AMG1302-T10A Wireless N ADSL2+ 4-port Gateway Default Login Details LAN IP Address https://192.168.1.1 Password Version 1.00 Edition 1, 2/2012 1234 IMPORTANT! READ CAREFULLY BEFORE USE. KEEP THIS GUIDE FOR FUTURE REFERENCE. www.zyxel.com www.zyxel.
IMPORTANT! READ CAREFULLY BEFORE USE. KEEP THIS GUIDE FOR FUTURE REFERENCE. Graphics in this book may differ slightly from the product due to differences in operating systems, operating system versions, or if you installed updated firmware/software for your device. Every effort has been made to ensure that the information in this manual is accurate. Related Documentation • Quick S tart Guide The Quick Start Guide shows how to connect the Device and access the Web Configurator wizards.
Contents Overview Contents Overview User’s Guide .......................................................................................................................................13 Introduction .............................................................................................................................................15 The Web Configurator .............................................................................................................................21 Status Screens ...
Contents Overview 4 AMG1302-T10A User’s Guide
Table of Contents Table of Contents Contents Overview ..............................................................................................................................3 Table of Contents .................................................................................................................................5 Part I: User’s Guide ......................................................................................... 13 Chapter 1 Introduction...........................................
Table of Contents 4.2.1 Configuring the Wireless Network Settings .............................................................................31 4.2.2 Using WPS ..............................................................................................................................33 4.2.3 Without WPS ...........................................................................................................................36 4.2.4 Setting Up Wireless Network Scheduling ...............................
Table of Contents 6.4.5 Nailed-Up Connection (PPP) ...................................................................................................82 6.4.6 NAT ..........................................................................................................................................82 6.5 Traffic Shaping ..................................................................................................................................82 6.5.1 ATM Traffic Classes ............................
Table of Contents 8.6 The WDS Screen ............................................................................................................................ 110 8.7 The Scheduling Screen ................................................................................................................... 112 8.8 Wireless LAN Technical Reference ................................................................................................. 112 8.8.1 Wireless Network Overview ............................
Table of Contents 10.4.2 Guidelines For Enhancing Security With Your Firewall .......................................................150 10.4.3 Security Considerations .......................................................................................................150 10.4.4 Triangle Route .....................................................................................................................151 Chapter 11 Filters .........................................................................
Table of Contents 15.3.2 IP Precedence .....................................................................................................................174 15.3.3 Automatic Priority Queue Assignment .................................................................................175 Chapter 16 Dynamic DNS Setup .........................................................................................................................177 16.1 Overview ......................................................
Table of Contents 20.3 The Time and Date Screen ..........................................................................................................204 Chapter 21 Logs ...................................................................................................................................................207 21.1 Overview .......................................................................................................................................207 21.1.
Table of Contents 12 AMG1302-T10A User’s Guide
P ART I User’s Guide 13
C HAPT ER 1 Introduction 1.1 Overview The Device is a high speed ADSL2+ 802.11n wireless router with built-in switch, firewall and content filtering. You are provided with ease of installation and shared Internet access. The robust firewall and content filtering features make the Device a complete security solution. Only use firmware for your Device’s specific model. Refer to the label on the bottom of your Device. Note: All screens displayed in this user’s guide are from the AMG1302-T10A model. 1.
Chapter 1 Introduction 1.4 Applications for the Device Here are some example uses for which the Device is well suited. 1.4.1 Internet Access Your Device provides shared Internet access by connecting the DSL port to the DSL or MODEM jack on a splitter or your telephone jack. Computers can connect to the Device’s LAN ports (or wirelessly). Figure 1 Device’s Router Features LAN DSL You can also configure firewall and content filtering feature on the Device for secure Internet access.
Chapter 1 Introduction You can configure your wireless network in either the built-in Web Configurator, or using the WPS button. Figure 2 Wireless Access Example 1.5.1 Using the WPS/WLAN Button Use the WPS/WLAN button on the Device to activate and deactivate wireless. To turn it on, simply press the WPS/WLAN button for 1 second. Once the WPS/WLAN LED turns green, the wireless network is active.
Chapter 1 Introduction 1.6 LEDs (Lights) The following graphic displays the labels of the LEDs. Figure 3 LEDs None of the LEDs are on if the Device is receiving power. Table 1 LED Descriptions LED COLOR STATUS DESCRIPTION POWER Green On The Device is receiving power and ready for use. Blinking The Device is self-testing. On The Device detected an error while self-testing, or there is a device malfunction. Off The Device is receiving power.
Chapter 1 Introduction 1.7 The RESET Button If you forget your password or cannot access the web configurator, you will need to use the RESET button at the back of the device to reload thefactory-default configuration file. This means that you will lose all configurations that you had previously and the password will be reset to “1234”. 1.7.1 Using the Reset Button 1 Make sure the POWER LED is on (blinking).
Chapter 1 Introduction 20 AMG1302-T10A User’s Guide
C HAPT ER 2 The Web Configurator 2.1 Overview The web configurator is an HTML-based management interface that allows easy device setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions. The recommended screen resolution is 1024 by 768 pixels. In order to use the web configurator you need to allow: • Web browser pop-up windows from your device. Web pop-up blocking is enabled by default in Windows XP SP (Service Pack) 2.
Chapter 2 The Web Configurator 5 The following screen displays if you have yet changed your password. It is strongly recommended you change the default password. Enter a new password, retype it to confirm and click Apply; alternatively click Ignore to proceed to the main menu if you do not want to change the password now. Figure 5 Change Password Screen 6 Select Go to Wizard setup and click Apply to display the wizard main screen.
Chapter 2 The Web Configurator 2.2 The Main Screen Figure 7 Main Screen A B C D As illustrated above, the main screen is divided into these parts: • A - title bar • B - navigation panel • C - main window • D - status bar 2.2.1 Title Bar The title bar provides some icons in the upper right corner.
Chapter 2 The Web Configurator The icons provide the following functions. Table 2 Web Configurator Icons in the Title Bar ICON DESCRIPTION Wizards: Click this icon to go to the configuration wizards. See Chapter 5 on page 55 for more information. Logout: Click this icon to log out of the web configurator. 2.2.2 Navigation Panel Use the menu items on the navigation panel to open screens to configure Device features. The following tables describe each menu item.
Chapter 2 The Web Configurator Table 3 Navigation Panel Summary LINK Filter TAB FUNCTION URL Filter Use this screen to block access to certain URL web sites. Application Filter Use this screen to allow or block traffic from certain applications. IP/MAC Filter Use this screen to configure IP/MAC filtering rules for incoming or outgoing traffic. Advanced Static Route Use this screen to configure IP static routes to tell your device about networks beyond the directly connected remote nodes.
Chapter 2 The Web Configurator Right after you log in, the Status screen is displayed. See Chapter 3 on page 27 for more information about the Status screen. 2.2.4 Status Bar Check the status bar when you click Apply or OK to verify that the configuration has been updated.
C HAPT ER 3 Status Screens 3.1 Overview Use the Status screens to look at the current status of the device, system resources, and interfaces (LAN and WAN). The Status screen also provides detailed information from DHCP and statistics from bandwidth management, and traffic.
Chapter 3 Status Screens 3.2 The Status Screen Use this screen to view the status of the Device. Click Status to open this screen. Figure 8 Status Screen Each field is described in the following table. Table 4 Status Screen LABEL DESCRIPTION Refresh Interval Select how often you want the Device to update this screen. Apply Click this to update this screen immediately. Device Information 28 Host Name This field displays the Device system name. It is used for identification.
Chapter 3 Status Screens Table 4 Status Screen LABEL DESCRIPTION IPv4 WAN Information DSL Mode This is the DSL standard that your Device is using. Annex Type IP Address This is the current IP address of the Device in the WAN. Click this to go to the screen where you can change it.If Connect Manually is enabled in Internet Access Setup, you can click Connect to connect to the WAN. IP Subnet Mask This is the current subnet mask in the WAN.
Chapter 3 Status Screens Table 4 Status Screen LABEL DESCRIPTION System Uptime This field displays how long the Device has been running since it last started up. The Device starts up when you plug it in, when you restart it (Maintenance > Tools > Restart), or when you reset it. Current Date/ Time This field displays the current date and time in the Device. You can change this in Maintenance > System > Time Setting. System Mode This displays whether the Device is functioning as a router or a bridge.
C HAPT ER 4 Tutorials 4.1 Overview This chapter shows you how to use the Device’s various features. • Setting Up a Secure Wireless Network, see page 31 • Configuring the MAC Address Filter, see page 38 • Configuring Static Route for Routing to Another Network, see page 40 • Multiple Public and Private IP Address Mappings, see page 42 • Firewall Rule to Allow a Specified Service, see page 46 • Port BindingConfiguration, see page 48 4.
Chapter 4 Tutorials 1 Click Network > Wireless LAN to open the AP screen. Configure the screen using the provided parameters (see page 31). Click Apply. 2 Click the Advanced Setup button and select 802.11b+g+n in the 802.11 Mode field. Click Apply. Thomas can now use the WPS feature to establish a wireless connection between his notebook and the Device (see Section 4.2.2 on page 33). He can also use the notebook’s wireless client to search for the Device (see Section 4.2.3 on page 36).
Chapter 4 Tutorials 4.2.2 Using WPS This section shows you how to set up a wireless network using WPS. It uses the Device as the AP and ZyXEL NWD210N as the wireless client which connects to the notebook. Note: The wireless client must be a WPS-aware device (for example, a WPS USB adapter or PCMCIA card). There are two WPS methods to set up the wireless client settings: • Push Button Configuration (PBC) - simply press a button. This is the easier of the two methods.
Chapter 4 Tutorials The following figure shows you an example of how to set up a wireless network and its security by pressing a button on both Device and wireless client. Example WPS Process: PBC Method Device Wireless Client WITHIN 2 MINUTES Press and hold for 5 seconds SECURITY INFO COMMUNICATION PIN Configuration When you use the PIN configuration method, you need to use both the Device’s web configurator and the wireless client’s utility.
Chapter 4 Tutorials 2 Enter the PIN number in the PIN field in the Network > Wireless LAN > WPS Station screen on the Device. 3 Click the Start buttons (or the button next to the PIN field) on boththe wireless client utility screen and the Device’s WPS Station screen within two minutes. The Device authenticates the wireless client and sends the proper configuration settings to the wireless client. This may take up to two minutes. The wireless client is then able to communicate with the Device securely.
Chapter 4 Tutorials The following figure shows you how to set up a wireless network and its security on a Device and a wireless client by using PIN method. Example WPS Process: PIN Method Wireless Client Device WITHIN 2 MINUTES Authentication by PIN SECURITY INFO COMMUNICATION 4.2.3 Without WPS Use the wireless adapter’s utility installed on the notebook to search for the “Example” SSID. Then enter the “DoNotStealMyWirelessNetwork” pre-shared key to establish an wireless Internet connection.
Chapter 4 Tutorials Note: The Device supports IEEE 802.11b and IEEE 802.11g wireless clients. Make sure that your notebook or computer’s wireless adapter supports one of these standards. 4.2.4 Setting Up Wireless Network Scheduling Thomas mostly uses his notebook to access the Internet on weekends; occasionally he uses it at night on weekdays. Here is how Thomas can set up a schedule to turn on the wireless network at specific time and days.
Chapter 4 Tutorials 2 Configure the screen as follows. In the Everyday row, set the Action to Off. Then set wireless network from Mondays to Fridays to be On between 18:00 and 23:30. Turn on the wireless network all day on Saturdays and Sundays. Click Apply. 4.3 Configuring the MAC Address Filter Thomas iced that his daughter Josephine spends too much time surfing the web and downloading media files.
Chapter 4 Tutorials 1 Click Network > LAN > Client List to open the following screen. Look for the MAC address of Josephine’s computer. 2 Click Network > Wireless LAN to open the AP screen. Click the Edit button in the MAC Filter field.
Chapter 4 Tutorials 3 Select Enable MAC Filter and Deny Association. Enter the MAC address you found in the Client List screen. Click Apply. Josephine will no longer be able to access the Internet through the Device. 4.4 Configuring Static Route for Routing to Another Network In order to extend your Intranet and control traffic flowing directions, you may connect a router to the Device’s LAN. The router may be used to separate two department networks.
Chapter 4 Tutorials You need to specify a static routing rule on the Device to specify R as the router in charge of forwarding traffic to N2. In this case, the Device routes traffic from A to R and then R routes the traffic to B. N1 A R N2 B This tutorial uses the following example IP settings: Table 5 IP Settings in this Tutorial DEVICE / COMPUTER IP ADDRESS The Device’s WAN 172.16.1.1 The Device’s LAN 192.168.1.1 A 192.168.1.34 R’s N1 192.168.1.253 R’s N2 192.168.10.2 B 192.168.10.
Chapter 4 Tutorials 3 Click Edit on a new rule in the Static Route screen. 4 Configure the Static Route Setup screen using the following settings: 4a Type 192.168.10.0 and subnet mask 255.255.255.0 for the destination, N2. 4b Type 192.168.1.253 (R’s N1 address) in the Gateway IP Address field. 4a Click Apply. Now B should be able to receive traffic from A. You may need to additionally configure B’s firewall settings to allow specific traffic to pass through. 4.
