Page 1 NWA3000-N Series Wireless N Business WLAN 3000 Series Access Point Default Login Details IP Address https://192.168.1.2 User Name admin Password 1234 Version 2.23 www.zyxel.com Edition 1, 1/2011 www.zyxel.com Copyright © 2011 ZyXEL Communications Corporation...
Page 3: About This User's Guide
About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to configure a NWA3000-N series AP using the web configurator. You should have at least a basic knowledge of TCP/IP networking concepts and topology.
Page 4: Document Conventions
Syntax Conventions • The product in this book may be referred to as the “NWA3000-N series AP”, the “device”, the “AP”, or the “system” in this User’s Guide. • Product labels, screen names, field labels and field choices are all in bold font.
Page 5 Document Conventions Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The NWA3000-N series AP icon is not an exact representation of your device. NWA3000-N series AP Computer Notebook computer Server Printer Firewall Telephone...
Page 6: Safety Warnings
• The PoE (Power over Ethernet) devices that supply or receive power and their connected Ethernet cables must all be completely indoors. • The indoors versions of this product are for indoor use only (utilisation intérieure exclusivement). This product is recyclable. Dispose of it properly. NWA3000-N Series User’s Guide...
Page 7: Table Of Contents
1.2.3 MBSSID ........................22 1.3 Management Mode ......................23 1.4 Ways to Manage the NWA3000-N series AP ..............24 1.5 Good Habits for Managing the NWA3000-N series AP ............25 1.6 Hardware Connections ......................26 1.7 LEDs ............................ 27 1.8 Starting and Stopping the NWA3000-N series AP ............... 29 Chapter 2 The Web Configurator ......................
Page 8 Part II: Technical Reference ..............73 Chapter 5 Dashboard ..........................75 5.1 Overview ..........................75 5.1.1 What You Can Do in this Chapter ................75 5.2 Dashboard ........................... 76 5.2.1 CPU Usage ........................ 80 5.2.2 Memory Usage ......................81 NWA3000-N Series User’s Guide...
Page 9 8.2.1 Add or Edit a DNS Setting ..................110 Chapter 9 Wireless ..........................111 9.1 Overview ..........................111 9.1.1 What You Can Do in this Chapter ................111 9.1.2 What You Need to Know ...................111 9.2 Controller ..........................112 9.3 AP Management .........................113 NWA3000-N Series User’s Guide...
Page 10 12.2 Radio ..........................149 12.2.1 Add/Edit Radio Profile .................... 150 12.3 SSID ..........................154 12.3.1 SSID List ........................ 154 12.3.2 Security List ......................158 12.3.3 MAC Filter List ......................161 Chapter 13 MON Profile ........................165 NWA3000-N Series User’s Guide...
Page 11 15.5.5 HTTPS Example ....................203 15.6 SSH ..........................209 15.6.1 How SSH Works ....................210 15.6.2 SSH Implementation on the NWA3000-N series AP ..........211 15.6.3 Requirements for Using SSH ..................211 15.6.4 Configuring SSH ....................212 15.6.5 Examples of Secure Telnet Using SSH ..............213...
Page 12 18.2 Diagnostics ........................253 18.3 Packet Capture ....................... 254 18.3.1 Packet Capture Files ..................... 256 18.3.2 Example of Viewing a Packet Capture File ............257 18.4 Wireless Frame Capture ....................258 18.4.1 Wireless Frame Capture Files ................261 NWA3000-N Series User’s Guide...
Page 13 Troubleshooting........................267 21.1 Overview .......................... 267 21.2 Power, Hardware Connections, and LEDs ..............267 21.3 NWA3000-N series AP Access and Login ............... 268 21.4 Internet Access ........................ 270 21.5 Wireless AP Troubleshooting ..................272 21.6 Resetting the NWA3000-N series AP ................277 21.7 Getting More Troubleshooting Help .................
Page 14 Table of Contents NWA3000-N Series User’s Guide...
Page 15: Part I User's Guide
User’s Guide...
Page 17: Chapter 1 Introduction
IEEE 802.1x, Wi-Fi Protected Access (WPA), WPA2 and Wired Equivalent Privacy (WEP) data encryption. A NWA3000-N series AP can manage up to 24 other NWA3000-N series APs on your network. Configuration profiles let you easily use different WLAN and security settings for various virtual and managed APs.
Page 18: Applications For The Nwa3000-N Series Ap
The NWA3000-N series AP can act as a wireless network bridge and establish wireless links with other APs. In the figure below, the two NWA3000-N series APs (A and B) are connected to independent wired networks and have a bridge connection (A can communicate with B) at the same time.
Page 19 Chapter 1 Introduction At the time of writing, WDS security is compatible with other ZyXEL access points only. Refer to your other access point’s documentation for details. Figure 1 Bridge Application Figure 2 Repeater Application NWA3000-N Series User’s Guide...
Page 20 LAN 1 to connect to the computers in LAN 2. Figure 3 Bridging Example Be careful to avoid bridge loops when you enable bridging in the NWA3000-N series AP. Bridge loops cause broadcast traffic to circle the network endlessly, resulting in possible throughput degradation and disruption of communications.
Page 21 Chapter 1 Introduction • If two or more NWA3000-N series APs (in bridge mode) are connected to the same hub. Figure 4 Bridge Loop: Two Bridges Connected to Hub • If your NWA3000-N series AP (in bridge mode) is connected to a wired LAN while communicating with another wireless bridge that is also connected to the same wired LAN.
Page 22: Ap + Bridge
Chapter 1 Introduction 1.2.2 AP + Bridge In AP + Bridge mode, the NWA3000-N series AP supports both AP and bridge connection at the same time. In the figure below, A and B use X as an AP to access the wired network, while X and Y communicate in bridge mode.
Page 23: Management Mode
Chapter 1 Introduction NWA3000-N series AP provides multiple virtual APs, each forming its own BSS and using its own individual SSID profile. You can assign different wireless and security settings to each SSID profile. This allows you to compartmentalize groups of users, set varying access privileges, and prioritize network traffic to and from certain BSSs.
Page 24: Ways To Manage The Nwa3000-N Series Ap
APs (M1 ~ M4). Figure 7 CAPWAP Network Example 1.4 Ways to Manage the NWA3000-N series AP You can use the following ways to manage the NWA3000-N series AP. Web Configurator The Web Configurator allows easy NWA3000-N series AP setup and management using an Internet browser.
