ComOS 3.3.1 Release Note Introduction The new Livingston Enterprises ComOS(TM) 3.3.1 software release is now available for the PortMaster(TM) 2E, 2ER, 2, 2R and 25. This software release is provided at no charge to all Livingston customers. The following document describes the features of the ComOS 3.3.1 software release and how to upgrade your PortMaster. Upgrade instructions are included at the end of this release note. WARNING! YOU MUST USE PMINSTALL VERSION 3.3 OR LATER IN ORDER TO PERFORM THIS UPGRADE! Livingston shipped ComOS 3.3, an interim release, with the new MOD-10I-U 5-BRI ISDN expansion board in December of 1995. The new ComOS 3.3.1 includes all the functionality of ComOS 3.3, plus many other new useful features. All new shipments of the MOD-10I-U include ComOS 3.3.1. Contents Introduction Contents New Features in ComOS 3.3 and 3.3.1 Bug Fixes in ComOS 3.3 and 3.3.1 ISDN Basic Rate Interface (BRI) support Configuring ISDN New RADIUS Attributes Memory Usage in ComOS 3.3 and 3.3.1 for PM-2E Upgrade Instructions New Features in ComOS 3.3 and 3.3.1 ComOS 3.3 includes the following new features: .ISDN Basic Rate Interface (BRI) support .Multilink PPP on ISDN .Multilink V.120 on ISDN .Dynamic loadable software modules for memory management .ARP entries cleared on Frame Relay .Require PAP option .Per user port limit for Multilink PPP and Multilink V.120 .Per user idle timeouts .Per user session time limits .IP numbered interfaces through User Table .BOOTP support .Called-Station-Id and Calling-Station-Id for RADIUS accounting .RADIUS accounting sends notification of PortMaster boot .Outbound PAP authentication .Increase in active interfaces ComOS 3.3.1 adds the following new features: .5ESS Custom Point-to-Point ISDN Support .Ascend Multilink PPP compatibility .Data over voice for both inbound and outbound ISDN connections .AT strings for more user control for outbound ISDN dialing .Console now ignores modem type and autolog .!root login on serial ports can be disabled .Non-printing characters allowed in passwords .RADIUS Accounting records signed .Port Type included in RADIUS Authorization and Accounting .Input and output octet counters in RADIUS Accounting .RFC 1877 support added so clients can learn their DNS server from PortMaster .Location Table entries made simpler and easier Description of New Features in ComOS 3.3 This section describes the new features in ComOS 3.3 in more detail. ISDN Basic Rate Interface (BRI) support ISDN basic rate interface support has been added. This release added full support for the new MOD-10I-U ISDN expansion boards available for the PortMaster 2E and 2ER. Consult the "Installing the MOD-10I-U ISDN Expansion Board" release note for a full list of supported capabilities. See "ISDN Basic Rate Interface (BRI) support" on page 7 for instructions on configuring the PortMaster 2E to use the MOD-10I-U ISDN expansion board. Multilink PPP on ISDN Multilink PPP (MP) is now supported on ISDN interfaces. This is supported concurrently with the Livingston Multi-line Load Balancing. The PortMaster automatically detects and accepts both Multi-line Load Balancing and Multilink PPP connections. Outbound, the PortMaster can be set to use Multilink PPP via the Location Table by using the "set location Location_Name multilink on" command. Multilink V.120 on ISDN Implemented Multilink V.120 on ISDN interfaces. This allows the Livingston PowerLink128 ISDN Modem to make 128Kbps connections to the PortMaster. Second connections generate PowerLink128 RADIUS Accounting records. Dynamic loadable software modules for memory management Memory management has been improved and Dynamic Load modules have been implemented. Device drivers now only load if the specific device is present in the PortMaster (i.e. sync port or ISDN). In addition if SNMP or IPX are not needed they can be disabled to save memory. The commands "set ipx off" and "set snmp off" cause the modules to not load. Any device drivers or subsystems not needed provide additional operational memory for the PortMaster. See the memory guidelines below for PortMaster memory requirements. IMPORTANT - to use IPX, you must now use the "set ipx on" command. If you are upgrading from a previous release and had IPX configured, it defaults to "on" in this release. When turning IPX or SNMP off, you must do a "save all" and reboot the PortMaster before the change takes effect. ARP