Chapter 4 Tutorials This tutorial uses the following example settings: Table 6 IP Settings in this Tutorial DEVICE / COMPUTER IP ADDRESS The Device’s WAN 172.16.1.253 (IP-1) 172.16.1.254 (IP-2) The Device’s LAN 192.168.1.1 A 192.168.1.2 B 192.168.1.3 C a.b.c.d To do this, you can use either of the following settings: • Full Feature NAT with many-to-many no overload mapping • Full Feature NAT with one-to-one mapping 4.5.
Chapter 4 Tutorials 3 Click the Address Mapping tab, and then click the Edit icon on a new rule. 4 Configure the rule using the following settings: • Type: Many-to-Many No Overload • Local IP addresses: 192.168.1.2 ~ 192.168.1.3 • Global IP addresses: 172.16.1.253 ~ 172.16.1.254 Then click Apply. 4.5.
Chapter 4 Tutorials 2 Select Active Network Address Translation(NAT) and Full Feature in the General screen. Click Apply. 3 Click the Address Mapping tab, click the Edit icon on a new rule. 4 Configure two rules for the one-to-one mappings: • Rule 1 (This maps the public IP address 172.16.1.253 to the private IP address 192.168.1.2) Type: One-to-One Local Start IP: 192.168.1.2 Global Start IP: 172.16.1.253 • Rule 2 (This maps the public IP address 172.16.1.254 to the private IP address 192.168.1.
Chapter 4 Tutorials 4.6 Firewall Rule to Allow a Specified Service The following Internet firewall rule example allows a Secure Shell (SSH) connection from the Internet. 1 Click Security > Firewall > Rules. 2 Select WAN to LAN in the Packet Direction field. Figure 9 Firewall Example: Rules 46 3 In the Rules screen, select the index number after which you want to add the rule. For example, if you select “6”, your new rule becomes number 7 and the previous rule 7 (if there is one) becomes rule 8.
Chapter 4 Tutorials 5 Select Active and in the Action for Matched Packets field, select Permit. Configure the Source and Destination Addresses as follows and click Add >> for each. In the Available Services menu, select SSH(TCP/UDP:22) and click Add >>. Click Apply. Figure 10 Firewall Example: Edit Rule On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following.
Chapter 4 Tutorials Rule 1 allows a SSH connection from the WAN IP address 1.1.1.1 to IP address 1.1.1.2. Figure 11 Firewall Example: Rules 4.7 Port Binding Configuration This tutorial shows you how to configure port binding for WAN connections with different ATM QoS settings for different types of traffic. The port binding feature is used to group each WAN connection with specific LAN ports and WLANs.
Chapter 4 Tutorials 2 To configure bandwidth for the data connection, select UBR in the ATM QoS Type field. Click Apply to save the settings.
Chapter 4 Tutorials 3 To configure dedicated bandwidth of 400kbps for the VoIP connection, select CBR in the ATM QoS Type field and enter the Peak Cell Rate as 943 (divide the bandwidth 400000 bps by 424). Click Apply to save the settings. Configured WAN connections can be viewed by clicking the More Connections tab under Network > WAN. See the WAN Setup chapter (Chapter 6 on page 89) for more information on configuring WAN connections and ATM QoS settings.
Chapter 4 Tutorials 4.7.2 Configuring Port Binding You can then group specific WAN PVCs with LAN ports or WLANs, so traffic from these ports is forwarded through specific WAN PVCs.
Chapter 4 Tutorials 52 AMG1302-T10A User’s Guide
P ART II Technical Reference 53
C HAPT ER 5 Internet Setup Wizard 5.1 Overview Use the wizard setup screens to configure your system for Internet access with the information given to you by your ISP. Note: See the advanced menu chapters for background information on these fields. 5.2 Internet Access Wizard Setup 1 After you enter the password to access the web configurator, select Go to Wizard setup and click Apply. Otherwise, click the wizard icon ( ) in the top right corner of the web configurator to go to the wizards.
Chapter 5 Internet Setup Wizard 2 Click INTERNET SETUP to configure the system for Internet access and wireless connection. Figure 13 Wizard Welcome 3 Your Device attempts to detect your DSL connection and your connection type. 3a The following screen appears if a connection is not detected. Check your hardware connections and click Restart the INTERNET/WIRELESS SETUP Wizard to return to the wizard welcome screen. If you still cannot connect, click Manually configure your Internet connection.
Chapter 5 Internet Setup Wizard 3b The following screen displays if a PPPoE or PPPoA connection is detected. Enter your Internet account information (username, password and/or service name) exactly as provided by your ISP. Then click Next and see Section 5.3 on page 63 for wireless connection wizard setup. Figure 15 Auto-Detection: PPPoE 3c The following screen appears if the Device detects a connection but not the connection type. Click Next and refer to Section 5.2.
Chapter 5 Internet Setup Wizard 5.2.1 Manual Configuration 1 If the Device fails to detect your DSL connection type but the physical line is connected, enter your Internet access information in the wizard screen exactly as your service provider gave it to you. Leave the defaults in any fields for which you were not given information. Figure 17 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen.
Chapter 5 Internet Setup Wizard Table 8 Internet Access Wizard Setup: ISP Parameters 2 LABEL DESCRIPTION Back Click this to return to the previous screen without saving. Next Click this to continue to the next wizard screen. The next wizard screen you see depends on what protocol you chose above. Exit Click this to close the wizard screen without saving. The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode.
Chapter 5 Internet Setup Wizard The following table describes the fields in this screen. Table 9 LABEL DESCRIPTION User Name Enter the user name exactly as your ISP assigned. If assigned a name in the form user@domain where domain identifies a service name, then enter both components exactly as given. Password Enter the password associated with the user name above. Service Name Type the name of your PPPoE service here. Back Click this to return to the previous screen without saving.
Chapter 5 Internet Setup Wizard The following table describes the fields in this screen. Table 10 Internet Connection with RFC 1483 LABEL DESCRIPTION IP Address This field is available if you select Routing in the Mode field. Type your ISP assigned IP address in this field. Back Click this to return to the previous screen without saving. Next Click this to continue to the next wizard screen. Exit Click this to close the wizard screen without saving.
Chapter 5 Internet Setup Wizard The following table describes the fields in this screen. Table 11 Internet Connection with ENET ENCAP LABEL DESCRIPTION Obtain an IP Address Automatically A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. Static IP Address Select Static IP Address if your ISP gave you an IP address to use. IP Address Enter your ISP assigned IP address.
Chapter 5 Internet Setup Wizard Table 12 Internet Connection with PPPoA (continued) LABEL DESCRIPTION Apply Click this to save your changes. Exit Click this to close the wizard screen without saving. • If the user name and/or password you entered for PPPoE or PPPoA connection are not correct, the screen displays as shown next. Click Back to Username and Password setup to go back to the screen where you can modify them.
Chapter 5 Internet Setup Wizard 1 Select Yes and click Next to configure wireless settings. Otherwise, select No and skip to Step 6. Figure 24 Connection Test Successful 2 Use this screen to activate the wireless LAN. Click Next to continue. Figure 25 Wireless LAN Setup Wizard 1 The following table describes the labels in this screen. Table 13 Wireless LAN Setup Wizard 1 64 LABEL DESCRIPTION Active Select the check box to turn on the wireless LAN.
Chapter 5 Internet Setup Wizard 3 Configure your wireless settings in this screen. Click Next. Figure 26 Wireless LAN The following table describes the labels in this screen. Table 14 Wireless LAN Setup Wizard 2 LABEL DESCRIPTION Network Name(SSID) Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN. If you change this field on the Device, make sure all wireless stations use the same SSID in order to access the network.
Chapter 5 Internet Setup Wizard 5.3.1 Manually Assign a WPA-PSK key Choose Manually assign a WPA-PSK key in the Wireless LAN setup screen to set up a PreShared Key. Figure 27 Manually Assign a WPA-PSK key The following table describes the labels in this screen. Table 15 Manually Assign a WPA-PSK key LABEL DESCRIPTION Pre-Shared Key Type from 8 to 63 case-sensitive ASCII characters. You can set up the most secure wireless connection by configuring WPA in the wireless LAN screens.
Chapter 5 Internet Setup Wizard The following table describes the labels in this screen. Table 16 Manually Assign a WEP key LABEL DESCRIPTION Key The WEP keys are used to encrypt data. Both the Device and the wireless stations must use the same WEP key for data transmission. Enter any 5 or 13 ASCII characters, or 10 or 26 hexadecimal characters ("0-9", "AF") for a 64-bit or 128-bit WEP key respectively. 5 Back Click this to return to the previous screen without saving.
Chapter 5 Internet Setup Wizard Note: No wireless LAN settings display if you chose not to configure wireless LAN settings. Figure 30 Internet Access and WLAN Wizard Setup Complete 7 68 Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the rest of this guide for more detailed information on the complete range of Device features.
C HAPT ER 6 WAN Setup 6.1 Overview This chapter describes how to configure WAN settings from the WAN screens. Use these screens to configure your Device for Internet access. A WAN (Wide Area Network) connection is an outside connection to another network or the Internet. It connects your private networks (such as a LAN (Local Area Network) and other networks, so that a computer in one location can communicate with computers in other locations. Figure 31 LAN and WAN LAN WAN 6.1.
Chapter 6 WAN Setup WAN IP Address The WAN IP address is an IP address for the Device, which makes it accessible from an outside network. It is used by the Device to communicate with other devices in other networks. It can be static (fixed) or dynamically assigned by the ISP each time the Device tries to access the Internet.
Chapter 6 WAN Setup 6.2 The Internet Access Setup Screen Use this screen to change your Device’s WAN settings. Click Network > WAN > Internet Access Setup. The screen differs by the WAN type and encapsulation you select.
Chapter 6 WAN Setup The following table describes the labels in this screen. Table 17 Network > WAN > Internet Access Setup LABEL DESCRIPTION Line ADSL Mode Select the mode supported by your ISP. Use Auto Sync-Up if you are not sure which mode to choose from. The Device dynamically diagnoses the mode supported by the ISP and selects the best compatible one for your connection. Other options are ADSL2+, ADSL2, G.DMT, T1.413 and G.lite. ADSL Type Select the type supported by your ISP.
Chapter 6 WAN Setup Table 17 Network > WAN > Internet Access Setup (continued) LABEL DESCRIPTION IPv6 Message Fetch Type If the encapsulation type is ENET ENCAP, you can select Dynamic Mode to automatically obtain an IP address or Static Mode to enter a static IP address. DHCP IPv6 Enable Select DHCP if you want to obtain an IPv6 address from a DHCPv6 server.
Chapter 6 WAN Setup 6.2.1 Advanced Internet Access Setup Use this screen to edit your Device's advanced WAN settings. Click the Advanced Setup button in the Internet Access Setup screen. The screen appears as shown. Figure 33 Network > WAN > Internet Access Setup: Advanced Setup The following table describes the labels in this screen.
Chapter 6 WAN Setup Table 18 Network > WAN > Internet Access Setup: Advanced Setup (continued) LABEL DESCRIPTION ATM QoS Type Select CBR (Continuous Bit Rate) to specify fixed (always-on) bandwidth for voice or data traffic. Select UBR (Unspecified Bit Rate) for applications that are non-time sensitive, such as e-mail. Select rtVBR (real-time Variable Bit Rate) type for applications with bursty connections that require closely controlled delay and delay variation.
Chapter 6 WAN Setup The following table describes the labels in this screen. Table 19 Network > WAN > More Connections LABEL DESCRIPTION # This is an index number indicating the number of the corresponding connection. Active This field indicates whether the connection is active or not. Clear the check box to disable the connection. Select the check box to enable it. Name This is the name you gave to the Internet connection.
Chapter 6 WAN Setup 6.3.1 More Connections Edit Use this screen to configure a connection. Click the edit icon in the More Connections screen to display the following screen. Figure 35 Network > WAN > More Connections: Edit The following table describes the labels in this screen. Table 20 Network > WAN > More Connections: Edit LABEL DESCRIPTION General Active Select the check box to activate or clear the check box to deactivate this connection.
Chapter 6 WAN Setup Table 20 Network > WAN > More Connections: Edit (continued) LABEL DESCRIPTION Encapsulation Select the method of encapsulation used by your ISP from the drop-down list box. Choices vary depending on the mode you select in the Mode field. If you select Bridge in the Mode field, the encapsulation type is RFC 1483. If you select Routing in the Mode field, select PPPoA, RFC 1483, ENET ENCAP or PPPoE.
Chapter 6 WAN Setup Table 20 Network > WAN > More Connections: Edit (continued) LABEL DESCRIPTION Apply Click this to save your changes. Advanced Setup Click this to display the More Connections Advanced Setup screen and edit more details of your WAN setup. 6.3.2 Configuring More Connections Advanced Setup Use this screen to edit your Device's advanced WAN settings. Click the Advanced Setup button in the More Connections Edit screen. The screen appears as shown.
Chapter 6 WAN Setup Table 21 Network > WAN > More Connections: Edit: Advanced Setup (continued) LABEL DESCRIPTION Sustain Cell Rate The Sustain Cell Rate (SCR) sets the average cell rate (long-term) that can be transmitted. Type the SCR, which must be less than the PCR. Note that system default is 0 cells/sec. Maximum Burst Size Maximum Burst Size (MBS) refers to the maximum number of cells that can be sent at the peak rate. Type the MBS, which is less than 65535.
Chapter 6 WAN Setup Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site. By implementing PPPoE directly on the Device (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the Device does that part of the task. Furthermore, with NAT, all of the LANs’ computers will have access. 6.4.1.