Page 25: Good Habits For Managing The Nwa3000-N Series Ap
Chapter 1 Introduction Console Port You can use the console port to manage the NWA3000-N series AP using CLI commands. See the Command Reference Guide for more information about the CLI. The default settings for the console port are as follows.
Page 26: Hardware Connections
If you forget your password, you will have to reset the NWA3000-N series AP to its factory default settings. If you backed up an earlier configuration file, you won’t have to totally re-configure the NWA3000-N series AP;...
Page 27: Leds
Chapter 1 Introduction 1.7 LEDs The following are the LED descriptions for your NWA3000-N series AP. Figure 8 LEDs Table 2 LEDs LABEL COLOR STATUS DESCRIPTION WLAN Green The wireless LAN is active. Blinking The wireless LAN is active, and transmitting or receiving data.
Page 28 Table 2 LEDs (continued) LABEL COLOR STATUS DESCRIPTION ETHERNET Green The NWA3000-N series AP has a 10/100 Mbps Ethernet connection. Blinking The NWA3000-N series AP has a 10/100 Mbps Ethernet connection and is sending or receiving data. Yellow The NWA3000-N series AP has a 1000 Mbps Ethernet connection.
Page 29: Starting And Stopping The Nwa3000-N Series Ap
Chapter 1 Introduction 1.8 Starting and Stopping the NWA3000-N series Here are some of the ways to start and stop the NWA3000-N series AP. Always use Maintenance > Shutdown or the shutdown command before you turn off the NWA3000-N series AP or remove the power. Not doing so can cause the firmware to become corrupt.
Page 30 Chapter 1 Introduction NWA3000-N Series User’s Guide...
Page 31: The Web Configurator
H A P T E R The Web Configurator 2.1 Overview The NWA3000-N series AP Web Configurator allows easy management using an Internet browser. In order to use the Web Configurator, you must: • Use Internet Explorer 7.0 and later or Firefox 1.5 and later •...
Page 32: Access
Chapter 2 The Web Configurator 2.2 Access Make sure your NWA3000-N series AP hardware is properly connected. See the Quick Start Guide. Browse to https://192.168.1.2. The Login screen appears. Enter the user name (default: “admin”) and password (default: “1234”). Click Login. If you logged in using the default user name and password, the Update Admin Info screen appears.
Page 33: The Main Screen
2.3 The Main Screen The Web Configurator’s main screen is divided into these parts: Figure 9 The Web Configurator’s Main Screen • A - Title Bar • B - Navigation Panel • C - Main Window NWA3000-N Series User’s Guide...
Page 34: Title Bar
Use the menu items on the navigation panel to open screens to configure NWA3000-N series AP features. Click the arrow in the middle of the right edge of the navigation panel to hide the navigation panel menus or drag it to resize them.
Page 35: Monitor Menu
View Log Displays log entries for the NWA3000-N series AP. View AP Displays logs for connected APs. 2.3.2.3 Configuration Menu Use the configuration menu screens to configure the NWA3000-N series AP’s features. Table 6 Configuration Menu Screens Summary FOLDER OR FUNCTION...
Page 36 FUNCTION LINK Controller Configure how the NWA3000-N series AP handles APs that newly connect to the network. This is available when the NWA3000-N series AP is in controller mode. Edit wireless AP information, remove APs, and Management reboot them. MON Mode Configure how the NWA3000-N series AP monitors for rogue APs.
Page 37 Configure the system log, e-mail logs, and remote syslog servers. 2.3.2.4 Maintenance Menu Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and reboot or shut down the NWA3000-N series AP. Table 7 Maintenance Menu Screens Summary FOLDER OR FUNCTION...
Page 38: Warning Messages
Figure 13 Site Map 2.3.5 Object Reference Click Object Reference to open the Object Reference screen. Select the type of object and the individual object and click Refresh to show which configuration NWA3000-N Series User’s Guide...
Page 39 This field identifies the configuration item that references the object. Description If the referencing configuration item has a description configured, it displays here. Refresh Click this to update the information in this screen. Cancel Click Cancel to close the screen. NWA3000-N Series User’s Guide...
Page 40 Configurator rather than having to use a separate terminal program. In addition to logging in directly to the NWA3000-N series AP’s CLI, you can also log into other devices on the network through this Console. It uses SSH to establish a connection.
Page 41 Command Line Enter commands for the device that you are currently logged into here. If you are logged into the NWA3000-N series AP, see the CLI Reference Guide for details on using the command line to configure it. Device IP Address This is the IP address of the device that you are currently logged into.
Page 42 • You are using the latest version of the Java program (http://www.java.com). To login in through the Console: Click the Console button on the Web Configurator title bar. Enter the IP address of the NWA3000-N series AP and click OK. NWA3000-N Series User’s Guide...
Page 43 Enter the password and click OK. If your login is successful, the command line appears and the status bar at the bottom of the Console updates to reflect your connection state. NWA3000-N Series User’s Guide...
Page 44: Tables And Lists
• Sort in descending (reverse) alphabetical order • Select which columns to display • Group entries by field • Show entries in groups • Filter by mathematical operators (<, >, or =) or searching for text. NWA3000-N Series User’s Guide...
Page 45 Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. NWA3000-N Series User’s Guide...
Page 46 Click this to create a new entry. For features where the entry’s position in the numbered list is important (features where the NWA3000-N series AP applies the table’s entries in order like the firewall for example), you can select an entry and click Add to create a new entry after the selected entry.
Page 47 In some lists you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list. Figure 17 Working with Lists NWA3000-N Series User’s Guide...
Page 48 Chapter 2 The Web Configurator NWA3000-N Series User’s Guide...
Page 49: Configuration Basics
3.3 Feature Configuration Overview This section provides information about configuring the main features in the NWA3000-N series AP. The features are listed in the same sequence as the menu item(s) in the Web Configurator. Each feature description is organized as shown below.
Page 50: Feature
AP management entries, so there is no WHERE USED entry. 3.3.2 MGNT Mode Use this screen to set the NWA3000-N series AP to control other NWA3000-N series APs, work as a standalone AP, or be managed by another NWA3000-N series AP.
Page 51: Device Ha
3.3.5 Device HA To increase network reliability, device HA lets a backup NWA3000-N series AP automatically take over if a master NWA3000-N series AP fails. Device HA is available when the NWA3000-N series AP is in controller mode. Configuration > Device HA...
