Nortel Secure Router 2330/4134Installation — SFPsRelease: 10.2Document Revision: 03.01www.nortel.comNN47263-303.

Nortel 2330 Installation Instructions Manual

precautions

Cautions and warnings for the Secure Router 2330/4134

Foreign Exchange Station (FXS) Interface Modules

Personal safety and equipment protection

Electrostatic discharge

New in this release

Introduction

Nortel Secure Router 2330/4134 hardware components fundamentals

Secure Router 4134 Fan tray

Interface modules for the Secure Router 2330/4134

T1/E1 Small Module

ISDN BRI S/T and ISDN BRI U Small Modules

Serial Small Module

FXS Small Module

FXO Small Module

T1/E1 Medium Module (supported on Secure Router 4134 only)

HSSI Medium Module (supported on Secure Router 4134 only)

Installation — Hardware Components NN47263-301 03.01 7 September

GbE Medium Module (supported on Secure Router 4134 only)

FE and FE/PoE Medium Module (supported on Secure Router 4134 only)

Mediation Server Module for OCS (supported on Secure Router 4134 only)

Voice Carrier Medium Module (supported on Secure Router 4134 only)

GbE Large Module (supported on Secure Router 4134 only)

ADSL2+ Small Module

Secure Router 4134 Internal hardware components

DDR SO-DIMM

VPN/IPSec module

Hot swapping Secure Router 4134 hardware components

Compatible internal modules for Secure Router 2330

Replaceable parts for Secure Router 2330

Installing Secure Router 2330/4134 hardware components

Installing the interface modules

Prerequisites

Installing a Small Module

Installing a Large Module on the Secure Router 4134

Installing a Small Module in the Secure Router 4134 Voice Carrier Medium Module

Hot swapping interface modules

Connecting Secure Router 2330/4134 power cables

Connecting DC power

Connecting the console port cable

Replacing a Secure Router 4134 fan tray module

Installing the internal VPN/IPSec module

Removing the internal VPN/IPSec module

Installing or removing an internal PVM on the Secure Router 4134

Installing the internal PVM

Removing the internal PVM

Replacing the DIMM in the Secure Router 4134

Installing a DIMM on the Mediation Server Module

Removing a DIMM from the Mediation Server Module

Replacing the Secure Router 4134 internal Compact Flash

Removing the Secure Router 2330 top cover

Installing or removing the internal SCIM module on the Secure Router 2330

Installing the internal SCIM module

Removing the internal SCIM module

Installing the internal PVIM module

Removing the internal PVIM module

Replacing the Secure Router 2330 DIMM

Replacing the Secure Router 2330 internal Compact Flash

Environmental requirements

Interface connector pin assignments

Serial cable descriptions

DCE V.35 serial cable

DTE X.21 serial cable

DCE X.21 serial cable

DTE RS-449 serial cable

DCE RS-449 serial cable

DTE RS-232 serial cable

DCE RS-232 serial cable

DTE RS-530 serial cable

DTE RS-530A serial cable

Hardware reliability

Battery life expectancy on the Mediation Server Module for OCS

Translations of safety messages

Overcurrent warning statement

Cover plate warning statement

Power cord warning statement

Secure Router 4134

quick start

TIA-968-A

European Union and European Free Trade Association (EFTA) notice

VCCI statement (Japan/Nippon only)

National Safety Statements of Compliance

Denan statement (Japan/Nippon only)

WEEE Directive Compliance Statement

Cautions and warnings for the Secure Router 4134

Foreign Exchange Office (FXO) Interface Modules

Cables and connectors protection

Antistatic material

Nortel Secure Router

Secure Router 4134 installation and initial configuration

Secure Router 4134 installation and initial configuration navigation

Installing the Secure Router 4134 chassis and hardware components

Installing a power supply module

Installing the chassis

Grounding the chassis

Installing a Medium Module

Installing a Small Module in the Voice Carrier Medium Module

Connecting power cables

Powering up the router

Configuring the Secure Router 4134 for remote access

Establishing remote access

Using SSH for remote access

Changing the default administrator password

Qualified service personnel warning statement

NN47263-100 02.01 Standard 18 February

nortel secure router

Packet ﬁlter

GRE and IPIP tunneling

Authentication, Authorization, and Accounting

SSH2

Firewall and NAT Fundamentals

Stateful inspection elements

Transit policies on trusted zones only

Default ﬁrewall

Firewall network protection features

Policy-based controls

ALG Overview

NAT Overview

Static NAT

NAT failover for ﬁrewalls

NAT Hairpinning

Standards compliance

Packet ﬁlter fundamentals

Maximum allowable ﬁlter rules on Ethernet modules

IPv6 packet ﬁlters

MAC packet ﬁlters

Conﬁguration considerations

IPsec VPN fundamentals

Site-to-Site VPN

Remote access VPN

Remote access VPN with L2TP server

Supported IPsec security protocols

IKE modes

Peer authentication methods for IKE

User authentication for remote access VPN

Internet X.509 PKI certiﬁcate and CRL proﬁle

Certiﬁcate enrollment using SCEP client

Manual certiﬁcate enrollment

Multiple IPsec proposals

Identifying trafﬁc to be encrypted with VPN

Firewall considerations for trusted and untrusted VPN interfaces

Dead peer detection

Security Policy Database

QoS over VPN

Logging and Statistics

GRE and IPIP tunneling fundamentals

IPIP

IPv6 over IPv4 GRE tunnels

PPPoE client fundamentals

Authentication, Authorization, and Accounting fundamentals

CHAP authentication

EAP IEEE 802.1X

Authorization

SSH2 fundamentals

SSH ciphers

SSH key exchange methods

SSH public key ﬁle formats

Firewall and NAT conﬁguration

Conﬁguring global bypass trusted

Conﬁguring global DOS protection

Conﬁguring global NAT hairpinning

Conﬁguring global IP reassembly

Conﬁguring global logging

Conﬁguring global maximum connection limits for the ﬁrewall

Conﬁguring NAT failover

Conﬁguring proxy NAT

Conﬁguring global URL key ﬁlters

procedure steps

Conﬁguring policy-speciﬁc properties

Conﬁguring connection reservations

Conﬁguring stealth mode

Applying an object to a policy

Conﬁguring bandwidth for the policy

Conﬁguring the maximum connections for the policy within a conﬁgured timeframe