Chapter 6 WAN Setup either a dynamic or static IP. However the encapsulation method assigned influences your choices for IP address and ENET ENCAP gateway. IP Assignment with PPPoA or PPPoE Encapsulation If you have a dynamic IP, then the IP Address and Gateway IP Address fields are not applicable (N/A). If you have a static IP, then you need to fill in the IP Address field, the Subnet mask and the Gateway IP Address field.
Chapter 6 WAN Setup Sustained Cell Rate (SCR) is the mean cell rate of each bursty traffic source. It specifies the maximum average rate at which cells can be sent over the virtual connection. SCR may not be greater than the PCR. Maximum Burst Size (MBS) is the maximum number of cells that can be sent at the PCR. After MBS is reached, cell rates fall below SCR until cell rate averages to the SCR again. At this time, more cells (up to the MBS) can be sent at the PCR again.
Chapter 6 WAN Setup The VBR-nRT (non real-time Variable Bit Rate) type is used with bursty connections that do not require closely controlled delay and delay variation. It is commonly used for "bursty" traffic typical on LANs. PCR and MBS define the burst levels, SCR defines the minimum level. An example of an VBR-nRT connection would be non-time sensitive data file transfers. Unspecified Bit Rate (UBR) The Unspecified Bit Rate (UBR) ATM traffic class is for bursty data transfers.
C HAPT ER 7 LAN Setup 7.1 Overview A Local Area Network (LAN) is a shared communication system to which many networking devices are connected. It is usually located in one immediate area such as a building or floor of a building. Use the LAN screens to help you configure a LAN DHCP server and manage IP addresses. LAN DSL 7.1.1 What You Can Do in the LAN Screens • Use he t LAN IP screen (Section 7.2 on page 86) to set the LAN IP address and subnet mask of your Device.
Chapter 7 LAN Setup Subnet Mask Subnet masks determine the maximum number of possible hosts on a network. You can also use subnet masks to divide one network into multiple sub-networks. DHCP A DHCP (Dynamic Host Configuration Protocol) server can assign your Device an IP address, subnet mask, DNS and other routing information when it's turned on. RIP RIP (Routing Information Protocol) allows a router to exchange routing information with other routers.
Chapter 7 LAN Setup 1 Enter an IP address into the IP Address field. The IP address must be in dotted decimal notation. This will become the IP address of your Device. 2 Enter the IP subnet mask into the IP Subnet Mask field. Unless instructed otherwise it is best to leave this alone, the configurator will automatically compute a subnet mask based upon the IP address you entered. 3 Click Apply to save your settings. Figure 38 Network > LAN > IP The following table describes the fields in this screen.
Chapter 7 LAN Setup The following table describes the labels in this screen. Table 23 Network > LAN > IP: Advanced Setup LABEL DESCRIPTION RIP & Multicast Setup RIP Direction Select the RIP direction from None, Both, In Only and Out Only. RIP Version Select the RIP version from RIP-1, RIP-2B and RIP-2M. IGMP Snoop Select Enabled to activate IGMP Snooping. This allows the Device to passively learn memberships in multicast groups. Back Click this to return to the previous screen without saving.
Chapter 7 LAN Setup The following table describes the labels in this screen. Table 24 Network > LAN > DHCP Server LABEL DESCRIPTION DHCP Server DHCP If set to Server, your Device can assign IP addresses, an IP default gateway and DNS servers to Windows 95, Windows NT and other systems that support the DHCP client. If set to None, the DHCP server will be disabled. If set to Relay, the Device acts as a surrogate DHCP server and relays DHCP requests and responses between the remote server and the clients.
Chapter 7 LAN Setup Use this screen to change your Device’s static DHCP settings. Click Network > LAN > Client List to open the following screen. Figure 41 Network > LAN > Client List The following table describes the labels in this screen. Table 25 Network > LAN > Client List LABEL DESCRIPTION IP Address Enter the IP address that you want to assign to the computer on your LAN with the MAC address that you will also specify. MAC Address Enter the MAC address of a computer on your LAN.
Chapter 7 LAN Setup When you use IP alias, you can also configure firewall rules to control access between the LAN's logical networks (subnets). Note: Make sure that the subnets of the logical networks do overlap. The following figure shows a LAN divided into subnets A, B, and C. Figure 42 Physical Network & Partitioned Logical Networks A: 192.168.1.1 - 192.168.1.24 Ethernet Interface B: 192.168.2.1 - 192.168.2.24 C: 192.168.3.1 - 192.168.3.24 7.5.
Chapter 7 LAN Setup 7.6 The IPv6 Screen Use this screen to configure the IPv6 settings for your Device’s LAN interface. See Appendix E on page 281 for background information about IPv6. Figure 44 Network > LAN > IPv6 The following table describes the labels in this screen. Table 27 Network > LAN > IPv6 LABEL DESCRIPTION Radvd Setup Radvd Enable Select Enable to have the Device send router advertisement messages to the LAN hosts.
Chapter 7 LAN Setup LABEL DESCRIPTION DHCP6 Setup DHCP6 Server Select Enable to have the Device act as a DHCP6 server and pass IPv6 Prefix and DNS information to clients. DHCP6 Mode Select Auto if your ISP dynamically assigns IPv6 Prefix and DNS information. Select Mannual to configure these parameters manually. Prefix/Length If manual DHCP6 mode is selected, specify the IPv6 prefix and prefix length to pass to clients. Preferred Lifetime Enter the preferred lifetime for the prefix.
Chapter 7 LAN Setup IP Pool Setup The Device is pre-configured with a pool of IP addresses for the DHCP clients (DHCP Pool). See the product specifications in the appendices. Do not assign static IP addresses from the DHCP pool to your LAN computers. 7.7.3 DNS Server Addresses DNS (Domain Name System) maps a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it.
Chapter 7 LAN Setup Once you have decided on the network number, pick an IP address that is easy to remember, for instance, 192.168.1.1, for your Device, but make sure that no other device on your network is using that IP address. The subnet mask specifies the network number portion of an IP address. Your Device will compute the subnet mask automatically based on the IP address that you entered. You don't need to change the subnet mask computed by the Device unless you are instructed to do otherwise.
Chapter 7 LAN Setup 7.7.6 Multicast Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.
C HAPT ER 8 Wireless LAN 8.1 Overview This chapter describes how to perform tasks related to setting up and optimizing your wireless network, including the following. • Turning the wireless connection on or off. • Configuring a name, wireless channel and security for the network. • Using WiFi Protected Setup (WPS) to configure your wireless network. • Setting up multiple wireless networks. • Using a MAC (Media Access Control) address filter to restrict access to the wireless network.
Chapter 8 Wireless LAN 8.1.2 What You Need to Know About Wireless Wireless Basics “Wireless” is essentially radio communication. In the same way that walkie-talkie radios send and receive information over the airwaves, wireless networking devices exchange information with one another. A wireless networking device is just like a radio that lets your computer exchange information with radios attached to other computers.
Chapter 8 Wireless LAN 8.2 The AP Screen Use this screen to configure the wireless settings of your Device. Click Network > Wireless LAN to open the AP screen. Figure 46 Network > Wireless LAN > AP The following table describes the labels in this screen. Table 28 Network > Wireless LAN > AP LABEL DESCRIPTION Wireless Setup Enable Wireless LAN Click the check box to activate wireless LAN. Channel Selection Select the country in which you are using the device. Set the operating frequency/channel.
Chapter 8 Wireless LAN Table 28 Network > Wireless LAN > AP LABEL DESCRIPTION Cancel Click this to restore your previously saved settings. Advanced Setup Click this to display the Wireless Advanced Setup screen and edit more details of your WLAN setup. See Section 8.2.5 on page 104 for more details. 8.2.
Chapter 8 Wireless LAN Note: WEP is extremely insecure. Its encryption can be broken by an attacker, using widely-available software. It is strongly recommended that you use a more effective security mechanism. Use the strongest security mechanism that all the wireless devices in your network support. For example, use WPA-PSK or WPA2-PSK if all your wireless devices support it, or use WPA or WPA2 if your wireless devices support it and you have a RADIUS server.
Chapter 8 Wireless LAN 8.2.3 WPA(2)-PSK Use this screen to configure and enable WPA(2)-PSK authentication. Click Network > Wireless LAN to display the AP screen. Select WPA-PSK or WPA2-PSK from the Security Mode list. Figure 49 Network > Wireless LAN > AP: WPA(2)-PSK The following table describes the wireless LAN security labels in this screen. Table 31 Network > Wireless LAN > AP: WPA(2)-PSK LABEL DESCRIPTION Security Mode Choose WPA-PSK or WPA2-PSK from the drop-down list box.
Chapter 8 Wireless LAN 8.2.4 WPA(2) Authentication Use this screen to configure and enable WPA or WPA2 authentication. Click the Wireless LAN link under Network to display the AP screen. Select WPA, WPA2 or WPAMixed from the Security Mode list. Figure 50 Network > Wireless LAN > AP: WPA(2) The following table describes the wireless LAN security labels in this screen. Table 32 Network > Wireless LAN > AP: WPA(2) LABEL DESCRIPTION Security Mode Choose WPA or WPA2 from the drop-down list box.
Chapter 8 Wireless LAN Table 32 Network > Wireless LAN > AP: WPA(2) LABEL DESCRIPTION Authentication Server IP Address Enter the IP address of the external authentication server in dotted decimal notation. Port Number Enter the port number of the external authentication server. You need not change this value unless your network administrator instructs you to do so with additional information.
Chapter 8 Wireless LAN Table 33 Network > Wireless LAN > AP: Advanced Setup LABEL DESCRIPTION Preamble Select a preamble type from the drop-down list menu. Choices are Long or Short. See the Appendix D on page 271 for more information. 802.11 Mode Select 802.11b Only to allow only IEEE 802.11b compliant WLAN devices to associate with the Device. Select 802.11g Only to allow only IEEE 802.11g compliant WLAN devices to associate with the Device. Select 802.11b+g to allow either IEEE 802.11b or IEEE 802.
Chapter 8 Wireless LAN 8.2.6 MAC Filter Use this screen to change your Device’s MAC filter settings. Click the Edit button in the AP screen. The screen appears as shown. Figure 52 Network > Wireless LAN > AP: MAC Address Filter The following table describes the labels in this screen. Table 34 Network > Wireless LAN > AP: MAC Address Filter LABEL DESCRIPTION Enable MAC Filter Select the check box to enable MAC address filtering.
Chapter 8 Wireless LAN Click Network > Wireless LAN > More AP. The following screen displays. Figure 53 Network > Wireless LAN > More AP The following table describes the labels in this screen. Table 35 Network > Wireless LAN > More AP LABEL DESCRIPTION # This is the index number of each SSID profile. Active This field indicates whether this SSID is active. SSID An SSID profile is the set of parameters relating to one of the Device’s BSSs.
Chapter 8 Wireless LAN The following table describes the fields in this screen. Table 36 Network > Wireless LAN > More AP: Edit LABEL DESCRIPTION Network Name (SSID) The SSID (Service Set IDentity) identifies the service set with which a wireless device is associated. Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN.
Chapter 8 Wireless LAN Click Network > Wireless LAN > WPS. The following screen displays. Figure 55 Network > Wireless LAN > WPS The following table describes the labels in this screen. Table 37 Network > Wireless LAN > WPS LABEL DESCRIPTION WPS Setup Enable WPS Select the check box to activate WPS on the Device. PIN Number This shows the PIN (Personal Identification Number) of the Device. Enter this PIN in the configuration utility of the device you want to connect to using WPS.
Chapter 8 Wireless LAN Click Network > Wireless LAN > WPS Station. The following screen displays. Figure 56 Network > Wireless LAN > WPS Station The following table describes the labels in this screen. Table 38 Network > Wireless LAN > WPS Station LABEL DESCRIPTION Push Button Click this to add another WPS-enabled wireless device (within wireless range of the Device) to your wireless network.
Chapter 8 Wireless LAN Click Network > Wireless LAN > WDS. The following screen displays. Figure 57 Network > Wireless LAN > WDS The following table describes the labels in this screen. Table 39 Network > Wireless LAN > WDS LABEL DESCRIPTION WDS Security Select the type of the key used to encrypt data between APs. All the wireless APs (including the Device) must use the same pre-shared key for data transmission.
Chapter 8 Wireless LAN 8.7 The Scheduling Screen Use the wireless LAN scheduling to configure the days you want to enable or disable the wireless LAN. Click Network > Wireless LAN > Scheduling. The following screen displays. Figure 58 Network > Wireless LAN > Scheduling The following table describes the labels in this screen. Table 40 Network > Wireless LAN > QoS LABEL DESCRIPTION Enable Wireless LAN Scheduling Select this box to activate wireless LAN scheduling on your Device.
Chapter 8 Wireless LAN 8.8.1 Wireless Network Overview Wireless networks consist of wireless clients, access points and bridges. • A wireless client is a radio connected to a user’s computer. • An access point is a radio with a wired connection to a network, which can connect with numerous wireless clients and let them access the network. • A bridge is a radio that relays communications between access points and wireless clients, extending a network’s range.
Chapter 8 Wireless LAN • If two wireless networks overlap, they should use a different channel. Like radio stations or television channels, each wireless network uses a specific channel, or frequency, to send and receive information. • Every device in the same wireless network must use security compatible with the AP. Security stops unauthorized devices from using the wireless network. It can also protect the information that is sent in the wireless network.