entries cleared on Frame Relay ARP entries are now cleared on Frame Relay interfaces when LMI stops reporting the DLCI. This eliminates packet traffic on PVC's which have been disabled. Require PAP option The support for Challenge Handshake Authentication Protocol (CHAP) can now be disabled. Administrators who do not wish to support inbound CHAP authentication can now use the command "set chap off" to disable it. If CHAP is disabled, the only authentication supported is PAP or simple username/password login. It is recommended that this form of authentication use more advanced security subsystems like one-time password smart cards. Per user port limit for Multilink PPP and Multilink V.120 Implemented Port Limits on a per user basis, only for Multilink V.120 and Multilink PPP users. If left unconfigured, port limits are not imposed, and Multilink V.120 and Multilink PPP sessions are allowed. If a port limit is set, the user is limited to that number of ports on the PortMaster for Multilink V.120 and Multilink PPP only. The command to do so is "set user Username maxports Number". This can be specified as part of the new RADIUS Port-Limit attribute. Per user idle timeouts Implemented idle timeouts on a per user basis. Idle timeouts can be set in the User Table or can be provided as part of the new RADIUS Idle-Timeout attribute. To set them in the User Table use the "set user Username idle Minutes" command. Per user session time limits Implemented session limits from the User Table or RADIUS. If RADIUS returns a session time limit using the new Session-Timeout attribute, the user is automatically disconnected when the time limit is exceeded. To set a session limit in the User Table use the "set user Username session-limit Minutes" command. IP numbered interfaces through the User Table Implemented IP numbered interfaces for network users through the User Table. By using the "set user Username local-ip-address IPaddress" command, the PortMaster uses the local-ip-address as its IP address to the serial interface. This function is not available in RADIUS. BOOTP support BOOTP Support has been added. Clients dialing into the PortMaster can now make BOOTP requests to determine IP address, Subnet Mask, Default Gateway, DNS server, and Domain Name. The PortMaster only responds to BOOTP requests on its serial or ISDN lines. Called-Station-Id and Calling-Station-Id for RADIUS accounting RADIUS Accounting has been extended to provide Called-Station-Id and Calling-Station-Id on ISDN dial-up connections (where provided by the ISDN carrier). These attributes can be used to differentiate ISDN calls from analog calls and to track origination of ISDN calls. RADIUS accounting sends notification of PortMaster boot The PortMaster logs a Start record with no Username to the RADIUS accounting server at boot time. Outbound PAP authentication Outbound PAP authentication is now supported. The PortMaster previously required the remote end to authenticate with CHAP. Now, by specifying a PAP username and Password in the Location Table dial script, the PortMaster can be authenticated by the remote end using PAP. This is done by setting the Send String in the last line of the dial script to contain the PAP information. The command is: set location Location_Name script Number "=PAP=User/Password" This authenticates using PAP as user User with password Password. ComOS 3.3.1 has an even simpler method of specifying PAP authentication in the location table. Increase in active interfaces The ceiling on maximum active interfaces has been raised from 100 to 500 when more than 1MB of memory is found. Description of New Features in ComOS 3.3.1 This section describes the new features in ComOS 3.3.1 in more detail. 5ESS Custom Point-to-Point ISDN Support 5ESS Custom Point-to-Point ISDN Support has been added. PMconsole(TM) 3.3 does not support the 5ess-ptp switch type, so if you are using 5ESS Point-to-Point you must set the switch type from the command line as follows: set isdn-switch 5ess-ptp save all reboot Ascend Multilink PPP compatibility Compatibility with Ascend's version of Multilink PPP has been added. Data over voice for both inbound and outbound ISDN connections Data over voice is now supported for both inbound and outbound ISDN connections. The PortMaster automatically accepts voice calls inbound and treats them as data calls. Outbound, setting the voice attribute in