Page 52: Ap Profile
AP. Use Host Name to configure the system and domain name for the NWA3000-N series AP. Use Date/Time to configure the current date, time, and time zone in the NWA3000-N series AP. Use Console Speed to set the console speed. Use Language to select a language for the Web Configurator screens.
Page 53: Logs And Reports
Chapter 3 Configuration Basics 3.5.2 Logs and Reports The NWA3000-N series AP provides a system log, offers two e-mail profiles to which to send log messages, and sends information to four syslog servers. It can also e-mail you statistical reports on a daily basis.
Page 54 Chapter 3 Configuration Basics NWA3000-N Series User’s Guide...
Page 55: Chapter 4 Tutorials
Tutorials 4.1 Sample Network Setup This tutorial shows you how to use CAPWAP to have one NWA3000-N series AP control other NWA3000-N series APs to create a wireless network that allows two types of connections: staff and guest. Staff connections have full access to the network, while guests are limited to Internet access (DNS, HTTP and HTTPS services).
Page 56: Set The Management Modes
In this example, the guest VLAN (102) can only access the Internet while the staff VLAN (101) has access to all aspects of the network. 4.1.1 Set the Management Modes Use this section to set the management modes for the controller and managed APs. NWA3000-N Series User’s Guide...
Page 57: Set The Lan Ip Address And Management Vlan (Vlan99)
MODE screen to set them to be the managed APs using the Auto IP address option so they obtain the controller’s IP address from the DHCP server. Now you can no longer log into the web configurator of the managed NWA3000-N series APs; you must manage the NWA3000-N series AP through the controller AP on your network.
Page 58: Set Up Wireless User Authentication
Note: If you did not replace the factory default certificate with one that uses your NWA3000-N series AP's MAC address when you first logged into the NWA3000-N series AP, do it now in the Object > Certificate > My Certificates screen.
Page 59 Open the Configuration > System > Auth. Server screen. Turn on the authentication server and select the certificate to use. Click Apply. Open the Configuration > Object > User > User screen and click Add. The Add A User window opens. NWA3000-N Series User’s Guide...
Page 60: Create The Ap Profiles (Staff, Guest)
Finally, you will associate them with a radio profile which is applied to your AP’s radio transmitter. Open the Configuration > Object > AP Profile > SSID > Security List screen and then click the Add button. NWA3000-N Series User’s Guide...
Page 61 Under Security Mode, select 802.1X then set the Radius Server Type to Internal. Click OK. Next, open the Configuration > Object > AP Profile > SSID > SSID List screen and click the Add button. NWA3000-N Series User’s Guide...
Page 62 SSID profile with the same settings except ‘guest’ as the profile name and SSID and 102 for the VLAN ID. Open the Configuration > Object> AP Profile > Radio screen and then double-click the default entry. NWA3000-N Series User’s Guide...
Page 63: Rogue Ap Detection
4.2 Rogue AP Detection Rogue APs are wireless access points interacting with the network managed by the NWA3000-N series AP but which are not under the control of the network administrator. In short, they are a security risk because they circumvent network security policy.
Page 64 Chapter 4 Tutorials In this example, an employee illicitly connects his own AP (RG) to the network that the NWA3000-N series AP manages. While not necessarily a malicious act, it can nonetheless have severe security consequences on the network. Figure 20 Rogue AP Example A...
Page 65 Chapter 4 Tutorials Here, an attacker sets up a rogue AP (RG) outside the network, which he uses in an attempt to mimic an NWA3000-N series AP-controlled SSID in order to capture passwords and other information when authorized wireless clients mistakenly connect to it.
Page 66 AP scans each channel before moving on to the next. Scan Channel Mode: Set this to auto to automatically scan channels in the area. Click OK to save your changes. Next, click Configuration > Wireless > AP Management. NWA3000-N Series User’s Guide...
Page 67: Rogue Ap Containment
165. 4.2.1 Rogue AP Containment When the NWA3000-N series AP discovers a rogue AP within its broadcast radius, it can react in one of two ways: If the rogue AP is connected directly to the network (such as plugged into a switch downstream of the NWA3000-N series AP), then the network administrator must manually disconnect it.
Page 68 Figure 22 Containing a Rogue AP This tutorial shows you how to quarantine a rogue AP on your network: Click Configuration > Wireless > MON Mode. NWA3000-N Series User’s Guide...
Page 69: Load Balancing
The second response is to kick the connections until the AP is no longer considered overloaded. Both of these tactics are known as ‘load balancing’. This tutorial shows you how to configure the NWA3000-N series AP’s load balancing feature. NWA3000-N Series User’s Guide...
Page 70: Dynamic Channel Selection
Set the Mode. If you choose By Station Number, then enter the Max Station Number in the available field. This balances network traffic based on the number of specified stations downstream of the NWA3000-N series AP. If you choose By Traffic Level, then enter the traffic threshold at which the NWA3000-N series AP starts balancing connected stations.
Page 71 Select Enable Dynamic Channel Selection to turn on this feature. Set the DCS Time Interval. This is how often the NWA3000-N series AP surveys the other APs within its broadcast radius. If you place your APs in an area with a large number of competing APs, set this number lower to ensure that your device can adjust quickly changing conditions.
Page 72 Chapter 4 Tutorials NWA3000-N Series User’s Guide...
Page 73: Part Ii: Technical Reference
Technical Reference...
Page 75: Chapter 5 Dashboard
H A P T E R Dashboard 5.1 Overview Use the Dashboard screens to check status information about the NWA3000-N series AP. 5.1.1 What You Can Do in this Chapter • The main Dashboard screen (Section 5.2 on page 76) displays the NWA3000-N series AP’s general device information, system status, system resource usage,...
Page 76: Dashboard
Chapter 5 Dashboard 5.2 Dashboard This screen is the first thing you see when you log into the NWA3000-N series AP. It also appears every time you click the Dashboard icon in the navigation panel. The Dashboard displays general device information, system status, system resource usage, and interface status in widgets that you can re-arrange to suit your needs.
Page 77 MAC address is assigned to the first radio, and so on. Firmware This field displays the version number and date of the firmware the Version NWA3000-N series AP is currently running. Click the icon to open the screen where you can upload firmware. System Resources CPU Usage This field displays what percentage of the NWA3000-N series AP’s...
Page 78 Management This shows whether the NWA3000-N series AP is set to control other Mode NWA3000-N series APs, work as a stand alone AP, or be controlled by another NWA3000-N series AP. Interface Status If an Ethernet interface does not have any physical ports associated Summary with it, its entry is displayed in light gray text.
