802.11g Wireless Broadband Router with Firewall User's Guide

ManualsBrandsZyXEL Communications ManualsNetwork RouterP-334W

Prestige 334W

802.11g Wireless Broadband Router with Firewall

User’s Guide

Version 3.60

May 2004

Summary of content (496 pages)

PAGE 1
Prestige 334W 802.11g Wireless Broadband Router with Firewall User’s Guide Version 3.
PAGE 2
Prestige 334W User’s Guide Copyright Copyright © 2004 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
PAGE 3
Prestige 334W User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: This device may not cause harmful interference. This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a CLASS B digital device pursuant to Part 15 of the FCC Rules.
PAGE 4
Prestige 334W User’s Guide Information for Canadian Users The Industry Canada label identifies certified equipment. This certification means that the equipment meets certain telecommunications network protective, operation, and safety requirements. The Industry Canada does not guarantee that the equipment will operate to a user's satisfaction. Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company.
PAGE 5
Prestige 334W User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
PAGE 6
PAGE 7
Prestige 334W User’s Guide Customer Support When you contact your customer support representative please have the following information ready: Please have the following information ready when you contact customer support. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it.
PAGE 8
Prestige 334W User’s Guide METHOD SUPPORT E-MAIL SALES E-MAIL TELEPHONE1 FAX 1 WEB SITE REGULAR MAIL FTP SITE LOCATION SWEDEN FINLAND support@zyxel.se +46 31 744 7700 sales@zyxel.se +46 31 744 7701 support@zyxel.fi +358-9-4780-8411 sales@zyxel.fi +358-9-4780 8448 Customer Support www.zyxel.se ZyXEL Communications A/S Sjöporten 4, 41764 Göteborg Sweden www.zyxel.
PAGE 9
Prestige 334W User’s Guide Table of Contents Copyright......................................................................................................................................................ii Federal Communications Commission (FCC) Interference Statement................................................. iii Information for Canadian Users ...............................................................................................................iv ZyXEL Limited Warranty ....................
PAGE 10
Prestige 334W User’s Guide 3.6.4 WAN MAC Address.............................................................................................................3-12 3.7 Basic Setup Complete .................................................................................................................3-14 Chapter 4 Media Bandwidth Management Setup......................................................................................4-1 4.1 Media Bandwidth Management Setup Overview .............................
PAGE 11
Prestige 334W User’s Guide 7.4 Configuring Roaming .................................................................................................................. 7-6 7.4.1 Requirements for Roaming .................................................................................................... 7-8 Chapter 8 Wireless Security ........................................................................................................................ 8-1 8.1 Wireless Security Overview.......................
PAGE 12
Prestige 334W User’s Guide SUA/NAT and Static Route .......................................................................................................................... III Chapter 10 Network Address Translation (NAT) Screens.......................................................................10-1 10.1 NAT Overview .........................................................................................................................10-1 10.1.1 NAT Definitions ......................................
PAGE 13
Prestige 334W User’s Guide 13.3 The Firewall, NAT and Remote Management ..................................................................... 13-5 13.3.1 LAN-to-WAN rules ............................................................................................................. 13-5 13.3.2 WAN-to-LAN rules ............................................................................................................. 13-5 13.4 Configuring Content Filtering ....................................................
PAGE 14
Prestige 334W User’s Guide 16.4.1 Dynamic Secure Gateway Address.......................................................................................16-3 16.5 Summary Screen .....................................................................................................................16-3 16.6 Keep Alive................................................................................................................................16-5 16.7 NAT Traversal ...............................................
PAGE 15
Prestige 334W User’s Guide 18.5 Monitor Screen ..................................................................................................................... 18-13 Chapter 19 Maintenance ........................................................................................................................... 19-1 19.1 Maintenance Overview .......................................................................................................... 19-1 19.2 Status Screen.................................
PAGE 16
Prestige 334W User’s Guide 24.1 Introduction to Internet Access Setup...................................................................................24-1 24.2 Ethernet Encapsulation ..........................................................................................................24-1 24.3 Configuring the PPTP Client .................................................................................................24-3 24.4 Configuring the PPPoE Client ...............................................
PAGE 17
Prestige 334W User’s Guide 30.2.2 Configuring a TCP/IP Filter Rule ........................................................................................ 30-6 30.2.3 Configuring a Generic Filter Rule...................................................................................... 30-11 30.3 Example Filter ...................................................................................................................... 30-13 30.4 Filter Types and NAT................................................
PAGE 18
Prestige 334W User’s Guide 34.3.2 Restore Using FTP Session Example....................................................................................34-8 34.4 Uploading Firmware and Configuration Files .....................................................................34-8 34.4.1 Firmware File Upload ...........................................................................................................34-8 34.4.2 Configuration File Upload .............................................................
PAGE 19
Prestige 334W User’s Guide Appendix G Wireless LAN With IEEE 802.1x ......................................................................................... G-1 Appendix H Types of EAP Authentication................................................................................................ H-1 Appendix I Antenna Selection and Positioning Recommendation............................................................I-1 Appendix J Brute-Force Password Guessing Protection ....................................
PAGE 20
PAGE 21
Prestige 334W User’s Guide List of Figures Figure 1-1 Secure Internet Access via Cable, DSL or Wireless Modem........................................................ 1-6 Figure 1-2 VPN Application .......................................................................................................................... 1-6 Figure 1-3 Internet Access Application Example........................................................................................... 1-7 Figure 2-1 Change Password Screen............
PAGE 22
Prestige 334W User’s Guide Figure 8-6 Wireless: WPA-PSK....................................................................................................................8-11 Figure 8-7 WPA with RADIUS Application Example..................................................................................8-14 Figure 8-8 Wireless: WPA ............................................................................................................................8-15 Figure 8-9 Wireless: 802.1x and Dynamic WEP .....
PAGE 23
Prestige 334W User’s Guide Figure 14-7 Remote Management: DNS.................................................................................................... 14-12 Figure 14-8 Security................................................................................................................................... 14-13 Figure 15-1 Encryption and Decryption....................................................................................................... 15-2 Figure 15-2 IPSec Architecture..........
PAGE 24
Prestige 334W User’s Guide Figure 19-15 System Restart.......................................................................................................................19-12 Figure 20-1 Login Screen .............................................................................................................................20-2 Figure 20-2 SMT Menu Overview ...............................................................................................................20-3 Figure 20-3 SMT Main Menu.......
PAGE 25
Prestige 334W User’s Guide Figure 28-10 NAT Example 1 .................................................................................................................... 28-10 Figure 28-11 Menu 4 Internet Access & NAT Example..............................................................................28-11 Figure 28-12 NAT Example 2 .....................................................................................................................28-11 Figure 28-13 Menu 15.2.
PAGE 26
Prestige 334W User’s Guide Figure 33-9 LAN & WAN DHCP...............................................................................................................33-10 Figure 34-1 Telnet in Menu 24.5 ..................................................................................................................34-3 Figure 34-2 FTP Session Example................................................................................................................34-4 Figure 34-3 Telnet into Menu 24.6 .........
PAGE 27
Prestige 334W User’s Guide List of Tables Table 2-1 Screens Summary........................................................................................................................... 2-3 Table 3-1 Wizard 2: Wireless LAN Setup ...................................................................................................... 3-3 Table 3-2 Wizard 3: Wireless LAN Setup: Basic Security.............................................................................
PAGE 28
Prestige 334W User’s Guide Table 9-6 WAN: Traffic Redirect ....................................................................................................................9-13 Table 10-1 NAT Definitions..........................................................................................................................10-1 Table 10-2 NAT Mapping Types...................................................................................................................
PAGE 29
Prestige 334W User’s Guide Table 19-1 Maintenance Status .................................................................................................................... 19-2 Table 19-2 Maintenance System Statistics ................................................................................................... 19-3 Table 19-3 Maintenance DHCP Table.......................................................................................................... 19-4 Table 19-4 Maintenance Any IP.............
PAGE 30
Prestige 334W User’s Guide Table 32-2 Menu 23.4 System Security : IEEE802.1x .................................................................................32-4 Table 33-1 System Maintenance: Status Menu Fields ..................................................................................33-2 Table 33-2 Menu 24.2.1 System Maintenance : Information........................................................................33-4 Table 33-3 Menu 24.3.2 System Maintenance : Syslog and Accounting...............
PAGE 31
Prestige 334W User’s Guide Preface About This User's Manual Congratulations on your purchase of the Prestige 334 802.11g Wireless Broadband Router with Firewall. This manual is designed to guide you through the configuration of your Prestige for its various applications. Use the web configurator, System Management Terminal (SMT) or command interpreter interface to configure your Prestige. Not all features can be configured through all interfaces.
PAGE 32
Prestige 334W User’s Guide • • • • • • The version number on the title page is the latest firmware version that is documented in this User’s Guide. Earlier versions may also be included. “Enter” means for you to type one or more characters and press the carriage return. “Select” or “Choose” means for you to use one of the predefined choices. The SMT menu titles and labels are in Bold Times New Roman font. Command and arrow keys are enclosed in square brackets.
PAGE 33
Getting Started Part I: Getting Started This part helps you get to know your Prestige, introduces the web configurator and covers how to configure the Wizard Setup screens.
PAGE 34
PAGE 35
Prestige 334W User’s Guide Chapter 1 Getting to Know Your Prestige This chapter introduces the main features and applications of the Prestige. 1.1 Prestige Internet Security Gateway Overview The Prestige is the ideal secure gateway for all data passing between the Internet and LAN’s. By integrating NAT, firewall, media bandwidth management and VPN capability, ZyXEL’s Prestige is a complete security solution that protects your Intranet and efficiently manages data traffic on your network.
PAGE 36
Prestige 334W User’s Guide 1.2.2 Non-Physical Features Media Bandwidth Management ZyXEL’s Media Bandwidth Management allows you to specify bandwidth classes based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth classes.
PAGE 37
Prestige 334W User’s Guide IEEE 802.11b Data Rate (Mbps) Modulation 1 DBPSK (Differential Binary Phase Shift Keyed) 2 DQPSK (Differential Quadrature Phase Shift Keying) 5.5 / 11 CCK (Complementary Code Keying) The Prestige may be prone to RF (Radio Frequency) interference from other 2.4 GHz devices such as microwave ovens, wireless phones, Bluetooth enabled devices, and other wireless LANs. 802.11g Wireless LAN Standard The Prestige, complies with the 802.
PAGE 38
Prestige 334W User’s Guide Dynamic DNS Support With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider. IP Multicast Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet Group Management Protocol) is the protocol used to support multicast groups.
PAGE 39
Prestige 334W User’s Guide Any IP The Any IP feature allows a computer to access the Internet without changing the network settings (such as IP address and subnet mask) of the computer, when the IP addresses of the computer and the Prestige are not in the same subnet. Full Network Management The embedded web configurator is an all-platform web-based utility that allows you to easily access the Prestige’s management settings and configure the firewall.
PAGE 40
Prestige 334W User’s Guide 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem You can connect a cable modem, DSL or wireless modem to the Prestige for broadband Internet access via an Ethernet or a wireless port on the modem. The Prestige guarantees not only high speed Internet access, but secure internal network protection and traffic management as well. Figure 1-1 Secure Internet Access via Cable, DSL or Wireless Modem 1.3.
PAGE 41
Prestige 334W User’s Guide 1.3.3 Internet Access Application Add a wireless LAN to your existing network without expensive network cables. Wireless stations can move freely anywhere in the coverage area and use resources on the wired network.
PAGE 42
PAGE 43
Prestige 334W User’s Guide Chapter 2 Introducing the Web Configurator This chapter describes how to access the Prestige web configurator and provides an overview of its screens. 2.1 Web Configurator Overview The embedded web configurator allows you to manage the Prestige from anywhere through a browser such as Microsoft Internet Explorer or Netscape Navigator. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions with JavaScript enabled.
PAGE 44
Prestige 334W User’s Guide Step 6. You should now see the MAIN MENU screen (see Figure 2-2). The management session automatically times out when the time period set in the Administrator Inactivity Timer field expires (default five minutes). Simply log back into the Prestige if this happens to you. 2.
PAGE 45
Prestige 334W User’s Guide Click WIZARD for initial configuration including general setup, Wireless LAN Setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment. Click BW SETUP for initial configuration of media bandwidth management. Use submenus to configure Prestige features. Click to view the web configurator in the language of your choice. Click LOGOUT at any time to exit the web configurator.
PAGE 46
Prestige 334W User’s Guide Table 2-1 Screens Summary LINK LAN WIRELESS WAN SUA/NAT STATIC ROUTE 2-4 TAB FUNCTION DDNS Use this screen to set up dynamic DNS. Password Use this screen to change your password. Time Zone Use this screen to change your Prestige’s time and date. IP Use this screen to configure LAN DHCP, TCP/IP settings and to enable Any IP. Static DHCP Use this screen to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses.
PAGE 47
Prestige 334W User’s Guide Table 2-1 Screens Summary LINK FIREWALL TAB FUNCTION Settings Use this screen to activate/deactivate the firewall and log packets related to firewall rules. Filter This screen allows you to block sites containing certain keywords in the URL and set the days and times for the Prestige to perform content filtering. Services Use this screen to enable service blocking.
PAGE 48
Prestige 334W User’s Guide Table 2-1 Screens Summary LINK LOGOUT 2-6 TAB FUNCTION DHCP Table This screen displays DHCP (Dynamic Host Configuration Protocol) related information and is READ-ONLY. Any IP Use this screen to allow a computer to access the Internet without changing the network settings of the computer, when the IP addresses of the computer and the Prestige are not in the same subnet. F/W Upload Use this screen to upload firmware to your Prestige.
PAGE 49
Prestige 334W User’s Guide Chapter 3 Wizard Setup This chapter provides information on the Wizard Setup screens in the web configurator. 3.1 Wizard Setup Overview The web configurator’s setup wizard helps you configure your device to access the Internet. The second screen has three variations depending on what encapsulation type you use. Refer to your ISP checklist in the Quick Start Guide to know what to enter in each field. Leave a field blank if you don’t have that information. 3.
PAGE 50
Prestige 334W User’s Guide Figure 3-1 Wizard 1: General Setup 3.3 Wizard Setup: Screen 2 Set up your wireless LAN using the second wizard screen. Figure 3-2 Wizard 2: Wireless LAN Setup The following table describes the fields in this screen.
PAGE 51
Prestige 334W User’s Guide Table 3-1 Wizard 2: Wireless LAN Setup LABEL ESSID DESCRIPTION Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN. If you change this field on the Prestige, make sure all wireless stations use the same ESSID in order to access the network. Choose Channel ID To manually set the Prestige to use a channel, select a channel from the drop-down list box. The level of Security can be selected as none, basic or extended.
PAGE 52
Prestige 334W User’s Guide Figure 3-3 Wizard 3: Wireless LAN Setup: Basic Security The following table describes the labels in this screen. Table 3-2 Wizard 3: Wireless LAN Setup: Basic Security WEP Encryption Select 64-bit WEP or 128-bit WEP to allow data encryption. ASCII Select this option in order to enter ASCII characters as the WEP keys. HEX Select this option to enter hexadecimal characters as the WEP keys. The preceding “0x” is entered automatically.
PAGE 53
Prestige 334W User’s Guide If you choose Extend security in the Wireless LAN Setup screen, you can set up a Pre-Shared Key. Figure 3-4 Wizard 3: Wireless LAN Setup: Extend Security The following table describes the labels in this screen. Table 3-3 Wizard 3: Wireless LAN Setup: Extend Security Pre-Shared Key Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "AF") characters.
PAGE 54
Prestige 334W User’s Guide Figure 3-5 Wizard 4: Ethernet Encapsulation The following table describes the fields in this screen. Table 3-4 Wizard 4: Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet. Otherwise, choose PPP over Ethernet or PPTP for a dial-up connection.
PAGE 55
Prestige 334W User’s Guide Table 3-4 Wizard 4: Ethernet Encapsulation LABEL DESCRIPTION Relogin Every (min) This field only applies when you select Telia Login in the Service Type field. The Telia server logs the Prestige out if the Prestige does not log in periodically. Type the number of minutes from 1 to 59 (30 default) for the Prestige to wait between logins. Back Click Back to return to the previous screen. Next Click Next to continue. 3.5.
PAGE 56
Prestige 334W User’s Guide Figure 3-6 Wizard 4: PPPoE Encapsulation The following table describes the fields in this screen. Table 3-5 Wizard 4: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose PPP over Ethernet from the pull-down list box. PPPoE forms a dial-up connection. Service Name Type the name of your service provider. User Name Type the user name given to you by your ISP. Password Type the password associated with the user name above.
PAGE 57
Prestige 334W User’s Guide Table 3-5 Wizard 4: PPPoE Encapsulation LABEL DESCRIPTION Click Back to return to the previous screen. Back 3.5.3 PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables transfers of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the Internet.
PAGE 58
Prestige 334W User’s Guide Table 3-6 Wizard 4: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. User Name Type the user name given to you by your ISP. Password Type the password associated with the User Name above. Nailed-Up Connection Select Nailed-Up Connection if you do not want the connection to time out.
PAGE 59
Prestige 334W User’s Guide Table 3-7 Private IP Address Ranges 10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255 You can obtain your IP address from the IANA, from an ISP or have it assigned by a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks.
PAGE 60
Prestige 334W User’s Guide The Prestige can get the DNS server addresses in the following ways. 1. The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS Server fields in DHCP Setup. 2. If the ISP did not give you DNS server information, leave the DNS Server fields in DHCP Setup set to 0.0.0.0 for the ISP to dynamically assign the DNS server IP addresses. 3.6.
PAGE 61
Prestige 334W User’s Guide Figure 3-8 Wizard 5: WAN Setup The following table describes the fields in this screen. Table 3-9 Wizard 5: WAN Setup LABEL DESCRIPTION WAN IP Address Assignment Get automatically from ISP Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Use fixed IP address Select this option If the ISP assigned a fixed IP address. My WAN IP Address Enter your WAN IP address in this field if you selected Use Fixed IP Address.
PAGE 62
Prestige 334W User’s Guide Table 3-9 Wizard 5: WAN Setup LABEL DESCRIPTION System DNS Server Address Assignment (if applicable) DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Prestige uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server.
PAGE 63
Prestige 334W User’s Guide Figure 3-9 Wizard Finish Well done! You have successfully set up your Prestige to operate on your network and access the Internet.
PAGE 64
PAGE 65
Prestige 334W User’s Guide Chapter 4 Media Bandwidth Management Setup This chapter provides information on the bandwidth management setup screens in the web configurator. 4.1 Media Bandwidth Management Setup Overview The web configurator’s BW SETUP allows you to specify bandwidth classes based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth classes.
PAGE 66
Prestige 334W User’s Guide Table 4-1 Media Bandwidth Management Setup 1 LABEL DESCRIPTION Select the Active check box to have the Prestige apply bandwidth management to traffic going out through the Prestige’s WAN, LAN or WLAN port. Active Managed Bandwidth (Kbps) Enter the amount of Managed Bandwidth in kbps (2 to 100,000) that you want to allocate for traffic. 20 kbps to 20,000 kbps is recommended.
PAGE 67
Prestige 334W User’s Guide Table 4-2 Media Bandwidth Management Setup 2: Services LABEL DESCRIPTION Choose Channel ID Create bandwidth management classes by selecting services from the list provided. Back Click Back to display the previous screen. Next Click Next to proceed to the next screen. XBox Live VoIP (SIP) FTP E-Mail eMule/eDonkey WWW For a detailed description of these services, see the Media Bandwidth Management chapter.
PAGE 68
Prestige 334W User’s Guide Table 4-3 Media Bandwidth Management Setup 3: Service Priority LABEL DESCRIPTION Service These fields display the services selected in the previous screen. Priority Select High, Mid or Low priority for each service to have your Prestige use a priority for traffic that matches that service. If the rules set up in this wizard are changed in ADVANCED - BW MGMT Configuration, then the service priority radio button will be set to Others.