the location table with "set Location_Name voice on" forces a voice call. In outbound asynchronous mode, the AT&N55 command forces a voice call. AT strings for more user control for outbound ISDN dialing In asynchronous ISDN mode new AT strings have been added to allow more user control when performing outbound dialing. Specifically the new strings are: &N55 Perform an outbound call using data over Voice (a Voice call is originated). &N56 Perform an outbound call using a 56000 data connection. &N64 Perform an outbound call using a 64000 data connection. &N0 Attempt to autodetect the available data service (64000 or 56000) Console now ignores modem type When the console diagnostic switch is up, the PortMaster no longer attempts to configure the modem specified for the console port. This allows a terminal to be more easily attached to the console for debugging purposes when a modem was previously attached. Any autolog setting on S0 is now ignored if the console diagnostic switch is up. !root login on serial ports can be disabled The command "set serial-admin off" disables !root logins on the serial ports. !root can still login on port S0 if the console dip switch is up. Non-printing characters allowed in passwords Support has been added to allow the entry of non-printing characters in the login password field. RADIUS Accounting records signed RADIUS accounting has been extended to deliver signed accounting records for verification of authenticity as per the current RADIUS Internet-Draft. Port Type included in RADIUS Authorization and Accounting RADIUS accounting and authorization has been extended. The new NAS-Port-Type is now included in Access Requests and Accounting Requests. This allows administrators to know definitively whether a user is attempting a session on an asynchronous port, an ISDN port, or a synchronous port. Input and output octet counters in RADIUS Accounting RADIUS accounting has been extended to include input and output bytes counts in the RADIUS Stop records. RFC 1877 support added so clients can learn their DNS server from PortMaster. Support for RFC 1877 has been added. This allows hosts which support RFC 1877 to learn their DNS (and other servers) through the PPP protocol negotiation. Use the "set nameserver Ipaddress" command on the PortMaster to set the nameserver that the PortMaster tells the host about. You can set an alternate name server with "set nameserver 2 Ipaddress". Location Table entries made simpler and easier. New location table entries now default to PPP and its associated configuration parameters to simplify data entry for the most common types of dial locations. Automatic location table scripting has been implemented. Instead of requiring the administrator to enter a V.25bis or AT style send/expect dial script, they can simply enter the telephone number, user name, and password to use when dialing to a remote location. The following commands have been added to support this: set location Location_Name telephone 8005551212 set location Location_Name username PPP_PAP_username set location Location_Name password PPP_PAP_password Bug Fixes in ComOS 3.3 and 3.3.1 The following bugs have been fixed in ComOS 3.3 and 3.3.1 Bug Fixes in ComOS 3.3 The PortMaster no longer loses track of IP addresses it provided as assigned address from the pool. This bug caused the PortMaster to start giving out address 0.0.0.0 to dial-in hosts because it is out of addresses. Users which have initiated a PPP connection using PPP autodetect and get authenticated and authorized as a SLIP user are now properly handled. Service is denied and the PortMaster cleans up the session. Previously a variety of symptoms would be experienced causing an incorrect active configuration. The correct active user is retained for ports configured for host prompt. Serial port spurious interrupt handling has been extended to include detecting streams of framing errors. Some modems get confused about their configuration and begin sending continuous data to the PortMaster at a baud rate different than set on the PortMaster. This would cause all operation on the PortMaster to appear stopped for several minutes to several hours. The PortMaster now attempts to reset the modem and continues to operate properly even if the modem does not recover. Bug Fixes in ComOS 3.3.1 "No Circuit Available" on ISDN lines has been fixed. In some cases a call was not being