Page 79 Click Renew to send a new DHCP request to a DHCP server. Top 5 Station When the NWA3000-N series AP is in controller mode this displays the top 5 Access Points (AP) with the highest number of station (aka wireless client) connections during the past 24 hours.
Page 80: Cpu Usage
This displays the number of wireless clients connected to the NWA3000-N series AP. 5.2.1 CPU Usage Use this screen to look at a chart of the NWA3000-N series AP’s recent CPU usage. To access this screen, click CPU Usage in the dashboard. Figure 24 Dashboard > CPU Usage The following table describes the labels in this screen.
Page 81: Memory Usage
Chapter 5 Dashboard 5.2.2 Memory Usage Use this screen to look at a chart of the NWA3000-N series AP’s recent memory (RAM) usage. To access this screen, click Memory Usage in the dashboard. Figure 25 Dashboard > Memory Usage The following table describes the labels in this screen.
Page 82 Chapter 5 Dashboard NWA3000-N Series User’s Guide...
Page 83: Chapter 6 Monitor
• The AP List screen (Section 6.4 on page 87) displays which APs are currently connected to the NWA3000-N series AP. This is available when the NWA3000-N series AP is in controller mode. • The Radio List screen (Section 6.5 on page...
Page 84: Lan Status
Click this to set the Poll Interval the screen uses. Stop Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval. Interface Summary NWA3000-N Series User’s Guide...
Page 85 This field displays the port speed and duplex setting (Full or Half). HA Status This is available when the NWA3000-N series AP is in controller mode. This field displays the status of the interface in the virtual router. Active - This interface is the master interface in the virtual router.
Page 86: Lan Status Graph
6.3.1 LAN Status Graph Use the port statistics graph to look at a line graph of packet statistics for the NWA3000-N series AP’s physical LAN port. To view, in the LAN Status screen click the Switch to Graphic View button.
Page 87: Ap List
Use this screen to view which APs are currently connected to the NWA3000-N series AP. This is available when the NWA3000-N series AP is in controller mode. To access this screen, click Monitor > Wireless > AP Information > AP List.
Page 88 LABEL DESCRIPTION Add to Mgnt AP When the NWA3000-N series AP is in controller mode, it lists the List compatible NWA3000-N series APs it detects in this screen. Select an entry where the Status displays an AP icon with a question mark (?) and click this button to have the NWA3000-N series AP manage it.
Page 89: Station Count Of Ap
This field displays the date and time the information in the window was last updated. 6.5 Radio List Use this screen to view statistics for the NWA3000-N series AP’s wireless radio transmitters when it is in standalone mode or the radios in each of the APs NWA3000-N Series User’s Guide...
Page 90 Chapter 6 Monitor connected to the NWA3000-N series AP when it is in controller mode. To access this screen, click Monitor > Wireless > AP Information > Radio List. Figure 30 Monitor > Wireless > AP Information > Radio List (Controller Mode) The following table describes the labels in this screen.
Page 91: Ap Mode Radio Information
24 hours. To access this window, click the More Information button in the Radio List Statistics screen. Figure 31 Monitor > Wireless > AP Information > Radio List > More Information NWA3000-N Series User’s Guide...
Page 92 VLAN This displays the VLAN ID associated with the SSID. WDS Link When the NWA3000-N series AP is in standalone mode and you set the Detail wireless operating mode to AP+Bridge or Bridge/Repeater this displays information about the Wireless Distribution System (WDS) connections.
Page 93: Station List
This is the station’s index number in this list. MAC Address This is the station’s MAC address. Associated AP This is available when the NWA3000-N series AP is in controller mode. This indicates the AP through which the station is connected to the network. SSID Name This indicates the name of the wireless network to which the station is connected.
Page 94: Rogue Ap
Wireless > Rogue AP > Detected Device to access this screen. Note: The NWA3000-N series AP or at least one of the APs the NWA3000-N series AP is managing must be set to Monitor mode in order to detect other wireless devices in its vicinity.
Page 95: Legacy Device Info
Click this to refresh the items displayed on this page. 6.8 Legacy Device Info When the NWA3000-N series AP is in controller mode you can use this screen to configure and maintain a list of compatible legacy (NWA-3000 series) APs. Use the list to link to their Web Configurators.
Page 96: Legacy Device Info Add Or Edit
Enter the legacy AP’s IP address. Address Description Enter a description to help you identify the legacy AP. Click OK to save your changes back to the NWA3000-N series AP. Cancel Click Cancel to exit this screen without saving your changes. 6.9 View Log Log messages are stored in two separate logs, one for regular log messages and one for debugging messages.
Page 97 • For individual log descriptions, see Appendix A on page 285. • For the maximum number of log messages in the NWA3000-N series AP, see Chapter 22 on page 279. Events that generate an alert (as well as a log message) display in red. Regular logs display in black.
Page 98 This field displays the priority of the log message. It has the same range of values as the Priority field above. Category This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields. NWA3000-N Series User’s Guide...
Page 99 Note This field displays any additional information about the log message. The Web Configurator saves the filter settings if you leave the View Log screen and return to it later. NWA3000-N Series User’s Guide...
Page 100: View Ap Log
- Indicates the query has not been initialized. querying - Indicates the query is in process. fail - Indicates the query failed. success - Indicates the query succeeded. AP Information This displays the MAC address for the selected AP. NWA3000-N Series User’s Guide...
Page 101 This indicates the time that the log messages was created or recorded on the AP. Priority This indicates the selected log message’s priority. Category This indicates the selected log message’s category. Message This displays content of the selected log message. NWA3000-N Series User’s Guide...
Page 102 DESCRIPTION Source This displays the source IP address of the selected log message. Destination This displays the source IP address of the selected log message. Note This displays any notes associated with the selected log message. NWA3000-N Series User’s Guide...
Page 103: Chapter 7 Management Mode
7.1 Overview This chapter discusses using the NWA3000-N series AP in management mode, which determines whether the NWA3000-N series AP is used in its default standalone mode, or as part of a Control And Provisioning of Wireless Access Points (CAPWAP) network.
Page 104: Capwap Discovery And Management
DTLS pre-shared key. The managed AP is ready for association with wireless clients. 7.2.2 Managed AP Finds the Controller A managed NWA3000-N series AP can find the controller in one of the following ways: • Manually specify the controller’s IP address using the commands. See the NWA3000-N series AP CLI Reference Guide for details.