PAGE 69
System, LAN, WLAN and WAN Part II: System, LAN, WLAN and WAN This part covers configuration of the system, LAN, WLAN and WAN screens.
PAGE 70
PAGE 71
Prestige 334W User’s Guide Chapter 5 System Screens This chapter provides information on the System screens. 5.1 System Overview See the Wizard Setup chapter for more information on the next few screens. 5.2 Configuring General Setup Click SYSTEM to open the General screen.
PAGE 72
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 5-1 System General Setup LABEL DESCRIPTION System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field (see the Wizard Setup chapter for how to find your computer’s name). This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.
PAGE 73
Prestige 334W User’s Guide 5.3 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect.
PAGE 74
Prestige 334W User’s Guide Figure 5-2 DDNS The following table describes the labels in this screen. Table 5-2 DDNS LABEL DESCRIPTION Active Select this check box to use dynamic DNS. Service Provider Select the name of your Dynamic DNS service provider. DDNS Type Select the type of service that you are registered for from your Dynamic DNS service provider.
PAGE 75
Prestige 334W User’s Guide Table 5-2 DDNS LABEL DESCRIPTION Host Names 1~3 Enter the host names in the three fields provided. You can specify up to two host names in each field separated by a comma (","). User Enter your user name. Password Enter the password assigned to you. Enable Wildcard Select the check box to enable DynDNS Wildcard. Off Line This option is available when CustomDNS is selected in the DDNS Type field.
PAGE 76
Prestige 334W User’s Guide Figure 5-3 Password The following table describes the labels in this screen. Table 5-3 Password LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field. New Password Type the new password in this field. Retype to Confirm Type the new password again in this field. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 5.
PAGE 77
Prestige 334W User’s Guide Figure 5-4 Time Setting The following table describes the labels in this screen. Table 5-4 Time Setting LABEL Use Time Server when Bootup System Screens DESCRIPTION Select the time service protocol that your time server sends when you turn on the Prestige. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works. The main difference between them is the format.
PAGE 78
Prestige 334W User’s Guide Table 5-4 Time Setting LABEL DESCRIPTION Time Server IP Address Enter the IP address of your time server. Check with your ISP/network administrator if you are unsure of this information. Current Time This field displays the time of your Prestige. Each time you reload this page, the Prestige synchronizes the time with the time server. New Time This field displays the last updated time from the time server.
PAGE 79
Prestige 334W User’s Guide Chapter 6 LAN Screens This chapter describes how to configure LAN settings. 6.1 LAN Overview Local Area Network (LAN) is a shared communication system to which many computers are attached. The LAN screens can help you configure a LAN DHCP server, manage IP addresses, and partition your physical network into logical networks. 6.
PAGE 80
Prestige 334W User’s Guide These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded web configurator help regarding what fields need to be configured. 6.3.2 IP Address and Subnet Mask Refer to the IP Address and Subnet Mask section in the Wizard Setup chapter for this information. 6.3.3 RIP Setup RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers.
PAGE 81
Prestige 334W User’s Guide 6.4 Any IP Traditionally, you must set the IP addresses and the subnet masks of a computer and the Prestige to be in the same subnet to allow the computer to access the Internet (through the Prestige). In cases where your computer is required to use a static IP address in another network, you may need to manually configure the network settings of the computer every time you want to access the Internet via the Prestige.
PAGE 82
Prestige 334W User’s Guide You must enable NAT/SUA to use the Any IP feature on the Prestige. 6.4.1 How Any IP Works Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address, also known as a Media Access Control or MAC address, on the local area network. IP routing table is defined on IP Ethernet devices (the Prestige) to decide which hop to use, to help forward data along to its specified destination.
PAGE 83
Prestige 334W User’s Guide Figure 6-2 IP The following table describes the fields in this screen. Table 6-1 IP LABEL DHCP Server IP Pool Starting Address LAN Screens DESCRIPTION DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients (computers) to obtain TCP/IP configuration at startup from a server. Leave the DHCP Server check box selected unless your ISP instructs you to do otherwise. Clear it to disable the Prestige acting as a DHCP server.
PAGE 84
Prestige 334W User’s Guide Table 6-1 IP LABEL Pool Size DESCRIPTION This field specifies the size, or count of the IP address pool. DNS Servers Assigned by DHCP Server The Prestige passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. The Prestige only passes this information to the LAN DHCP clients when you select the DHCP Server check box.
PAGE 85
Prestige 334W User’s Guide Table 6-1 IP LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Select the RIP direction from Both/In Only/Out Only/None. When set to Both or Out Only, the Prestige will broadcast its routing table periodically.
PAGE 86
Prestige 334W User’s Guide Table 6-1 IP LABEL Allow from LAN to WAN DESCRIPTION Select this check box to forward NetBIOS packets from the LAN to the WAN and from the WAN to the LAN. If your firewall is enabled with the default policy set to block WAN to LAN traffic, you also need to enable the default WAN to LAN firewall rule that forwards NetBIOS traffic. Clear this check box to block all NetBIOS packets going from the LAN to the WAN and from the WAN to the LAN.
PAGE 87
Prestige 334W User’s Guide Table 6-2 Static DHCP LABEL DESCRIPTION # This is the index number of the Static IP table entry (row). MAC Address Type the MAC address (with colons) of a computer on your LAN. IP Address This field specifies the size, or count of the IP address pool. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 6.
PAGE 88
Prestige 334W User’s Guide Table 6-3 IP Alias LABEL DESCRIPTION IP Alias 1,2 Select the check box to configure another LAN network for the Prestige. IP Address Enter the IP address of your Prestige in dotted decimal notation. IP Subnet Mask Your Prestige will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Prestige.
PAGE 89
Prestige 334W User’s Guide Chapter 7 Wireless Configuration and Roaming This chapter discusses how to configure the Wireless and Roaming screens on the Prestige. 7.1 Wireless LAN Overview This section introduces the wireless LAN(WLAN) and some basic scenarios. 7.1.1 IBSS An Independent Basic Service Set (IBSS), also called an Ad-hoc network, is the simplest WLAN configuration.
PAGE 90
Prestige 334W User’s Guide Figure 7-2 Basic Service set 7.1.3 ESS An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). An ESSID (ESS IDentification) uniquely identifies each ESS. All access points and their associated wireless stations within the same ESS must have the same ESSID in order to communicate.
PAGE 91
Prestige 334W User’s Guide Figure 7-3 Extended Service Set 7.2 Wireless LAN Basics Refer also to the Wizard Setup chapter for more background information on Wireless LAN features, such as channels. 7.2.1 RTS/CTS A hidden node occurs when two stations are within range of the same access point, but are not within range of each other. The following figure illustrates a hidden node.
PAGE 92
Prestige 334W User’s Guide Stations A and B do not hear each other. They can hear the Prestige. Figure 7-4 RTS/CTS When station A sends data to the Prestige, it might not know that station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations. RTS/CTS is designed to prevent collisions due to hidden nodes.
PAGE 93
Prestige 334W User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set, then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size. 7.
PAGE 94
Prestige 334W User’s Guide Table 7-1 Wireless LABEL ESSID DESCRIPTION (Extended Service Set IDentity) The ESSID identifies the Service Set with which a wireless station is associated. Wireless stations associating to the access point (AP) must have the same ESSID. Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN.
PAGE 95
Prestige 334W User’s Guide The roaming feature on the access points allows the access points to relay information about the wireless stations to each other. When a wireless station moves from a coverage area to another, it scans and uses the channel of a new access point, which then informs the access points on the LAN about the change. The new information is then propagated to the other access points on the LAN. An example is shown in Figure 7-6.
PAGE 96
Prestige 334W User’s Guide 7.4.1 Requirements for Roaming The following requirements must be met in order for wireless stations to roam between the coverage areas. 1. All the access points must be on the same subnet and configured with the same ESSID. 2. If IEEE 802.1x user authentication is enabled and to be done locally on the access point, the new access point must have the user profile for the wireless station. 3.
PAGE 97
Prestige 334W User’s Guide Table 7-2 Roaming LABEL DESCRIPTION Port Enter the port number to communicate roaming information between APs. The port number must be the same on all APs. The default is 3517. Make sure this port is not used by other services. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to reload the previous configuration for this screen.
PAGE 98
PAGE 99
Prestige 334W User’s Guide Chapter 8 Wireless Security This Chapter describes how to use the MAC Filter, 802.1x, Local User Database and RADIUS to configure wireless security on your Prestige. 8.1 Wireless Security Overview Wireless security is vital to your network to protect wireless communication between wireless stations, access points and the wired network. The figure below shows the possible wireless security levels on your Prestige.
PAGE 100
Prestige 334W User’s Guide Figure 8-2 Wireless: No Security The following table describes the labels in this screen. Table 8-1 Wireless: No Security LABEL DESCRIPTION Security Choose from one of the security features listed in the drop-down box. No Security Static WEP WPA-PSK WPA 802.1x + Dynamic WEP 802.1x + Static WEP 802.1x + No WEP Preamble Select a preamble type from the drop-down list menu. Choices are Long, Short and Dynamic. The default setting is Long.
PAGE 101
Prestige 334W User’s Guide Table 8-1 Wireless: No Security LABEL DESCRIPTION 802.11 Mode Select 802.11b Only to allow only IEEE 802.11b compliant WLAN devices to associate with the Prestige. Select 802.11g Only to allow only IEEE 802.11g compliant WLAN devices to associate with the Prestige. Select Mixed to allow either IEEE802.11b or IEEE802.11g compliant WLAN devices to associate with the Prestige. The transmission rate of your Prestige might be reduced. Max.
PAGE 102
Prestige 334W User’s Guide Table 8-2 Wireless Security Relational Matrix AUTHENTICATION METHOD/ KEY MANAGEMENT PROTOCOL ENCRYPTION METHOD ENTER MANUAL KEY IEEE 802.1X Yes Enable without Dynamic WEP Key Yes Disable WPA WEP No Enable WPA TKIP No Enable WPA-PSK WEP Yes Enable WPA-PSK TKIP Yes Enable 8.3 WEP Overview WEP (Wired Equivalent Privacy) as specified in the IEEE 802.11 standard provides methods for both data encryption and wireless station authentication. 8.3.
PAGE 103
Prestige 334W User’s Guide Figure 8-3 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network. Shared key authentication involves a four-message procedure.
PAGE 104
Prestige 334W User’s Guide 8.3.3 Preamble Type A preamble is used to synchronize the transmission timing in your wireless network. There are two preamble modes: Long and Short. Short preamble takes less time to process and minimizes overhead, so it should be used in a good wireless network environment when all wireless clients support it. Select Long if you have a ‘noisy’ network or are unsure of what preamble mode your wireless clients support as all IEEE 802.
PAGE 105
Prestige 334W User’s Guide Figure 8-4 Wireless: Static WEP Encryption The following table describes the wireless LAN security labels in this screen. Table 8-3 Wireless: Static WEP Encryption LABEL DESCRIPTION WEP Encryption Select 64-bit WEP or 128-bit WEP to enable data encryption. Authentication Method This field is activated when you select 64-bit WEP or 128-bit WEP in the WEP Encryption field. Select Auto, Open System or Shared Key from the drop-down list box.
PAGE 106
Prestige 334W User’s Guide Table 8-3 Wireless: Static WEP Encryption LABEL DESCRIPTION Hex Select this option in order to enter hexadecimal characters as the WEP keys. The preceding "0x", that identifies a hexadecimal key, is entered automatically. Key 1 to Key 4 The WEP keys are used to encrypt data. Both the Prestige and the wireless stations must use the same WEP key for data transmission. If you chose 64-bit WEP, then enter any 5 ASCII characters or 10 hexadecimal characters ("0-9", "A-F").
PAGE 107
Prestige 334W User’s Guide 8.5.1 User Authentication WPA applies IEEE 802.1x and Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. You can’t use the Prestige’s Local User Database for WPA authentication purposes since the Local User Database uses EAP MD5, which cannot be used to generate keys. See later in this chapter and the appendices for more information on IEEE 802.1x, RADIUS and EAP.
PAGE 108
Prestige 334W User’s Guide Step 3. Step 4. The AP derives and distributes keys to the wireless clients. The AP and wireless clients use the TKIP encryption process to encrypt data exchanged between them. Figure 8-5 WPA - PSK Authentication 8.6 Configuring WPA-PSK Authentication In order to configure and enable WPA-PSK Authentication; click the WIRELESS link under ADVANCED to display the Wireless screen. Select WPA-PSK from the Security list.
PAGE 109
Prestige 334W User’s Guide Figure 8-6 Wireless: WPA-PSK The following table describes the labels in this screen. Table 8-4 Wireless: WPA-PSK LABEL DESCRIPTION Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same. The only difference between the two is that WPA-PSK uses a simple common password, instead of user-specific credentials. Type a pre-shared key from 8 to 63 case-sensitive ASCII characters (including spaces and symbols).
PAGE 110
Prestige 334W User’s Guide Table 8-4 Wireless: WPA-PSK LABEL ReAuthentication Timer (in seconds) DESCRIPTION Specify how often wireless stations have to reenter usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes). If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server has priority.
PAGE 111
Prestige 334W User’s Guide 8.7 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client. The AEGIS client is bundled free (at the time of writing) with the Prestige client adaptor(s).
PAGE 112
Prestige 334W User’s Guide Figure 8-7 WPA with RADIUS Application Example 8.8 Configuring WPA Authentication In order to configure and enable WPA Authentication; click the WIRELESS link under ADVANCED to display the Wireless screen. Select WPA from the Security list.
PAGE 113
Prestige 334W User’s Guide Figure 8-8 Wireless: WPA The following table describes the labels in this screen. Table 8-5 Wireless: WPA LABEL ReAuthentication Timer (in seconds) DESCRIPTION Specify how often wireless stations have to reenter usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes).
PAGE 114
Prestige 334W User’s Guide Table 8-5 Wireless: WPA LABEL DESCRIPTION WPA Group Key Update Timer The WPA Group Key Update Timer is the rate at which the AP (if using WPA-PSK key management) or RADIUS server (if using WPA key management) sends a new group key out to all clients. The re-keying process is the WPA equivalent of automatically changing the WEP key for an AP and all stations in a WLAN on a periodic basis. Setting of the WPA Group Key Update Timer is also supported in WPA-PSK mode.
PAGE 115
Prestige 334W User’s Guide 8.10 Dynamic WEP Key Exchange The AP maps a unique key that is generated with the RADIUS server. This key expires when the wireless connection times out, disconnects or reauthentication times out. A new WEP key is generated each time reauthentication is performed. If this feature is enabled, it is not necessary to configure a default encryption key in the Wireless screen. You may still configure and store keys here, but they will not be used while Dynamic WEP is enabled.
PAGE 116
Prestige 334W User’s Guide Figure 8-9 Wireless: 802.1x and Dynamic WEP The following table describes the labels in this screen. Table 8-6 Wireless: 802.1x and Dynamic WEP LABEL ReAuthentication Timer (in seconds) DESCRIPTION Specify how often wireless stations have to reenter usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes).
PAGE 117
Prestige 334W User’s Guide Table 8-6 Wireless: 802.1x and Dynamic WEP LABEL DESCRIPTION Dynamic WEP Key Exchange Select 64-bit WEP or 128-bit WEP to enable data encryption. Up to 32 stations can access the Prestige when you configure dynamic WEP key exchange.This field is not available when you set Security to WPA or WPA-PSK. Preamble Select a preamble type from the drop-down list menu. Choices are Long, Short or Dynamic. The default setting is Long. See the section on preamble for more information.
PAGE 118
Prestige 334W User’s Guide Figure 8-10 Wireless: 802.1x and Static WEP The following table describes the labels in this screen. Table 8-7 Wireless: 802.1x and Static WEP LABEL DESCRIPTION WEP Encryption Select 64-bit WEP or 128-bit WEP to enable data encryption. Authentication Method This field is activated when you select 64-bit WEP or 128-bit WEP in the WEP Encryption field. Select Auto, Open System or Shared Key from the drop-down list box.
PAGE 119
Prestige 334W User’s Guide Table 8-7 Wireless: 802.1x and Static WEP LABEL DESCRIPTION ASCII Select this option in order to enter ASCII characters as the WEP keys. Hex Select this option in order to enter hexadecimal characters as the WEP keys. The preceding "0x", that identifies a hexadecimal key, is entered automatically. Key 1 to Key 4 The WEP keys are used to encrypt data. Both the Prestige and the wireless stations must use the same WEP key for data transmission.
PAGE 120
Prestige 334W User’s Guide Table 8-7 Wireless: 802.1x and Static WEP LABEL DESCRIPTION Authentication Databases The authentication database contains wireless station login information. The local user database is the built-in database on the Prestige. The RADIUS is an external server. Use this drop-down list box to select which database the Prestige should use (first) to authenticate a wireless station. Before you specify the priority, make sure you have set up the corresponding database correctly first.
PAGE 121
Prestige 334W User’s Guide Table 8-7 Wireless: 802.1x and Static WEP LABEL DESCRIPTION Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to reload the previous configuration for this screen. 8.13 Configuring 802.1x In order to configure and enable 802.1x; click the WIRELESS link under ADVANCED to display the Wireless screen. Select 802.1x + No WEP from the Security list. Figure 8-11 Wireless: 802.1x The following table describes the labels in this screen.
PAGE 122
Prestige 334W User’s Guide Table 8-8 Wireless: 802.1x and No WEP LABEL ReAuthentication Timer (in seconds) DESCRIPTION Specify how often wireless stations have to reenter usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes). If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server has priority.
PAGE 123
Prestige 334W User’s Guide Table 8-8 Wireless: 802.1x and No WEP LABEL DESCRIPTION 802.11 Mode Select 802.11b Only to allow only IEEE 802.11b compliant WLAN devices to associate with the Prestige. Select 802.11g Only to allow only IEEE 802.11g compliant WLAN devices to associate with the Prestige. Select Mixed to allow either IEEE802.11b or IEEE802.11g compliant WLAN devices to associate with the Prestige. The transmission rate of your Prestige might be reduced. Max.
PAGE 124
Prestige 334W User’s Guide Figure 8-12 MAC Address Filter The following table describes the labels in this menu. Table 8-9 MAC Address Filter LABEL Active 8-26 DESCRIPTION Select Yes from the drop down list box to enable MAC address filtering.
PAGE 125
Prestige 334W User’s Guide Table 8-9 MAC Address Filter LABEL DESCRIPTION Filter Action Define the filter action for the list of MAC addresses in the MAC Address table. Select Deny Association to block access to the Prestige, MAC addresses not listed will be allowed to access the Prestige Select Allow Association to permit access to the Prestige, MAC addresses not listed will be denied access to the Prestige. Set This is the index number of the MAC address.
PAGE 126
Prestige 334W User’s Guide 8.16 Configuring Local User Database To change your Prestige’s local user database, click the WIRELESS link under ADVANCED and then the Local User Database tab. The screen appears as shown.
PAGE 127
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 8-10 Local User Database LABEL DESCRIPTION Active Select this option to activate the user profile. User Name Enter the username (up to 31 characters) for this user profile. Password Type a password (up to 31 characters) for this user profile. Note that as you type a password, the screen displays a (*) for each character you type. Apply Click Apply to save your changes back to the Prestige.
PAGE 128
Prestige 334W User’s Guide • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access-Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: • Accounting-Request Sent by the access point requesting accounting.
PAGE 129
Prestige 334W User’s Guide • The wireless station sends a “start” message to the Prestige. • The Prestige sends a “request identity” message to the wireless station for identity information. • The wireless station replies with identity information, including username and password. • The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. 8.