Chapter 8 Wireless LAN These security standards do two things. First, they authenticate. This means that only people presenting the right credentials (often a username and password, or a “key” phrase) can access the network. Second, they encrypt. This means that the information sent over the air is encoded. Only people with the code key can understand the information, and only people who have been authenticated are given the code key. These security standards vary in effectiveness.
Chapter 8 Wireless LAN This type of security does not protect the information that is sent in the wireless network. Furthermore, there are ways for unauthorized wireless devices to get the MAC address of an authorized device. Then, they can use that MAC address to use the wireless network. 8.8.3.3 User Authentication Authentication is the process of verifying whether a wireless device is allowed to use the wireless network. You can make every user log in to the wireless network before using it.
Chapter 8 Wireless LAN support WPA2, you should set up WPA2-PSK or WPA2 (depending on the type of wireless network login) and select the WPA compatible option in the Device. Many types of encryption use a key to protect the information in the wireless network. The longer the key, the stronger the encryption. Every device in the wireless network must have the same key. 8.8.
Chapter 8 Wireless LAN 8.8.6 MBSSID Traditionally, you need to use different APs to configure different Basic Service Sets (BSSs). As well as the cost of buying extra APs, there is also the possibility of channel interference. The Device’s MBSSID (Multiple Basic Service Set IDentifier) function allows you to use one access point to provide several BSSs simultaneously. You can then assign varying QoS priorities and/or security modes to different SSIDs.
Chapter 8 Wireless LAN minutes to find another device that also has WPS activated. Then, the two devices connect and set up a secure network by themselves. 8.8.8.1 Push Button Configuration WPS Push Button Configuration (PBC) is initiated by pressing a button on each WPS-enabled device, and allowing them to connect automatically. You do not need to enter any information. every WPS-enabled device has a physical WPS button.
Chapter 8 Wireless LAN 3 Look for the client’s WPS PIN; it will be displayed either on the device, or in the WPS section of the client’s configuration interface (see the device’s User’s Guide for how to find the WPS PIN - for the Device, see Section 8.4 on page 108). 4 Enter the client’s PIN in the AP’s configuration interface.
Chapter 8 Wireless LAN The following figure shows a WPS-enabled wireless client (installed in a notebook computer) connecting to the WPS-enabled AP via the PIN method. Figure 62 Example WPS Process: PIN Method ENROLLEE REGISTRAR WPS This device’s WPS PIN: 123456 WPS Enter WPS PIN from other device: WPS START WPS START WITHIN 2 MINUTES SECURE EAP TUNNEL SSID WPA(2)-PSK COMMUNICATION 8.8.8.3 How WPS Works When two WPS-enabled devices connect, each device must assume a specific role.
Chapter 8 Wireless LAN The following figure shows a WPS-enabled client (installed in a notebook computer) connecting to a WPS-enabled access point. Figure 63 How WPS works ACTIVATE WPS ACTIVATE WPS WITHIN 2 MINUTES WPS HANDSHAKE ENROLLEE REGISTRAR SECURE TUNNEL SECURITY INFO COMMUNICATION The roles of registrar and enrollee last only as long as the WPS setup process is active (two minutes). The next time you use WPS, a different device can be the registrar if necessary.
Chapter 8 Wireless LAN is the registrar, and Client 1 is the enrollee. The registrar randomly generates the security information to set up the network, since it is unconfigured and has no existing information. Figure 64 WPS: Example Network Step 1 ENROLLEE REGISTRAR SECURITY INFO AP1 CLIENT 1 In step 2, you add another wireless client to the network.
Chapter 8 Wireless LAN In step 3, you add another access point (AP2) to your network. AP2 is out of range of AP1, so you cannot use AP1 for the WPS handshake with the new access point. However, you know that Client 2 supports the registrar function, so you use it to perform the WPS handshake instead. Figure 66 WPS: Example Network Step 3 EXISTING CONNECTION CLIENT 1 IS EX O GC TI N I ON CT E NN AP1 REGISTRAR CLIENT 2 SE CU RIT Y ENROLLEE INF O AP2 8.8.8.
Chapter 8 Wireless LAN • When you use the PBC method, there is a short period (from the moment you press the button on one device to the moment you press the button on the other device) when any WPS-enabled device could join the network. This is because the registrar has no way of identifying the “correct” enrollee, and cannot differentiate between your enrollee and a rogue device. This is a possible way for a hacker to gain access to a network. You can easily check to see if this has happened.
Chapter 8 Wireless LAN 126 AMG1302-T10A User’s Guide
C HAPT ER 9 Network Address Translation (NAT) 9.1 Overview This chapter discusses how to configure NAT on the Device. NAT (Network Address Translation NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network. 9.1.1 What You Can Do in the NAT Screens • Use he t NAT General Setup screen (Section 9.2 on page 128) to configure the NAT setup settings.
Chapter 9 Network Address Translation (NAT) Port Forwarding A port forwarding set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though NAT makes your whole inside network appear as a single computer to the outside world. SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
Chapter 9 Network Address Translation (NAT) Table 43 Network > NAT > General (continued) LABEL DESCRIPTION Max NAT/Firewall Session Per User When computers use peer to peer applications, such as file sharing applications, they need to establish NAT sessions. If you do not limit the number of NAT sessions a single client can establish, this can result in all of the available NAT sessions being used.
Chapter 9 Network Address Translation (NAT) Configuring Servers Behind Port Forwarding (Example) Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet. Figure 68 Multiple Servers Behind NAT Example A=192.168.1.
Chapter 9 Network Address Translation (NAT) The following table describes the fields in this screen. Table 44 Network > NAT > Port Forwarding LABEL DESCRIPTION Default Server Setup Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen.
Chapter 9 Network Address Translation (NAT) 9.3.2 The Port Forwarding Rule Edit Screen Use this screen to edit a port forwarding rule. Click the rule’s edit icon in the Port Forwarding screen to display the screen shown next. Figure 70 Network > NAT > Port Forwarding: Edit The following table describes the fields in this screen. Table 45 Network > NAT > Port Forwarding: Edit LABEL DESCRIPTION Rule Setup Active Click this check box to enable the rule.
Chapter 9 Network Address Translation (NAT) 9.4 The Address Mapping Screen Note: The Address Mapping screen is available only when you select Full Feature in the NAT > General screen. Ordering your rules is important because the Device applies the rules in the order that you specify. When a rule matches the current packet, the Device takes the corresponding action and the remaining rules are ignored.
Chapter 9 Network Address Translation (NAT) Table 46 Network > NAT > Address Mapping (continued) LABEL DESCRIPTION Type 1-1: One-to-one mode maps one local IP address to one global IP address. Note that port numbers do not change for the One-to-one NAT mapping type. M-1: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported only.
Chapter 9 Network Address Translation (NAT) The following table describes the fields in this screen. Table 47 Network > NAT > Address Mapping: Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. One-to-One: One-to-One mode maps one local IP address to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type. Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e.
Chapter 9 Network Address Translation (NAT) Use this screen to enable and disable the SIP (VoIP) ALG in the Device. To access this screen, click Network > NAT > ALG. Figure 73 Network > NAT > ALG The following table describes the fields in this screen. Table 48 Network > NAT > ALG LABEL DESCRIPTION Enable SIP ALG Select this to make sure SIP (VoIP) works correctly with port-forwarding and addressmapping rules. Apply Click this to save your changes.
Chapter 9 Network Address Translation (NAT) Table 49 NAT Definitions (continued) ITEM DESCRIPTION Local This refers to the packet address (source or destination) as the packet travels on the LAN. Global This refers to the packet address (source or destination) as the packet travels on the WAN. NAT never changes the IP address (either local or global) of an outside host. 9.6.
Chapter 9 Network Address Translation (NAT) 9.6.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP alias) behind the Device can communicate with three distinct WAN networks. Figure 75 NAT Application With IP Alias 9.6.5 NAT Mapping Types NAT supports five types of IP/port mapping. They are: • One to One: In One-to-One mode, the Device maps one local IP address to one global IP address.
Chapter 9 Network Address Translation (NAT) The following table summarizes these types.
Chapter 9 Network Address Translation (NAT) 140 AMG1302-T10A User’s Guide
C HAPTER 10 Firewalls 10.1 Overview This chapter shows you how to enable and configure the Device firewall. Use these screens to enable and configure the firewall that protects your Device and network from attacks by hackers on the Internet and control access to it. By default the firewall: • allows traffic that originates from your LAN computers to go to all other networks. • blocks traffic that originates on other networks from going to the LAN.
Chapter 10 Firewalls Anti-Probing If an outside user attempts to probe an unsupported port on your Device, an ICMP response packet is automatically returned. This allows the outside user to know the Device exists. The Device supports anti-probing, which prevents the ICMP response packet from being sent. This keeps outsiders from discovering your Device when unsupported ports are probed.
Chapter 10 Firewalls The following table describes the labels in this screen. Table 51 Security > Firewall > General LABEL DESCRIPTION Active Firewall Select this check box to activate the firewall. The Device performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated. Bypass Triangle Route If an alternate gateway on the LAN has an IP address in the same subnet as the Device’s LAN IP address, return traffic may not go through the Device.
Chapter 10 Firewalls Click Security > Firewall > Rules to bring up the following screen. This screen displays a list of the configured firewall rules. Note the order in which the rules are listed. Figure 78 Security > Firewall > Rules The following table describes the labels in this screen. Table 52 Security > Firewall > Rules LABEL DESCRIPTION Firewall Rules Storage Space in Use This read-only bar shows how much of the Device's memory for recording firewall rules it is currently using.
Chapter 10 Firewalls Table 52 Security > Firewall > Rules (continued) LABEL DESCRIPTION Destination IP This drop-down list box displays the destination addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any. Service This drop-down list box displays the services to which this firewall rule applies.
Chapter 10 Firewalls 10.3.1 Configuring Firewall Rules Use this screen to configure firewall rules. In the Rules screen, select an index number and click Add or click a rule’s Edit icon to display this screen and refer to the following table for information on the labels. Figure 79 Security > Firewall > Rules: Edit The following table describes the labels in this screen. Table 53 Security > Firewall > Rules: Edit LABEL DESCRIPTION Edit Rule Active Select this option to enable this firewall rule.
Chapter 10 Firewalls Table 53 Security > Firewall > Rules: Edit (continued) LABEL DESCRIPTION Start IP Address Enter the single IP address or the starting IP address in a range here. End IP Address Enter the ending IP address in a range here. Subnet Mask Enter the subnet mask here, if applicable. Add >> Click Add >> to add a new address to the Source or Destination Address box. You can add multiple addresses, ranges of addresses, and/or subnets.
Chapter 10 Firewalls The following table describes the labels in this screen. Table 54 Security > Firewall > Rules: Edit: Edit Customized Services LABEL DESCRIPTION No. This is the number of your customized port. Click a rule’s number of a service to go to the Firewall Customized Services Config screen to configure or edit a customized service. Name This is the name of your customized service. Protocol This shows the IP protocol (TCP, UDP or TCP/UDP) that defines your customized service.
Chapter 10 Firewalls 10.4 Firewall Technical Reference This section provides some technical background information about the topics covered in this chapter. 10.4.1 Firewall Rules Overview Your customized rules take precedence and override the Device’s default settings. The Device checks the source IP address, destination IP address and IP protocol type of network traffic against the firewall rules (in the order you list them).
Chapter 10 Firewalls For example, you may create rules to: • Block certain types of traffic, such as IRC (Internet Relay Chat), from the LAN to the Internet. • Allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts on the Internet to specific hosts on the LAN. • Allow everyone except your competitors to access a web server. • Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.
Chapter 10 Firewalls Once these questions have been answered, adding rules is simply a matter of entering the information into the correct fields in the web configurator screens. 10.4.4 Triangle Route When the firewall is on, your Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the Device to protect your LAN against attacks. Figure 82 Ideal Firewall Setup WAN LAN 1 2 10.4.4.
Chapter 10 Firewalls 10.4.4.2 Solving the “Triangle Route” Problem If you have the Device allow triangle route sessions, traffic from the WAN can go directly to a LAN computer without passing through the Device and its firewall protection. Another solution is to use IP alias. IP alias allows you to partition your network into logical sections over the same Ethernet interface. Your Device supports up to three logical LAN interfaces with the Device being the gateway for each logical network.
C HAPTER 11 Filters 11.1 Overview This chapter introduces three types of filters supported by the Device. You can configure rules to restrict traffic by IP addresses, MAC addresses, application types and/or URLs. 11.1.1 What You Can Do in the Filter Screens • Use he t URL Filter screen (Section 11.2 on page 154) to block access to web sites. • Use he t Application Filter screen (Section 11.3 on page 154) to allow or deny traffic from certain types of applications.
Chapter 11 Filters 11.2 The URL Filter Screen Use this screen to block websites by URL. Click Security > Filter > URL Filter. The screen appears as shown. Figure 85 Security > Filter > URL Filter The following table describes the labels in this screen. Table 56 Access Management > Filter (URL) LABEL DESCRIPTION URL Filter Editing URL Filter Use this field to enable or disable the URL filter. URL Index Select the index number of the filter.
Chapter 11 Filters Click Security > Filter > Application Filter. The screen appears as shown. Figure 86 Security > Filter > Application Filter The following table describes the labels in this screen. Table 57 Access Management > Filter (Application) LABEL DESCRIPTION Application Filter Editing Application Filter Use this field to enable or disable the application filter. ICQ Use this field to allow or deny ICQ traffic. MSN Use this field to allow or deny MSN traffic.
