Can you help me with where to obtain the latest IOS and DSL firmware? Thanks, Ian. ... View more

Here it is! I.            SR520#show dsl interface ATM0 Alcatel 20190 chipset information                 ATU-R (DS)                      ATU-C (US) Modem Status:    Showtime (DMTDSL_SHOWTIME) DSL Mode:        ITU G.992.1 (G.DMT) Annex A ITU STD NUM:     0x03                            0x1 Vendor ID:       'STMI'                          'IFTN' Vendor Specific: 0x0000                          0x82B1 Vendor Country:  0x0F                            0xB5 Chip ID:         C196 (0) DFE BOM:         DFE3.0 Annex A (1) Capacity Used:   100%                            53% Noise Margin:     5.5 dB                         22.0 dB Output Power:    19.5 dBm                        12.5 dBm Attenuation:     46.0 dB                         26.0 dB FEC ES Errors:    0                               0 ES Errors:        9                               0 SES Errors:       0                               0 LOSES Errors:     0                               0 UES Errors:       0                               0 Defect Status:   None                            None                        Last Fail Code:  None Watchdog Counter: 0x77 Watchdog Resets: 0 Selftest Result: 0x00 Subfunction:     0x00 Interrupts:      4128 (0 spurious) PHY Access Err:  0 Activations:     1 LED Status:      ON LED On Time:     100 LED Off Time:    100 Init FW:         init_AMR-3.0.014_no_bist.bin Operation FW:    AMR-3.0.014.bin FW Source:       embedded FW Version:      3.0.14                  Interleave             Fast    Interleave              Fast Speed (kbps):          6048                0           448                 0 Cells:               188843                0        377867                 0 Reed-Solomon EC:          0                0             0                 0 CRC Errors:              15                0             0                 0 Header Errors:            9                0             0                 0 Total BER:                3405E-10               0E-0 Leakage Average BER:      3405E-10               0E-0                         ATU-R (DS)      ATU-C (US) Bitswap:               enabled            enabled Bitswap success:          0                   0 Bitswap failure:          0                   0 LOM Monitoring : Disabled DMT Bits Per Bin 000: 0 0 0 0 0 0 2 3 4 6 6 7 7 7 8 7 010: 8 7 8 7 7 7 7 6 6 6 6 6 5 4 4 2 020: 0 B B C C C C C C C C C C B 7 B 030: B B B B B B B B B B B B B B B B 040: 0 B B B A B B B B B 2 A A A A A 050: A A A A A A A A A A A A A A A A 060: A 9 A A A 9 A 9 9 9 9 9 A 9 9 9 070: 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 080: 9 9 9 9 9 0 9 9 9 9 8 9 9 9 8 9 090: 8 0 0 0 0 0 0 0 0 0 0 9 8 8 8 7 0A0: 0 0 5 7 7 6 8 8 8 8 8 7 8 8 8 8 0B0: 8 7 7 7 7 8 8 8 7 8 8 8 6 8 8 7 0C0: 7 7 7 6 5 4 0 0 4 5 5 4 2 2 5 6 0D0: 6 6 3 0 6 6 6 6 6 6 6 5 6 6 6 5 0E0: 6 5 5 5 5 5 5 5 5 5 5 5 4 5 4 4 0F0: 4 3 2 0 0 0 2 3 3 4 4 3 2 2 3 3 DSL: Training log buffer capability is not enabled ... View more

Hi Ade, Seeing something very similar here with an SR520 connected to Zen. Did you ever get a resolution to this problem? Cheers, Ian. ... View more

Andy, Many thanks for the reply. I had wondered about filtering by port but, unfortunately, it isn't really what we're trying to achieve. I may have to go down that sort of route if I can't get anything else to work, but in the first instance what I'm trying to understand is why the route-map argument isn't working. I've noticed that what I said in my previous post wasn't quite correct. The situation is that the simple static NAT command: ip nat inside source static 192.168.1.5 10.85.10.2 appears to work 'as advertised', whereas: ip nat inside source static 192.168.1.5 10.85.10.2 route-map toOtherSite does not. You might have thought that if the 'toOtherSite' route map just matches an access list of 'any source, any destination' the effect should be the same as the previous line (ie without the route-map argument). But it isn't - I've tried. Instead, the very presence of the route-map argument appears to filter out all traffic. The static entry: Pro Inside global         Inside local          Outside local         Outside global --- 10.85.10.2            192.168.1.5           ---                   --- is still present in the NAT translation table but it's as if it's no longer used. Pinging from the 192.168.1.5 host generates dynamic NAT entries (courtesy of my dynamic NAT command line - see previous post) but they're not translated to 10.85.10.2. So, in practice, the effect of adding the route-map argument is exactly the same as removing the static NAT command altogether, and I'm finding that more than a little counter-intuitive, not to mention counter- what the documentation appears to be saying. I have wondered whether this feature isn't supported on my hardware. The route-map option certainly pops up in the CLI interactive help but does this mean that it will work on my hardware? I've tried to find the answer to that on the web but failed. As ever, any enlightenment gratefully received. Cheers, Ian. ... View more