PAGE 130
Prestige 334W User’s Guide Table 8-11 RADIUS LABEL DESCRIPTION Server IP Address Port Number Shared Secret Enter the IP address of the external authentication server in dotted decimal notation. Enter the port number of the external authentication server. The default port number is 1812. You need not change this value unless your network administrator instructs you to do so with additional information.
PAGE 131
Prestige 334W User’s Guide Chapter 9 WAN Screens This chapter describes how to configure WAN settings. 9.1 WAN Overview See the Wizard Setup chapter for more information on the fields in the WAN screens. 9.2 TCP/IP Priority (Metric) The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks.
PAGE 132
Prestige 334W User’s Guide Figure 9-1 WAN: Route The following table describes the labels in this screen. Table 9-1 WAN: Route LABEL WAN Traffic Redirect DESCRIPTION The default WAN connection is "1' as your broadband connection via the WAN port should always be your preferred method of accessing the WAN. The default priority of the routes is WAN and then Traffic Redirect. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 9.
PAGE 133
Prestige 334W User’s Guide Figure 9-2 Ethernet Encapsulation The following table describes the labels in this screen. Table 9-2 Ethernet Encapsulation LABEL DESCRIPTION Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet. Service Type Choose from Standard, Telstra (RoadRunner Telstra authentication method), RRManager (Roadrunner Manager authentication method), RR-Toshiba (Roadrunner Toshiba authentication method) or Telia Login.
PAGE 134
Prestige 334W User’s Guide Table 9-2 Ethernet Encapsulation LABEL DESCRIPTION Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 9.4.2 PPPoE Encapsulation The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection.
PAGE 135
Prestige 334W User’s Guide Figure 9-3 PPPoE Encapsulation The following table describes the labels in this screen. Table 9-3 PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPP over Ethernet choice is for a dial-up connection using PPPoE. The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e. xDSL, cable, wireless, etc.
PAGE 136
Prestige 334W User’s Guide Table 9-3 PPPoE Encapsulation LABEL DESCRIPTION Nailed-Up Connection Select Nailed-Up Connection if you do not want the connection to time out. Idle Timeout This value specifies the time in seconds that elapses before the router automatically disconnects from the PPPoE server. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 9.4.
PAGE 137
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 9-4 PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multiprotocol, and virtual private networking over public networks, such as the Internet.
PAGE 138
Prestige 334W User’s Guide Figure 9-5 WAN: IP The following table describes the labels in this screen. Table 9-5 WAN: IP LABEL DESCRIPTION WAN IP Address Assignment Get automatically from ISP Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Use fixed IP address Select this option If the ISP assigned a fixed IP address. My WAN IP Address Enter your WAN IP address in this field if you selected Use Fixed IP Address.
PAGE 139
Prestige 334W User’s Guide Table 9-5 WAN: IP LABEL DESCRIPTION Remote IP Address Enter the Remote IP Address (if your ISP gave you one) in this field. Gateway/Remote IP Address Enter the gateway IP address (if your ISP gave you one) in this field if you selected Use Fixed IP Address.
PAGE 140
Prestige 334W User’s Guide Table 9-5 WAN: IP LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only. When set to Both or Out Only, the Prestige will broadcast its routing table periodically. When set to Both or In Only, the Prestige will incorporate RIP information that it receives.
PAGE 141
Prestige 334W User’s Guide Table 9-5 WAN: IP LABEL DESCRIPTION Allow between WAN and LAN Select this check box to forward NetBIOS packets from the LAN to the WAN and from the WAN to the LAN. If your firewall is enabled with the default policy set to block WAN to LAN traffic, you also need to enable the default WAN to LAN firewall rule that forwards NetBIOS traffic. Clear this check box to block all NetBIOS packets going from the LAN to the WAN and from the WAN to the LAN.
PAGE 142
Prestige 334W User’s Guide 9.7 Traffic Redirect Traffic redirect forwards WAN traffic to a backup gateway when the Prestige cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the Prestige still provides firewall protection. Figure 9-7 Traffic Redirect WAN Setup The following network topology allows you to avoid triangle route security issues (see the Appendices) when the backup gateway is connected to the LAN.
PAGE 143
Prestige 334W User’s Guide 9.8 Configuring Traffic Redirect To change your Prestige’s Traffic Redirect settings, click WAN, then the Traffic Redirect tab. The screen appears as shown. Figure 9-9 WAN: Traffic Redirect The following table describes the labels in this screen. Table 9-6 WAN: Traffic Redirect LABEL DESCRIPTION Active Select this check box to have the Prestige use traffic redirect if the normal WAN connection goes down.
PAGE 144
Prestige 334W User’s Guide Table 9-6 WAN: Traffic Redirect LABEL DESCRIPTION Check WAN IP Address Configuration of this field is optional. If you do not enter an IP address here, the Prestige will use the default gateway IP address. Configure this field to test your Prestige's WAN accessibility. Type the IP address of a reliable nearby computer (for example, your ISP's DNS server address). If you are using PPTP or PPPoE Encapsulation, type "0.0.0.
PAGE 145
NAT and Static Route Part III: SUA/NAT and Static Route This part covers Network Address Translation and setting up static routes.
PAGE 146
PAGE 147
Prestige 334W User’s Guide Chapter 10 Network Address Translation (NAT) Screens This chapter discusses how to configure NAT on the Prestige. 10.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network. 10.1.
PAGE 148
Prestige 334W User’s Guide NAT never changes the IP address (either local or global) of an outside host. 10.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side.
PAGE 149
Prestige 334W User’s Guide Figure 10-1 How NAT Works 10.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the Prestige can communicate with three distinct WAN networks. More examples follow at the end of this chapter.
PAGE 150
Prestige 334W User’s Guide Figure 10-2 NAT Application With IP Alias 10.1.5 NAT Mapping Types NAT supports five types of IP/port mapping. They are: One to One: In One-to-One mode, the Prestige maps one local IP address to one global IP address. Many to One: In Many-to-One mode, the Prestige maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL’s Single User Account feature (the SUA Only option).
PAGE 151
Prestige 334W User’s Guide Many One-to-One: In Many-One-to-One mode, the Prestige maps each local IP address to a unique global IP address. Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world. Port numbers do not change for One-to-One and Many One-to-One NAT mapping types. The following table summarizes these types.
PAGE 152
Prestige 334W User’s Guide 10.2 Using NAT You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the Prestige. 10.2.1 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
PAGE 153
Prestige 334W User’s Guide 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers. In addition to the servers for specified services, NAT supports a default server. A service request that does not have a server explicitly designated for it is forwarded to the default server. If the default is not defined, the service request is simply discarded.
PAGE 154
Prestige 334W User’s Guide IP address assigned by ISP. Figure 10-3 Multiple Servers Behind NAT Example 10.4 Configuring SUA Server If you do not assign a Default Server IP Address, the Prestige discards all packets received for ports that are not specified in this screen or remote management. Click SUA/NAT to open the SUA Server screen. Refer to Table 10-3 for port numbers commonly used for particular services.
PAGE 155
Prestige 334W User’s Guide Figure 10-4 SUA/NAT Setup The following table describes the labels in this screen. Table 10-4 SUA/NAT Setup LABEL Default Server NAT Screens DESCRIPTION In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. If you do not assign a Default Server IP Address, the Prestige discards all packets received for ports that are not specified in this screen or remote management.
PAGE 156
Prestige 334W User’s Guide Table 10-4 SUA/NAT Setup LABEL DESCRIPTION # Number of an individual SUA server entry. Active Select this check box to enable the SUA server entry. Clear this checkbox to disallow forwarding of these ports to an inside server without having to delete the entry. Name Enter a name to identify this port-forwarding rule. Start Port Enter a port number here. To forward only one port, enter it again in the End Port field.
PAGE 157
Prestige 334W User’s Guide Figure 10-5 Address Mapping The following table describes the labels in this screen. Table 10-5 Address Mapping LABEL DESCRIPTION Local Start IP This refers to the Inside Local Address (ILA), which is the starting local IP address. If the rule is for all local IP addresses, then this field displays 0.0.0.0 as the Local Start IP address. Local IP addresses are N/A for Server port mapping. Local End IP This is the end Inside Local Address (ILA).
PAGE 158
Prestige 334W User’s Guide Table 10-5 Address Mapping LABEL DESCRIPTION Type 1. One-to-One mode maps one local IP address to one global IP address. Note that port numbers do not change for the One-to-one NAT mapping type. 2. Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported only. 3.
PAGE 159
Prestige 334W User’s Guide Table 10-6 Address Mapping Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-one mode maps one local IP address to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type. 2. Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature. 3.
PAGE 160
Prestige 334W User’s Guide receives a response with a specific port number and protocol ("incoming" port), the Prestige forwards the traffic to the LAN IP address of the computer that sent the request. After that computer’s connection for that service closes, another computer on the LAN can use the service in the same manner. This way you do not need to configure a new IP address each time you want a different LAN computer to use the application. 10.6.
PAGE 161
Prestige 334W User’s Guide Only one LAN computer can use a trigger port (range) at a time. Figure 10-8 Trigger Port The following table describes the labels in this screen. Table 10-7 Trigger Port LABEL # NAT Screens DESCRIPTION This is the rule index number (read-only).
PAGE 162
Prestige 334W User’s Guide Table 10-7 Trigger Port LABEL DESCRIPTION Name Type a unique name (up to 15 characters) for identification purposes. All characters are permitted - including spaces. Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The Prestige forwards the traffic with this port (or range of ports) to the client computer on the LAN that requested the service.
PAGE 163
Prestige 334W User’s Guide Chapter 11 Static Route Screens This chapter shows you how to configure static routes for your Prestige. 11.1 Static Route Overview Each remote node specifies only the network to which the gateway is directly connected, and the Prestige has no knowledge of the networks beyond. For instance, the Prestige knows about network N2 in the following figure through remote node router R1.
PAGE 164
Prestige 334W User’s Guide Figure 11-2 Static Route The following table describes the labels in this screen. Table 11-1 Static Route LABEL DESCRIPTION # Number of an individual static route. Name Name that describes or identifies this route. Active This field shows whether this static route is active (Yes) or not (No). Destination This parameter specifies the IP network address of the final destination. Routing is always based on network number. Gateway This is the IP address of the gateway.
PAGE 165
Prestige 334W User’s Guide Figure 11-3 Static Route: Edit The following table describes the labels in this screen. Table 11-2 Static Route: Edit LABEL DESCRIPTION Route Name Enter the name of the IP static route. Leave this field blank to delete this static route. Active This field allows you to activate/deactivate this static route. Destination IP Address This parameter specifies the IP network address of the final destination. Routing is always based on network number.
PAGE 166
Prestige 334W User’s Guide Table 11-2 Static Route: Edit LABEL DESCRIPTION Private This parameter determines if the Prestige will include this route to a remote node in its RIP broadcasts. Select this check box to keep this route private and not included in RIP broadcasts. Clear this checkbox to propagate this route to other hosts through RIP broadcasts. Apply Click Apply to save your changes back to the Prestige. Cancel Click Cancel to return to the previous screen and not save your changes.
PAGE 167
UPnP and Firewall Part IV: UPnP and Firewall This part provides information and configuration instructions for configuration of Universal Plug and Play, firewall and content filtering.
PAGE 168
PAGE 169
Prestige 334W User’s Guide Chapter 12 UPnP This chapter introduces the Universal Plug and Play feature. 12.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network.
PAGE 170
Prestige 334W User’s Guide 12.1.3 Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 12.
PAGE 171
Prestige 334W User’s Guide Figure 12-1 Configuring UPnP The following table describes the labels in this screen. Table 12-1 Configuring UPnP LABEL DESCRIPTION Enable the Universal Plug and Play (UPnP) feature Select this checkbox to activate UPnP. Be aware that anyone could use a UPnP application to open the web configurator's login screen without entering the Prestige's IP address (although you must still enter the password to access the web configurator).
PAGE 172
Prestige 334W User’s Guide 12.4 Installing UPnP in Windows Example This section shows how to install UPnP in Windows Me and Windows XP. 12.4.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. Step 1. Click Start and Control Panel. Double-click Add/Remove Programs. Step 2. Click on the Windows Setup tab and select Communication in the Components selection box. Click Details. Step 3.
PAGE 173
Prestige 334W User’s Guide Step 1. Click Start and Control Panel. Step 2. Double-click Network Connections. Step 3. In the Network Connections window, click Advanced in the main menu and select Optional Networking Components …. The Windows Optional Networking Components Wizard window displays. Step 4. Select Networking Service in the Components selection box and click Details. Step 5. In the Networking Services window, select the Universal Plug and Play check box. Step 6.
PAGE 174
Prestige 334W User’s Guide 12.5 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the ZyXEL device. Make sure the computer is connected to a LAN port of the ZyXEL device. Turn on your computer and the ZyXEL device. 12.5.1 Auto-discover Your UPnP-enabled Network Device Step 1. Click Start and Control Panel. Double-click Network Connections. An icon displays under Internet Gateway.
PAGE 175
Prestige 334W User’s Guide Step 3. UPnP In the Internet Connection Properties window, click Settings to see the port mappings that were automatically created. Step 4. You may edit or delete the port mappings or click Add to manually add port mappings.
PAGE 176
Prestige 334W User’s Guide When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. Step 5. Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray Step 6. Double-click the icon to display your current Internet connection status. 12.5.
PAGE 177
Prestige 334W User’s Guide Step 1. Click Start and then Control Panel. Step 2. Double-click Network Connections. Step 3. Select My Network Places under Other Places. Step 4. An icon with the description for each UPnP-enabled device displays under Local Network. Step 5. Right-click the icon for your ZyXEL device and select Invoke. The web configurator login screen displays.
PAGE 178
Prestige 334W User’s Guide Step 6. 12-10 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device.
PAGE 179
Prestige 334W User’s Guide Chapter 13 Firewall This chapter gives some background information on firewalls and explains how to get started with the Prestige firewall. 13.1 Introduction What is a Firewall? Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term "firewall" is a system or group of systems that enforces an access-control policy between two networks.
PAGE 180
Prestige 334W User’s Guide Prestige can be used to prevent theft, destruction and modification of data, as well as log events, which may be important to the security of your network. The Prestige is installed between the LAN and a broadband modem connecting to the Internet. This allows it to act as a secure gateway for all data passing between the Internet and the LAN. The Prestige has one Ethernet WAN port and four Ethernet LAN ports, which are used to physically separate the network into two areas.
PAGE 181
Prestige 334W User’s Guide 13.2 Firewall Settings Screen From the MAIN MENU, click FIREWALL to open the Settings screen. Figure 13-1 Firewall: Settings The following table describes the labels in this screen. Table 13-1 Firewall: Settings LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The Prestige performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
PAGE 182
Prestige 334W User’s Guide Table 13-1 Firewall: Settings LABEL LAN to WAN Packets to Log DESCRIPTION To log packets related to firewall rules, make sure that Access Control under Log is selected in the Logs, Log Settings screen. Choose what LAN to WAN packets to log.
PAGE 183
Prestige 334W User’s Guide 13.3 The Firewall, NAT and Remote Management Figure 13-2 Firewall Rule Directions 13.3.1 LAN-to-WAN rules LAN-to-WAN rules are local network to Internet firewall rules. The default is to forward all traffic from your local network to the Internet. How can you block certain LAN to WAN traffic? You may choose to block certain LAN-to-WAN traffic in the Services screen (click the Services tab).
PAGE 184
Prestige 334W User’s Guide How can you forward certain WAN to LAN traffic? You may allow traffic originating from the WAN to be forwarded to the LAN by: Configuring NAT port forwarding rules in the web configurator SUA Server screen or SMT NAT menus. Configuring One-to-One and Many-One-to-One NAT mapping rules in the web configurator Address Mapping screen or SMT NAT menus. Configuring WAN or LAN & WAN access for services in the Remote Management screens or SMT menus.
PAGE 185
Prestige 334W User’s Guide Figure 13-3 Firewall: Filter The following table describes the labels in this screen. Table 13-2 Firewall: Filter LABEL DESCRIPTION Restricted Web Features ActiveX Firewall ActiveX is a tool for building dynamic and active Web pages and distributed object applications. When you visit an ActiveX Web site, ActiveX controls are downloaded to your browser, where they remain in case you visit the site again.
PAGE 186
Prestige 334W User’s Guide Table 13-2 Firewall: Filter LABEL DESCRIPTION Java Cookies Web Proxy Enable URL Keyword Blocking Java is a programming language and development environment for building downloadable Web components or Internet and intranet business applications of all kinds. Web servers that track usage and provide service based on ID use cookies. This is a server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service.
PAGE 187
Prestige 334W User’s Guide Figure 13-4 Firewall: Service The following table describes the labels in this screen. Table 13-3 Firewall: Service LABEL Enable Services Blocking Available Service Firewall DESCRIPTION Select this check box to enable this feature. This is a list of pre-defined services (ports) you may prohibit your LAN computers from using. Select the port you want to block using the drop-down list and click Add to add the port to the Blocked Service field.
PAGE 188
Prestige 334W User’s Guide Table 13-3 Firewall: Service LABEL DESCRIPTION Blocked Service This is a list of services (ports) that will be inaccessible to computers on your LAN once you enable service blocking. Choose the IP port (TCP, UDP or TCP/UDP) that defines your customized port from the drop down list box. A custom port is a service that is not available in the pre-defined Available Services list and you must define using the next two fields.
PAGE 189
Remote Management and VPN/IPSec Part V: Remote Management and VPN/IPSec This part provides information and configuration instructions for configuration of remote management and VPN/IPSec.
PAGE 190
PAGE 191
Prestige 334W User’s Guide Chapter 14 Remote Management Screens This chapter provides information on the Remote Management screens. 14.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which Prestige interface (if any) from which computers. When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access. See the firewall chapters for details on configuring firewall rules.
PAGE 192
Prestige 334W User’s Guide 14.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: 1. A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 2. You have disabled that service in one of the remote management screens. 3. The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the Prestige will disconnect the session immediately. 4.
PAGE 193
Prestige 334W User’s Guide Figure 14-1 Remote Management: WWW The following table describes the labels in this screen. Table 14-1 Remote Management: WWW LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the Prestige using this service.
PAGE 194
Prestige 334W User’s Guide 14.3 Configuring Telnet You can configure your Prestige for remote Telnet access as shown next. The administrator uses Telnet from a computer on a remote network to access the Prestige. Figure 14-2 Telnet Configuration on a TCP/IP Network 14.4 Configuring TELNET Click REMOTE MGMT and the TELNET tab to display the screen as shown.
PAGE 195
Prestige 334W User’s Guide Figure 14-3 Remote Management: Telnet The following table describes the labels in this screen. Table 14-2 Remote Management: Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the Prestige using this service.
PAGE 196
Prestige 334W User’s Guide 14.5 Configuring FTP You can upload and download the Prestige’s firmware and configuration files using FTP, please see the chapter on firmware and configuration file maintenance for details. To use this feature, your computer must have an FTP client. To change your Prestige’s FTP settings, click REMOTE MGMT, then the FTP tab. The screen appears as shown. Figure 14-4 Remote Management: FTP The following table describes the labels in this screen.
PAGE 197
Prestige 334W User’s Guide Table 14-3 Remote Management: FTP LABEL Secured Client IP Address DESCRIPTION A secured client is a “trusted” computer that is allowed to communicate with the Prestige using this service. Select All to allow any computer to access the Prestige using this service. Choose Selected to just allow the computer with the IP address that you specify to access the Prestige using this service. Apply Click Apply to save your customized settings and exit this screen.
PAGE 198
Prestige 334W User’s Guide SNMP is only available if TCP/IP is configured. Figure 14-5 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the Prestige). An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions.
PAGE 199
Prestige 334W User’s Guide SNMP itself is a simple request/response protocol based on the manager/agent model. The manager issues a request and the agent returns responses using the following protocol operations: • Get - Allows the manager to retrieve an object variable from the agent. • GetNext - Allows the manager to retrieve the next object variable from a table or list within an agent.