completely disconnected even though the PortMaster thought the disconnect had completed. In this case additional attempts to dial out would fail because a new circuit was not actually available. The PortMaster now fully cleans these connections up. Occasionally the message "mwac_cmd: ISDN command timeout - ip0<0200, 8014>" would be displayed on the PortMaster console. At this point ISDN traffic would cease until rebooting. This has been fixed. Some PPP packets would fail to transmit over ISDN with the message "remote_slifrecv: Limited expansion room - packet lost" being displayed on the console. This has been fixed. Release 3.3 introduced a bug in which duplicate IP addresses would be assigned to multiple users. This typically happened if the port was configured as a host prompt port with network dial-in disabled and a network connection was started by PPP autodetect or entering "ppp" at the host prompt. All additional PPP users coming in on other ports with the same configuration would receive the same IP address. In some cases this problem occurred with other configurations. This has been fixed. NOTE: Users should verify that ports which they want to allow PPP connections to be established from the "host:" prompt have network dial-in enabled. Multiple simultaneous outbound dialing over ISDN has been fixed. Previously if multiple outbound dial attempts were initiated within 200ms of each other, the second dial attempt would be lost and the second outbound dial would never complete. ISDN Basic Rate Interface (BRI) support ComOS 3.3 adds support for Livingston's new 5 BRI ISDN card. Up to two ISDN cards, in addition to a 10-port 115.2 Kbps asynchronous card, are supported in the PortMaster 2E or 2ER. PortMasters support dial-on-demand ISDN connections using BRI ports and the PPP protocol. Each BRI supports two 64 Kbps B channels for data and one 16 Kbps D channel for signaling. Multiple lines can be used to increase bandwidth, either using Multilink PPP, as defined by RFC 1717, or using Livingston's Multi-line Load Balancing. ISDN BRI ports are easier to configure than asynchronous or synchronous ports because the NT1 is integrated in the port. No modem, CSU/DSU, or external terminal adapter is required. ISDN ports can also be used to do anything that an asynchronous port can be used for except network hardwired. Async or sync usage is autodetected. 56K or 64K speeds are also autodetected. The ISDN ports support synchronous PPP and asynchronous V.120 PPP or SLIP. ISDN connections can be initiated on an as-needed basis or they can remain active all the time. A dial-out location must be specified in the Location Table for dial-out connections and a dial-in user must be specified in the User Table or RADIUS for dial-in connections. CHAP is available for dial-in or dial-out authentication. PAP is available for dial-in authentication, and is available for dial-out authentication if the =PAP= Send string is used in the V.25bis dialing script. The following commands have been added to configure ISDN: set isdn-switch ni-1|dms-100|5ess|5ess-ptp set Port spid Number set Port directory Number See "Configuring ISDN" for more information on the ISDN commands. Any 64K ISDN B-channel port can be used as a dial-out ISDN modem. A user can telnet to a ISDN port and then execute a Hayes AT dialing command to connect to a remote ISDN PortMaster, PortMaster ISDN Office Router, or external ISDN modem. The PortMaster responds to any "AT" command which is not specifically a dial command with an "OK". That way, attempts to set S registers, flow control, or other things needed by analog modems are accepted by the PortMaster but ignored. This allows existing configured dialer software to be used with the PortMaster ISDN port without any changes. The "AT&N56" command sets the port for 56K operation for this dialout, and the "AT&N64" command sets the port for 64K. The "AT&N0" command attempts to autodetect the available data service, either 56000 or 64000. The "AT&N55" command performs an outbound call using data over voice. A dial command can be ATDT, ATD or ATDP followed by the phone number. Phone numbers can have dashes "-", commas "," or digits in them, ending with a carriage return. Since ISDN does not require pauses in dialing, commas in the phone number are accepted but ignored. Configuring ISDN Only three additional things need to be configured on the PortMaster