Page 105: Notes On Capwap
7.3 The Management Mode Screen Use this screen to configure the NWA3000-N series AP as an a controller of managed NWA3000-N series APs, a standalone AP, or a managed AP.
Page 106 Chapter 7 Management Mode Note: After you change the operation mode, the NWA3000-N series AP resets to its default settings for the mode you set it to, including the IP address of 192.168.1.2. It also backs up its configuration to a xxx-backup.conf file where xxx denotes the mode the NWA3000-N series AP was previously using.
Page 107: Chapter 8 Lan Setting
DNS server fields. • If your ISP dynamically assigns the DNS server IP addresses (along with the NWA3000-N series AP’s WAN IP address), set the DNS server fields to get the DNS server address from the ISP.
Page 108: Lan Setting
Chapter 8 LAN Setting 8.2 LAN Setting This screen lists every Ethernet interface. To access this screen, click Configuration > LAN Setting. Figure 41 Configuration > LAN Setting NWA3000-N Series User’s Guide...
Page 109 NWA3000-N series AP uses them in sequence. A hyphen (-) displays for the default DNS server address entry. The NWA3000-N series AP uses this default entry if it cannot get a reply for any of the other servers. Type...
Page 110: Add Or Edit A Dns Setting
This is the IP address of a DNS server. This field displays N/A if you have the NWA3000-N series AP get a DNS server IP address from the ISP dynamically but the LAN interface is using a static IP address.
Page 111: Chapter 9 Wireless
(Section 9.3 on page 113) manages the NWA3000-N series AP’s general wireless settings if it is in standalone mode or the general wireless settings of all of the NWA3000-N series AP‘s managed APs if the NWA3000-N series AP is in controller mode.
Page 112: Controller
AP does not become overloaded. 9.2 Controller Use this screen to set how the NWA3000-N series AP allows new APs to connect to the network. This is available when the NWA3000-N series AP is in controller mode.
Page 113: Ap Management
Chapter 9 Wireless 9.3 AP Management Use this screen to manage all of the APs connected to the NWA3000-N series AP. Click Configuration > Wireless > AP Management to access this screen. This screen manages the NWA3000-N series AP’s general wireless settings if it is in standalone mode or the general wireless settings of all of the NWA3000-N series AP’s managed APs if the NWA3000-N series AP is in controller mode.
Page 114 R1 Mode / Profile This field displays the AP or MON profile for Radio 1. R2 Mode / Profile If the NWA3000-N series AP has a second radio this field displays the AP or MON profile for Radio 2. NWA3000-N Series User’s Guide...
Page 115: Edit Ap List
This field displays the AP’s hardware model information. It displays “N/A” (not applicable) only when the AP disconnects from the NWA3000-N series AP and the information is unavailable as a result. Description Enter a description for this AP. You can use up to 31 characters, spaces and underscores allowed.
Page 116: Mon Mode
Select the operating mode for radio 1. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the NWA3000-N series AP to be managed (or subsequently passed on to an upstream gateway for managing).
Page 117 This field indicates the selected AP’s containment status. Role This field indicates whether the selected AP is a rogue-ap or a friendly-ap. To change the AP’s role, click the Edit button. MAC Address This field indicates the AP’s radio MAC address. NWA3000-N Series User’s Guide...
Page 118: Add/Edit Rogue/Friendly List
Click this button to export the current list of either rogue APs or friendly APS. Apply Click Apply to save your changes back to the NWA3000-N series Reset Click Reset to return the screen to its last-saved settings. 9.4.1 Add/Edit Rogue/Friendly List Select an AP and click the Edit button in the Configuration >...
Page 119: Load Balancing
Chapter 9 Wireless Table 41 Configuration > Wireless > MON Mode > Add/Edit Rogue/Friendly LABEL DESCRIPTION Click OK to save your changes back to the NWA3000-N series AP. Cancel Click Cancel to close the window with changes unsaved. 9.5 Load Balancing Use this screen to configure wireless network traffic load balancing between the APs on your network.
Page 120: Disassociating And Delaying Connections
AP will be kicked continuously and never be allowed to connect. Apply Click Apply to save your changes back to the NWA3000-N series AP. Reset Click Reset to return the screen to its last-saved settings. 9.5.1 Disassociating and Delaying Connections When your AP becomes overloaded, there are two basic responses it can take.
Page 121 Connections are kicked based on either idle timeout or signal strength. The NWA3000-N series AP first looks to see which devices have been idle the longest, then starts kicking them in order of highest idle time. If no connections are idle, the next criteria the NWA3000-N series AP analyzes is signal strength.
Page 122: Dcs
Table 43 Configuration > Wireless > DCS LABEL DESCRIPTION Enable Dynamic Select this to have the NWA3000-N series AP automatically select the Channel Selection radio channel upon which it broadcasts by scanning the area around it and determining what channels are currently being used by other devices.
Page 123 On the other hand, if you know there are numerous other devices in the region, you should set the level to High to keep the interference to a minimum. In this case, the NWA3000-N series AP’s tolerance for interference is quite strict.
Page 124: Technical Reference
Channels selected list. Apply Click Apply to save your changes back to the NWA3000-N series AP. Reset Click Reset to return the screen to its last-saved settings.
Page 125 AP, signal strength, activity, and so on. Finally, there is an alternative four channel scheme for ETSI, consisting of channels 1, 5, 9, 13. This offers significantly less overlap that the other one. Figure 55 An Alternative Four-Channel Deployment NWA3000-N Series User’s Guide...
Page 126 AP instead limits the incoming connections as a means to maintain bandwidth integrity. There are two kinds of wireless load balancing available on the NWA3000-N series Load balancing by station number limits the number of devices allowed to connect to your AP.
Page 127: Chapter 10 Device Ha
H A P T E R Device HA 10.1 Overview Device HA is available when the NWA3000-N series AP is in controller mode. Device HA lets a backup NWA3000-N series AP (also in controller mode) automatically take over if the master NWA3000-N series AP fails.
Page 128: What You Need To Know
You can configure a separate management IP address for each interface. You can use it to access the NWA3000-N series AP for management whether the NWA3000-N series AP is the master or a backup. The management IP address should be in the same subnet as the interface IP address.
Page 129: Device Ha General
This screen lets you enable or disable device HA, and displays which device HA mode the NWA3000-N series AP is set to use along with a summary of the monitored interfaces. Click Configuration > Device HA > General to display.