PAGE 200
Prestige 334W User’s Guide 14.6.3 Configuring SNMP To change your Prestige’s SNMP settings, click REMOTE MGMT, then the SNMP tab. The screen appears as shown. Figure 14-6 Remote Management: SNMP The following table describes the labels in this screen.
PAGE 201
Prestige 334W User’s Guide Table 14-5 Remote Management: SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests. Set Community Enter the Set community, which is the password for incoming Set requests from the management station. The default is public and allows all requests.
PAGE 202
Prestige 334W User’s Guide To change your Prestige’s DNS settings, click REMOTE MGMT, then the DNS tab. The screen appears as shown. Figure 14-7 Remote Management: DNS The following table describes the labels in this screen. Table 14-6 Remote Management: DNS LABEL DESCRIPTION Server Port The DNS service port number is 53 and cannot be changed here. Server Access Select the interface(s) through which a computer may send DNS queries to the Prestige.
PAGE 203
Prestige 334W User’s Guide 14.8 Configuring Security To change your Prestige’s security settings, click REMOTE MGMT, then the Security tab. The screen appears as shown. If an outside user attempts to probe an unsupported port on your Prestige, an ICMP response packet is automatically returned. This allows the outside user to know the Prestige exists. Your Prestige supports antiprobing, which prevents the ICMP response packet from being sent.
PAGE 204
Prestige 334W User’s Guide Table 14-7 Security LABEL DESCRIPTION Respond to Ping on The Prestige will not respond to any incoming Ping requests when Disable is selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply to incoming WAN Ping requests. Otherwise select LAN & WAN to reply to both incoming LAN and WAN Ping requests. Do not respond to requests for unauthorized services Select this option to prevent hackers from finding the Prestige by probing for unused ports.
PAGE 205
Prestige 334W User’s Guide Chapter 15 Introduction to IPSec This chapter introduces the basics of IPSec VPNs 15.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication. 15.1.
PAGE 206
Prestige 334W User’s Guide Figure 15-1 Encryption and Decryption Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission. Data Origin Authentication The IPSec receiver can verify the source of IPSec packets. This service depends on the data integrity service. 15.1.
PAGE 207
Prestige 334W User’s Guide 15.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 15-2 IPSec Architecture 15.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).
PAGE 208
Prestige 334W User’s Guide 15.2.2 Key Management Key management allows you to determine whether to use IKE (ISAKMP) or manual key configuration in order to set up a VPN. 15.3 Encapsulation The two modes of operation for IPSec VPNs are Transport mode and Tunnel mode. Figure 15-3 Transport and Tunnel Mode IPSec Encapsulation 15.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet.
PAGE 209
Prestige 334W User’s Guide Inside header: The inside IP header contains the destination IP address of the final system behind the VPN gateway. The security protocol appears after the outer IP header and before the inside IP header. 15.4 IPSec and NAT Read this section if you are running IPSec on a host computer behind the Prestige. NAT is incompatible with the AH protocol in both Transport and Tunnel mode.
PAGE 210
PAGE 211
Prestige 334W User’s Guide Chapter 16 VPN Screens This chapter introduces the VPN Web Configurator. See the Logs chapter for information on viewing logs and the Appendices for IPSec log descriptions. 16.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections. 16.2 IPSec Algorithms The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN.
PAGE 212
Prestige 334W User’s Guide 16.2.2 ESP (Encapsulating Security Payload) Protocol The ESP protocol (RFC 2406) provides encryption as well as some of the services offered by AH. ESP authenticating properties are limited compared to the AH due to the non-inclusion of the IP header information during the authentication process. However, ESP is sufficient if only the upper layer protocols need to be authenticated.
PAGE 213
Prestige 334W User’s Guide If the remote secure gateway has a static WAN IP address, enter it in the Secure Gateway Address field. You may alternatively enter the remote secure gateway’s domain name (if it has one) in the Secure Gateway Address field. You can also enter a remote secure gateway’s domain name in the Secure Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS.
PAGE 214
Prestige 334W User’s Guide Local and remote IP addresses must be static. Click VPN to open the Summary screen. This is a read-only menu of your IPSec rules (tunnels). Edit or create an IPSec rule by selecting an index number and then clicking Edit to configure the associated submenus. Figure 16-2 VPN: Summary The following table describes the labels in this screen. Table 16-2 VPN: Summary LABEL DESCRIPTION # The VPN policy index number.
PAGE 215
Prestige 334W User’s Guide Table 16-2 VPN: Summary LABEL Remote Addr. DESCRIPTION This is the IP address(es) of computer(s) on the remote network behind the remote IPSec router. A single (static) IP address is displayed when the Remote Address Start and Remote Address End/Mask fields in the Rule Setup IKE (or Manual) screen are both configured to the same IP address.
PAGE 216
Prestige 334W User’s Guide If the Prestige has its maximum number of simultaneous IPSec tunnels connected to it and they all have keep alive enabled, then no other tunnels can take a turn connecting to the Prestige because the Prestige never drops the tunnels that are already connected. When there is outbound traffic with no inbound traffic, the Prestige automatically drops the tunnel after two minutes. 16.
PAGE 217
Prestige 334W User’s Guide Use ESP security protocol (in either transport or tunnel mode). Use IKE keying mode. Enable NAT traversal on both IPSec endpoints. In order for IPSec router A (see the figure) to receive an initiating IPSec packet from IPSec router B, set the NAT router to forward UDP port 500 to IPSec router A. 16.7.2 Remote DNS Server In cases where you want to use domain names to access Intranet servers on a remote network that has a DNS server, you must identify that DNS server.
PAGE 218
Prestige 334W User’s Guide If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote network. 16.8 ID Type and Content With aggressive negotiation mode (see Section 16.11.1), the Prestige identifies incoming SAs by ID type and content since this identifying information is not encrypted.
PAGE 219
Prestige 334W User’s Guide Table 16-4 Peer ID Type and Content Fields PEER ID TYPE CONTENT IP Type the IP address of the computer with which you will make the VPN connection or leave the field blank to have the Prestige automatically use the address in the Secure Gateway Address field. DNS Type a domain name (up to 31 characters) by which to identify the remote IPSec router. E-mail Type an e-mail address (up to 31 characters) by which to identify the remote IPSec router.
PAGE 220
Prestige 334W User’s Guide Table 16-6 Mismatching ID Type and Content Configuration Example PRESTIGE A Peer ID content: aa@yahoo.com PRESTIGE B Peer ID content: N/A 16.9 Pre-Shared Key A pre-shared key identifies a communicating party during a phase 1 IKE negotiation (see Section 16.11 for more on IKE phases). It is called “pre-shared” because you have to share it with another party before you can communicate with them over a secure connection. 16.
PAGE 221
Prestige 334W User’s Guide Figure 16-5 VPN: Rule Setup (Basic) The following table describes the labels in this screen.
PAGE 222
Prestige 334W User’s Guide Table 16-7 VPN: Rule Setup (Basic) LABEL DESCRIPTION Active Select this check box to activate this VPN tunnel. This option determines whether a VPN rule is applied before a packet leaves the firewall. Keep Alive Select this check box to have the Prestige automatically re-initiate the SA after the SA lifetime times out, even if there is no traffic. The remote IPSec router must also have keep alive enabled in order for this feature to work.
PAGE 223
Prestige 334W User’s Guide Table 16-7 VPN: Rule Setup (Basic) LABEL DESCRIPTION DNS Server (for IPSec VPN) If there is a private DNS server that services the VPN, type its IP address here. The Prestige assigns this additional DNS server to the Prestige’s DHCP clients that have IP addresses in this IPSec rule's range of local addresses. A DNS server allows clients on the VPN to find other computers and servers on the VPN by their (private) domain names.
PAGE 224
Prestige 334W User’s Guide Table 16-7 VPN: Rule Setup (Basic) LABEL Peer Content DESCRIPTION The configuration of the peer content depends on the peer ID type. For IP, type the IP address of the computer with which you will make the VPN connection. If you configure this field to 0.0.0.0 or leave it blank, the Prestige will use the address in the Secure Gateway Address field (refer to the Secure Gateway Address field description).
PAGE 225
Prestige 334W User’s Guide Table 16-7 VPN: Rule Setup (Basic) LABEL Pre-Shared Key DESCRIPTION Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters.
PAGE 226
Prestige 334W User’s Guide Figure 16-6 Two Phases to Set Up the IPSec SA In phase 1 you must: Choose a negotiation mode. Authenticate the connection by entering a pre-shared key. Choose an encryption algorithm. Choose an authentication algorithm. Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires.
PAGE 227
Prestige 334W User’s Guide Choose Tunnel mode or Transport mode. Set the IPSec SA lifetime. This field allows you to determine how long the IPSec SA should stay up before it times out. The Prestige automatically renegotiates the IPSec SA if there is traffic when the IPSec SA lifetime period expires. The Prestige also automatically renegotiates the IPSec SA if both IPSec routers have keep alive enabled, even if there is no traffic.
PAGE 228
Prestige 334W User’s Guide 16.11.3 Perfect Forward Secrecy (PFS) Enabling PFS means that the key is transient. The key is thrown away and replaced by a brand new key using a new Diffie-Hellman exchange for each new IPSec SA setup. With PFS enabled, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys. The (time-consuming) Diffie-Hellman exchange is the trade-off for this extra security.
PAGE 229
Prestige 334W User’s Guide Figure 16-7 VPN IKE: Advanced VPN Screens 16-19
PAGE 230
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 16-8 VPN IKE: Advanced LABEL Active DESCRIPTION Select this check box to activate this VPN policy. Select this check box to turn on the Keep Alive feature for this SA. Keep Alive Turn on Keep Alive to have the Prestige automatically reinitiate the SA after the SA lifetime times out, even if there is no traffic. The remote IPSec router must also have keep alive enabled in order for this feature to work.
PAGE 231
Prestige 334W User’s Guide Table 16-8 VPN IKE: Advanced LABEL Local Port End DESCRIPTION Enter a port number in this field to define a port range. This port number must be greater than that specified in the previous field (or equal to it for configuring an individual port). Remote IP addresses must be static and correspond to the remote IPSec router's configured local IP addresses. The remote address fields do not apply when the Secure Gateway Address field is configured to 0.0.0.0.
PAGE 232
Prestige 334W User’s Guide Table 16-8 VPN IKE: Advanced LABEL DESCRIPTION When you select IP in the Local ID Type field, type the IP address of your computer in the local Content field. The Prestige automatically uses the IP address in the My IP Address field (refer to the My IP Address field description) if you configure the local Content field to 0.0.0.0 or leave it blank. It is recommended that you type an IP address other than 0.0.0.
PAGE 233
Prestige 334W User’s Guide Table 16-8 VPN IKE: Advanced LABEL DESCRIPTION The configuration of the peer content depends on the peer ID type. For IP, type the IP address of the computer with which you will make the VPN connection. If you configure this field to 0.0.0.0 or leave it blank, the Prestige will use the address in the Secure Gateway Address field (refer to the Secure Gateway Address field description).
PAGE 234
Prestige 334W User’s Guide Table 16-8 VPN IKE: Advanced LABEL DESCRIPTION SA Life Time Define the length of time before an IKE SA automatically renegotiates in this field. It may range from 60 to 3,000,000 seconds (almost 35 days). A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected.
PAGE 235
Prestige 334W User’s Guide Table 16-8 VPN IKE: Advanced LABEL DESCRIPTION Authentication Algorithm Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security. SA Life Time Define the length of time before an IKE SA automatically renegotiates in this field.
PAGE 236
Prestige 334W User’s Guide Current ZyXEL implementation assumes identical outgoing and incoming SPIs. 16.14 Configuring Manual Key You only configure VPN Manual Key when you select Manual in the IPSec Keying Mode field on the Rule Setup IKE screen. This is the Rule Setup Manual screen as shown next.
PAGE 237
Prestige 334W User’s Guide Figure 16-8 Rule Setup: Manual The following table describes the labels in this screen.
PAGE 238
Prestige 334W User’s Guide Table 16-9 Rule Setup: Manual LABEL DESCRIPTION Active Select this check box to activate this VPN policy. IPSec Keying Mode Select IKE or Manual from the drop-down list box. Manual is a useful option for troubleshooting if you have problems using IKE key management. Protocol Number Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any protocol.
PAGE 239
Prestige 334W User’s Guide Table 16-9 Rule Setup: Manual LABEL Remote Port End DNS Server (for IPSec VPN) DESCRIPTION Enter a port number in this field to define a port range. This port number must be greater than that specified in the previous field. If Remote Port Start is left at 0, Remote Port End will also remain at 0. If there is a private DNS server that services the VPN, type its IP address here.
PAGE 240
Prestige 334W User’s Guide Table 16-9 Rule Setup: Manual LABEL DESCRIPTION Authentication Algorithm Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security. Encryption Key (Only with ESP) With DES, type a unique key 8 characters long.
PAGE 241
Prestige 334W User’s Guide When there is outbound traffic but no inbound traffic, the SA times out automatically after two minutes. A tunnel with no outbound or inbound traffic is "idle" and does not timeout until the SA lifetime period expires. See section 16.6 on keep alive to have the Prestige renegotiate an IPSec SA when the SA lifetime expires, even if there is no traffic. Figure 16-9 SA Monitor The following table describes the labels in this screen.
PAGE 242
Prestige 334W User’s Guide Table 16-10 SA Monitor LABEL DESCRIPTION Previous Page (If applicable) Click Previous Page to view more items in the summary. Refresh Click Refresh to display the current active VPN connection(s). Next Page (If applicable) Click Next Page to view more items in the summary. 16.16 Configuring Global Setting To change your Prestige’s Global Settings, click VPN, then the Global Setting tab. The screen appears as shown.
PAGE 243
Prestige 334W User’s Guide Table 16-11 VPN: Global Setting LABEL DESCRIPTION Allow Through IP/Sec Tunnel Select this check box to send NetBIOS packets through the VPN connection. Apply Click Apply to save your changes back to the Prestige. Reset Click Reset to begin configuring this screen afresh. 16.
PAGE 244
Prestige 334W User’s Guide Figure 16-11 Telecommuters Sharing One VPN Rule Example 16.17.2 Telecommuters Using Unique VPN Rules Example With aggressive negotiation mode (see section 16.11.1), the Prestige can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a Prestige at headquarters. They can use different IPSec parameters (including the pre-shared key) and the local IP addresses (or ranges of addresses) can overlap.
PAGE 245
Prestige 334W User’s Guide Figure 16-12 Telecommuters Using Unique VPN Rules Example VPN Screens 16-35
PAGE 246
Prestige 334W User’s Guide 16.18 VPN and Remote Management If a VPN tunnel uses a remote management service port (Telnet, FTP, WWW SNMP, DNS or ICMP) and terminates at the Prestige’s LAN or WAN port, configure remote management (REMOTE MGNT) to allow access for that service. If the VPN tunnel terminates at the Prestige’s LAN IP address, configure remote management for LAN, WAN server access or LAN & WAN.
PAGE 247
Logs, Media Bandwidth Management and Maintenance Part VI: Logs, Media Bandwidth Management and Maintenance This part covers the centralized logs, media bandwidth management and maintenance screens.
PAGE 248
PAGE 249
Prestige 334W User’s Guide Chapter 17 Centralized Logs This chapter contains information about configuring general log settings and viewing the Prestige’s logs. Refer to the appendices for example log message explanations. 17.1 View Log The web configurator allows you to look at all of the Prestige’s logs in one location. Click the LOGS in the navigation panel to open the View Log screen.
PAGE 250
Prestige 334W User’s Guide Table 17-1 View Logs LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see section 17.2) display in the drop-down list box. Select a category of logs to view; select All Logs to view logs from all of the log categories that you selected in the Log Settings page. Time This field displays the time the log was recorded. See the chapter on system maintenance and information to configure the Prestige’s time and date.
PAGE 251
Prestige 334W User’s Guide Figure 17-2 Log Settings Centralized Logs 17-3
PAGE 252
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 17-2 log Settings LABEL DESCRIPTION Address Info Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via email. Mail Subject Type a title that you want to be in the subject line of the log e-mail message that the Prestige sends. Not all Prestige models have this field.
PAGE 253
Prestige 334W User’s Guide Table 17-2 log Settings LABEL Log Schedule DESCRIPTION This drop-down menu is used to configure the frequency of log messages being sent as E-mail: • Daily • Weekly • Hourly • When Log is Full • None. If you select Weekly or Daily, specify a time of day when the E-mail should be sent. If you select Weekly, then also specify which day of the week the E-mail should be sent. If you select When Log is Full, an alert is sent when the log fills up.
PAGE 254
PAGE 255
Prestige 334W User’s Guide Chapter 18 Media Bandwidth Management This chapter contains information about configuring media bandwidth management, editing rules and viewing the Prestige’s media bandwidth management logs. 18.1 Bandwidth Management Overview ZyXEL’s Media Bandwidth Management allows you to specify bandwidth management rules based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth rules.
PAGE 256
Prestige 334W User’s Guide Figure 18-1 Application-based Bandwidth Management Example 18.1.2 Subnet-based Bandwidth Management Example The following example uses bandwidth rules based solely on LAN subnets. Each bandwidth rule (Subnet A and Subnet B) is allotted 320 Kbps. Figure 18-2 Subnet-based Bandwidth Management Example 18.1.
PAGE 257
Prestige 334W User’s Guide Figure 18-3 Application and Subnet-based Bandwidth Management Example 18.1.4 Bandwidth Usage Example Here is an example of a Prestige that has bandwidth usage enabled on an interface. The first figure shows each bandwidth rule’s bandwidth budget. The rules are set up based on subnets. The interface is set to 320 Kbps. Each subnet is allocated 64 Kbps. The unbudgeted 64 Kbps allows traffic not defined to go out when you do not select the Use All Managed Bandwidth option.
PAGE 258
Prestige 334W User’s Guide The following figure shows the bandwidth usage with the maximize bandwidth usage option enabled. The Prestige divides up the unbudgeted 64 Kbps among the rules that require more bandwidth. If the administration department only uses 32 Kbps of the budgeted 64 Kbps, the Prestige also divides the remaining 32 Kbps among the rules that require more bandwidth.
PAGE 259
Prestige 334W User’s Guide Table 18-2 Media Bandwidth Management Priorities Priority Levels: Traffic with a higher priority gets through faster while traffic with a lower priority is dropped if the network is congested. High Typically used for voice traffic or video that is especially sensitive to jitter (jitter is the variations in delay). Mid Typically used for “excellent effort” or better than best effort and would include important business traffic that can tolerate some delay.
PAGE 260
Prestige 334W User’s Guide eMule/eDonkey These programs use advanced file sharing applications relying on central servers to search for files. They use default port 4662. WWW The World Wide Web is an Internet system to distribute graphical, hyper-linked information, based on Hyper Text Transfer Protocol (HTTP) - a client/server protocol for the World Wide Web. The Web is not synonymous with the Internet; rather, it is just one service on the Internet.
PAGE 261
Prestige 334W User’s Guide Table 18-3 Commonly Used Services SERVICE DESCRIPTION HTTP(TCP:80) Hyper Text Transfer Protocol - a client/server protocol for the world wide web. HTTPS(TCP:443) HTTPS is a secured http session often used in e-commerce. ICQ(UDP:4000) This is a popular Internet chat program. IKE(UDP:500) The Internet Key Exchange algorithm is used for key distribution and management. IPSEC_TUNNEL(AH:0) The IPSEC AH (Authentication Header) tunneling protocol uses this service.
PAGE 262
Prestige 334W User’s Guide Table 18-3 Commonly Used Services SERVICE DESCRIPTION REXEC(TCP:514) Remote Execution Daemon. RLOGIN(TCP:513) Remote Login. RTELNET(TCP:107) Remote Telnet. RTSP(TCP/UDP:554) The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP(TCP:115) Simple File Transfer Protocol. SMTP(TCP:25) Simple Mail Transfer Protocol is the message-exchange standard for the Internet.