Andy, Thank you for getting back. Yes, there certainly is a lot of content relating to the CLI but I have no option because the CCA is hopelessly flaky. I've been looking at the changes it makes to the running config as I apply/remove its zone-based firewall but it's difficult even to do this since, having applied the firewall settings, it then starts to claim that the firewall is disabled. I presume it isn't since the settings are still present in the running config. Sometimes, after a considerable delay, refreshing the Firewall and DMZ dialogue results in it once again accepting that a firewall is configured. !? I'm afraid that I really can't work with software as non-functional as this and am a little perplexed that Cisco, which has a reputation to protect, would let it see the light of day. Cheers, Ian. ... View more

Andy, Thanks for getting back. You'd said previously that, as well as setting up port forwarding, I'd need to put permit statements in for the firewall (presumably for each forwarded port). Unless I'm getting the wrong end of the stick, now you're saying something a bit different. I'd be happy if the CCA would handle the firewall setup but, as I said, the port forwarding didn't seem to be working before which suggests the CCA wasn't doing this at that time. How would I persuade it to now? And why does it sometimes tell me my firewall isn't configured and other times tell me it is? I'm finding it very difficult software to trust. Where do I start with configuring the firewall with the CLI? Is there some sort of manual entry on this? Thanks, Ian. ... View more

Andy, Once again, very many thanks for the continued support. It is invaluable. Yes, my NAT config seems to be in order, according to your instructions, but it's very reassuring to know that this is the case. With regard to the firewall, once again I'm afraid, the CCA tends only to lead to the tearing out of hair. Depending on its mood at the time, it sometimes reports that 'the firewall is not configured' and other times that it is (security level == low, by default), but, in any case, it's difficult to see how to configure it at all since the only control is a slider with what seem to be 3 preset security levels (low, medium and high). Highly granular it is not. Or am I just not looking in the right place? I'm in Security - Firewall and DMZ. I'm moving away from any idea of using the CCA altogether and think that I'd be happier configuring the firewall from the command line. Given what you already know about what I'm trying to do, which approach would you recommend and can you point me in the direction of some more information? Thanks, Ian. ... View more

Andrew, Really appreciate your help with this. I have now succeeded in connecting to our ISP. Wonderful! I need now to set up some outgoing filtering (by IP address) and am perusing the sec_cr_book.pdf document for help with this. It's certainly more difficult than reading the back of cereal packets. I thought that I had worked out how to set up some port forwarding using entries of the form:      ip nat inside source static tcp interface Dialer0 but it doesn't seem to be working. All that I'm trying to do, if it isn't already obvious, is direct all traffic arriving from outside on a particular port to a particular server on the LAN, eg port 25 to the mail server. I've discovered turning debug (of various things) on and that's proving helpful, but I haven't yet worked out how to find out what's happening to all my incoming SMTP. I'll labour on but, as ever, any tips would me much appreciated. Cheers, Ian. ... View more

Andrew, Many thanks for getting back to me about this and sorry for the delay in replying - due to the Christmas break. I've just got back in today and have tried the configuration you suggest but, unfortunately, with no luck (ie no connection). At least I don't think I'm having any luck. I can't say I'm terribly clear how to query the device's status, either with the CLI or the CCA. I noticed that, by default, an interface ATM0.1 was showing in my config. You made no mention of that and so I tried clearing it (no inter atm0.1, followed by saving config and restarting). However that doesn't seem to have allowed the unit to connect either. How can I get some meaningful diagnostics about what's going on? I'm used to some sort of log showing connection attempts and the outcome. I'm very much at sea here. I badly need some sort of support manual. I got the unit on the understanding that it was configurable with the CCA, and that does not appear to be the case. Can you point me to some documentation that will give me the background I need to use the CLI with some confidence? Cheers, Ian. ... View more

Hello, Me again. I'm not prone to paranoia but I think Cisco must have it in for me as that last post just posted itself, without waiting for any user input. I was just going to add that I'm happy to struggle a little more with the CLI if this is the only way to configure this thing but, in that case, where can I go for a little more background? Many thanks, Ian. ... View more