Page 130 NWA3000-N series AP’s interfaces loses its connection, the master NWA3000-N series AP forces all of its interfaces to the fault state so the backup NWA3000-N series AP can take over all of the master NWA3000-N series AP’s functions.
Page 131: Active-Passive Mode
The Device HA Active-Passive Mode screen lets you configure general active- passive mode device HA settings, view and manage the list of monitored interfaces, and synchronize backup NWA3000-N series APs. To access this screen, click Configuration > Device HA > Active-Passive Mode.
Page 132 APs in the same virtual router (same cluster ID). Backup - This NWA3000-N series AP is a backup NWA3000-N series AP in the virtual router. This NWA3000-N series AP does not use any of the virtual IP addresses. Priority This field is available for a backup NWA3000-N series AP.
Page 133 IP address (the virtual router IP address). Server Address If this NWA3000-N series AP is set to backup role, enter the IP address or Fully-Qualified Domain Name (FQDN) of the NWA3000-N series AP from which to get updated configuration. Usually, you should enter the IP address or FQDN of a virtual router on a secure network.
Page 134: Edit Monitored Interface
If you leave this field blank in the master NWA3000-N series AP, no backup NWA3000-N series APs can synchronize from it. If you leave this field blank in a backup NWA3000-N series AP, it cannot synchronize from the master NWA3000-N series AP.
Page 135: Technical Reference
The following section contains additional technical information about the features described in this chapter. Virtual Router The master and backup NWA3000-N series AP form a single ‘virtual router’. In the following example, master NWA3000-N series AP A and backup NWA3000-N series AP B form a virtual router.
Page 136 ID to identify each virtual router. In the following example, NWA3000-N series APs A and B form a virtual router that uses cluster ID 1. NWA3000-N series APs C and D form a virtual router that uses cluster ID 2.
Page 137: Chapter 11 User
This chapter describes how to set up user accounts and user settings for the NWA3000-N series AP. You can also set up rules that control when users have to log in to the NWA3000-N series AP before the NWA3000-N series AP routes traffic for them.
Page 138: User Summary
Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The NWA3000-N series AP confirms you want to remove it before doing so. Object...
Page 139: Add/Edit User
- this user can look at the configuration of the NWA3000-N series AP but not to change it • user - this user has access to the NWA3000-N series AP’s services but cannot look at the configuration Description This field displays the description for each user.
Page 140 - this user can look at and change the configuration of the NWA3000-N series AP • limited-admin - this user can look at the configuration of the NWA3000-N series AP but not to change it • user - this is used for embedded RADIUS server and SNMPv3 user access...
Page 141: Setting
This screen controls default settings, login settings, lockout settings, and other user settings for the NWA3000-N series AP. You can also use this screen to specify when users must log in to the NWA3000-N series AP before it routes traffic for them.
Page 142 Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. This field is a sequential value, and it is not associated with a specific entry. NWA3000-N Series User’s Guide...
Page 143 Table 50 Configuration > Object > User > Setting (continued) LABEL DESCRIPTION User Type These are the kinds of user account the NWA3000-N series AP supports. • admin - this user can look at and change the configuration of the NWA3000-N series AP •...
Page 144: Edit User Authentication Timeout Settings
- this user can look at the configuration of the NWA3000-N series AP but not to change it • user - this user has access to the NWA3000-N series AP’s services but cannot look at the configuration Lease Time Enter the number of minutes this type of user account has to renew the current session before the user is logged out.
Page 145 Type the number of minutes this type of user account can be logged Time into the NWA3000-N series AP in one session before the user has to log in again. You can specify 1 to 1440 minutes. You can enter 0 to make the number of minutes unlimited.
Page 146 Chapter 11 User NWA3000-N Series User’s Guide...
Page 147: Chapter 12 Ap Profile
The following terms and concepts may help as you read this chapter. Wireless Profiles At the heart of all wireless AP configurations on the NWA3000-N series AP are profiles. A profile represents a group of saved settings that you can use across any number of connected APs.
Page 148 MAC addresses. If a client’s MAC address is on the list, then it is either allowed or denied, depending on how you set up the MAC Filter profile. You can have a maximum of 32 MAC filtering profiles on the NWA3000-N series AP. SSID The SSID (Service Set IDentifier) is the name that identifies the Service Set with which a wireless station is associated.
Page 149: Radio
This screen allows you to create radio profiles for the APs on your network. A radio profile is a list of settings that an NWA3000-N series AP AP can use to configure either one of its two radio transmitters. To access this screen click Configuration >...
Page 150: Add/Edit Radio Profile
This screen allows you to create a new radio profile or edit an existing one. To access this screen, click the Add button or select a radio profile from the list and click the Edit button. Figure 67 Configuration > Object > AP Profile > Add/Edit Profile (Standalone Mode) NWA3000-N Series User’s Guide...
Page 151 Enter up to 31 alphanumeric characters to be used as this profile’s name. Spaces and underscores are allowed. Operating This displays if the NWA3000-N series AP is set to standalone mode. Mode Select AP+Bridge to have the radio function as an access point and bridge simultaneously.
Page 152 APs in an area, decrease the output power of the NWA5160N to reduce interference with other APs. Select one of the following 100%(Full Power), 50%, 25%, or 12.5%. See the product specifications for more information on your NWA3000-N series AP’s output power. Note: Reducing the output power also reduces the NWA3000-N series AP’s effective broadcast radius.
Page 153 This section displays if you set the Operating Mode to AP+Bridge or Bridge/Repeater. Configure the security settings for the NWA3000-N series AP’s Wireless Distribution System (WDS), the wireless connection between two or more APs. Select No Security to not encrypt the traffic between APs.
Page 154: Ssid
SSID Profile Indicates which SSID profile is associated with this radio profile. Click OK to save your changes back to the NWA3000-N series AP. Cancel Click Cancel to exit this screen without saving your changes.
Page 155 Chapter 12 AP Profile Note: You can have a maximum of 32 SSID profiles on the NWA3000-N series AP. Figure 68 Configuration > Object > AP Profile > SSID List The following table describes the labels in this screen. Table 54 Configuration > Object > AP Profile > SSID List...
Page 156 Security Profile Select a security profile from this list to associate with this SSID. If none exist, you can use the Create new Object menu to create one. Note: It is highly recommended that you create security profiles for all of your SSIDs to enhance your network security. NWA3000-N Series User’s Guide...