PAGE 263
Prestige 334W User’s Guide Figure 18-6 Bandwidth Management Configuration Media Bandwidth Management 18-9
PAGE 264
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 18-4 Bandwidth Management Configuration LABEL DESCRIPTION Active Select this check box to have the Prestige apply bandwidth management. Enable bandwidth management to give traffic that matches a bandwidth rule priority over traffic that does not match a bandwidth rule. Enabling bandwidth management also allows you to control the maximum amounts of bandwidth that can be used by traffic that matches a bandwidth rule.
PAGE 265
Prestige 334W User’s Guide 18.3 Editing Bandwidth Management Rules Use the Bandwidth Management Configuration Edit screen to configure a bandwidth management rule. Use bandwidth rules to allocate specific amounts of bandwidth capacity (bandwidth budgets) to specific applications and/or subnets. 18.3.1 Bandwidth Borrowing Enable bandwidth borrowing by selecting Use All Managed Bandwidth on a rule to allow the rule to use any unused bandwidth. Unused bandwidth is given to the highest priority rule first.
PAGE 266
Prestige 334W User’s Guide Table 18-5 Bandwidth Management Edit LABEL DESCRIPTION Active Select this check box to have the Prestige apply this bandwidth management rule. Enable a bandwidth management rule to give traffic that matches the rule priority over traffic that does not match the rule. Rule Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces. BW Budget Specify the maximum bandwidth allowed for the rule in kbps.
PAGE 267
Prestige 334W User’s Guide Table 18-5 Bandwidth Management Edit LABEL DESCRIPTION Protocol Enter the protocol (service type) number, for example: 1 for ICMP, 6 for TCP or 17 for UDP. Apply Click Apply to save your customized settings and exit this screen. Reset Click Reset to begin configuring this screen afresh. Delete Click Delete to remove a rule configuration. 18.5 Monitor Screen Select Monitor tab in BW MGMT to view the bandwidth usage of the LAN, WAN and WLAN configured bandwidth rules.
PAGE 268
Prestige 334W User’s Guide Figure 18-8 Bandwidth Management Monitor 18-14 Media Bandwidth Management
PAGE 269
Prestige 334W User’s Guide Chapter 19 Maintenance This chapter displays system information such as ZyNOS firmware, port IP addresses and port traffic statistics. 19.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your Prestige. 19.2 Status Screen Click MAINTENANCE to open the Status screen, which you can use to monitor your Prestige. Note that these fields are READ-ONLY and only for diagnostic purposes.
PAGE 270
Prestige 334W User’s Guide Table 19-1 Maintenance Status LABEL DESCRIPTION System Name This is the System Name you chose in the first Internet Access Wizard screen. It is for identification purposes Model Name The model name identifies your device type. The model name should also be on a sticker on your Prestige. If you are uploading firmware, be sure to upload firmware for this exact model name. This field is not available on all models.
PAGE 271
Prestige 334W User’s Guide Figure 19-2 Maintenance System Statistics The following table describes the labels in this screen. Table 19-2 Maintenance System Statistics LABEL DESCRIPTION Port This is the WAN, LAN or WLAN port. Status This displays the port speed and duplex setting if you're using Ethernet encapsulation and down (line is down), idle (line (ppp) idle), dial (starting to trigger a call) and drop (dropping a call) if you're using PPPoE encapsulation.
PAGE 272
Prestige 334W User’s Guide 19.3 DHCP Table Screen DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the Prestige as a DHCP server or disable it. When configured as a server, the Prestige provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.
PAGE 273
Prestige 334W User’s Guide Table 19-3 Maintenance DHCP Table LABEL Refresh DESCRIPTION Click Refresh to renew the screen. 19.4 Any IP Table Click MAINTENANCE, Any IP Table. The Any IP table shows current read-only information (including the IP address and the MAC address) of all network devices that use the Any IP feature to communicate with the Prestige. Figure 19-4 Maintenance Any IP The following table describes the labels in this screen.
PAGE 274
Prestige 334W User’s Guide Figure 19-5 Maintenance Association List The following table describes the labels in this screen. Table 19-5 Maintenance Association List LABEL DESCRIPTION # This is the index number of an associated wireless station. MAC Address This field displays the MAC address of an associated wireless station. Association Time This field displays the time a wireless station first associated with the Prestige. Refresh Click Refresh to redisplay the current screen. 19.
PAGE 275
Prestige 334W User’s Guide The following table describes the labels in this screen. Table 19-6 Maintenance Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them. Upload Click Upload to begin the upload process. This process may take up to two minutes.
PAGE 276
Prestige 334W User’s Guide If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen. Figure 19-9 Upload Error Message 19.7 Configuration Screen See the Firmware and Configuration File Maintenance chapter for transferring configuration files using FTP/TFTP commands. Click MAINTENANCE, and then the Configuration tab. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next.
PAGE 277
Prestige 334W User’s Guide Figure 19-10 Maintenance Configuration 19.7.1 Backup Configuration Backup configuration allows you to back up (save) the Prestige’s current configuration to a file on your computer. Once your Prestige is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes. The backup configuration file will be useful in case you need to return to your previous settings.
PAGE 278
Prestige 334W User’s Guide Table 19-7 Maintenance Restore Configuration LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click Browse... to find the file you want to upload. Remember that you must decompress compressed (.ZIP) files before you can upload them. Upload Click Upload to begin the upload process. Do not turn off the Prestige while configuration file upload is in progress.
PAGE 279
Prestige 334W User’s Guide Figure 19-13 Configuration Restore Error 19.7.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the Prestige to its factory defaults as shown on the screen. The following warning screen will appear. Figure 19-14 Factory Defaults You can also press the RESET button on the rear panel to reset the factory defaults of your Prestige.
PAGE 280
Prestige 334W User’s Guide Figure 19-15 System Restart 19-12 Maintenance
PAGE 281
SMT General Configuration Part VII: SMT General Configuration This part covers System Management Terminal configuration for general setup, WAN setup, LAN setup, WLAN setup, Internet access, remote node, static route, NAT and enabling the firewall. See the web configurator parts of this guide for background information on features configurable by web configurator and SMT.
PAGE 282
PAGE 283
Prestige 334W User’s Guide Chapter 20 Introducing the SMT This chapter explains how to access and navigate the System Management Terminal and gives an overview of its menus. 20.1 SMT Introduction The Prestige’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
PAGE 284
Prestige 334W User’s Guide Please note that if there is no activity for longer than five minutes after you log in, your Prestige will automatically log you out. Enter Password : **** Figure 20-1 Login Screen 20.1.4 Prestige SMT Menu Overview The following figure gives you an overview of the various SMT menu screens of your Prestige.
PAGE 285
Prestige 334W User’s Guide Figure 20-2 SMT Menu Overview 20.2 Navigating the SMT Interface The SMT (System Management Terminal) is the interface that you use to configure your Prestige. Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below.
PAGE 286
Prestige 334W User’s Guide Table 20-1 Main Menu Commands OPERATION KEYSTROKE DESCRIPTION Move down to another menu [ENTER] To move forward to a submenu, type in the number of the desired submenu and press [ENTER]. Move up to a previous menu [ESC] Press [ESC] to move back to the previous menu. Move to a “hidden” Press [SPACE Fields beginning with “Edit” lead to hidden menus and have a BAR] to change No default setting of No.
PAGE 287
Prestige 334W User’s Guide Copyright (c) 1994 - 2004 ZyXEL Communications Corp. Prestige 334W Main Menu Getting Started 1. General Setup 2. WAN Setup 3. LAN Setup 4. Internet Access Setup Advanced Applications 11. Remote Node Setup 12. Static Routing Setup 14. Dial-in User Setup 15. NAT Setup Advanced Management 21. Filter and Firewall Setup 22. SNMP Configuration 23. System Password 24. System Maintenance 26. Schedule Setup 27. VPN/IPSec Setup 99.
PAGE 288
Prestige 334W User’s Guide Table 20-2 Main Menu Summary # MENU TITLE DESCRIPTION 24 System Maintenance This menu provides system status, diagnostics, software upload, etc. 26 Schedule Setup Use this menu to schedule outgoing calls. 27 VPN/ IPSec Setup Use this menu to configure VPN connections. 99 Exit Use this to exit from SMT and return to a blank screen. 20.3 Changing the System Password Change the Prestige default password by following the steps shown next. Step 1.
PAGE 289
Prestige 334W User’s Guide Chapter 21 Menu 1 General Setup Menu 1 - General Setup contains administrative and system-related information. 21.1 General Setup Menu 1 — General Setup contains administrative and system-related information (shown next). The System Name field is for identification purposes. However, because some ISPs check this name you should enter your computer's "Computer Name". • In Windows 95/98 click Start, Settings, Control Panel, Network.
PAGE 290
Prestige 334W User’s Guide Menu 1 - General Setup System Name= Domain Name= zyxel.com.tw First System DNS Server= From ISP IP Address= N/A Second System DNS Server= From ISP IP Address= N/A Third System DNS Server= From ISP IP Address= N/A Edit Dynamic DNS= No Press ENTER to Confirm or ESC to Cancel: Figure 21-1 Menu 1 General Setup Step 2. Fill in the required fields. Refer to the table shown next for more information about these fields.
PAGE 291
Prestige 334W User’s Guide Table 21-1 Menu 1 General Setup FIELD DESCRIPTION DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address Second System of a machine before you can access it. The Prestige uses a system DNS Server DNS server (in the order you specify here) to resolve domain names Third System DNS for VPN, DDNS and the time server.
PAGE 292
Prestige 334W User’s Guide Menu 1.1 - Configure Dynamic DNS Service Provider= WWW.DynDNS.ORG Active= No DDNSType= DynamicDNS Host1= Host2= Host3= USER= Password= ******** Enable Wildcard= No Offline= N/A Edit Update IP Address: Use Server Detected IP= No User Specified IP Address= No IP Address= N/A Press ENTER to Confirm or ESC to Cancel: Figure 21-2 Menu 1.1 Configure Dynamic DNS Follow the instructions in the next table to configure Dynamic DNS parameters. Table 21-2 Menu 1.
PAGE 293
Prestige 334W User’s Guide Table 21-2 Menu 1.1 Configure Dynamic DNS FIELD Offline DESCRIPTION EXAMPLE This field is only available when CustomDNS is selected in the DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes. When Yes is selected, http://www.dyndns.org/ traffic is redirected to a URL that you have previously specified (see www.dyndns.org for details).
PAGE 294
PAGE 295
Prestige 334W User’s Guide Chapter 22 Menu 2 WAN Setup This chapter describes how to configure the WAN using menu 2. 22.1 Introduction to WAN This chapter explains how to configure settings for your WAN port. 22.2 WAN Setup From the main menu, enter 2 to open menu 2. Menu 2 - WAN Setup MAC Address: Assigned By= Factory default IP Address= N/A Press ENTER to Confirm or ESC to Cancel: Figure 22-1 Menu 2 WAN Setup The following table describes the fields in this menu.
PAGE 296
Prestige 334W User’s Guide Table 22-1 Menu 2 WAN Setup FIELD DESCRIPTION When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
PAGE 297
Prestige 334W User’s Guide Chapter 23 Menu 3 LAN Setup This chapter covers how to configure your wired Local Area Network (LAN) settings. 23.1 LAN Setup This section describes how to configure the Ethernet using Menu 3 — LAN Setup. From the main menu, enter 3 to display menu 3. Menu 3 - LAN Setup 1. LAN Port Filter Setup 2. TCP/IP and DHCP Setup 5. Wireless LAN Setup Enter Menu Selection Number: Figure 23-1 Menu 3 LAN Setup 23.1.
PAGE 298
Prestige 334W User’s Guide 23.2 Protocol Dependent Ethernet Setup Depending on the protocols for your applications, you need to configure the respective Ethernet Setup, as outlined below. For TCP/IP Ethernet setup refer to the Internet Access Application chapter. For bridging Ethernet setup refer to the Bridging Setup chapter. 23.3 TCP/IP Ethernet Setup and DHCP Use menu 3.2 to configure your Prestige for TCP/IP. To edit menu 3.2, enter 3 from the main menu to display Menu 3 — LAN Setup.
PAGE 299
Prestige 334W User’s Guide Table 23-1 Menu 3.2: DHCP Ethernet Setup Fields FIELD DESCRIPTION EXAMPLE Client IP Pool: Starting Address This field specifies the first of the contiguous addresses in the IP address pool. Size of Client IP This field specifies the size, or count of the IP address pool. Pool First DNS Server Second DNS Server The Prestige passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. 192.168.1.
PAGE 300
Prestige 334W User’s Guide Table 23-2 Menu 3.2: LAN TCP/IP Setup Fields FIELD DESCRIPTION EXAMPLE TCP/IP Setup: IP Address IP Subnet Mask RIP Direction Enter the IP address of your Prestige in dotted decimal notation Your Prestige will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Prestige. Press [SPACE BAR] and then [ENTER] to select the RIP direction.
PAGE 301
Prestige 334W User’s Guide Figure 23-4 Physical Network & Partitioned Logical Networks You must use menu 3.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network. Press [ENTER] to open Menu 3.2.1 - IP Alias Setup, as shown next. Menu 3.2.1 - IP Alias Setup IP Alias 1= Yes IP Address= IP Subnet Mask= 0.0.0.
PAGE 302
Prestige 334W User’s Guide Table 23-3 Menu 3.2.1: IP Alias Setup FIELD DESCRIPTION EXAMPLE IP Alias 1, 2 Choose Yes to configure the LAN network for the Prestige. IP Address Enter the IP address of your Prestige in dotted decimal notation. IP Subnet Mask Your Prestige will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Prestige.
PAGE 303
Prestige 334W User’s Guide Menu 3.5 - Wireless LAN Setup ESSID= Wireless Hide ESSID= No Channel ID= CH06 2437MHz RTS Threshold= 2432 Frag. Threshold= 2432 WEP Encryption= Disable Default Key= N/A Key1= N/A Key2= N/A Key3= N/A Key4= N/A Authen. Method= N/A Edit MAC Address Filter= No Edit Roaming Configuration= No Preamble= Long 802.11 Mode= Mixed Press ENTER to Confirm or ESC to Cancel: Figure 23-6 Menu 3.5 Wireless LAN Setup The following table describes the fields in this menu. Table 23-4 Menu 3.
PAGE 304
Prestige 334W User’s Guide Table 23-4 Menu 3.5 Wireless LAN Setup FIELD WEP DESCRIPTION EXAMPLE Select Disable to allow wireless stations to communicate with the access points without any data encryption. Select 64-bit WEP or 128-bit WEP to enable data encryption. Default Key Enter the key number (1 to 4) in this field. Only one key can be enabled at any one time. This key must be the same on the Prestige and the wireless stations to communicate. Key 1 to Key 4 The WEP keys are used to encrypt data.
PAGE 305
Prestige 334W User’s Guide Table 23-4 Menu 3.5 Wireless LAN Setup FIELD DESCRIPTION EXAMPLE When you have completed this menu, press [ENTER] at the prompt “Press ENTER to confirm or ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen. 23.4.1 Configuring MAC Address Filter Your Prestige checks the MAC address of the wireless station device against a list of allowed or denied MAC addresses.
PAGE 306
Prestige 334W User’s Guide Menu 3.5.
PAGE 307
Prestige 334W User’s Guide Table 23-5 Menu 3.5.1 WLAN MAC Address Filter FIELD DESCRIPTION MAC Address Filter 1..32 Enter the MAC addresses (in XX:XX:XX:XX:XX:XX format) of the client computers that are allowed or denied access to the Prestige in these address fields. When you have completed this menu, press [ENTER] at the prompt “Press ENTER to confirm or ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen. 23.4.
PAGE 308
Prestige 334W User’s Guide Menu 3.5.2 - Roaming Configuration Active= Yes Port #= 3517 Press ENTER to Confirm or ESC to Cancel: Figure 23-10 Menu 3.5.2 Roaming Configuration The following table describes the fields in this menu. Table 23-6 Menu 3.5.2 Roaming Configuration FIELD DESCRIPTION Active Press [SPACE BAR] and then [ENTER] to select Yes to enable roaming on the Prestige if you have two or more Prestige’s on the same subnet.
PAGE 309
Prestige 334W User’s Guide Chapter 24 Internet Access This chapter shows you how to configure your Prestige for Internet access . 24.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your Prestige to access the Internet. There are three different menu 4 screens depending on whether you chose Ethernet, PPTP or PPPoE Encapsulation. Contact your ISP to determine what encapsulation type you should use. 24.
PAGE 310
Prestige 334W User’s Guide Table 24-1 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name Enter the name of your Internet Service Provider, e.g., myISP. This information is for identification purposes only. Encapsulation Press [SPACE BAR] and then press [ENTER] to choose Ethernet. The encapsulation method influences your choices for the IP Address field.
PAGE 311
Prestige 334W User’s Guide Table 24-1 Menu 4: Internet Access Setup (Ethernet) FIELD Network Address Translation DESCRIPTION Network Address Translation (NAT) allows the translation of an Internet protocol address used within one network (for example a private IP address used in a local network) to a different IP address known within another network (for example a public IP address used on the Internet). Choose None to disable NAT. Choose SUA Only if you have a single public IP address.
PAGE 312
Prestige 334W User’s Guide Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= PPTP Service Type= N/A My Login= My Password= ******** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Figure 24-2 Internet Access Setup (PPTP) The following table contains instructions about the new fields when you choose PPTP in the Encapsulation fi
PAGE 313
Prestige 334W User’s Guide Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Figure 24-3 Internet Access Setup (PPPoE) The following table contains instructions about the new fields when you choose PPPoE in the Encapsulation
PAGE 314
Prestige 334W User’s Guide You may deactivate the firewall in menu 21.2 or via the Prestige embedded web configurator. You may also define additional firewall rules or modify existing ones but please exercise extreme caution in doing so. See the chapters on firewall for more information on the firewall.
PAGE 315
Prestige 334W User’s Guide Chapter 25 Remote Node Configuration This chapter covers remote node configuration. 25.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up Internet access, you are actually configuring a remote node. The following describes how to configure Menu 11.1 Remote Node Profile, Menu 11.
PAGE 316
Prestige 334W User’s Guide Menu 11.1 - Remote Node Profile Rem Node Name= MyISP Active= Yes Route= IP Encapsulation= Ethernet Service Type= Standard Service Name= N/A Outgoing: My Login= N/A My Password= N/A Retype to Confirm= N/A Server= N/A Relogin Every (min)= N/A Edit IP= No Session Options: Edit Filter Sets= No Edit Traffic Redirect= No Press ENTER to Confirm or ESC to Cancel: Figure 25-1 Menu 11.
PAGE 317
Prestige 334W User’s Guide Table 25-1 Menu 11.1 Remote Node Profile for Ethernet Encapsulation FIELD My Password Retype to Confirm DESCRIPTION EXAMPLE Enter the password assigned by your ISP when the Prestige calls this remote node. Valid for PPPoE encapsulation only. ***** Type your password again to make sure that you have entered it correctly. ***** Server This field is valid only when RoadRunner is selected in the Service Type field.
PAGE 318
Prestige 334W User’s Guide 25.2.2 PPPoE Encapsulation The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). You can only use PPPoE encapsulation when you’re using the Prestige with a DSL modem as the WAN device. If you change the Encapsulation to PPPoE, then you will see the next screen. Please see the appendix for more information on PPPoE. Menu 11.
PAGE 319
Prestige 334W User’s Guide The second is that the Prestige will try to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive for obvious reasons. Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a constant connection and the cost is of no concern. The following table describes the fields not already described in Table 25-1. Table 25-2 Fields in Menu 11.
PAGE 320
Prestige 334W User’s Guide 25.2.3 PPTP Encapsulation If you change the Encapsulation to PPTP in menu 11.1, then you will see the next screen. Please see the appendix for information on PPTP. Menu 11.
