ZyNOS FAQ

1. What is ZyNOS?
2. How do I access the Prestige SMT menu?
3. What data compression protocol does the Prestige support?
4. What is the default console port baud rate? Moreover, how do I change it?
5. How do I upload the ZyNOS firmware via console?
6. How do I upgrade/backup the ZyNOS firmware by using TFTP client program via LAN?
7. How do I upload ROMFILE via console?
8. How do I backup/restore SMT configurations by using TFTP client program via LAN?
9. What should I do if I forget the system password?
10. What is SUA? When should I use SUA?
11. What is the difference between NAT and SUA?
12. How many network users can the SUA support?
13. How do I capture the PPP log in my Prestige?
14. Why do we need the input filter in menu 3.1 and call filter in menu 11.1?
15. How can I protect against IP spoofing attacks?
16. What is DNS proxy?
    16.a How do I turn on DNS Proxy?
    16.b How do I set DNS other than Prestige IP address?
17. What is a Nailed-up Connection and when do I need to use it?
18. What are Device filters and Protocol filters?
19. Why can't I configure device filters or protocol filters?
20. The Prestige supports to upload the firmware and configuration files using FTP, but how do I prevent the outside user from 'FTP' my Prestige?

1. What is ZyNOS?

ZyNOS is ZyXEL's proprietary Network Operating System. It is the platform on all Prestige routers that delivers network services and applications. It is designed in a modular fashion so it is easy for developers to add new features. New ZyNOS software upgrades can be easily downloaded from our FTP sites as they become available.

2. How do I access the Prestige SMT menu?

The SMT interface is a menu driven interface, which can be accessed via a RS232 console or a Telnet connection. To access the Prestige via SMT console port, a computer equipped with communication software such as HyperTerminal must be configured to the following parameters.

- VT100 terminal emulation
- 9600bps baud rate
- N81 data format (No Parity, 8 data bits, 1 stop bit)

The default console port baud rate is 9600bps. You can change it to 115200bps in Menu 24.2.2 to speed up access of the SMT.

3. What data compression protocol does the Prestige support?
The Prestige supports STAC compression. Please note that STAC is not enabled in the Prestige by default. You can enable it in Remote Node setup (SMT menu 11.2, Edit PPP Option).

4. What is the default console port baud rate? Moreover, how do I change it?

The default console port baud rate is 9600bps. When configuring the SMT, please make sure that terminal baud rate is also 9600bps. You can change the console baud rate from 9600bps to 57600 to speed up SMT access, by using SMT menu 24.2.2.

5. How do I upload the ZyNOS firmware code via console?

The procedure for uploading via console is as follows.

1. Enter debug mode when powering on the Prestige using a terminal emulator
2. Enter 'ATUR' to start the uploading
3. Use X-modem protocol to transfer the ZyNOS code
4. Enter 'ATGO' to restart the Prestige

6. How do I upgrade/backup the ZyNOS firmware by using TFTP client program via LAN?

The Prestige allows you to transfer the firmware from/to Prestige by using TFTP program via LAN. The procedure for uploading via TFTP is as follows.

1. Use the TELNET client program in your PC to login to your Prestige, and use Menu 24.8 to enter CI command 'sys stdio 0' to disable console idle timeout.
2. To upgrade firmware, use TFTP client program to put firmware in file 'ras' in the Prestige.
3. When the data transfer is finished, the Prestige will program the upgraded firmware into FLASH ROM and reboot itself.
4. To backup your firmware, use the TFTP client program to get file 'ras' from the Prestige.

7. How do I upload ROMFILE via console port?

In some situations, such as losing the system password or the need of resetting SMT to factory default you may need to upload the ROMFILE.

The procedure for uploading via the console port is as follows.

1. Enter debug mode when powering on the Prestige using a terminal emulator
2. Enter 'ATUR3' to start the uploading
3. Use X-modem protocol to transfer ROMFILE
4. Enter 'ATGO' to restart the Prestige

8. How do I backup/restore SMT configurations by using TFTP client program via LAN?

1. Use the TELNET client program in your PC to login to your Prestige, and use Menu 24.8 to enter CI command 'sys stdio 0' to disable console idle timeout
2. To backup the SMT configurations, use TFTP client program to get file 'rom-0' from the Prestige.
3. To restore the SMT configurations, use the TFTP client program to save your configuration in file 'rom-0' in the Prestige.

9. What should I do if I forget the system password?

In case you forget the system password, you can upload ROMFILE to reset the SMT to factory default. After uploading ROMFILE, the default system password is '1234'.

10. What is SUA? When should I use SUA?

SUA (Single User Account) is a unique feature supported by Prestige router which allows multiple people to access Internet concurrently for the cost of a single user account.

When Prestige acting as SUA receives a packet from a local client destined for the outside Internet, it replaces the source address in the IP packet header with its own address and the source port in the TCP or UDP header with another value chosen out of a local pool. It then recomputes the appropriate header checksums and forwards the packet to the Internet as if it is originated from Prestige using the IP address assigned by ISP. When reply packets from the external Internet are received by Prestige, the original IP source address and TCP/UDP source port numbers are written into the destination fields of the packet (since it is now moving in the opposite direction), the checksums are recomputed, and the packet is delivered to its true destination. This is because SUA keeps a table of the IP addresses and port numbers of the local systems currently using it.