Chapter 11 Filters 11.4 The IP/MAC Filter Screen Use this screen to create and apply IP/MAC filters. Click Security > Filter > IP/MAC Filter. The screen appears as shown. Figure 87 Security > Filter > IP/MAC Filter The following table describes the labels in this screen. Table 58 Access Management > Filter (IP/MAC) LABEL DESCRIPTION IP/MAC Filter Rule Editing IP/MAC Filter Set Index Select the index number of the filter rule. Active Use this field to enable or disable the rule.
Chapter 11 Filters Table 58 Access Management > Filter (IP/MAC) (continued) LABEL DESCRIPTION Subnet Mask Enter the IP subnet mask for the destination IP address. Port Number Enter the destination port of the packets that you wish to filter. The range of this field is 0 to 65535. This field is ignored if it is 0. Protocol Select ICMP, TCP or UDP for the upper layer protocol. MAC Address This field is only available when you select MAC in the Rule Type field.
Chapter 11 Filters 158 AMG1302-T10A User’s Guide
C HAPTER 12 Static Route 12.1 Overview The Device usually uses the default gateway to route outbound traffic from computers on the LAN to the Internet. To have the Device send data to devices not reachable through the default gateway, use static routes. For example, the next figure shows a computer (A) connected to the Device’s LAN interface. The Device routes most traffic from A to the Internet through the Device’s default gateway (R1).
Chapter 12 Static Route 12.1.1 What You Can Do in the Static Route Screens Use the Static Route screens (Section 12.2 on page 160) to view and configure IP static routes on the Device. 12.2 The Static Route Screen Use this screen to view the static route rules. Click Advanced > Static Route to open the Static Route screen. Figure 89 Advanced > Static Route The following table describes the labels in this screen.
Chapter 12 Static Route 12.2.1 Static Route Edit Use this screen to configure the required information for a static route. Select a static route index number and click Edit. The screen shown next appears. Figure 90 Advanced > Static Route: Edit The following table describes the labels in this screen. Table 60 Advanced > Static Route: Edit LABEL DESCRIPTION Static Route Setup Destination IP Address This parameter specifies the IP network address of the final destination.
Chapter 12 Static Route 162 AMG1302-T10A User’s Guide
C HAPTER 13 Port Binding 13.1 Overview This chapter describes how to configure the port binding settings. Port binding allows you to aggregate port connections into logical groups. You may bind WAN PVCs to Ethernet ports and WLANs to specify how traffic is forwarded. Different ATM QoS settings can be specified for each WAN PVC to meet bandwidth requirements for the type of traffic to be transferred.
Chapter 13 Port Binding If a WAN PVC is bound to an ethernet port, traffic from the ethernet port will only be forwarded through the specified WAN PVC and vice versa. If a port is not in a port binding group, traffic to and from the port will be forwarded according to the routing table. 13.1.1 What You Can Do in the Port Binding Screens • Use he t Port Binding screen (Section 13.2 on page 164) to activate port binding and set up port binding groups. • Use he t Port Binding Summary screen (Section 13.2.
Chapter 13 Port Binding Table 61 Advanced > Port Binding (continued) LABEL DESCRIPTION Group Summary Port Binding Summary Click this to view a summary of configured port binding groups. Apply Add the selected port binding group configuration. Delete Delete the selected port binding group configuration. Cancel Click this to restore your previously saved settings. 13.2.1 Port Binding Summary screen Use this screen to view configured port binding groups.
Chapter 13 Port Binding 166 AMG1302-T10A User’s Guide
C HAPTER 14 PVID Setting 14.1 Overview This chapter describes how to assign ports into Virtual Local Area Networks (VLAN) and configure frame tagging settings. A VLAN allows a physical network to be partitioned into multiple logical networks. A VLAN group can be treated as an individual device. Each group can have its own rules about where and how to forward traffic. You can assign any ports on the Device to a VLAN group and configure the settings for the group. Figure 94 802.1Q 802.
Chapter 14 PVID Setting enabled for the VID of a frame, then the frame is transmitted as a tagged frame; otherwise, it is transmitted as an untagged frame. 14.2 The pvid Setting Screen Use this screen to activate VLAN and set up VLANs. Click Advanced > pvid Setting to display the following screen. Figure 95 Advanced > pvid Setting The following table describes the labels in this screen. Table 63 Advanced > pvid Setting 168 LABEL DESCRIPTION Active Activate or deactivate the VLAN feature.
C HAPTER 15 Quality of Service (QoS) 15.1 Overview Use the QoS screen to set up your Device to use QoS for traffic management. Quality of Service (QoS) refers to both a network’s ability to deliver data with minimum delay, and the networking methods used to control bandwidth. QoS allows the Device to group and prioritize application traffic and fine-tune network performance. Without QoS, all traffic data are equally likely to be dropped when the network is congested.
Chapter 15 Quality of Service (QoS) • Use he t QoS Settings Summary screen (Section 15.2.1 on page 173) to check the summary of QoS rules and actions you configured for the Device. 15.1.2 What You Need to Know About QoS 802.1p QoS is used to prioritize source-to-destination traffic flows. All packets in the same flow are given the same priority. 802.1p is a way of managing traffic in a network by grouping similar types of traffic together and treating each type as a class. You can use 802.
Chapter 15 Quality of Service (QoS) Click Advanced Setup > QoS to open the screen as shown next. Figure 97 Advanced Setup > QoS The following table describes the labels in this screen. Table 64 Advanced Setup > QoS LABEL DESCRIPTION Quality of Service QoS Use this field to turn on QoS to improve your network performance. You can give priority to traffic that the Device forwards out through the WAN interface. Give high priority to voice and video to make them run more smoothly.
Chapter 15 Quality of Service (QoS) Table 64 Advanced Setup > QoS LABEL DESCRIPTION WRR Weight If you selected WRR, specify the WRR weight for each queue index. A higher weight indicates the traffic will receive more bandwidth while a lower weight indicates it will receive less bandwidth. For example, 15 is receives more bandwidth than 1. Discipline Save Click this to save the discipline. Rule&Action Summary Click this to open a summary table showing the QoS settings. See Section 15.2.
Chapter 15 Quality of Service (QoS) Table 64 Advanced Setup > QoS LABEL DESCRIPTION Type of Service Remarking Select a type of service to re-assign the priority level to matched traffic. DSCP Remarking Available options are: Normal service, Minimize delay, Maximize throughput, Maximize reliability and Minimize monetary cost. Specify a DSCP number between 0 and 63 to re-assign the priority level to matched traffic. 802.
Chapter 15 Quality of Service (QoS) Table 65 Advanced Setup > QoS > Rule&Action Summary LABEL DESCRIPTION IPP/TOS (DSCP) This shows the IPP/TOS or DSCP settings. 802.1p This is the 802.1p priority level. Actions IPP/TOS (DSCP) Remarking The Device re-assigns the priority values specified in this field to matched traffic. 802.1p Remarking The Device re-assigns the priority levels specified in this field to matched traffic.
Chapter 15 Quality of Service (QoS) 15.3.3 Automatic Priority Queue Assignment If you enable QoS on the Device, the Device can automatically base on the IEEE 802.1p priority level, IP precedence and/or packet length to assign priority to traffic which does not match a class. The following table shows you the internal layer-2 and layer-3 QoS mapping on the Device.
Chapter 15 Quality of Service (QoS) 176 AMG1302-T10A User’s Guide
C HAPTER 16 Dynamic DNS Setup 16.1 Overview Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect.
Chapter 16 Dynamic DNS Setup 16.2 The Dynamic DNS Screen Use this screen to change your Device’s DDNS. Click Advanced > Dynamic DNS. The screen appears as shown. Figure 99 Advanced > Dynamic DNS The following table describes the fields in this screen. Table 68 Advanced > Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic DNS Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider.
C HAPTER 17 Remote Management 17.1 Overview Remote management allows you to determine which services/protocols can access which Device interface (if any) from which computers. The following figure shows remote management of the Device coming in from the WAN. Figure 100 Remote Management From the WAN LAN WAN HTTP Telnet Note: When you configure remote management to allow management from the WAN, you still need to configure an IP filter rule to allow access.
Chapter 17 Remote Management 17.1.1 What You Can Do in the Remote Management Screens • Use he t WWW screen (Section 17.2 on page 181) to configure through which interface(s) and from which IP address(es) users can use HTTP to manage the Device. • Use he t Telnet screen (Section 17.3 on page 181) to configure through which interface(s) and from which IP address(es) users can use Telnet to manage the Device. • Use he t FTP screen (Section 17.
Chapter 17 Remote Management 17.2 The WWW Screen Use this screen to specify how to connect to the Device from a web browser, such as Internet Explorer. 17.2.1 Configuring the WWW Screen Click Advanced > Remote MGMT to display the WWW screen. Figure 101 Advanced > Remote MGMT > WWW The following table describes the labels in this screen. Table 69 Advanced > Remote Management > WWW LABEL DESCRIPTION Server Port You may change the server port number for a service, if needed.
Chapter 17 Remote Management Click Advanced > Remote MGMT > Telnet tab to display the screen as shown. Figure 102 Advanced > Remote MGMT > Telnet The following table describes the labels in this screen. Table 70 Advanced > Remote Management > Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Chapter 17 Remote Management The following table describes the labels in this screen. Table 71 Advanced > Remote MGMT > FTP LABEL DESCRIPTION Server Port You may change the server port number for a service, if needed. However, you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the Device using this service.
Chapter 17 Remote Management network management functions. It executes applications that control and monitor managed devices. The managed devices contain object variables/managed objects that define each piece of information to be collected about a device. Examples of variables include such as number of packets received, node port status etc. A Management Information Base (MIB) is a collection of managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects.
Chapter 17 Remote Management 17.6 The DNS Screen Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 85 for background information. Use this screen to set from which IP address the Device will accept DNS queries and on which interface it can send them your Device’s DNS settings. This feature is not available when the Device is set to bridge mode. Click Advanced > Remote MGMT > DNS to change your Device’s DNS settings.
Chapter 17 Remote Management Note: If you want your device to respond to pings and requests for unauthorized services, you may also need to configure the firewall anti probing settings to match. Figure 107 Advanced > Remote Management > ICMP The following table describes the labels in this screen.
C HAPTER 18 Universal Plug-and-Play (UPnP) 18.1 Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network. In turn, a device can leave a network smoothly and automatically when it is no longer in use. 18.1.
Chapter 18 Universal Plug-and-Play (UPnP) When a UPnP device joins a network, it announces its presence with a multicast message. For security reasons, the Device allows multicast messages on the LAN only. All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum UPnP™ Implementers Corp. (UIC).
Chapter 18 Universal Plug-and-Play (UPnP) Table 75 Advanced > UPnP > General LABEL DESCRIPTION Apply Click this to save your changes. Reset Click this to restore your previously saved settings. 18.3 Installing UPnP in Windows Example This section shows how to install UPnP in Windows Me and Windows XP. Installing UPnP in Windows Me Follow the steps below to install the UPnP in Windows Me. 1 Click Start and Control Panel. Double-click Add/Remove Programs.
Chapter 18 Universal Plug-and-Play (UPnP) 3 In the Communications window, select the Universal Plug and Play check box in the Components selection box. Add/Remove Programs: Windows Setup: Communication: Components 4 Click OK to go back to the Add/Remove Programs Properties window and click Next. 5 Restart the computer when prompted. Installing UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP. 190 1 Click Start and Control Panel. 2 Double-click Network Connections.
Chapter 18 Universal Plug-and-Play (UPnP) 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components …. Network Connections 4 The Windows Optional Networking Components Wizard window displays. Select Networking Service in the Components selection box and click Details.
Chapter 18 Universal Plug-and-Play (UPnP) 5 In the Networking Services window, select the Universal Plug and Play check box. Networking Services 6 Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 18.4 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the Device. Make sure the computer is connected to a LAN port of the Device.
Chapter 18 Universal Plug-and-Play (UPnP) 2 Right-click the icon and select Properties. Network Connections 3 In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created.
Chapter 18 Universal Plug-and-Play (UPnP) 4 You may edit or delete the port mappings or click Add to manually add port mappings. Internet Connection Properties: Advanced Settings Internet Connection Properties: Advanced Settings: Add 5 194 When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically.
Chapter 18 Universal Plug-and-Play (UPnP) 6 Select Show icon in notification area when connected option and click OK. An icon displays in the system tray. System Tray Icon 7 Double-click on the icon to display your current Internet connection status. Internet Connection Status Web Configurator Easy Access With UPnP, you can access the web-based configurator on the Device without finding out the IP address of the Device first. This comes helpful if you do not know the IP address of the Device.
Chapter 18 Universal Plug-and-Play (UPnP) 3 Select My Network Places under Other Places. Network Connections 4 196 An icon with the description for each UPnP-enabled device displays under Local Network.
Chapter 18 Universal Plug-and-Play (UPnP) 5 Right-click on the icon for your Device and select Invoke. The web configurator login screen displays. Network Connections: My Network Places 6 Right-click on the icon for your Device and select Properties. A properties window displays with basic information about the Device.