PAGE 321
Prestige 334W User’s Guide 25.3 Edit IP Move the cursor to the Edit IP field in menu 11.1, then press [SPACE BAR] to select Yes. Press [ENTER] to open Menu 11.3 - Remote Node Network Layer Options. Menu 11.3 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= 1 Private= N/A RIP Direction= None Version= N/A Multicast= None Enter here to CONFIRM or ESC to CANCEL: Figure 25-4 Menu 11.
PAGE 322
Prestige 334W User’s Guide Table 25-4 Remote Node Network Layer Options FIELD DESCRIPTION EXAMPLE My WAN Addr This field is applicable to PPPoE and PPTP encapsulations only. Some implementations, especially the UNIX derivatives, require the WAN link to have a separate IP network number from the LAN and each end must have a unique address within the WAN network number. If this is the case, enter the IP address assigned to the WAN port of your Prestige.
PAGE 323
Prestige 334W User’s Guide Table 25-4 Remote Node Network Layer Options FIELD Multicast DESCRIPTION EXAMPLE IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group. The Prestige supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2). Press [SPACE BAR] to enable IP Multicasting or select None to disable it. See the LAN Setup chapter for more information on this feature. None (default) Once you have completed filling in Menu 11.
PAGE 324
Prestige 334W User’s Guide Menu 11.5 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Call Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 25-6 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation) 25.4.1 Traffic Redirect Setup Configure parameters that determine when the Prestige will forward WAN traffic to the backup gateway using Menu 11.6 — Traffic Redirect Setup.
PAGE 325
Prestige 334W User’s Guide Table 25-5 Menu 11.6: Traffic Redirect Setup FIELD DESCRIPTION EXAMPLE Configuration: Backup Gateway IP Address Enter the IP address of your backup gateway in dotted decimal notation. Metric Enter a number from 1 to 15 to set this route’s priority among the Prestige’s routes (see the Metric section in the WAN and Dial Backup Setup chapter) The smaller the number, the higher priority the route has.
PAGE 326
PAGE 327
Prestige 334W User’s Guide Chapter 26 Static Route Setup This chapter shows how to setup IP static routes. 26.1 IP Static Route Setup Step 1. To configure an IP static route, use Menu 12 – Static Routing Setup (shown next). Menu 12 - IP Static Route Setup 1. 2. 3. 4. 5. 6. 7. 8. ________ ________ ________ ________ ________ ________ ________ ________ Enter selection number: Figure 26-1 Menu 12 IP Static Route Setup Step 2. Now, type the route number of a static route you want to configure.
PAGE 328
Prestige 334W User’s Guide Menu 12.1 - Edit IP Static Route Route #: 1 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ? Metric= 2 Private= No Press ENTER to Confirm or ESC to Cancel: Figure 26-2 Menu12.1 Edit IP Static Route The following table describes the fields for Menu 12.1 – Edit IP Static Route Setup. Table 26-1 Menu12.1 Edit IP Static Route FIELD DESCRIPTION Route # This is the index number of the static route that you chose in menu 12.1.
PAGE 329
Prestige 334W User’s Guide Table 26-1 Menu12.1 Edit IP Static Route FIELD Private DESCRIPTION This parameter determines if the Prestige will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and is not included in RIP broadcasts. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.
PAGE 330
PAGE 331
Prestige 334W User’s Guide Chapter 27 Dial-in User Setup This chapter shows you how to create user accounts on the ZyAIR. 27.1 Dial-in User Setup By storing user profiles locally, your ZyAIR is able to authenticate wireless users without interacting with a network RADIUS server. Follow the steps below to set up user profiles on your ZyAIR. Step 1. From the main menu, enter 14 to display Menu 14 - Dial-in User Setup. Menu 14 - Dial-in User Setup 1. 2. 3. 4. 5. 6. 7. 8.
PAGE 332
Prestige 334W User’s Guide The following table describes the fields in this screen. Table 27-1 Menu 14.1- Edit Dial-in User FIELD User Name DESCRIPTION Enter a username up to 31 alphanumeric characters long for this user profile. This field is case sensitive. Active Press [SPACE BAR] to select Yes and press [ENTER] to enable the user profile. Password Enter a password up to 31 characters long for this user profile.
PAGE 333
Prestige 334W User’s Guide Chapter 28 Network Address Translation (NAT) This chapter discusses how to configure NAT on the Prestige. 28.1 Using NAT You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the Prestige. 28.1.1 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server. See section 28.3.
PAGE 334
Prestige 334W User’s Guide Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relogin Every (min)= N/A IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Figure 28-1 Menu 4 Applying NAT for Internet Access The following figure shows how you apply NAT to the remote node in
PAGE 335
Prestige 334W User’s Guide Menu 11.3 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= 1 Private= N/A RIP Direction= None Version= N/A Multicast= None Enter here to CONFIRM or ESC to CANCEL: Figure 28-2 Menu 11.3 Applying NAT to the Remote Node The following table describes the options for Network Address Translation. Table 28-1 Applying NAT in Menus 4 & 11.
PAGE 336
Prestige 334W User’s Guide configurator screens for further information on these menus. To configure NAT, enter 15 from the main menu to bring up the following screen. Menu 15 - NAT Setup 1. Address Mapping Sets 2. Port Forwarding Setup 3. Trigger Port Setup Enter Menu Selection Number: Figure 28-3 Menu 15 NAT Setup 28.3.1 Address Mapping Sets Enter 1 to bring up Menu 15.1 — Address Mapping Sets. Menu 15.1 - Address Mapping Sets 1. NAT_SET 255.
PAGE 337
Prestige 334W User’s Guide Menu 15.1.255 - Address Mapping Rules Set Name= SUA Idx --1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Local Start IP --------------0.0.0.0 Local End IP --------------255.255.255.255 Global Start IP --------------0.0.0.0 0.0.0.0 Global End IP --------------- Type -----M-1 Server Press ENTER to Confirm or ESC to Cancel: Figure 28-5 Menu 15.1.255 SUA Address Mapping Rules The following table explains the fields in this menu. Menu 15.1.255 is read-only.
PAGE 338
Prestige 334W User’s Guide Table 28-2 SUA Address Mapping Rules FIELD DESCRIPTION EXAMPLE When you have completed this menu, press [ENTER] at the prompt “Press ENTER to confirm or ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen. User-Defined Address Mapping Sets Now let’s look at option 1 in menu 15.1. Enter 1 to bring up this menu. We’ll just look at the differences from the previous menu.
PAGE 339
Prestige 334W User’s Guide ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9. Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6.
PAGE 340
Prestige 334W User’s Guide Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= 0.0.0.0 End = N/A Global IP: Start= 0.0.0.0 End = N/A Press ENTER to Confirm or ESC to Cancel: Figure 28-7 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set The following table explains the fields in this menu. Table 28-4 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION EXAMPLE Type Press [SPACE BAR] and then [ENTER] to select from a total of five types.
PAGE 341
Prestige 334W User’s Guide 28.4 Configuring a Server behind NAT Follow these steps to configure a server behind NAT: Step 1. Enter 15 in the main menu to go to Menu 15 - NAT Setup. Step 2. Enter 2 to display Menu 15.2 - NAT Server Setup as shown next. Menu 15.2 - NAT Server Setup Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 0.0.0.0 2. 21 25 192.168.1.33 3. 0 0 0.0.0.0 4. 0 0 0.0.0.0 5. 0 0 0.0.0.0 6. 0 0 0.0.0.0 7. 0 0 0.0.0.0 8.
PAGE 342
Prestige 334W User’s Guide Figure 28-9 Multiple Servers Behind NAT Example 28.5 General NAT Examples The following are some examples of NAT configuration. 28.5.1 Example 1: Internet Access Only In the following Internet access example, you only need one rule where the ILAs (Inside Local Addresses) of computers A through D map to one dynamic IGA (Inside Global Address) assigned by your ISP.
PAGE 343
Prestige 334W User’s Guide Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relogin Every (min)= N/A IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Figure 28-11 Menu 4 Internet Access & NAT Example From menu 4, choose the SUA Only option from the Network Address Tra
PAGE 344
Prestige 334W User’s Guide Menu 15.2.1 - NAT Server Setup Rule Start Port No. End Port No. IP Address --------------------------------------------------- 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Default 0 0 0 0 0 0 0 0 0 0 0 Default 0 0 0 0 0 0 0 0 0 0 0 192.168.1.10 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: Figure 28-13 Menu 15.2.1 Specifying an Inside Server 28.5.
PAGE 345
Prestige 334W User’s Guide Figure 28-14 NAT Example 3 Step 1. In this case you need to configure Address Mapping Set 1 from Menu 15.1 - Address Mapping Sets. Therefore you must choose the Full Feature option from the Network Address Translation field (in menu 4 or menu 11.3) in Figure 28-15. Step 2. Then enter 15 from the main menu. Step 3. Enter 1 to configure the Address Mapping Sets. Step 4. Enter 1 to begin configuring this new set.
PAGE 346
Prestige 334W User’s Guide Menu 11.3 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= Full Feature Metric= 1 Private= N/A RIP Direction= None Version= N/A Multicast= None Enter here to CONFIRM or ESC to CANCEL: Figure 28-15 Example 3: Menu 11.3 The following figures show how to configure the first rule. Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= 192.168.1.
PAGE 347
Prestige 334W User’s Guide Menu 15.1.1 - Address Mapping Rules Set Name= NAT_SET Idx --1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Local Start IP --------------192.168.1.10 192.168.1.11 0.0.0.0 Local End IP --------------255.255.255.255 Action= None Global Start IP --------------10.132.50.1 10.132.50.2 10.132.50.3 10.132.50.3 Global End IP --------------- Type -----1-1 1-1 M-1 Server Select Rule= N/A Press ENTER to Confirm or ESC to Cancel: Figure 28-17 Example 3: Final Menu 15.1.
PAGE 348
Prestige 334W User’s Guide Menu 15.2 - NAT Server Setup Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 0.0.0.0 2. 80 80 192.168.1.21 3. 25 25 192.168.1.20 4. 0 0 0.0.0.0 5. 0 0 0.0.0.0 6. 0 0 0.0.0.0 7. 0 0 0.0.0.0 8. 0 0 0.0.0.0 9. 0 0 0.0.0.0 10. 0 0 0.0.0.0 11. 0 0 0.0.0.0 12. 0 0 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: HTTP:80 FTP:21 Telnet:23 SMTP:25 POP3:110 PPTP:1723 Example 3: Menu 15.2 28.5.
PAGE 349
Prestige 334W User’s Guide Other applications such as some gaming programs are NAT unfriendly because they embed addressing information in the data stream. These applications won’t work through NAT even when using One-to-One and Many-to-Many No Overload mapping types. Follow the steps outlined in example 3 to configure these two menus as follows. Menu 15.1.1.1 Address Mapping Rule Type= Many-One-to-One Local IP: Start= 192.168.1.10 End = 192.168.1.12 Global IP: Start= 10.132.50.1 End = 10.132.50.
PAGE 350
Prestige 334W User’s Guide 28.6 Configuring Trigger Port Forwarding Only one LAN computer can use a trigger port (range) at a time. Enter 3 in menu 15 to display Menu 15.3 — Trigger Port Setup, shown next. Menu 15.3 - Trigger Port Setup Incoming Trigger Rule Name Start Port End Port Start Port End Port ---------------------------------------------------------------------1. Real Audio 6970 7170 7070 7070 2. 0 0 0 0 3. 0 0 0 0 4. 0 0 0 0 5. 0 0 0 0 6. 0 0 0 0 7. 0 0 0 0 8. 0 0 0 0 9. 0 0 0 0 10. 0 0 0 0 11.
PAGE 351
Prestige 334W User’s Guide Table 28-5 Menu 15.3 Trigger Port Setup FIELD End Port DESCRIPTION Enter a port number or the ending port number in a range of port numbers. EXAMPLE 7070 Press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.
PAGE 352
PAGE 353
Prestige 334W User’s Guide Chapter 29 Enabling the Firewall This chapter shows you how to get started with the Prestige firewall. 29.1 Remote Management and the Firewall When SMT menu 24.11 is configured to allow management (see the Remote Management chapter) and the firewall is enabled: • The firewall blocks remote management from the WAN unless you configure a firewall rule to allow it. • The firewall allows remote management from the LAN. 29.
PAGE 354
Prestige 334W User’s Guide Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off. Refer to the User's Guide for details about the firewall default policies. You may define additional Policy rules or modify existing ones but please exercise extreme caution in doing so. Active: No You can use the Web Configurator to configure the firewall.
PAGE 355
SMT Advanced Management Part VIII: SMT Advanced Management This part discusses filtering setup, SNMP, system security, system information and diagnosis, firmware and configuration file maintenance, system maintenance, remote management and call scheduling. See the web configurator parts of this guide for background information on features configurable by web configurator and SMT.
PAGE 356
PAGE 357
Prestige 334W User’s Guide Chapter 30 Filter Configuration This chapter shows you how to create and apply filters. 30.1 Introduction to Filters Your Prestige uses filters to decide whether to allow passage of a data packet and/or to make a call. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters, which are discussed later. Data filtering screens the data to determine if the packet should be allowed to pass.
PAGE 358
Prestige 334W User’s Guide Call Filtering Outgoing Packet No match Data Filtering Match Drop packet No match Built-in default Call Filters User-defined Call Filters (if applicable) Match No match Active Data Send packet and reset Idle Timer Match Drop packet if line not up Initiate call if line not up Drop packet if line not up Or Or Send packet but do not reset Idle Timer Send packet but do not reset Idle Timer Figure 30-1 Outgoing Packet Filtering Process For incoming packets, your Pr
PAGE 359
Prestige 334W User’s Guide Start Packet into filter Fetch First Filter Set Filter Set Fetch Next Filter Set Fetch First Filter Rule Fetch Next Filter Rule Yes Yes Next Filter Set Available? No Next filter Rule Available? No Active? Yes No Check Next Rule Execute Filter Rule Forward Drop Drop Packet Accept Packet Figure 30-2 Filter Rule Process Filter Configuration 30-3
PAGE 360
Prestige 334W User’s Guide You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port. 30.2 Configuring a Filter Set The Prestige includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. Step 1. Enter 21 in the main menu to open menu 21. Menu 21 - Filter and Firewall Setup 1. Filter Setup 2.
PAGE 361
Prestige 334W User’s Guide Step 3. Select the filter set you wish to configure (1-12) and press [ENTER]. Step 4. Enter a descriptive name or comment in the Edit Comments field and press [ENTER]. Step 5. Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1.1 - Filter Rules Summary. This screen shows the summary of the existing rules in the filter set. The following tables contain a brief description of the abbreviations used in the previous menus.
PAGE 362
Prestige 334W User’s Guide Table 30-2 Rule Abbreviations Used ABBREVIATION DESCRIPTION IP Pr Protocol SA Source Address SP Source Port number DA Destination Address DP Destination Port number Off Offset Len Length GEN Refer to the next section for information on configuring the filter rules. 30.2.1 Configuring a Filter Rule To configure a filter rule, type its number in Menu 21.1.1 - Filter Rules Summary and press [ENTER] to open menu 21.1.1.1 for the rule.
PAGE 363
Prestige 334W User’s Guide To configure TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press [ENTER] to open Menu 21.1.1.1 - TCP/IP Filter Rule, as shown next. Menu 21.1.1.1 - TCP/IP Filter Rule Filter #: 1,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 0 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 137 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.
PAGE 364
Prestige 334W User’s Guide Table 30-3 TCP/IP Filter Rule FIELD DESCRIPTION IP Mask Port # Port # Comp Enter the IP mask to apply to the Destination: IP Addr. Enter the destination port of the packets that you wish to filter. The range of this field is 0 to 65535. This field is ignored if it is 0. Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the destination port in the packet against the value given in Destination: Port #. OPTIONS 0.0.0.
PAGE 365
Prestige 334W User’s Guide Table 30-3 TCP/IP Filter Rule FIELD Log DESCRIPTION OPTIONS Press [SPACE BAR] and then [ENTER] to select a logging option from the following: None – No packets will be logged. Action Matched - Only packets that match the rule parameters will be logged. Action Not Matched - Only packets that do not match the rule parameters will be logged. None Both – All packets will be logged. Action Matched Press [SPACE BAR] and then [ENTER] to select the action for a matching packet.
PAGE 366
Prestige 334W User’s Guide Packet into IP Filter Filter Active? No Yes Apply SrcAddrMask to Src Addr Check Src IP Addr Not Matched Matched Apply DestAddrMask to Dest Addr Check Dest IP Addr Not Matched Matched Check IP Protocol Not Matched Matched Check Src & Dest Port Not Matched Matched More? Yes No Action Matched Drop Drop Packet Action Not Matched Check Next Rule Check Next Rule Drop Forward Forward Check Next Rule Accept Packet Figure 30-7 Executing an IP Filter 30-10 Filter Config
PAGE 367
Prestige 334W User’s Guide 30.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generic rules, the Prestige treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes.
PAGE 368
Prestige 334W User’s Guide Table 30-4 Generic Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Generic Filter Rule TCP/IP Filter Rule Filter Type Use [SPACE BAR] and then [ENTER] to select a rule type. Parameters displayed below each type will be different. TCP/IP filter rules are used to filter IP packets while generic filter rules allow filtering of non-IP packets. Active Select Yes to turn on the filter rule or No to turn it off.
PAGE 369
Prestige 334W User’s Guide 30.3 Example Filter Let’s look at an example to block outside users from accessing the Prestige via telnet. Figure 30-9 Telnet Filter Example Step 1. Enter 21 from the main menu to open Menu 21 - Filter and Firewall Setup. Step 2. Enter 1 to open Menu 21.1 - Filter Set Configuration. Step 3. Enter the index of the filter set you wish to configure (say 3) and press [ENTER]. Step 4. Enter a descriptive name or comment in the Edit Comments field and press [ENTER]. Step 5.
PAGE 370
Prestige 334W User’s Guide Step 6. Enter 1 to configure the first filter rule (the only filter rule of this set). Make the entries in this menu as shown in the following figure. Menu 21.1.3.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 23 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.
PAGE 371
Prestige 334W User’s Guide Menu 21.1.3 - Filter Rules Summary # 1 2 3 4 5 6 A Type Filter Rules M m n - ---- --------------------------------------------------------------- - - Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F N N N N N Enter Filter Rule Number (1-6) to Configure: This shows you that you have configured and activated (A = Y) a TCP/IP filter rule (Type = IP, Pr = 6) for destination telnet ports (DP = 23). M = N means an action can be taken immediately.
PAGE 372
Prestige 334W User’s Guide Generic and TCP/IP filter rules are discussed in more detail in the next section. When NAT (Network Address Translation) is enabled, the inside IP address and port number are replaced on a connection-byconnection basis, which makes it impossible to know the exact address and port on the wire. Therefore, the Prestige applies the protocol filters to the “native” IP address and port number before NAT for outgoing packets and after NAT for incoming packets.
PAGE 373
Prestige 334W User’s Guide 30.6.1 Applying LAN Filters LAN traffic filter sets may be useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and enter the number(s) of the filter set(s) that you want to apply as appropriate. You can choose up to four filter sets (from twelve) by entering their numbers separated by commas, e.g., 3, 4, 6, 11.
PAGE 374
Prestige 334W User’s Guide Menu 11.
PAGE 375
Prestige 334W User’s Guide Chapter 31 SNMP Configuration This chapter explains SNMP Configuration menu 22. 31.1 About SNMP Simple Network Management Protocol is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your Prestige supports SNMP agent functionality, which allows a manager station to manage and monitor the Prestige through the network. The Prestige supports SNMP version one (SNMPv1) and version two c (SNMPv2c).
PAGE 376
Prestige 334W User’s Guide An agent is a management software module that resides in a managed device (the Prestige). An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions. It executes applications that control and monitor managed devices.