Page 157 For example, an SSID that only has network printers connected to it. VLAN ID Enter a VLAN ID for the NWA3000-N series AP to use to tag traffic originating from this SSID. Hidden SSID Select this if you want to “hide”...
Page 158: Security List
To access this screen click Configuration > Object > AP Profile > SSID > Security List. Note: You can have a maximum of 32 security profiles on the NWA3000-N series AP. Figure 70 Configuration > Object > AP Profile > SSID > Security List The following table describes the labels in this screen.
Page 159 Select internal to use the NWA3000-N series AP’s internal Type authentication database, or external to use an external RADIUS server for authentication. Primary / Select this to have the NWA3000-N series AP use the specified Secondary Radius RADIUS server. Server Activate Radius Server...
Page 160 Share Secret be shared between the external accounting server and the NWA3000- N series AP. The key must be the same on the external accounting server and your NWA3000-N series AP. The key is not sent over the network. Reauthentication Enter the interval (in seconds) between authentication requests.
Page 161: Mac Filter List
SSIDs. To access this screen click Configuration > Object > AP Profile > SSID > MAC Filter List. Note: You can have a maximum of 32 MAC filtering profiles on the NWA3000-N series Figure 72 Configuration > Object > AP Profile > SSID > MAC Filter List The following table describes the labels in this screen.
Page 162 Select allow to permit the wireless client with the MAC addresses in this profile to connect to the network through the associated SSID; select deny to block the wireless clients with the specified MAC addresses. Click this to add a MAC address to the profile’s list. NWA3000-N Series User’s Guide...
Page 163 This field specifies a MAC address associated with this profile. Description This field displays a description for the MAC address associated with this profile. You can click the description to make it editable. Enter up to 60 characters, spaces and underscores allowed. NWA3000-N Series User’s Guide...
Page 164 Chapter 12 AP Profile NWA3000-N Series User’s Guide...
Page 165: Chapter 13 Mon Profile
Passive Scan A passive scan is performed when an 802.11-compatible monitoring device is set to periodically listen to a specified channel or number of channels for other wireless devices broadcasting on the 802.11 frequencies. NWA3000-N Series User’s Guide...
Page 166: Mon Profile
This field is a sequential value, and it is not associated with a specific profile. Status This field shows whether or not the entry is activated. Profile Name This field indicates the name assigned to the monitor profile. NWA3000-N Series User’s Guide...
Page 167: Add/Edit Mon Profile
Select auto to have the AP switch to the next sequential channel Mode once the Channel dwell time expires. Select manual to set specific channels through which to cycle sequentially when the Channel dwell time expires. Selecting this options makes the Scan Channel List options available. NWA3000-N Series User’s Guide...
Page 168: Technical Reference
Scan Channel Mode is set to manual. These channels are limited to the 5 GHz range (802.11 a/n). Click OK to save your changes back to the NWA3000-N series AP. Cancel Click Cancel to exit this screen without saving your changes.
Page 169 (those from recognized networks, for example). It is recommended that you export (save) your list of friendly APs often, especially if you have a network with a large number of access points. NWA3000-N Series User’s Guide...
Page 170 Chapter 13 MON Profile NWA3000-N Series User’s Guide...
Page 171: Chapter 14 Certificates
185) save CA certificates and trusted remote host certificates to the NWA3000-N series AP. The NWA3000-N series AP trusts any valid certificate that you have imported as a trusted certificate. It also trusts any valid certificate signed by any of the certificates that you have imported as a trusted certificate.
Page 172 A certification path is the hierarchy of certification authority certificates that validate a certificate. The NWA3000-N series AP does not trust a certificate if any certificate on its path has expired or been revoked.
Page 173: Verifying A Certificate
• Key distribution is simple and very secure since you can freely distribute public keys and you never need to transmit private keys. Self-signed Certificates You can have the NWA3000-N series AP act as a certification authority and sign its own certificates. Factory Default Certificate The NWA3000-N series AP generates its own unique self-signed certificate when you first turn it on.
Page 174 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. NWA3000-N Series User’s Guide...
Page 175: My Certificates
When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates. Click this to go to the screen where you can have the NWA3000-N series AP generate a certificate or a certification request. Edit Double-click an entry or select it and click Edit to open a screen with an in-depth list of information about the certificate.
Page 176 Expired! message if the certificate has expired. Import Click Import to open a screen where you can save a certificate to the NWA3000-N series AP. Refresh Click Refresh to display the current validity status of the certificates. NWA3000-N Series User’s Guide...
Page 177: Add My Certificates
Click Configuration > Object > Certificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the NWA3000-N series AP create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request.
Page 178 Enrollment Options These radio buttons deal with how and when the certificate is to be generated. Create a self- Select this to have the NWA3000-N series AP generate the signed certificate certificate and act as the Certification Authority (CA) itself. This way you do not need to apply to a certification authority for certificates.
Page 179 Table 63 Configuration > Object > Certificate > My Certificates > Add (continued) LABEL DESCRIPTION Create a Select this to have the NWA3000-N series AP generate and store a certification request for a certificate. Use the My Certificate Details screen to request and save it...
Page 180 Create screen. Click Return and check your information in the My Certificate Create screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the NWA3000-N series AP to enroll a certificate online.
Page 181: Edit My Certificates
Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificate’s name. Figure 79 Configuration > Object > Certificate > My Certificates > Edit NWA3000-N Series User’s Guide...
Page 182 (along with the certificate itself). If the certificate is a self-signed certificate, the certificate itself is the only one in the list. The NWA3000-N series AP does not trust the certificate and displays “Not trusted” in this field if any certificate on the path has expired or been revoked.
Page 183 This field does not display for a certification request. MD5 Fingerprint This is the certificate’s message digest that the NWA3000-N series AP calculated using the MD5 algorithm. SHA1 Fingerprint This is the certificate’s message digest that the NWA3000-N series AP...
Page 184: Import Certificates
Table 64 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Click OK to save your changes back to the NWA3000-N series AP. You can only change the name. Cancel Click Cancel to quit and return to the My Certificates screen.
Page 185: Trusted Certificates
Trusted Certificates screen. This screen displays a summary list of certificates that you have set the NWA3000-N series AP to accept as trusted. The NWA3000-N series AP also accepts any valid certificate signed by a certificate on this list as being trustworthy;...
Page 186 Table 66 Configuration > Object > Certificate > Trusted Certificates (continued) LABEL DESCRIPTION Object You cannot delete certificates that any of the NWA3000-N series AP’s Reference features are configured to use. Select an entry and click Object References to open a screen that shows which settings use the entry.