11. What is the difference between NAT and SUA?

NAT is a generic name defined in RFC 1631 'The IP Network Address Translator (NAT)'.
SUA (Internet Single User Account) is ZyXEL's implementation and trade name for functioning PAT (Port Address Translation) which is a specific type of NAT. SUA( or PAT for NAT) translates address into port mapping.

The primary motivation for RFC 1631 is that there is not enough IP address to go around. In addition, great many corporations simply did not bother to obtain legal (globally unique) IP addresses for their networks and now finding themselves unable to connect to the Internet.

Basically, NAT is a process of translating one address to another. A NAT implementation can be as simple as substituting an IP address with another. This allows a network to rectify the illegal address problem mentioned above without going through each and every host.

The aim of ZyXEL's SUA is to minimize the Internet access cost in a small office environment by using a single IP address to represent the multiple hosts inside. It does more than IP address translation, it also enables hosts on the LAN can access the Internet at the same time.

12. How many network users can the SUA support?

The fixed-size translation table limits the number of simultaneous. A reasonable number will be less than 20 users. Beyond that, the limited modem bandwidth would probably become the bottleneck and any increase in the translation table size will not help.

13. How do I capture the PPP log in my Prestige?

The procedure to capture the PPP log in Prestige is as following.

To enable the capture of PPP log before a connection is established:

1. Enter SMT Menu 24.8, the CI command mode
2. Enter 'sys trcl cl' command
3. Enter 'sys trcl sw on' command
4. Enter 'sys trcp sw on' command

To display the PPP log after a connection is disconnected:

1. Enter 'sys trcl sw off' command
2. Enter 'sys trcp sw off' command
3. Enter 'sys trcl disp' command

14. Why do we need the input filter in menu 3.1 and call filter in menu 11.1?

Two factory default filter sets have been optimized for Internet connection. They are configured in menu 21 and applied to menu 3.1 and menu 11.5 to prevent NETBIOS triggering the call. You can remove it if you do not need it.

15. How can I protect against IP spoofing attacks?

The Prestige's filter sets provide a means to protect against IP spoofing attacks. The basic scheme is as follows:

For the incoming data filter:

- Deny packets from the outside that claim to be from the inside
- Allow everything that is not spoofing us

Filter rule setup:

- Filter type =TCP/IP Filter Rule
- Active =Yes
- Source IP Addr =a.b.c.d
- Source IP Mask =w.x.y.z
- Action Matched =Drop
- Action Not Matched =Forward

Where a.b.c.d is an IP address on your local network and w.x.y.z is your netmask:

For the outgoing data filters:

- Deny bounceback packet
- Allow packets that originate from us

Filter rule setup:

- Filter Type =TCP/IP Filter Rule
- Active =Yes
- Destination IP Addr =a.b.c.d
- Destination IP Mask =w.x.y.z
- Action Matched =Drop
- Action No Matched =Forward

Where a.b.c.d is an IP address on your local network and w.x.y.z is your netmask.

16. What is DNS proxy?

If enabled, DNS Proxy allows the Prestige to act as the DNS server for the local network. The Prestige gets the IP address of the actual DNS server from the remote site via IPCP negotiation. Note this feature only works if the remote site supports RFC 1877.

16.a. How do I turn on DNS Proxy?

DNS Proxy is enabled only if the selection of the DHCP field under DHCP Setup in Menu 3.2 is Server and the Primary DNS Server is set to 0.0.0.0. (this is the factory default). If the DNS Proxy is enabled, the Prestige will assign its IP address as the Primary DNS in the responses to DHCP requests on the local network.

16.b. How do I set DNS other than Prestige IP address?

The Prestige assigns the values entered in Primary DNS server and Secondary DNS server fields in Menu 3.2 to the responses to the DHCP requests on the local network if the DHCP Server function is enabled.

17. What is a Nailed-up Connection and when do I need to use it?

A Nailed-up Connection, when enabled, emulates a leased line connection even though the physical line is a dial-up connection. The Prestige dials and holds up a connection, without any traffic requesting it.

When you want the link to be always up, you need to use it.

18. What are Device filters and Protocol filters?

In ZyNOS, the filters have been separated into two groups. One group is called 'device filter group', and the other is called 'protocol filter group'. Generic filters belong to the 'device filter group', TCP/IP and IPX filters belong to the 'protocol filter group'.

19. Why can't I configure device filters or protocol filters?

In ZyNOS, you can not mix different filter groups in the same filter set.

20. The Prestige supports to upload the firmware and configuration files using FTP, but how do I prevent the outside user from 'FTP' my Prestige?

The Prestige supports to upload the firmware and configuration files using FTP connections via LAN and WAN. So, this becomes unsecure that anyone can make a FTP connection over the Internet to your Prestige. To prevent from outside users connecting to your Prestige via FTP, you can configure a filter to block the FTP connection from WAN. Click here for the details about how to configure this filter set.

All contents copyright © 1999 ZyXEL Communications Corporation.