PAGE 377
Prestige 334W User’s Guide Menu 22 - SNMP Configuration SNMP: Get Community= public Set Community= public Trusted Host= 0.0.0.0 Trap: Community= public Destination= 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: Figure 31-2 Menu 22 SNMP Configuration The following table describes the SNMP configuration parameters.
PAGE 378
Prestige 334W User’s Guide 31.4 SNMP Traps The Prestige will send traps to the SNMP manager when any one of the following events occurs: Table 31-2 SNMP Traps TRAP # TRAP NAME DESCRIPTION 1 coldStart (defined in RFC-1215) A trap is sent after booting (power on). 2 warmStart (defined in RFC-1215) A trap is sent after booting (software reboot). 3 linkDown (defined in RFC-1215) A trap is sent with the port number when any of the links are down. See the following table.
PAGE 379
Prestige 334W User’s Guide Chapter 32 System Security This chapter describes how to configure the system security on the Prestige. 32.1 System Security You can configure the system password, an external RADIUS server and 802.1x in this menu. 32.1.1 System Password Menu 23 - System Security 1. Change Password 2. RADIUS Server 4. IEEE802.1x Figure 32-1 Menu 23 System Security You should change the default password. If you forget your password you have to restore the default configuration file.
PAGE 380
Prestige 334W User’s Guide Menu 23.2 - System Security - RADIUS Server Authentication Server: Active= No Server Address= 10.11.12.13 Port #= 1812 Shared Secret= ******** Accounting Server: Active= No Server Address= 10.11.12.13 Port #= 1813 Shared Secret= ******** Press ENTER to Confirm or ESC to Cancel: Figure 32-3 Menu 23.2 System Security : RADIUS Server The following table describes the fields in this screen. Table 32-1 Menu 23.
PAGE 381
Prestige 334W User’s Guide Table 32-1 Menu 23.2 System Security : RADIUS Server FIELD DESCRIPTION Server Address Port Enter the IP address of the external accounting server in dotted decimal notation. The default port of the RADIUS server for accounting is 1813. EXAMPLE 10.11.12.13 1813 You need not change this value unless your network administrator instructs you to do so with additional information.
PAGE 382
Prestige 334W User’s Guide Menu 23.4 - System Security - IEEE802.1x Wireless Port Control= No Authentication Required ReAuthentication Timer (in second)= 1800 Idle Timeout (in second)= 3600 Key Management Protocol= Local User Database Only Dynamic WEP Key Exchange= 64-bit WEP PSK = N/A WPA Mixed Mode= N/A Data Privacy for Broadcast/Multicast packets= N/A WPA Broadcast/Multicast Key Update Timer= N/A Authentication Databases= N/A Press ENTER to Confirm or ESC to Cancel: Figure 32-5 Menu 23.
PAGE 383
Prestige 334W User’s Guide Table 32-2 Menu 23.4 System Security : IEEE802.1x FIELD Idle Timeout (in second) DESCRIPTION The ZyAIR automatically disconnects a client from the wired network after a period of inactivity. The client needs to enter the username and password again before access to the wired network is allowed. This field is activated only when you select Authentication Required in the Wireless Port Control field. The default time interval is 3600 seconds (or 1 hour).
PAGE 384
Prestige 334W User’s Guide Table 32-2 Menu 23.4 System Security : IEEE802.1x FIELD DESCRIPTION Authentication Databases The authentication database contains wireless station login information. The local user database is the built-in database on the ZyAIR. The RADIUS is an external server. Use this field to decide which database the ZyAIR should use (first) to authenticate a wireless station. Before you specify the priority, make sure you have set up the corresponding database correctly first.
PAGE 385
Prestige 334W User’s Guide Chapter 33 System Information and Diagnosis This chapter covers the information and diagnostic tools in SMT menus 24.1 to 24.4. These tools include updates on system status, port status, log and trace capabilities and upgrades for the system software. This chapter describes how to use these tools in detail. Type 24 in the main menu to open Menu 24 – System Maintenance, as shown in the following figure. Menu 24 - System Maintenance 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
PAGE 386
Prestige 334W User’s Guide Menu 24.1 - System Maintenance - Status Port WAN LAN WLAN Port WAN LAN Status TxPkts 100M/Full 15982 100M/Full 22381 54M 261 Ethernet Address 00:A0:C5:01:23:46 00:A0:C5:01:23:45 System up Time: RxPkts 938667 21235 0 IP Address 172.1.2.3 192.168.1.1 Cols 0 0 0 Tx B/s 78 2399 0 IP Mask 255.255.0.0 255.255.255.0 07:33:32 Wed. Dec. 24, 2003 Rx B/s 2520 128 0 DHCP Client Server Up Time 2:07:57 6:55:05 6:55:05 6:55:10 Name: Routing: IP ZyNOS F/W Version: V3.60(JK.
PAGE 387
Prestige 334W User’s Guide Table 33-1 System Maintenance: Status Menu Fields FIELD DESCRIPTION IP Mask The IP mask of the port listed on the left. DHCP The DHCP setting of the port listed on the left. System up Time The total time the Prestige has been on. Name This is the Prestige's system name + domain name assigned in menu 1. For example, System Name= xxx; Domain Name= baboo.mickey.com Name= xxx.baboo.mickey.com Routing Refers to the routing protocol used.
PAGE 388
Prestige 334W User’s Guide Menu 24.2.1 - System Maintenance - Information Name: P334W Routing: IP ZyNOS F/W Version: V3.60(JK.0)b1 | 01/28/2004 LAN Ethernet Address: 00:A0:C5:01:23:45 IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Press ESC or RETURN to Exit: Figure 33-4 Menu 24.2.1 System Maintenance : Information The following table describes the fields in this menu. Table 33-2 Menu 24.2.1 System Maintenance : Information FIELD DESCRIPTION Name Displays the system name of your Prestige.
PAGE 389
Prestige 334W User’s Guide Menu 24.2.2 – System Maintenance – Change Console Port Speed Console Port Speed: 9600 Press ENTER to Confirm or ESC to Cancel: Figure 33-5 Menu 24.2.2 System Maintenance : Change Console Port Speed 33.3 Log and Trace There are two logging facilities in the Prestige. The first is the error logs and trace records that are stored locally. The second is the syslog facility for message logging. 33.3.
PAGE 390
Prestige 334W User’s Guide Table 33-3 Menu 24.3.2 System Maintenance : Syslog and Accounting PARAMETER Syslog Server IP Address Log Facility DESCRIPTION Enter the IP Address of the server that will log the CDR (Call Detail Record) and system messages i.e., the syslog server. Press [SPACE BAR] and then [ENTER] to select a Local option. The log facility allows you to log the message to different files in the server. Please refer to the documentation of your syslog program for more details.
PAGE 391
Prestige 334W User’s Guide 3. Filter log Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D). Src: Source Address Dst: Destination Address prot: Protocol (“TCP”,”UDP”,”ICMP”) spo: Source port dpo: Destination port Mar 03 10:39:43 202.132.155.
PAGE 392
Prestige 334W User’s Guide 5. Firewall log Firewall Log Message Format SdcmdSyslogSend(SYSLOG_FIREWALL, SYSLOG_NOTICE, buf); buf = IP[Src=xx.xx.xx.xx : spo=xxxx Dst=xx.xx.xx.xx : dpo=xxxx | prot | rule | action] Src: Source Address spo: Source port (empty means no source port information) Dst: Destination Address dpo: Destination port (empty means no destination port information) prot: Protocol (“TCP”,”UDP”,”ICMP”, ”IGMP”, ”GRE”, ”ESP”) rule: where a means "set" number; b means "rule" number.
PAGE 393
Prestige 334W User’s Guide IP Frame: ENET0-RECV Size: Frame Type: IP Header: IP Version Header Length Type of Service Total Length Identification Flags Fragment Offset Time to Live Protocol Header Checksum Source IP Destination IP TCP Header: Source Port Destination Port Sequence Number Ack Number Header Length Flags Window Size Checksum Urgent Ptr Options 0000: 02 04 02 00 RAW DATA: 0000: 45 0010: 00 0020: 60 Press any key 00 00 02 to 44/ 44 Time: 17:02:44.
PAGE 394
Prestige 334W User’s Guide Menu 24.4 - System Maintenance - Diagnostic TCP/IP 1. Ping Host 2. WAN DHCP Release 3. WAN DHCP Renewal 4. Internet Setup Test System 11. Reboot System Enter Menu Selection Number: Host IP Address= N/A Figure 33-8 Menu 24.4 System Maintenance : Diagnostic 33.4.1 WAN DHCP DHCP functionality can be enabled on the LAN or WAN as shown in Figure 33-9. LAN DHCP has already been discussed.
PAGE 395
Prestige 334W User’s Guide Table 33-4 System Maintenance Menu Diagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machine (with an IP address) on your LAN or WAN. Enter its IP address in the Host IP Address field below. WAN DHCP Release Enter 2 to release your WAN DHCP settings. WAN DHCP Renewal Enter 3 to renew your WAN DHCP settings. Internet Setup Test Enter 4 to test the Internet setup. You can also test the Internet setup in Menu 4 - Internet Access.
PAGE 396
PAGE 397
Prestige 334W User’s Guide Chapter 34 Firmware and Configuration File Maintenance This chapter tells you how to backup and restore your configuration file as well as upload new firmware and configuration files. 34.1 Filename Conventions The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup, TCP/IP Setup, etc. It arrives from ZyXEL with a “rom” filename extension.
PAGE 398
Prestige 334W User’s Guide Table 34-1 Filename Conventions FILE TYPE INTERNAL NAME EXTERNAL NAME DESCRIPTION Configuration File Rom-0 This is the configuration filename on the Prestige. Uploading the rom-0 file replaces the entire ROM file system, including your Prestige configurations, system-related data (including the default password), the error log and the trace log. *.rom Firmware Ras This is the generic name for the ZyNOS firmware on the Prestige. *.bin 34.
PAGE 399
Prestige 334W User’s Guide 34.2.1 Backup Configuration Follow the instructions as shown in the next screen. Menu 24.5 - System Maintenance - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Prestige. Then type "root" and SMT password as requested. 3. Locate the 'rom-0' file. 4. Type 'get rom-0' to back up the current Prestige configuration to your workstation.
PAGE 400
Prestige 334W User’s Guide 34.2.3 Example of FTP Commands from the Command Line 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit Figure 34-2 FTP Session Example 34.2.4 GUI-based FTP Clients The following table describes some of the commands that you may see in GUI-based FTP clients.
PAGE 401
Prestige 334W User’s Guide 3. The IP address in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the Prestige will disconnect the Telnet session immediately. 4. You have an SMT console session running. 34.2.6 Backup Configuration Using TFTP The Prestige supports the up/downloading of the firmware and the configuration file using TFTP (Trivial File Transfer Protocol) over LAN. Although TFTP should work over WAN as well, it is not recommended.
PAGE 402
Prestige 334W User’s Guide 34.2.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Table 34-3 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the Prestige. 192.168.1.1 is the Prestige’s default IP address when shipped. Send/Fetch Use “Send” to upload the file to the Prestige and “Fetch” to back up the file on your computer. Local File Enter the path and name of the firmware file (*.
PAGE 403
Prestige 334W User’s Guide 34.3.1 Restore Using FTP For details about backup using (T)FTP please refer to earlier sections on FTP and TFTP file upload in this chapter. Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Prestige. Then type "root" and SMT password as requested. 3.
PAGE 404
Prestige 334W User’s Guide 34.3.2 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec. ftp>quit Figure 34-4 Restore Using FTP Session Example Refer to section 34.2.5 to read about configurations that disallow TFTP and FTP over WAN. 34.
PAGE 405
Prestige 334W User’s Guide Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested. 3. Type "put firmware filename ras" where "firmwarefilename" is the name of your firmware upgrade file on your workstation and "ras" is the remote file name on the system. 4.
PAGE 406
Prestige 334W User’s Guide 34.4.3 FTP File Upload Command from the DOS Prompt Example Step 1. Launch the FTP client on your computer. Step 2. Enter “open”, followed by a space and the IP address of your Prestige. Step 3. Press [ENTER] when prompted for a username. Step 4. Enter your password as requested (the default is “1234”). Step 5. Enter “bin” to set transfer mode to binary. Step 6. Use “put” to transfer files from the computer to the Prestige, for example, “put firmware.
PAGE 407
Prestige 334W User’s Guide To use TFTP, your computer must have both telnet and TFTP clients. To transfer the firmware and the configuration file, follow the procedure shown next. Step 1. Use telnet from your computer to connect to the Prestige and log in. Because TFTP does not have any security checks, the Prestige records the IP address of the telnet client and accepts TFTP requests only from this address. Step 2.
PAGE 408
PAGE 409
Prestige 334W User’s Guide Chapter 35 System Maintenance This chapter leads you through SMT menus 24.8 to 24.10. 35.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main system firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions. Enter the CI from the SMT by selecting menu 24.8. See the included disk or the zyxel.com web site for more detailed information on CI commands.
PAGE 410
Prestige 334W User’s Guide The |symbol means “or”. For example, sys filter netbios config means that you must specify the type of netbios filter and whether to turn it on or off. 35.1.2 Command Usage A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished. Copyright (c) 1994 - 2003 ZyXEL Communications Corp.
PAGE 411
Prestige 334W User’s Guide 35.2.1 Budget Management Menu 24.9.1 shows the budget management statistics for outgoing calls. Enter 1 from Menu 24.9 - System Maintenance - Call Control to bring up the following menu. Menu 24.9.1 - Budget Management Remote Node 1. MyISP Connection Time/Total Budget No Budget Elapsed Time/Total Period No Budget Reset Node (0 to update screen): Figure 35-4 Budget Management The total budget is the time limit on the accumulated time for outgoing calls to a remote node.
PAGE 412
Prestige 334W User’s Guide 35.2.2 Call History This is the second option in Menu 24.9 - System Maintenance - Call Control. It displays information about past incoming and outgoing calls. Enter 2 from Menu 24.9 - System Maintenance - Call Control to bring up the following menu. Menu 24.9.2 - Call History 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Phone Number Dir Rate #call Max Min Total Enter Entry to Delete(0 to exit): Figure 35-5 Call History The following table describes the fields in this screen.
PAGE 413
Prestige 334W User’s Guide you turn on your Prestige. Menu 24.10 allows you to update the time and date settings of your Prestige. The real time is then displayed in the Prestige error logs and firewall logs. Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown next. Menu 24 - System Maintenance 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
PAGE 414
Prestige 334W User’s Guide Table 35-3 Time and Date Setting Fields FIELD Time Protocol DESCRIPTION Enter the time service protocol that your timeserver sends when you turn on the Prestige. Not all timeservers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works. The main differences between them are the format. Daytime (RFC 867) format is day/month/year/time zone of the server.
PAGE 415
Prestige 334W User’s Guide i. On leaving menu 24.10 after making changes. ii. When the Prestige starts up, if there is a timeserver configured in menu 24.10. iii. 24-hour intervals after starting.
PAGE 416
PAGE 417
Prestige 334W User’s Guide Chapter 36 Remote Management This chapter covers remote management (SMT menu 24.11). 36.1 Remote Management Remote management allows you to determine which services/protocols can access which Prestige interface (if any) from which computers. You may manage your Prestige from a remote location via: Internet (WAN only) ALL (LAN and WAN) LAN only Neither (Disable). When you Choose WAN only or ALL (LAN & WAN), you still need to configure a firewall rule to allow access.
PAGE 418
Prestige 334W User’s Guide The following table describes the fields in this screen. Table 36-1 Menu 24.11 – Remote Management Control FIELD DESCRIPTION EXAMPLE Telnet Server FTP Server Web Server SNMP Service DNS Service Each of these read-only labels denotes a service or protocol. Port This field shows the port number for the service or protocol. You may change the port number if needed, but you must use the same port number to access the Prestige.
PAGE 419
Prestige 334W User’s Guide Chapter 37 Call Scheduling Call scheduling (applicable for PPPoA or PPPoE encapsulation only) allows you to dictate when a remote node should be called and for how long. 37.1 Introduction to Call Scheduling The call scheduling feature allows the Prestige to manage a remote node and dictate when a remote node should be called and for how long. This feature is similar to the scheduler in a videocassette recorder (you can specify a time period for the VCR to record).
PAGE 420
Prestige 334W User’s Guide To setup a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 — Schedule Set Setup as shown next. Menu 26.
PAGE 421
Prestige 334W User’s Guide Table 37-1 Menu 26.1 Schedule Set Setup FIELD Weekday: Day DESCRIPTION If you selected Weekly in the How Often field above, then select the day(s) when the set should activate (and recur) by going to that day(s) and pressing [SPACE BAR] to select Yes, then press [ENTER]. EXAMPLE Yes No N/A Start Time Enter the start time when you wish the schedule set to take effect in hourminute format.
PAGE 422
Prestige 334W User’s Guide Menu 11.
PAGE 423
SMT VPN/IPSec Part IX: SMT VPN/IPSec This part provides information about configuring VPN/IPSec for secure communications. See the web configurator parts of this guide for background information on features configurable by web configurator and SMT.
PAGE 424
PAGE 425
Prestige 334W User’s Guide Chapter 38 VPN/IPSec Setup This chapter introduces the VPN SMT menus. 38.1 VPN/IPSec Overview The VPN/IPSec main SMT menu has these main submenus: 1. Define VPN policies in menu 27.1 submenus, including security policies, endpoint IP addresses, peer IPSec router IP address and key management. 2. Menu 27.2 - SA Monitor allows you to manage (refresh or disconnect) your SA connections. This is an overview of the VPN menu tree.
PAGE 426
Prestige 334W User’s Guide Menu 27 - VPN/IPSec Setup 1. IPSec Summary 2. SA Monitor Enter Menu Selection Number: Figure 38-2 Menu 27 VPN/IPSec Setup 38.2 IPSec Summary Screen Type 1 in menu 27 and then press [ENTER] to display Menu 27.1 IPSec Summary. This is a summary read-only menu of your IPSec rules (tunnels). Edit or create an IPSec rule by selecting an index number and then configuring the associated submenus. Menu 27.
PAGE 427
Prestige 334W User’s Guide Table 38-1 Menu 27.1 IPSec Summary FIELD DESCRIPTION Name This field displays the unique identification name for this VPN rule. The name may be up to 32 characters long but only 10 characters will be displayed here. A Y signifies that this VPN rule is active. Local Addr Start When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Single, this is a static IP address on the LAN behind your Prestige. EXAMPLE Taiwan Y 192.168.1.
PAGE 428
Prestige 334W User’s Guide Table 38-1 Menu 27.1 IPSec Summary FIELD DESCRIPTION Key Mgt This field displays the SA’s type of key management, (IKE or Manual). Remote Addr Start When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Single, this is a static IP address on the network behind the remote IPSec router. EXAMPLE IKE 172.16.2.40 When the Addr Type field in Menu 27.1.
PAGE 429
Prestige 334W User’s Guide Table 38-1 Menu 27.1 IPSec Summary FIELD Select Command DESCRIPTION EXAMPLE Press [SPACE BAR] to choose from None, Edit, Delete, Go To Rule, Next Page or Previous Page and then press [ENTER]. You must select a rule in the next field when you choose the Edit, Delete or Go To commands. None Select None and then press [ENTER] to go to the “Press ENTER to Confirm…” prompt. Use Edit to create or edit a rule. Use Delete to remove a rule.
PAGE 430
Prestige 334W User’s Guide Menu 27.1.1 – IPSec Setup Index= 1 Name= Taiwan Active= Yes Keep Alive= No Nat Traversal= No Local ID type Content= My IP Addr= 0.0.0.0 Peer ID type= IP Content= Secure Gateway Address= zw50test.zyxel.com.tw Protocol= 0 DNS Server= 0.0.0.0 Local: Addr Type= SINGLE Local IP Addr= 1.1.1.1 Port Start= 0 End= N/A Remote: Addr Type= SUBNET IP Addr Start= 4.4.4.4 End/Subnet Mask= 255.255.0.