Chapter 18 Universal Plug-and-Play (UPnP) 198 AMG1302-T10A User’s Guide
C HAPTER 19 CWMP 19.1 Overview The Device supports TR-069 Amendment 1 (CPE WAN Management Protocol Release 2.0) and TR069 Amendment 2 (CPE WAN Management Protocol v1.1, Release 3.0). TR-069 is a protocol that defines how your Device (ZD) can be managed via a management server (MS) such as ZyXEL’s Vantage Access. Figure 109 LAN and WAN ZD MS An administrator can use a management server to remotely set up the Device, modify settings, perform firmware upgrades as well as monitor and diagnose the Device.
Chapter 19 CWMP 19.2 The CWMP Setup Screen Use this screen to configure your Device to be managed by a management server. Click Advanced> CWMP to display the following screen. Figure 110 Advanced > CWMP The following table describes the fields in this screen. Table 76 Advanced > CWMP LINK DESCRIPTION CWMP Setup CWMP ACS Login Information 200 Select Activated to allow the Device to be managed by a management server or select Deactivated to not allow the Device to be managed by a management server.
Chapter 19 CWMP Table 76 Advanced > CWMP (continued) LINK Password DESCRIPTION The password is used to authenticate the Device when making a connection to the management server. This password on the management server and the Device must be the same. Type a password of up to 255 printable characters found on an English-language keyboard. Connection Request Information Use this part of the screen to allow the management server to connect to the Device after a successful login.
Chapter 19 CWMP 202 AMG1302-T10A User’s Guide
C HAPTER 20 System Settings 20.1 Overview This chapter shows you how to configure system related settings, such as system time, password, name, the domain name and the inactivity timeout interval. 20.1.1 What You Can Do in the System Settings Screens • Use he t General screen (Section 20.2 on page 203) to configure system settings. • Use he t Time and Date screen (Section 20.3 on page 204) to set the system time. 20.2 The General Screen Use this screen to configure system admin password.
Chapter 20 System Settings Table 77 Maintenance > System > General LABEL Retype to confirm DESCRIPTION Type the new password again for confirmation. Apply Click this to save your changes. Cancel Click this to restore your previously saved settings. 20.3 The Time and Date Screen Use this screen to configure the Device’s time based on your local time zone. To change your Device’s time and date, click Maintenance > System > Time and Date. The screen appears as shown.
Chapter 20 System Settings Table 78 Maintenance > System > Time and Date (continued) LABEL DESCRIPTION Manual Select this radio button to enter the time and date manually. If you configure a new time and date, Time Zone and Daylight Saving at the same time, the new time and date you entered has priority and the Time Zone and Daylight Saving settings do not affect it. New Time This field displays the last updated time from the time server or the last time configured manually.
Chapter 20 System Settings 206 AMG1302-T10A User’s Guide
C HAPTER 21 Logs 21.1 Overview This chapter contains information about viewing the Device’s logs. The web configurator allows you to choose which types of events and/or alerts to have the Device log and then display the logs. 21.1.1 What You Need To Know About Logs Alerts An alert is a message that is enabled as soon as the event occurs. They include system errors, attacks (access control) and attempted access to blocked web sites. Some categories such as System Errors consist of both logs and alerts.
Chapter 21 Logs Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the log is full. Selecting many alert and/or log categories (especially Access Control) may result in many e-mails being sent. Figure 113 Maintenance > System Logs The following table describes the fields in this screen. Table 79 Maintenance > Logs > Log Settings LABEL DESCRIPTION System Log Log Type Select the types of logs that you want to display and record. Then click Submit to display the details.
Chapter 21 Logs 21.3 Log Descriptions This section provides descriptions of example log messages. Table 80 System Maintenance Logs LOG MESSAGE DESCRIPTION Time calibration is successful The router has adjusted its time based on information from the time server. Time calibration failed The router failed to get information from the time server. WAN interface gets IP: %s A WAN interface got a new IP address from the DHCP, PPPoE, or dial-up server.
Chapter 21 Logs Table 81 System Error Logs LOG MESSAGE DESCRIPTION %s exceeds the max. number of session per host! This attempt to create a NAT session exceeds the maximum number of NAT session table entries allowed to be created per host. setNetBIOSFilter: calloc error The router failed to allocate memory for the NetBIOS filter settings. readNetBIOSFilter: calloc error The router failed to allocate memory for the NetBIOS filter settings. WAN connection is down. A WAN connection is down.
Chapter 21 Logs Table 83 TCP Reset Logs (continued) LOG MESSAGE DESCRIPTION Exceed MAX incomplete, sent TCP RST The router sent a TCP reset packet when the number of incomplete connections (TCP and UDP) exceeded the user-configured threshold. (Incomplete count is for all TCP and UDP connections through the firewall.
Chapter 21 Logs Table 86 CDR Logs (continued) LOG MESSAGE DESCRIPTION board %d line %d channel %d, call %d, %s C02 OutCall Connected %d %s The PPPoE, PPTP or dial-up call is connected. The PPPoE, PPTP or dial-up call was disconnected. board %d line %d channel %d, call %d, %s C02 Call Terminated Table 87 PPP Logs LOG MESSAGE DESCRIPTION ppp:LCP Starting The PPP connection’s Link Control Protocol stage has started. ppp:LCP Opening The PPP connection’s Link Control Protocol stage is opening.
Chapter 21 Logs Table 90 Attack Logs (continued) LOG MESSAGE DESCRIPTION ip spoofing - WAN ICMP (type:%d, code:%d) The firewall detected an ICMP IP spoofing attack on the WAN port. icmp echo : ICMP (type:%d, code:%d) The firewall detected an ICMP echo attack. syn flood TCP The firewall detected a TCP syn flood attack. ports scan TCP The firewall detected a TCP port scan attack. teardrop TCP The firewall detected a TCP teardrop attack. teardrop UDP The firewall detected an UDP teardrop attack.
Chapter 21 Logs Table 92 ACL Setting Notes PACKET DIRECTION DIRECTION DESCRIPTION (L to W) LAN to WAN ACL set for packets traveling from the LAN to the WAN. (W to L) WAN to LAN ACL set for packets traveling from the WAN to the LAN. (L to L/Device) LAN to LAN/ Device ACL set for packets traveling from the LAN to the LAN or the Device. (W to W/Device) WAN to WAN/ Device ACL set for packets traveling from the WAN to the WAN or the Device.
Chapter 21 Logs Table 93 ICMP Notes (continued) TYPE CODE DESCRIPTION Information Request 15 0 Information request message Information Reply 16 0 Information reply message Table 94 Syslog Logs LOG MESSAGE DESCRIPTION Mon dd hr:mm:ss hostname src="" dst="" msg="" e="" devID="" cat=" "This message is sent by the system ("RAS" displays as the system name if you haven’t configured one) when the rout
Chapter 21 Logs 216 AMG1302-T10A User’s Guide
C HAPTER 22 Tools 22.1 Overview This chapter explains how to upload new firmware, manage configuration files and restart your Device. Use the instructions in this chapter to change the device’s configuration file or upgrade its firmware. After you configure your device, you can backup the configuration file to a computer. That way if you later misconfigure the device, you can upload the backed up configuration file to return to your previous settings.
Chapter 22 Tools Do not turn off the Device while firmware upload is in progress! Figure 114 Maintenance > Tools > Firmware The following table describes the labels in this screen. Table 96 Maintenance > Tools > Firmware LABEL DESCRIPTION Current Firmware Version This is the present Firmware version and the date created. File Path Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click this to find the .bin file you want to upload.
Chapter 22 Tools The Device automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 116 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the Status screen. If the upload was not successful, the following screen will appear. Click Return to go back to the Firmware screen. Figure 117 Error Message 22.
Chapter 22 Tools Backup Configuration Backup Configuration allows you to back up (save) the Device’s current configuration to a file on your computer. Once your Device is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes. The backup configuration file will be useful in case you need to return to your previous settings. Click Backup to save the Device’s current configuration to your computer.
Chapter 22 Tools If you uploaded the default configuration file you may need to change the IP address of your computer to be in the same subnet as that of the default device IP address (192.168.1.1). See Appendix A on page 231 for details on how to set up your computer’s IP address. If the upload was not successful, the following screen will appear. Click Return to go back to the Configuration screen.
Chapter 22 Tools Click Maintenance > Tools > Restart. Click Restart to have the Device reboot. This does not affect the Device's configuration.
C HAPTER 23 Diagnostic 23.1 Overview These read-only screens display information to help you identify problems with the Device. 23.1.1 What You Can Do in the Diagnostic Screens • Use he t General screen (Section 23.2 on page 223) to ping an IP address. • Use he t DSL Line screen (Section 23.3 on page 224) to view the DSL line statistics and reset the ADSL line. 23.2 The General Screen Use this screen to ping an IP address. Click Maintenance > Diagnostic to open the screen shown next.
Chapter 23 Diagnostic The following table describes the fields in this screen. Table 98 Maintenance > Diagnostic > General LABEL DESCRIPTION TCP/IP Address Type the IP address of a computer that you want to ping in order to test a connection. Ping Click this to ping the IP address that you entered. 23.3 The DSL Line Screen Use this screen to view the DSL line statistics and reset the ADSL line. Click Maintenance > Diagnostic > DSL Line to open the screen shown next.
Chapter 23 Diagnostic The following table describes the fields in this screen. Table 99 Maintenance > Diagnostic > DSL Line LABEL DESCRIPTION ATM Status Click this to view your DSL connection’s Asynchronous Transfer Mode (ATM) statistics. ATM is a networking technology that provides high-speed data transfer. ATM uses fixed-size packets of information called cells. With ATM, a high QoS (Quality of Service) can be guaranteed. The (Segmentation and Reassembly) SAR driver translates packets into ATM cells.
Chapter 23 Diagnostic Table 99 Maintenance > Diagnostic > DSL Line (continued) LABEL DESCRIPTION DSL Line Status Click this to view statistics about the DSL connections. noise margin downstream is the signal to noise ratio for the downstream part of the connection (coming into the Device from the ISP). It is measured in decibels. The higher the number the more signal and less noise there is. output power upstream is the amount of power (in decibels) that the Device is using to transmit to the ISP.
C HAPTER 24 Troubleshooting This chapter offers some suggestions to solve problems you might encounter. The potential problems are divided into the following categories. • Power, Hardware Connections, and LEDs • Device Access and Login • Internet Access 24.1 Power, Hardware Connections, and LEDs The Device does not turn on. None of the LEDs turn on. 1 Make sure the Device is turned on. 2 Make sure you are using the power adaptor or cord included with the Device.
Chapter 24 Troubleshooting 24.2 Device Access and Login I forgot the IP address for the Device. 1 The default IP address is 192.168.1.1. 2 If you changed the IP address and have forgotten it, you might get the IP address of the Device by looking up the IP address of the default gateway for your computer. To do this in most Windows computers, click Start > Run, enter cmd, and then enter ipconfig.
Chapter 24 Troubleshooting • Try to access the Device using another service, such as Telnet. If you can access the Device, check the remote management settings and firewall rules to find out why the Device does not respond to HTTP. • If your computer is connected to the WAN port or is connected wirelessly, use a computer that is connected to a ETHERNET port. I can see the Login screen, but I cannot log in to the Device. 1 Make sure you have entered the password correctly.
Chapter 24 Troubleshooting 3 If you are trying to access the Internet wirelessly, make sure the wireless settings in the wireless client are the same as the settings in the AP. 4 If you are trying to access the Internet wirelessly, make sure you enabled the wireless LAN and have selected the correct channel in the Wireless LAN > AP screen. 5 Disconnect all the cables from your device, and follow the directions in the Quick Start Guide again. 6 If the problem continues, contact your ISP.
A PPENDIX A Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP/Vista, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.
Appendix A Setting up Your Computer’s IP Address Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add. 2 Select Adapter and then click Add. 3 Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: 1 In the Network window, click Add. 2 Select Protocol and then click Add.
Appendix A Setting up Your Computer’s IP Address Figure 128 Windows 95/98/Me: TCP/IP Properties: IP Address 3 Click the DNS Configuration tab. • If you do not know your DNS information, select Disable DNS. • If you know your DNS information, select Enable DNS and type the information in the fields below (you may not need to fill them all in). Figure 129 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab.
Appendix A Setting up Your Computer’s IP Address • If you do not know your gateway’s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and click Add. 5 Click OK to save and close the TCP/IP Properties window. 6 Click OK to close the Network window. Insert the Windows CD if prompted. 7 Turn on your Device and restart your computer when prompted. Verifying Settings 1 Click Start and then Run.
Appendix A Setting up Your Computer’s IP Address Figure 131 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties. Figure 132 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties.
Appendix A Setting up Your Computer’s IP Address Figure 133 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP). • If you have a dynamic IP address click Obtain an IP address automatically. • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced.
Appendix A Setting up Your Computer’s IP Address 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK. Do one or more of the following if you want to configure additional IP addresses: • In he t IP Settings tab, in IP addresses, click Add. • In TCP/IP Address, type an IP address in IP address and a subnet mask in Subnet mask, and then click Add. • Repeat the above two steps for each IP address you want to add.
Appendix A Setting up Your Computer’s IP Address Figure 136 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT). 11 Turn on your Device and restart your computer (if prompted).
Appendix A Setting up Your Computer’s IP Address Figure 137 Windows Vista: Start Menu 2 In the Control Panel, double-click Network and Internet. Figure 138 Windows Vista: Control Panel 3 Click Network and Sharing Center. Figure 139 Windows Vista: Network And Internet 4 Click Manage network connections.
