ADSL Link Settings

DSL Standard

Select the standard to support for the DSL line, as specified by your ISP.

VPI Number

Type the VPI number to use for the ATM virtual path, as specified by your ISP.

VCI Number

Type the VCI number to use for the ATM virtual circuit, as specified by your ISP.

Encapsulation Type

Select the encapsulation type to use for the DSL line, as specified by your ISP.

PPP Settings

Username

Type your user name.

Password

Type your password.

Confirm password

Type your password.

Service

Type your service name.

If your ISP has not provided you with a service name, leave this field empty.

Authentication Method

Specify the authentication method to use for PPP connections, by selecting one of the following:

• Auto. If possible, use CHAP; otherwise, use PAP. This is the default.
• PAP
• CHAP

Server IP

If you selected PPTP, type the IP address of the PPTP server as given by your ISP.

If you selected Telstra (BPA), type the IP address of the Telstra authentication server as given by Telstra.

Phone Number

If you selected Dialup, type the phone number that the modem should dial, as given by your ISP.

Connect on demand

Select this option if you do not want the appliance to be constantly connected to the Internet. The appliance will establish a connection only under certain conditions.

This option is useful when configuring a backup connection. For information, see Configuring a Backup Internet Connection.

When no higher priority connection is available

Select this option to specify that the appliance should only establish a connection in the following cases:

• When no other connection exists, and the UTM-1 appliance is not acting as a Backup appliance.
  If another connection opens, the appliance will disconnect.
  For information on configuring the appliance as a Backup or Master, see Configuring High Availability.
• When there is interesting traffic (that is, traffic for which no static route is defined).

On outgoing activity

Select this option to specify that the appliance should only establish a connection if no other connection exists, and there is outgoing activity (that is, packets need to be transmitted to the Internet).

If another connection opens, or if the connection times out, the appliance will disconnect.

Idle timeout

Type the amount of time (in minutes) that the connection can remain idle. Once this period of time has elapsed, the appliance will disconnect.

The default value is 1.

Delay before connecting

Type the amount of time (in seconds) that the appliance should wait to re-connect to the Internet, if the connection goes down.

If you have an unstable Internet connection that tends to go down and then return almost immediately, this setting allows you to avoid unnecessary and costly dialing during outage periods, by deferring re-connection for a few seconds.

The default value is 0.

Obtain IP address automatically (using DHCP)

Clear this option if you do not want the UTM-1 appliance to obtain an IP address automatically using DHCP.

IP Address

Type the static IP address of your UTM-1 appliance.

Subnet Mask

Select the subnet mask that applies to the static IP address of your UTM-1 appliance.

Default Gateway

Type the IP address of your ISP’s default gateway.

Name Servers

Obtain Domain Name Servers automatically

Clear this option if you want the UTM-1 appliance to obtain an IP address automatically using DHCP, but not to automatically configure DNS servers.

Obtain WINS Server automatically

Clear this option if you want the UTM-1 appliance to obtain an IP address automatically using DHCP, but not to automatically configure the WINS server.

Primary DNS Server

Type the IP address of your ISP's primary DNS server.

Secondary DNS Server

Type the IP address of your ISP's secondary DNS server.

WINS Server

Type the IP address of your ISP's WINS server.

Traffic Shaper

Shape Upstream: Link Rate

Select this option to enable Traffic Shaper for outgoing traffic. Then type a rate (in kilobits/second) slightly lower than your Internet connection's maximum measured upstream speed in the field provided.

It is recommended to try different rates in order to determine which one provides the best results.

For information on using Traffic Shaper, see Using Traffic Shaper.

Shape Downstream: Link Rate

Select this option to enable Traffic Shaper for incoming traffic. Then type a rate (in kilobits/second) slightly lower than your Internet connection's maximum measured downstream speed in the field provided.

It is recommended to try different rates in order to determine which one provides the best results.

Note: Traffic Shaper cannot control the number or type of packets it receives from the Internet; it can only affect the rate of incoming traffic by dropping received packets. This makes the shaping of inbound traffic less accurate than the shaping of outbound traffic. It is therefore recommended to enable traffic shaping for incoming traffic only if necessary.

For information on using Traffic Shaper, see Using Traffic Shaper.

Advanced

External IP

If you selected PPTP, type the IP address of the PPTP client as given by your ISP.