to permit ISDN service. They are: the ISDN Switch type, a Service Profile Identifier (SPID) for each ISDN port, and a directory number(DN) for each ISDN port. All three can be configured from PMconsole 3.3 or from the command line interface. To display ISDN debug information on the console, use the commands: show isdn set console set debug isdn on To turn off debugging use the commands: set debug isdn off reset console ISDN Switch Type The ISDN Switch Type can be set to one of four values. Your telephone company can tell you which type its switch is: National ISDN-1 (NI-1), Northern Telecom DMS-100 Custom, AT&T 5ESS Custom Multi-Point, or AT&T 5ESS Custom Point-to-Point. If they have a DMS-100 or 5ESS switch that uses National ISDN-1, treat that as NI-1. Use one of the following commands to set the switch type. The default is NI-1. If you change the switch type after setting a SPID on a port you must reboot the PortMaster for the change to take effect. set isdn-switch ni-1 set isdn-switch dms-100 set isdn-switch 5ess set isdn-switch 5ess-ptp PMconsole 3.3 does not support the 5ess-ptp switch type, so if you are using 5ESS Point-to-Point you must set the switch type from the command line. SPID The Service Profile Identifier (SPID) is a number up to 20 digits long set for each port, which identifies the port to the telephone company. The telephone company can provide you with the SPIDs for each line. If the spid is invalid, "set debug isdn on" can reveal that. An example command is: set s10 spid 1510555121200 Directory Number If you set the Directory Number, then an incoming call must match this number to determine which port the call is taken on. It is a 10-digit phone number provided by the telephone company. Either of the following commands are accepted: set s10 dn 5105551111 set s10 directory 5105551111 Other port configuration ISDN ports are simpler to configure than asynchronous ports. You never set modem control (carrier detect), flow control or speed on an ISDN port. The PortMaster senses the speed and sets the port to 64000 or 56000 accordingly, flow control isn't needed on a synchronous line since clock is provided by the telephone company, and carrier detect is always used. Refer to the Communications Server Hardware Installation Guide for information on ISDN LED activity. The ports support both sync and async PPP (V.120). The show port command displays 64000/async if async PPP is in use. The port can be configured for anything an async port can be configured for, except that network hardwired is not supported. When using the ISDN port for network dial-out, the dial-out location should use a V.25bis script and authenticate using CHAP, but PAP is also available. Here is a table for what show port displays according to port status: .Port Status Modem Status Description .NO-SERVICE DCD- CTS- TELCO- NT1- No SPID set .NO-SERVICE DCD- CTS- TELCO- NT1+ No cable or no circuit to Telephone Company .NO-SERVICE DCD- CTS+ TELCO+ NT1+ Cable and ISDN circuit OK but SPID not registered .IDLE DCD- CTS+ TELCO+ NT1+ SPID registered and ready to use .ESTABLISHED DCD- CTS+ TELCO+ NT1+ Connecting or providing device service but no carrier sensed .ESTABLISHED DCD+ CTS+ TELCO+ NT1+ Connected .ESTABLISHED DCD+ CTS- TELCO+ NT1+ Connected with V.120 async but flow controlled by other end New RADIUS Attributes To use the new RADIUS attributes with RADIUS 1.16, upgrade your PortMaster to ComOS 3.3.1 as described below, add the following lines to your /etc/raddb/dictionary file, kill your radiusd daemon and restart it. ATTRIBUTE Session-Timeout 27 integer ATTRIBUTE Idle-Timeout 28 integer ATTRIBUTE Called-Station-Id 30 string ATTRIBUTE Calling-Station-Id 31 string ATTRIBUTE Acct-Input-Octets 42 integer ATTRIBUTE Acct-Output-Octets 43 integer ATTRIBUTE NAS-Port-Type 61 integer ATTRIBUTE Port-Limit 62 integer VALUE NAS-Port-Type Async 0 VALUE NAS-Port-Type Sync 1 VALUE NAS-Port-Type ISDN 2 VALUE NAS-Port-Type ISDN-V120 3 VALUE NAS-Port-Type ISDN-V110 4 Idle-Timeout is expressed in seconds but is rounded to a minute boundary, and can be any value from 120 (2 minutes) to 14400 (4 hours). Session-Timeout is expressed in seconds but is rounded to a minute, and can be up to a year long. Note that Port-Limit only works with certain types of users; see the Enhancements section above for restrictions. Here is an example /etc/raddb/users entry for a network user that