PAGE 431
Prestige 334W User’s Guide Table 38-2 Menu 27.1.1 IPSec Setup FIELD DESCRIPTION Nat Traversal Select this check box to enable NAT traversal. NAT traversal allows you to set up a VPN connection when there are NAT routers between the two IPSec routers. EXAMPLE The remote IPSec router must also have NAT traversal enabled. You can use NAT traversal with ESP protocol using Transport or Tunnel mode, but not with AH protocol nor with Manual key management.
PAGE 432
Prestige 334W User’s Guide Table 38-2 Menu 27.1.1 IPSec Setup FIELD Content DESCRIPTION EXAMPLE When you select IP in the Peer ID Type field, type the IP address of the computer with which you will make the VPN connection or leave the field blank to have the Prestige automatically use the address in the Secure Gateway Address field. When you select DNS in the Peer ID Type field, type a domain name (up to 31 characters) by which to identify the remote IPSec router.
PAGE 433
Prestige 334W User’s Guide Table 38-2 Menu 27.1.1 IPSec Setup FIELD DESCRIPTION End Enter a port number in this field to define a port range. This port number must be greater than that specified in the previous field. This field is N/A when 0 is configured in the Port Start field. Remote EXAMPLE N/A Remote IP addresses must be static and correspond to the remote IPSec router’s configured local IP addresses. The remote fields are N/A when the Secure Gateway Address field is configured to 0.0.0.0.
PAGE 434
Prestige 334W User’s Guide Table 38-2 Menu 27.1.1 IPSec Setup FIELD DESCRIPTION EXAMPLE Port Start 0 is the default and signifies any port. Type a port number from 0 to 65535. Someone behind the remote IPSec router cannot create a VPN tunnel when attempting to connect using a port number that does not match this port number or range of port numbers. 0 Some of the most common IP ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP; 110, POP3.
PAGE 435
Prestige 334W User’s Guide Menu 27.1.1.1 - IKE Setup Phase 1 Negotiation Mode= Main PSK= qwer1234 Encryption Algorithm= DES Authentication Algorithm= MD5 SA Life Time (Seconds)= 28800 Key Group= DH1 Phase 2 Active Protocol= ESP Encryption Algorithm= DES Authentication Algorithm= SHA1 SA Life Time (Seconds)= 28800 Encapsulation= Tunnel Perfect Forward Secrecy (PFS)= None Press ENTER to Confirm or ESC to Cancel: Figure 38-5 Menu 27.1.1.1 IKE Setup The following table describes the fields in this menu.
PAGE 436
Prestige 334W User’s Guide Table 38-3 Menu 27.1.1.1 IKE Setup FIELD Encryption Algorithm DESCRIPTION EXAMPLE When DES is used for data communications, both sender and receiver must know the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. Prestige DES encryption algorithm uses a 56-bit key. DES Triple DES (3DES), is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES.
PAGE 437
Prestige 334W User’s Guide Table 38-3 Menu 27.1.1.1 IKE Setup FIELD DESCRIPTION Perfect Perfect Forward Secrecy (PFS) is disabled (None) by default in phase 2 Forward IPSec SA setup. This allows faster IPSec setup, but is not so secure. Press Secrecy (PFS) [SPACE BAR] and choose from DH1 or DH2 to enable PFS. DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number (more secure, yet slower).
PAGE 438
Prestige 334W User’s Guide Menu 27.1.1.2 – Manual Setup Active Protocol= ESP Tunnel ESP Setup SPI (Decimal)= Encryption Algorithm= DES Key1= Key2= N/A Key3= N/A Authentication Algorithm= MD5 Key= N/A AH Setup SPI (Decimal)= N/A Authentication Algorithm= N/A Key= Press ENTER to Confirm or ESC to Cancel: Figure 38-6 Menu 27.1.1.2 Manual Setup The following table describes the fields in this menu. Table 38-5 Menu 27.1.1.
PAGE 439
Prestige 334W User’s Guide Table 38-5 Menu 27.1.1.2 Manual Setup FIELD DESCRIPTION EXAMPLE Key3 Enter a unique eight-character key. It can be comprised of any character including spaces (but trailing spaces are truncated). Authentication Press [SPACE BAR] to choose from MD5 or SHA1 and then press [ENTER]. Algorithm Key Enter the authentication key to be used by IPSec if applicable. The key must be unique. Enter 16 characters for MD5 authentication and 20 characters for SHA-1 authentication.
PAGE 440
PAGE 441
Prestige 334W User’s Guide Chapter 39 SA Monitor This chapter teaches you how to manage your SAs by using the SA Monitor in SMT menu 27.2. 39.1 SA Monitor Overview A Security Association (SA) is the group of security settings related to a specific VPN tunnel. This menu (shown next) displays active VPN connections. When there is outbound traffic but no inbound traffic, the SA times out automatically after two minutes.
PAGE 442
Prestige 334W User’s Guide The following table describes the fields in this menu. Table 39-1 Menu 27.2 SA Monitor FIELD DESCRIPTION # This is the security association index number. Name This field displays the identification name for this VPN policy. This name is unique for each connection where the secure gateway IP address is a public static IP address. EXAMPLE Taiwan When the secure gateway IP address is 0.0.0.
PAGE 443
Part X: Appendices and Index This section provides some Appendices and an Index.
PAGE 444
PAGE 445
Prestige 334W User’s Guide Appendix A PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your PC to an ATM PVC (Permanent Virtual Circuit) that connects to an xDSL Access Concentrator where the PPP session terminates (see the next figure). One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.
PAGE 446
Prestige 334W User’s Guide Diagram A-1 Single-PC per Modem Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC is acting as a L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the PPP frames to the ISP. The L2TP tunnel is capable of carrying multiple PPP sessions.
PAGE 447
Prestige 334W User’s Guide The Prestige as a PPPoE Client When using the Prestige as a PPPoE client, the PCs on the LAN see only Ethernet and are not aware of PPPoE. This alleviates the administrator from having to manage the PPPoE clients on the individual PCs.
PAGE 448
PAGE 449
Prestige 334W User’s Guide Appendix B PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a PC to a broadband modem over Ethernet? A solution is to build PPTP into the ANT (ADSL Network Termination) where PPTP is used only over the short haul between the PC and the modem over Ethernet.
PAGE 450
Prestige 334W User’s Guide In Windows VPN or PPTP Pass-Through feature, the PPTP tunneling is created from Windows 95, 98 and NT clients to an NT server in a remote location. The pass-through feature allows users on the network to access a different remote server using the Prestige's Internet connection. In NAT mode, the Prestige is able to pass the PPTP packets to the internal PPTP server (i.e. NT server) behind the NAT. Users need to forward PPTP packets to port 1723 by configuring the server in Menu 15.
PAGE 451
Prestige 334W User’s Guide The control connection runs over TCP. Similar to L2TP, a tunnel control connection is first established before call control messages can be exchanged. Please note that a tunnel control connection supports multiple call sessions. The following diagram depicts the message exchange of a successful call setup between a PC and an ANT.
PAGE 452
PAGE 453
Prestige 334W User’s Guide Appendix C NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. You can configure NetBIOS filters to: • Allow or disallow the sending of NetBIOS packets from the LAN to the WAN and from the WAN to the LAN.
PAGE 454
Prestige 334W User’s Guide Table C-1 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and WAN This field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN or from the WAN to the LAN. Forward IPSec Packets This field displays whether NetBIOS packets sent through a VPN connection are blocked or forwarded. Forward Trigger dial This field displays whether NetBIOS packets are allowed to initiate calls.
PAGE 455
Prestige 334W User’s Guide Command: sys filter netbios config 4 off This command stops NetBIOS commands from initiating calls.
PAGE 456
PAGE 457
Prestige 334W User’s Guide Appendix D Log Descriptions Configure centralized logs using the embedded web configurator; see the online help for details. This appendix describes some of the log messages. Chart 1 System Error Logs LOG MESSAGE DESCRIPTION %s exceeds the max. number of session per host! This attempt to create a NAT session exceeds the maximum number of NAT session table entries allowed to be created per host.
PAGE 458
Prestige 334W User’s Guide Chart 2 System Maintenance Logs LOG MESSAGE DESCRIPTION TELNET Login Successfully Someone has logged on to the router via telnet. TELNET Login Fail Someone has failed to log on to the router via telnet. FTP Login Successfully Someone has logged on to the router via ftp. FTP Login Fail Someone has failed to log on to the router via ftp. NAT Session Table is Full! The maximum number of NAT session table entries has been exceeded and the table is full.
PAGE 459
Prestige 334W User’s Guide Chart 4 Content Filtering Logs CATEGORY LOG MESSAGE IP/Domain Name JAVBLK DESCRIPTION The Prestige blocked access to this IP address or domain name because of a forbidden service such as: ActiveX, a Java applet, a cookie, or a proxy.
PAGE 460
Prestige 334W User’s Guide Chart 5 ICMP Type and Code Explanations TYPE CODE 0 11 Echo message Time Exceeded 0 Time to live exceeded in transit 1 Fragment reassembly time exceeded 12 Parameter Problem 0 13 Pointer indicates the error Timestamp 0 14 Timestamp request message Timestamp Reply 0 15 Timestamp reply message Information Request 0 16 Information request message Information Reply 0 D-4 DESCRIPTION Information reply message Log Descriptions
PAGE 461
Prestige 334W User’s Guide Appendix E Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.
PAGE 462
Prestige 334W User’s Guide 1. Click Start, Settings, Control Panel and double-click the Network icon to open the Network window. 2. The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: a. In the Network window, click Add. b. Select Adapter and then click Add. c. Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: a.
PAGE 463
Prestige 334W User’s Guide d. Select Client for Microsoft Networks from the list of network clients and then click OK. e. Restart your computer so the changes you made take effect. In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties. 1. Click the IP Address tab. -To have your computer assigned a dynamic IP address, select Obtain an IP address automatically.
PAGE 464
Prestige 334W User’s Guide 2. Click the DNS Configuration tab. -If you do not know your DNS information, select Disable DNS. -If you know your DNS information, select Enable DNS and type the information in the fields below (you may not need to fill them all in). 3. Click the Gateway tab. -If you do not know your gateway’s IP address, remove previously installed gateways. -If you have a gateway IP address, type it in the New gateway field and click Add. 4.
PAGE 465
Prestige 334W User’s Guide 5. Click OK to close the Network window. Insert the Windows CD if prompted. 6. Turn on your Prestige and restart your computer when prompted. Checking/Modifying Your Computer’s IP Address 1. Click Start and then Run. 2. In the Run window, type "winipcfg" and then click OK to open the IP Configuration window. 3. Select your network adapter. You should see your computer's (static) IP address, subnet mask and default gateway in this screen.
PAGE 466
Prestige 334W User’s Guide Windows 2000/NT/XP 1. In Windows XP, click start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel. 2. E-6 In Windows XP, click Network Connections. In Windows 2000/NT, click Network and Dial-up Connections. 3. Right-click Local Area Connection and then click Properties.
PAGE 467
Prestige 334W User’s Guide 4. Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties.
PAGE 468
Prestige 334W User’s Guide 5. The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP). - To have your computer assigned a dynamic IP address, click Obtain an IP address automatically. -If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. Click Advanced to go to the Advanced TCP/IP Settings screen shown next.
PAGE 469
Prestige 334W User’s Guide 6. -If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK. Do one or more of the following if you want to configure additional IP addresses: -In the IP Settings tab, in IP addresses, click Add. -In TCP/IP Address, type an IP address in IP address and a subnet mask in Subnet mask, and then click Add. -Repeat the above two steps for each IP address you want to add.
PAGE 470
Prestige 334W User’s Guide 7. In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): -Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). -If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields. If you wish to have more than two DNS servers, click Advanced, the DNS tab and then configure them using Add. 8.
PAGE 471
Prestige 334W User’s Guide Macintosh OS 8/9 1. Click the Apple menu, Control Panel and double-click TCP/IP to open the TCP/IP Control Panel. 2. Select Ethernet built-in from the Connect via list.
PAGE 472
Prestige 334W User’s Guide 3. For dynamically assigned settings, select Using DHCP Server from the Configure: list. 4. For statically assigned settings, do the following: -From the Configure box, select Manually. -Type your IP address in the IP Address box. -Type your subnet mask in the Subnet mask box. -Type the IP address of your Prestige in the Router address box. 5. Close the TCP/IP Control Panel. 6. Click Save if prompted, to save changes to your configuration. 7.
PAGE 473
Prestige 334W User’s Guide 2. Click Network in the icon bar. - Select Automatic from the Location list. - Select Built-in Ethernet from the Show list. - Click the TCP/IP tab. 3. For dynamically assigned settings, select Using DHCP from the Configure list. 4. For statically assigned settings, do the following: -From the Configure box, select Manually. -Type your IP address in the IP Address box. -Type your subnet mask in the Subnet mask box.
PAGE 474
PAGE 475
Prestige 334W User’s Guide Appendix F Wireless LAN and IEEE 802.11 A wireless LAN (WLAN) provides a flexible data communications system that you can use to access various services (navigating the Internet, email, printer services, etc.) without the use of a cabled connection. In effect a wireless LAN environment provides you the freedom to stay connected to the network while roaming around in the coverage area. WLAN is not available on all models.
PAGE 476
Prestige 334W User’s Guide Spread Spectrum (DSSS) and Frequency-Hopping Spread Spectrum (FHSS), in the 2.4 to 2.4825 GHz unlicensed ISM (Industrial, Scientific and Medical) band. The third method is infrared technology, using very high frequencies, just below visible light in the electromagnetic spectrum to carry data.
PAGE 477
Prestige 334W User’s Guide points can provide wireless coverage for an entire building or campus. All communications between stations or between a station and a wired network client go through the access point. The Extended Service Set (ESS) shown in the next figure consists of a series of overlapping BSSs (each containing an Access Point) connected together by means of a Distribution System (DS). Although the DS could be any type of network, it is almost invariably an Ethernet LAN.
PAGE 478
PAGE 479
Prestige 334W User’s Guide Appendix G Wireless LAN With IEEE 802.1x As wireless networks become popular for both portable computing and corporate networks, security is now a priority. Security Flaws with IEEE 802.11 Wireless networks based on the original IEEE 802.11 have a poor reputation for safety. The IEEE 802.11b wireless access standard, first published in 1999, was based on the MAC address. As the MAC address is sent across the wireless link in clear text, it is easy to spoof and fake.
PAGE 480
Prestige 334W User’s Guide RADIUS Server Authentication Sequence The following figure depicts a typical wireless network with a remote RADIUS server for user authentication using EAPOL (EAP Over LAN). Client computer access authorized. Client computer access not authorized. Diagram G-1 Sequences for EAP MD5–Challenge Authentication G-2 Wireless LAN with IEEE 802.
PAGE 481
Prestige 334W User’s Guide Appendix H Types of EAP Authentication This appendix discusses the four popular EAP authentication types: EAP-MD5, EAP-TLS, EAP-TTLS and PEAP. The type of authentication you use depends on the RADIUS server or the AP. Consult your network administrator for more information. EAP-MD5 (Message-Digest Algorithm 5) MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wireless station.
PAGE 482
Prestige 334W User’s Guide hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5 and EAPMSCHAPv2, for client authentication. For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, simple user name and password pair is more practical. The following table is a comparison of the features of four authentication types.
PAGE 483
Prestige 334W User’s Guide Appendix I Antenna Selection and Positioning Recommendation An antenna couples RF signals onto air. A transmitter within a wireless device sends an RF signal to the antenna, which propagates the signal through the air. The antenna also operates in reverse by capturing RF signals from the air. Choosing the right antennas and positioning them properly increases the range and coverage area of a wireless LAN. Antenna Characteristics Frequency An antenna in the frequency of 2.
PAGE 484
Prestige 334W User’s Guide Types of Antennas For WLAN There are two types of antennas used for wireless LAN applications. • Omni-directional antennas send the RF signal out in all directions on a horizontal plane. The coverage area is torus-shaped (like a donut) which makes these antennas ideal for a room environment. With a wide coverage area, it is possible to make circular overlapping coverage areas with multiple access points.
PAGE 485
Prestige 334W User’s Guide Appendix J Brute-Force Password Guessing Protection The following describes the commands for enabling, disabling and configuring the brute-force password guessing protection mechanism for the password. See other appendices for information on the command structure. Chart 6 Brute-Force Password Guessing Protection Commands COMMAND DESCRIPTION sys pwderrtm This command displays the brute-force guessing password protection settings.
PAGE 486
PAGE 487
Prestige 334W User’s Guide Appendix K Triangle Route The Ideal Setup When the firewall is on, your Prestige acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the Prestige to protect your LAN against attacks. Diagram K-1 Ideal Setup The “Triangle Route” Problem A traffic route is a path for sending or receiving data packets between two Ethernet devices.
PAGE 488
Prestige 334W User’s Guide Diagram K-2 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Your Prestige supports up to three logical LAN interfaces with the Prestige being the gateway for each logical network.
PAGE 489
Prestige 334W User’s Guide Diagram K-3 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your Prestige to your LAN. Therefore your LAN is protected. Diagram K-4 Gateways on the WAN Side How To Configure Triangle Route: Step 1. From the SMT main menu, enter 24. Step 2. Enter “8” in menu 24 to enter CI command mode.
PAGE 490
Prestige 334W User’s Guide Step 3. Use the following commands to allow/disallow triangle route. sys firewall ignore triangle all off This command allows triangle route. sys firewall ignore triangle all on This command disallows triangle route.
PAGE 491
Prestige 334W User’s Guide Index 8 802.1x ............................................................ 8-16 A Active............................................................. 25-2 Address Assignment ............................. 3-10, 3-11 Address Resolution Protocol (ARP) ................ 6-4 Ad-hoc Configuration ...................................... F-2 Allocated Budget ........................................... 25-5 Antenna Directional ....................................................
PAGE 492
Prestige 334W User’s Guide Disclaimer............................................................ii Distribution System ......................................... F-3 DNS .................................................... 14-11, 23-3 DNS Server For VPN Host............................................ 16-7 Domain Name............. 3-1, 3-11, 10-7, 18-3, 33-3 DoS (Denial of Service)................................... 1-2 DS ................................... See Distribution System DSL Modem ...............
PAGE 493
Prestige 334W User’s Guide Gateway IP Address....................................... 24-2 General Setup...................................3-1, 5-1, 21-1 Global............................................................. 10-1 H Hidden Menus................................................ 20-4 Hop Count...................................................... 26-2 Host.........................................................5-6, 21-4 How PPPoE Works ......................................... A-2 HTTP ..........
PAGE 494
Prestige 334W User’s Guide N Nailed-up Connection.................................... 25-4 Nailed-Up Connection ................................... 25-5 NAT........ 3-7, 10-6, 10-7, 10-8, 10-9, 25-8, 30-16 Applying NAT in the SMT Menus............ 28-1 Configuring ............................................... 28-3 Definitions ................................................. 10-1 Examples ................................................. 28-10 How NAT Works ......................................
PAGE 495
Prestige 334W User’s Guide Repairs ................................................................ v Replacement........................................................ v Required fields ............................................... 20-4 Reset Button..................................................... 1-1 Resetting the Time ......................................... 35-6 Restore ........................................................... 19-9 Restore Configuration ....................................
PAGE 496
Prestige 334W User’s Guide T TCP/IP ..... 6-6, 14-4, 23-3, 23-4, 25-7, 30-6, 30-7, 30-9, 30-12, 30-15 Setup.......................................................... 23-4 TCP/IP filter rule ........................................... 30-6 Telnet ............................................................. 14-4 Telnet Configuration...................................... 14-4 TFTP and FTP over WAN Management Limitations................................................. 34-4 TFTP and FTP Over WAN} ............