If you selected PPPoE, this field is optional, and you do not have to fill it in unless your ISP has instructed you to do so.

MTU

This field allows you to control the maximum transmission unit size.

As a general recommendation you should leave this field empty. If however you wish to modify the default MTU, it is recommended that you consult with your ISP first and use MTU values between 1300 and 1500.

MAC Cloning

A MAC address is a 12-digit identifier assigned to every network device. If your ISP restricts connections to specific, recognized MAC addresses, you must select this option to clone a MAC address.

Note: When configuring MAC cloning for the secondary Internet connection, the DMZ/WAN2 port must be configured as WAN2; otherwise this field is disabled. For information on configuring ports, see Managing Ports.

Hardware MAC Address

This field displays the UTM-1 appliance's MAC address.

This field is read-only.

Cloned MAC Address

Do one of the following:

• Click This Computer to automatically "clone" the MAC address of your computer to the UTM-1 appliance.
• If the ISP requires authentication using the MAC address of a different computer, type the MAC address in this field.

Note: In the secondary Internet connection, this field is enabled only if the DMZ/WAN2 port is set to WAN2.

Load Balancing

Load Balancing Weight

If you are using WAN load balancing, type a value indicating the amount of traffic that should be routed though this connection relative to the other connection.

For example, if you assign the primary connection a weight of 100, and you assign the secondary connection a weight of 50, twice as much traffic will be routed through the primary connection as through the secondary connection.

To ensure full utilization of both Internet connections, the ratio between the connections' load balancing weights should reflect the ratio between the connections' bandwidths.

The default value is 50.

For information on WAN load balancing, see Configuring WAN Load Balancing.

High Availability

Do not connect if this gateway is in passive state

If you are using High Availability (HA), select this option to specify that the gateway should connect to the Internet only if it is the Active Gateway in the HA cluster. This is called WAN HA.

This field is only enabled if HA is configured.

For information on HA, see Configuring High Availability.

Dead Connection Detection

Probe Next Hop

Select this option to automatically detect loss of connectivity to the default gateway. If you selected LAN, this is done by sending ARP requests to the default gateway. If you selected PPTP, PPPoE, or Dialup, this is done by sending PPP echo reply (LCP) messages to the PPP peer.

By default, if the default gateway does not respond, the Internet connection is considered to be down.

If it is determined that the Internet connection is down, and two Internet connections are defined, a failover will be performed to the second Internet connection, ensuring continuous Internet connectivity.

This option is selected by default.

Connection Probing Method

While the Probe Next Hop option checks the availability of the next hop router, which is usually at your ISP, connectivity to the next hop router does not always indicate that the Internet is accessible. For example, if there is a problem with a different router at the ISP, the next hop will be reachable, but the Internet might be inaccessible. Connection probing is a way to detect Internet failures that are more than one hop away.

Specify what method to use for probing the connection, by selecting one of the following:

• None. Do not perform Internet connection probing. Next hop probing will still be used, if the Probe Next Hop check box is selected. This is the default value.
• Ping Addresses. Ping anywhere from one to three servers specified by IP address or DNS name in the 1, 2, and 3 fields. If for 45 seconds none of the defined servers respond to pinging, the Internet connection is considered to be down.
  Use this method if you have reliable servers that can be pinged, that are a good indicator of Internet connectivity, and that are not likely to fail simultaneously (that is, they are not at the same location).
• Probe DNS Servers. Probe the primary and secondary DNS servers. If for 45 seconds neither gateway responds, the Internet connection is considered to be down.
  Use this method if the availability of your DNS servers is a good indicator for the availability of Internet connectivity.
• Probe VPN Gateway (RDP). Send RDP echo requests to up to three Check Point VPN gateways specified by IP address or DNS name in the 1, 2, and 3 fields. If for 45 seconds none of the defined gateways respond, the Internet connection is considered to be down.
  Use this option if you have Check Point VPN gateways, and you want loss of connectivity to these gateways to trigger ISP failover to an Internet connection from which these gateways are reachable.

1, 2, 3

If you chose the Ping Addresses connection probing method, type the IP addresses or DNS names of the desired servers.

If you chose the Probe VPN Gateway (RDP) connection probing method, type the IP addresses or DNS names of the desired VPN gateways.

You can clear a field by clicking Clear.