Appendix A Setting up Your Computer’s IP Address 5 Right-click Local Area Connection and then click Properties. Note: During this procedure, click Continue whenever Windows displays a screen saying that it needs your permission to continue. Figure 141 Windows Vista: Network and Sharing Center 6 Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
Appendix A Setting up Your Computer’s IP Address • If you have a static IP address click Use the following IP address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced. Figure 143 Windows Vista: Internet Protocol Version 4 (TCP/IPv4) Properties 8 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
Appendix A Setting up Your Computer’s IP Address Figure 144 Windows Vista: Advanced TCP/IP Properties 9 In the Internet Protocol Version 4 (TCP/IPv4) Properties window, (the General tab): • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). • If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields.
Appendix A Setting up Your Computer’s IP Address Figure 145 Windows Vista: Internet Protocol Version 4 (TCP/IPv4) Properties 10 Click OK to close the Internet Protocol Version 4 (TCP/IPv4) Properties window. 11 Click Close to close the Local Area Connection Properties window. 12 Close the Network Connections window. 13 Turn on your Device and restart your computer (if prompted). Verifying Settings 1 Click Start, All Programs, Accessories and then Command Prompt.
Appendix A Setting up Your Computer’s IP Address Figure 146 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 147 Macintosh OS 8/9: TCP/IP 244 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list.
Appendix A Setting up Your Computer’s IP Address • From he t Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. • Type the IP address of your Device in the Router address box. 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save changes to your configuration. 7 Turn on your Device and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the TCP/IP Control Panel window.
Appendix A Setting up Your Computer’s IP Address Figure 149 Macintosh OS X: Network 4 For statically assigned settings, do the following: • From he t Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. • Type the IP address of your Device in the Router address box. 5 Click Apply Now and close the window. 6 Turn on your Device and restart your computer (if prompted).
Appendix A Setting up Your Computer’s IP Address Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click Network. Figure 150 Red Hat 9.0: KDE: Network Configuration: Devices 2 Double-click on the profile of the network card you wish to configure. The Ethernet Device General screen displays as shown. Figure 151 Red Hat 9.
Appendix A Setting up Your Computer’s IP Address 4 If you know your DNS server IP address(es), click the DNS tab in the Network Configuration screen. Enter the DNS server information in the fields provided. Figure 152 Red Hat 9.0: KDE: Network Configuration: DNS 5 Click the Devices tab. 6 Click the Activate button to apply the changes. The following screen displays. Click Yes to save the changes in all screens. Figure 153 Red Hat 9.
Appendix A Setting up Your Computer’s IP Address Figure 154 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp USERCTL=no PEERDNS=yes TYPE=Ethernet • If you have a static IP address, enter static in the BOOTPROTO= field. Type IPADDR= followed by the IP address (in dotted decimal notation) and type NETMASK= followed by the subnet mask. The following example shows an example where the static IP address is 192.168.1.10 and the subnet mask is 255.255.255.0.
Appendix A Setting up Your Computer’s IP Address Figure 158 Red Hat 9.0: Checking TCP/IP Properties [root@localhost]# ifconfig eth0 Link encap:Ethernet HWaddr 00:50:BA:72:5B:44 inet addr:172.23.19.129 Bcast:172.23.19.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:717 errors:0 dropped:0 overruns:0 frame:0 TX packets:13 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:730412 (713.2 Kb) TX bytes:1570 (1.
A PPENDIX B IP Addresses and Subnetting This appendix introduces IP addresses and subnet masks. IP addresses identify individual devices on a network. Every networking device (including computers, servers, routers, printers, etc.) needs an IP address to communicate across the network. These networking devices are also known as hosts. Subnet masks determine the maximum number of possible hosts on a network. You can also use subnet masks to divide one network into multiple sub-networks.
Appendix B IP Addresses and Subnetting Figure 159 Network Number and Host ID How much of the IP address is the network number and how much is the host ID varies according to the subnet mask. Subnet Masks A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). The term “subnet” is short for “sub-network”. A subnet mask has 32 bits.
Appendix B IP Addresses and Subnetting Subnet masks are expressed in dotted decimal notation just like IP addresses. The following examples show the binary and decimal notation for 8-bit, 16-bit, 24-bit and 29-bit subnet masks. Table 101 Subnet Masks BINARY DECIMAL 1ST OCTET 2ND OCTET 3RD OCTET 4TH OCTET 8-bit mask 11111111 00000000 00000000 00000000 255.0.0.0 16-bit mask 11111111 11111111 00000000 00000000 255.255.0.0 24-bit mask 11111111 11111111 11111111 00000000 255.255.255.
Appendix B IP Addresses and Subnetting Table 103 Alternative Subnet Mask Notation (continued) SUBNET MASK ALTERNATIVE NOTATION LAST OCTET (BINARY) LAST OCTET (DECIMAL) 255.255.255.224 /27 1110 0000 224 255.255.255.240 /28 1111 0000 240 255.255.255.248 /29 1111 1000 248 255.255.255.252 /30 1111 1100 252 Subnetting You can use subnetting to divide one network into multiple sub-networks.
Appendix B IP Addresses and Subnetting Figure 161 Subnetting Example: After Subnetting In a 25-bit subnet the host ID has 7 bits, so each sub-network has a maximum of 27 – 2 or 126 possible hosts (a host ID of all zeroes is the subnet’s address itself, all ones is the subnet’s broadcast address). 192.168.1.0 with mask 255.255.255.128 is subnet A itself, and 192.168.1.127 with mask 255.255.255.128 is its broadcast address.
Appendix B IP Addresses and Subnetting Table 105 Subnet 2 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 64 IP Address (Binary) 11000000.10101000.00000001. 01000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: 192.168.1.64 Lowest Host ID: 192.168.1.65 Broadcast Address: 192.168.1.127 Highest Host ID: 192.168.1.126 Table 106 Subnet 3 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1.
Appendix B IP Addresses and Subnetting Subnet Planning The following table is a summary for subnet planning on a network with a 24-bit network number. Table 109 24-bit Network Number Subnet Planning NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET 1 255.255.255.128 (/25) 2 126 2 255.255.255.192 (/26) 4 62 3 255.255.255.224 (/27) 8 30 4 255.255.255.240 (/28) 16 14 5 255.255.255.248 (/29) 32 6 6 255.255.255.252 (/30) 64 2 7 255.255.255.
Appendix B IP Addresses and Subnetting Once you have decided on the network number, pick an IP address for your Device that is easy to remember (for instance, 192.168.1.1) but make sure that no other device on your network is using that IP address. The subnet mask specifies the network number portion of an IP address. Your Device will compute the subnet mask automatically based on the IP address that you entered.
A PPENDIX C Pop-up Windows, JavaScripts and Java Permissions In order to use the web configurator you need to allow: • Web browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). Note: Internet Explorer 6 screens are used here. Screens for other Internet Explorer versions may vary. Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device.
Appendix C Pop-up Windows, JavaScripts and Java Permissions Figure 163 Internet Options: Privacy 3 Click Apply to save this setting. Enable Pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 260 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab. 2 Select Settings…to open the Pop-up Blocker Settings screen.
Appendix C Pop-up Windows, JavaScripts and Java Permissions Figure 164 Internet Options: Privacy 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.167.1. 4 Click Add to move the IP address to the list of Allowed sites.
Appendix C Pop-up Windows, JavaScripts and Java Permissions 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed. 1 In Internet Explorer, click Tools, Internet Options and then the Security tab. Figure 166 Internet Options: Security 262 2 Click the Custom Level... button. 3 Scroll down to Scripting.
Appendix C Pop-up Windows, JavaScripts and Java Permissions Figure 167 Security Settings - Java Scripting Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected. 5 Click OK to close the window.
Appendix C Pop-up Windows, JavaScripts and Java Permissions Figure 168 Security Settings - Java JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 Make sure that Use Java 2 for
Appendix C Pop-up Windows, JavaScripts and Java Permissions Mozilla Firefox Mozilla Firefox 2.0 screens are used here. Screens for other versions may vary. You can enable Java, Javascripts and pop-ups in one screen. Click Tools, then click Options in the screen that appears. Figure 170 Mozilla Firefox: Tools > Options Click Content to show the screen below. Select the check boxes as shown in the following screen.
Appendix C Pop-up Windows, JavaScripts and Java Permissions 266 AMG1302-T10A User’s Guide
A PPENDIX D Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless adapters (A, B, C). Any time two or more wireless adapters are within range of each other, they can set up an independent network, which is commonly referred to as an ad-hoc network or Independent Basic Service Set (IBSS).
Appendix D Wireless LANs Figure 173 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN. The Access Points not only provide communication with the wired network but also mediate wireless network traffic in the immediate neighborhood.
Appendix D Wireless LANs Figure 174 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by wireless devices to transmit and receive data. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a channel different from an adjacent AP (access point) to reduce interference. Interference occurs when radio signals from different access points overlap causing interference and degrading performance.
Appendix D Wireless LANs Figure 175 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations. RTS/CTS is designed to prevent collisions due to hidden nodes.
Appendix D Wireless LANs Preamble Type Preamble is used to signal that data is coming to the receiver. Short and long refer to the length of the synchronization field in a packet. Short preamble increases performance as less time sending preamble means more time for sending data. All IEEE 802.11 compliant wireless adapters support long preamble, but not all support short preamble.
Appendix D Wireless LANs The following figure shows the relative effectiveness of these wireless security methods available on your Device. Table 112 Wireless Security Levels SECURITY LEVEL Least Secure SECURITY TYPE Unique SSID (Default) Unique SSID with Hide SSID Enabled MAC Address Filtering WEP Encryption IEEE802.
Appendix D Wireless LANs RADIUS is a simple package exchange in which your AP acts as a message relay between the wireless client and the network RADIUS server. Types of RADIUS Messages The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication: • Access-Request Sent by an access point requesting authentication. • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access.
Appendix D Wireless LANs EAP-MD5 (Message-Digest Algorithm 5) MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wireless client. The wireless client ‘proves’ that it knows the password by encrypting the password with the challenge and sends back the information. Password is not sent in plain text. However, MD5 authentication has some weaknesses.
Appendix D Wireless LANs If this feature is enabled, it is not necessary to configure a default encryption key in the wireless security configuration screen. You may still configure and store keys, but they will not be used while dynamic WEP is enabled. Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption.
Appendix D Wireless LANs called Rijndael. They both include a per-packet key mixing function, a Message Integrity Check (MIC) named Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying mechanism. WPA and WPA2 regularly change and rotate the encryption keys so that the same encryption key is never used twice.
Appendix D Wireless LANs WPA(2) with RADIUS Application Example To set up WPA(2), you need the IP address of the RADIUS server, its port number (default is 1812), and the RADIUS shared secret. A WPA(2) application example with an external RADIUS server looks as follows. "A" is the RADIUS server. "DS" is the distribution system. 1 The AP passes the wireless client's authentication request to the RADIUS server.
Appendix D Wireless LANs 4 The AP and wireless clients use the TKIP or AES encryption process, the PMK and information exchanged in a handshake to create temporal encryption keys. They use these keys to encrypt data exchanged between them. Figure 177 WPA(2)-PSK Authentication Security Parameters Summary Refer to this table to see what other security parameters you should configure for each authentication method or key management protocol type.
Appendix D Wireless LANs Antenna Characteristics Frequency An antenna in the frequency of 2.4GHz (IEEE 802.11b and IEEE 802.11g) or 5GHz (IEEE 802.11a) is needed to communicate efficiently in a wireless LAN Radiation Pattern A radiation pattern is a diagram that allows you to visualize the shape of the antenna’s coverage area. Antenna Gain Antenna gain, measured in dB (decibel), is the increase in coverage within the RF beam width.
Appendix D Wireless LANs 280 AMG1302-T10A User’s Guide
A PPENDIX E IPv6 Overview IPv6 (Internet Protocol version 6), is designed to enhance IP address size and features. The increase in IPv6 address size to 128 bits (from the 32-bit IPv4 address) allows up to 3.4 x 1038 IP addresses. IPv6 Addressing The 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv6 addresses can be abbreviated in two ways: • Leading zeros in a block can be omitted.
Appendix E IPv6 Global Address A global address uniquely identifies a device on the Internet. It is similar to a “public IP address” in IPv4. A global unicast address starts with a 2 or 3. Unspecified Address An unspecified address (0:0:0:0:0:0:0:0 or ::) is used as the source address when a device does not have its own address. It is similar to “0.0.0.0” in IPv4. Loopback Address A loopback address (0:0:0:0:0:0:0:1 or ::1) allows a host to send packets to itself. It is similar to “127.0.0.1” in IPv4.
Appendix E IPv6 Table 117 Reserved Multicast Address (continued) MULTICAST ADDRESS FF08:0:0:0:0:0:0:0 FF09:0:0:0:0:0:0:0 FF0A:0:0:0:0:0:0:0 FF0B:0:0:0:0:0:0:0 FF0C:0:0:0:0:0:0:0 FF0D:0:0:0:0:0:0:0 FF0E:0:0:0:0:0:0:0 FF0F:0:0:0:0:0:0:0 Subnet Masking Both an IPv6 address and IPv6 subnet mask compose of 128-bit binary digits, which are divided into eight 16-bit blocks and written in hexadecimal notation. Hexadecimal uses four bits for each character (1 ~ 10, A ~ F).