is authenticated using a login script or PAP using her password from the UNIX /etc/passwd file, and uses PPP with an address assigned from the PortMaster's dynamic address assignment pool. She is only allowed to connect once concurrently per PortMaster. After 10 minutes (600 seconds) of idle time without any traffic she is disconnected. After 2 hours (7200 seconds) elapsed time she is disconnected regardless of what she's doing. # # Example PPP user, address Assigned by PortMaster # Pfn Password = "UNIX" User-Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-MTU = 1500, Idle-Timeout = 600, Session-Timeout = 7200, Port-Limit = 1 Memory Usage in ComOS 3.3 and 3.3.1 for PM-2E Release 3.3 and 3.3.1 function on all existing PortMasters in about the same memory as release 3.1.4. Memory considerations are only required when adding ISDN modules to the PM-2E chassis. Model Async Sync ISDN Base Memory ------------------------- ------ ------ ------ ----------- PM-2E-10 + 1 ISDN 10 0 10 850K PM-2E-10 + 2 ISDN 10 0 20 900K PM-2E-20 + 1 ISDN 20 0 10 925K PM-2ER-10 + 1 ISDN 10 1 10 875K PM-2ER-10 + 2 ISDN 10 1 20 925K PM-2ER-20 + 1 ISDN 20 1 10 950K User Selectable Software Modules Module Memory Required ----------- --------------- SNMP 50K IPX 20K If SNMP is used an additional 50K is used. If IPX is used an additional 20K is used. In addition to the base and module memory required, memory is used to manage each table within the PortMaster. The most common table requiring memory is the routing table. 5K per 100 routes should be budgeted. With these guidelines the standard 1MB (1024K) should work on most configurations. If user entries are being managed on the PM-2ER-20 + 1 ISDN and IPX and SNMP are required, the PortMaster should be upgraded to 4MB (4096K). The PortMaster auto-detects the physical installed memory. 30-pin 70ns SIMMs are required, and there must be 4 SIMMs, all of them either 256K, 1MB, or 4MB. Mixing SIMMs is not supported. Upgrade Instructions READ THE PRECEDING SECTION ON MEMORY USAGE BEFORE UPGRADING A PM-2E! To upgrade using the included floppy follow these instructions. If you have different media, replace /dev/rfd0c with the appropriate device. You can also FTP the software from ftp://ftp.livingston.com/pub/le/software/ # umask 22 # mkdir /usr/portmaster # cd /usr/portmaster # tar xvf /dev/rfd0c # ./pminstall To upgrade a PM-2, PM-2R, PM-2E or PM-2ER to ComOS 3.3.1, run the new pminstall and choose the Upgrade PortMaster option, choose pm2_3.3.1 from the menu of upgrade choices, enter your PortMaster's hostname or IP address, enter your PortMaster's administrative password. pminstall upgrades your PortMaster to ComOS 3.3.1. To upgrade a PM-25 follow the same instructions except choose pm25_3.3.1 from the menu of upgrade choices instead of pm2_3.3.1. The upgrade does not affect your stored configuration in the PortMaster, but if you would like to backup your PortMaster configuration before upgrading, run pmreadconf before upgrading, as follows: # ./pmreadconf pmname pmpassword data/pmname.conf # chmod 600 data/pmname.conf Copyright and Trademarks 1996 Livingston Enterprises, Inc. All rights reserved. The product names, "ComOS," "IRX," "PortMaster," "PMconsole," and "TelePath" are trademarks belonging to Livingston Enterprises, Inc. All brand product names mentioned in this document are trademarks or registered trademarks of their respective manufacturers. Notices Livingston Enterprises, Inc. makes no representations or warranties with respect to the contents or use of this manual, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Livingston Enterprises, Inc. reserves the right to revise this publication and to make changes to its content, any time, without obligation to notify any person or entity of such revisions or changes. Contacting Livingston Technical Support Every Livingston PortMaster or IRX product comes with free lifetime software technical support and a one year hardware warranty. Livingston Enterprises provides free technical support via voice, FAX, and electronic mail. Technical support is available Monday through Friday 6am-5pm Pacific Time (GMT-8). To contact Livingston technical support by voice, dial 1-800-458-9966 within the US or 1-510-426-0770 outside the US, by FAX, dial 1-510-426-8951, by electronic mail, send mail to support@livingston.com, and through the World Wide Web at http://www.livingston.com/.