller number.
Users whose connections do not transmit a caller number (for example analog telephones)
can call an MSN that is set up especially for them.
Callback
All users can be configured so that they can be called back. Thus, PPP connections are only
possible from a predefined connection.
User Account and Password
After setting up a connection, the user account and password can be checked using PAP (Password
Authentication Protocol), CHAP (Challenge Handshake Authentication Protocol) or MSC-
HAP (Microsoft Challenge Handshake Authentication Protocol.
HG 1500 V3.0 also supports these protocols as a client when dialing in to a RAS server (for
example with an ISP).
IP Address Filter for Communication with the LAN
IP address filters can be defined to prevent attacks on devices in the LAN, both from insecure
(external) networks and from within the LAN. When IP filtering is activated, access is only possible
from address ranges that have explicit permission, and this access is only possible to
specified addresses. Optionally, access can be further limited to a specific protocol port.
P31003-H3570-Y100-4-7618, 2007-10-31
HiPath 3000/5000 V7, System Description 4-33