Appendix E IPv6 combines its interface ID and global and subnet information advertised from the router. This is a routable global IP address. DHCPv6 The Dynamic Host Configuration Protocol for IPv6 (DHCPv6, RFC 3315) is a server-client protocol that allows a DHCP server to assign and pass IPv6 network addresses, prefixes and other configuration information to DHCP clients. DHCPv6 servers and clients exchange DHCP messages using UDP.
Appendix E IPv6 such as the system name. The interface-ID option provides slot number, port information and the VLAN ID to the DHCPv6 server. The remote-ID option (if any) is stripped from the Relay-Reply messages before the relay agent sends the packets to the clients. The DHCP server copies the interface-ID option from the Relay-Forward message into the Relay-Reply message and sends it to the relay agent. The interface-ID should not change even after the relay agent restarts.
Appendix E IPv6 On the Device, you can either set up a configured tunnel or an automatic 6to4 tunnel. The following describes each method. Configured Tunnel A configured tunnel is a point-to-point tunnelling mechanism that encapsulates an IPv6 address with an IPv4 address. Routers (A and B) on both IPv6 networks (1 and 2) each must have an interface that connects to the IPv4 network (with an IPv4 address). This allows the router to send and receive IPv6 data over the IPv4 network.
Appendix E IPv6 For example, if you have an IPv4 address of 192.168.1.1 (first converted to binary notation and then to the colon hexadecimal representation of c0a8:0101), then the 6to4 addresses is 2002:c0a8:0101::1/ 64. Example - Enabling IPv6 on Windows XP/2003/Vista By default, Windows XP and Windows 2003 support IPv6. This example shows you how to use the ipv6 install command on Windows XP/2003 to enable IPv6. This also displays how to use the ipconfig command to see auto-generated IP addresses. C:\>
Appendix E IPv6 5 Click Start and then OK. 6 Now your computer can obtain an IPv6 address from a DHCPv6 server. Example - Enabling IPv6 on Windows 7 Windows 7 supports IPv6 by default. DHCPv6 is also enabled when you enable IPv6 on a Windows 7 computer. To enable IPv6 in Windows 7: 288 1 Select Control Panel > Network and Sharing Center > Local Area Connection. 2 Select the Internet Protocol Version 6 (TCP/IPv6) checkbox to enable it. 3 Click OK to save the change.
Appendix E IPv6 4 Click Close to exit the Local Area Connection Status screen. 5 Select Start > All Programs > Accessories > Command Prompt. 6 Use the ipconfig command to check your dynamic IPv6 address. This example shows a global address (2001:b021:2d::1000) obtained from a DHCP server. C:\>ipconfig Windows IP Configuration Ethernet adapter Local Area Connection: Connection-specific DNS IPv6 Address. . . . . . Link-local IPv6 Address IPv4 Address. . . . . . Subnet Mask . . . . . .
Appendix E IPv6 290 AMG1302-T10A User’s Guide
A PPENDIX F Services The following table lists some commonly-used services and their associated protocols and port numbers. • Name: This is a short, descriptive name for the service. You can use this one or create a different one, if you like. • Protocol: This is the type of IP protocol used by the service. If this is TCP/UDP, then the service uses the same port number with TCP and UDP. If this is USER-DEFINED, the Port(s) is the IP protocol number, not the port number.
Appendix F Services Table 118 Examples of Services NAME 292 PROTOCOL PORT(S) DESCRIPTION AH (IPSEC_TUNNEL) User-Defined 51 The IPSEC AH (Authentication Header) tunneling protocol uses this service. AIM TCP 5190 AOL’s Internet Messenger service. AUTH TCP 113 Authentication protocol used by some servers. BGP TCP 179 Border Gateway Protocol. BOOTP_CLIENT UDP 68 DHCP Client. BOOTP_SERVER UDP 67 DHCP Server.
Appendix F Services Table 118 Examples of Services (continued) NAME PROTOCOL PORT(S) DESCRIPTION NEW-ICQ TCP 5190 An Internet chat program. NEWS TCP 144 A protocol for news groups. NFS UDP 2049 Network File System - NFS is a client/ server distributed file service that provides transparent file sharing for network environments. NNTP TCP 119 Network News Transport Protocol is the delivery mechanism for the USENET newsgroup service.
Appendix F Services Table 118 Examples of Services (continued) 294 NAME PROTOCOL PORT(S) DESCRIPTION SQL-NET TCP 1521 Structured Query Language is an interface to access data on many different types of database systems, including mainframes, midrange systems, UNIX systems and network servers. SSDP UDP 1900 The Simple Service Discovery Protocol supports Universal Plug-and-Play (UPnP). SSH TCP/UDP 22 Secure Shell Remote Login Program. STRM WORKS UDP 1558 Stream Works Protocol.
A PPENDIX G Legal Information Copyright Copyright © 2012 by ZyXEL Communications Corporation. The contents of this publication may be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
Appendix G Legal Information If this device does cause harmful interference to radio/television reception, which can be determined by turning the device off and on, the user is encouraged to try to correct the interference by one or more of the following measures: 1 Reorient or relocate the receiving antenna. 2 Increase the separation between the equipment and the receiver. 3 Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
Appendix G Legal Information Viewing Certifications 1 Go to http://www.zyxel.com. 2 Select your product on the ZyXEL home page to go to that product's page. 3 Select the certification you wish to view from this page. ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
Appendix G Legal Information HOWEVER, CERTAIN ZYXEL'S PRODUCTS MAY CONTAIN-IN PART-SOME THIRD PARTY'S FREE AND OPEN SOFTWARE PROGRAMS WHICH ALLOW YOU TO FREELY COPY, RUN, DISTRIBUTE, MODIFY AND IMPROVE THE SOFTWARE UNDER THE APPLICABLE TERMS OF SUCH THRID PARTY'S LICENSES ("OPEN-SOURCED COMPONENTS"). THE OPEN-SOURCED COMPONENTS ARE LISTED IN THE NOTICE OR APPENDIX BELOW.
Appendix G Legal Information foregoing. Portions of the Software utilize or include third party software and other copyright material. Acknowledgements, licensing terms and disclaimers for such material are contained in the License Notice as below for the third party software, and your use of such material is exclusively governed by their respective terms. ZyXEL has provided, as part of the Software package, access to certain third party software as a convenience.
Appendix G Legal Information THIS LICENSE AGREEMENT IS EXPRESSLY MADE SUBJECT TO ANY APPLICABLE LAWS, REGULATIONS, ORDERS, OR OTHER RESTRICTIONS ON THE EXPORT OF THE SOFTWARE OR INFORMATION ABOUT SUCH SOFTWARE WHICH MAY BE IMPOSED FROM TIME TO TIME. YOU SHALL NOT EXPORT THE SOFTWARE, DOCUMENTATION OR INFORMATION ABOUT THE SOFTWARE AND DOCUMENTATION WITHOUT COMPLYING WITH SUCH LAWS, REGULATIONS, ORDERS, OR OTHER RESTRICTIONS.
Appendix G Legal Information Notice Information herein is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, except the express written permission of ZyXEL Communications Corporation.
Appendix G Legal Information This Product includes Linux Kernel, gcc, binutil, Ebtables , Busybox, Iptables, Boa, Bftpd, br2684ctl, brctl, Ez-ipupdate, ntpclient, zebra, utelnetd, rp-pppoe, iwpriv, matrixssl, igmpproxy, mtd, inetd, dnsmasq, ntfs-3g, tc, ecmh, and Dproxy-nexgen under below GPL license GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc.
Appendix G Legal Information The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License.
Appendix G Legal Information on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3.
Appendix G Legal Information obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.
Appendix G Legal Information TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS All other trademarks or trade names mentioned herein, if any, are the property of their respective owners. This Product includes uClibc, libtam, and vconfig under the LGPL License. GNU LESSER GENERAL PUBLIC LICENSE Version 2.1, February 1999 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
Appendix G Legal Information For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.
Appendix G Legal Information GNU LESSER GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".
Appendix G Legal Information licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.
Appendix G Legal Information these things: a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the
Appendix G Legal Information 11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License.
Appendix G Legal Information LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. END OF TERMS AND CONDITIONS.
Appendix G Legal Information This Product includes ppp below below license PPP License All of the code can be freely used and redistributed. The individual source files each have their own copyright and permission notice. Pppd, pppstats and pppdump are under BSD-style notices. Some of the pppd plugins are GPL'd. Chat is public domain. This Product includes net-snmp below license Various copyrights apply to this package, listed in various separate parts below.
Appendix G Legal Information and that the name of CMU and The Regents of the University of California not be used in advertising or publicity pertaining to distribution of the software without specific written permission. CMU AND THE REGENTS OF THE UNIVERSITY OF CALIFORNIA DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.
Appendix G Legal Information ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Appendix G Legal Information Copyright © 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. Use is subject to license terms below. This distribution may include materials developed by third parties. Sun, Sun Microsystems, the Sun logo and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries.
Appendix G Legal Information ---- Part 5: Sparta, Inc copyright notice (BSD) ----- Copyright (c) 2003-2009, Sparta, Inc All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
Appendix G Legal Information Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
Appendix G Legal Information * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * The name of Fabasoft R&D Software GmbH & Co KG or any of its subsidiaries, brand or product names may not be used to endorse or promote products derived from this software without specific prior written permission.
Appendix G Legal Information SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUC
Appendix G Legal InformationSafety Warnings Safety Warnings • • • • • • • • • • • • • • • • • • • • Do not use this product near water, for example, in a wet basement or near a swimming pool. Do not expose your device to dampness, dust or corrosive liquids. Do not store things on the device. Do not install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. Connect ONLY suitable accessories to the device. Do not open the device or unit.
Appendix G Legal InformationSafety Warnings 322 AMG1302-T10A User’s Guide
Index Index MBS 75, 80 PCR 75, 79 QoS 75, 79, 83 SCR 75, 80 status 225 Numbers 802.
Index DHCP 89 firewalls 142, 146 IP alias 91 IP precedence 172 IP/MAC filter 156 logs 207 port forwarding 130 reset 221 restoring 220 static route 161 WAN 71 wireless LAN 99 wizard 58 connection nailed-up 78, 82 on demand 78 copyright 295 CPE WAN Management Protocol, see CWMP CTS (Clear to Send) 270 CTS threshold 104, 114 customized services 147, 148 CWMP 199 activation 200 configuration 200 Dynamic Host Configuration Protocol, see DHCP dynamic WEP key exchange 274 DYNDNS wildcard 177 activation 178 E EA
Index default action 143 DoS 141 example 46 ICMP 142 packet direction 143 rules 144, 149 security 150 status 29 triangle route 143, 151 solutions 152 firmware 217 version 28 forwarding ports 128, 129 activation 132 configuration 130 example 130 rules 132 fragmentation threshold 104, 114, 270 FTP 15, 182 G Guide Quick Start 2 H hidden node 269 I IANA 258 Internet Assigned Numbers Authority see IANA IBSS 267 ICMP 142, 185 IEEE 802.
Index LEDs 18 example 137 global 137 IGA 136 ILA 136 inside 136 local 137 outside 136 P2P 129 port forwarding 128, 129 activation 132 configuration 130 example 130 rules 132 remote management 180 SIP ALG 135 activation 136 SUA 128 limitations wireless LAN 117 WPS 124 Local Area Network, see LAN login 21 passwords 21, 22 logs 207 alerts 207 settings 207 M MAC address 90, 106 filter 98, 99, 106, 115 MAC address filter activation 106 Management Information Base (MIB) 184 mapping address 133 rules 134 types
Index rules 132 reset 19, 221 PPPoA 72, 78, 81 restart 221 PPPoE 72, 78, 80 restoring configuration 220 preamble 105, 114 RFC 1483 72, 78, 81 preamble mode 271 RIP 86, 88, 95 pre-shared key 102 Routing Information Protocol, see RIP private IP address 95 probing, firewalls 142 RTS (Request To Send) 270 threshold 269, 270 product registration 297 RTS threshold 104, 114 PSK 276 rules, port forwarding 132 push button 17, 110 Push Button Configuration, see PBC push button, WPS 119 S safety wa
Index versions 183 SSID 98, 99, 108, 115 activation 107 MBSSID 118 static route 159 configuration 161 example 159 status 24, 27, 30 ATM 225 DSL connections 226 firewalls 29 firmware version 28 LAN 29 WAN 29 wireless LAN 29 WPS 109 triangle route 143, 151 solutions 152 U UBR 75, 79, 84 unicast 70 Universal Plug and Play, see UPnP upgrading firmware 217 SUA 128 UPnP 187 activation 188 cautions 187 example 189 installation 189 NAT traversal 187 subnet 251 URL 153 subnet mask 86, 94, 252 URL filter 154
Index multicast 70 multiplexing 72, 78, 81 nailed-up connection 73, 78, 82 NAT 78 setup 71 status 29 traffic shaping 82 example 83 VCI 72, 78, 81 VPI 72, 78, 81 warranty 297 note 297 WDS 110, 118 compatibility 110 example 118 web configurator 15, 21 login 21 passwords 21, 22 WEP 100, 116 key 101 Wide Area Network, see WAN Wi-Fi Protected Access 275 WiFi Protected Setup, see WPS wireless client WPA supplicants 276 Wireless Distribution System, see WDS wireless LAN 97, 113 activation 99 authentication 114, 1
Index example 122 limitations 124 PIN 109, 110, 119 example 121 push button 17, 110, 119 status 109 330 AMG1302-T10A User’s Guide
Index AMG1302-T10A User’s Guide 331
Index 332 AMG1302-T10A User’s Guide