Page 187: Edit Trusted Certificates
Edit icon to open the Trusted Certificates Edit screen. Use this screen to view in-depth information about the certificate, change the certificate’s name and set whether or not you want the NWA3000-N series AP to check a certification authority’s list of revoked certificates before trusting a certificate issued by the certification authority.
Page 188 Certificate Status Protocol). Type the protocol, IP address and pathname of the OCSP server. The NWA3000-N series AP may need to authenticate itself in order to assess the OCSP server. Type the login name (up to 31 ASCII characters) from the entity maintaining the server (usually a certification authority).
Page 189 MD5 Fingerprint This is the certificate’s message digest that the NWA3000-N series AP calculated using the MD5 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate.
Page 190: Import Trusted Certificates
Click this button and then Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. Click OK to save your changes back to the NWA3000-N series AP. You can only change the name. Cancel Click Cancel to quit and return to the Trusted Certificates screen.
Page 191: Technical Reference
OCSP OCSP (Online Certificate Status Protocol) allows an application or device to check whether a certificate is valid. With OCSP the NWA3000-N series AP checks the status of individual certificates instead of downloading a Certificate Revocation List (CRL). OCSP has two main advantages over a CRL. The first is real-time status information.
Page 192 Chapter 14 Certificates NWA3000-N Series User’s Guide...
Page 193: System
• The Console Speed screen (Section 15.4 on page 199) configures the console port speed when you connect to the NWA3000-N series AP via the console port using a terminal emulation program. • The WWW screens (Section 15.5 on page 200) configure settings for HTTP or HTTPS access to the NWA3000-N series AP.
Page 194: Host Name
15.3 Date and Time For effective scheduling and logging, the NWA3000-N series AP system time must be accurate. The NWA3000-N series AP has a software mechanism to set the time manually or get the current time and date from an external server.
Page 195 Chapter 15 System To change your NWA3000-N series AP’s time based on your local time zone and date, click Configuration > System > Date/Time. The screen displays as shown. You can manually set the NWA3000-N series AP’s time and date or have the NWA3000-N series AP get the date and time from a time server.
Page 196 When you set Time and Date Setup to Manual, enter the new date in this field and then click Apply. Get from Time Select this radio button to have the NWA3000-N series AP get the time Server and date from the time server you specify below. The NWA3000-N series AP requests time and date settings from the time server under the following circumstances.
Page 197: Pre-Defined Ntp Time Servers List
Click Reset to return the screen to its last-saved settings. 15.3.1 Pre-defined NTP Time Servers List When you turn on the NWA3000-N series AP for the first time, the date and time start at 2003-01-01 00:00:00. The NWA3000-N series AP then attempts to synchronize with one of the following pre-defined list of Network Time Protocol (NTP) time servers.
Page 198: Time Server Synchronization
As an option you can select the Enable Daylight Saving check box to adjust the NWA3000-N series AP clock for daylight savings. Click Apply. To get the NWA3000-N series AP date and time from a time server: Click System > Date/Time. Select Get from Time Server under Time and Date Setup.
Page 199: Console Speed
15.4 Console Speed This section shows you how to set the console port speed when you connect to the NWA3000-N series AP via the console port using a terminal emulation program. Table 1 on page 25 for default console port settings.
Page 200: Www Overview
Telnet management access are not secure. Figure 88 Secure and Insecure Service Access From the WAN 15.5.1 Service Access Limitations A service cannot be used to access the NWA3000-N series AP when you have disabled that service in the corresponding screen. 15.5.2 System Timeout There is a lease timeout for administrators.
Page 201: Configuring Www Service Control
Chapter 14 on page for more information). HTTPS on the NWA3000-N series AP is used so that you can securely access the NWA3000-N series AP using the Web Configurator. The SSL protocol specifies that the HTTPS server (the NWA3000-N series AP) must always authenticate itself to...
Page 202 Certificates SSL client to authenticate itself to the NWA3000-N series AP by sending the NWA3000-N series AP a certificate. To do that the SSL client must have a CA-signed certificate from a CA that has been imported as a trusted CA on the NWA3000-N series AP.
Page 203: Https Example
Click Reset to return the screen to its last-saved settings. 15.5.5 HTTPS Example If you haven’t changed the default HTTPS port on the NWA3000-N series AP, then in your browser enter “https://NWA3000-N series AP IP Address/” as the web site address where “NWA3000-N series AP IP Address”...
Page 204: Login Screen
The SSL client needs a certificate if Authenticate Client Certificates is selected on the NWA3000-N series AP. You must have imported at least one trusted CA to the NWA3000-N series AP in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).
Page 205 Chapter 15 System Apply for a certificate from a Certification Authority (CA) that is trusted by the NWA3000-N series AP (see the NWA3000-N series AP’s Trusted CA Web Configurator screen). Figure 93 Trusted Certificates The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s).
Page 206 CA to produce a screen similar to the one shown next Click Next to begin the wizard. The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. NWA3000-N Series User’s Guide...
Page 207 Enter the password given to you by the CA. Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. NWA3000-N Series User’s Guide...
Page 208 You should see the following screen when the certificate is correctly installed on your computer. 15.5.5.7 Using a Certificate When Accessing the NWA3000-N series To access the NWA3000-N series AP via HTTPS: Enter ‘https://NWA3000-N series AP IP Address/ in your browser’s web address field. NWA3000-N Series User’s Guide...
Page 209: Ssh
When Authenticate Client Certificates is selected on the NWA3000-N series AP, the following screen asks you to select a personal certificate to send to the NWA3000-N series AP. This screen displays even if you only have a single certificate as in the example.
Page 210: How Ssh Works
Chapter 15 System to securely connect to the WAN port of the NWA3000-N series AP (A) for a management session. Figure 94 SSH Communication Over the WAN Example 15.6.1 How SSH Works The following figure is an example of how a secure connection is established between two remote hosts using SSH v1.
Page 211: Ssh Implementation On The Nwa3000-N Series Ap
22 (by default). 15.6.3 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the NWA3000-N series AP over SSH. NWA3000-N Series User’s Guide...
Page 212: Configuring Ssh
NWA3000-N series AP CLI using this service. Version 1 Select the check box to have the NWA3000-N series AP use both SSH version 1 and version 2 protocols. If you clear the check box, the NWA3000-N series AP uses only SSH version 2 protocol.
Page 213: Examples Of Secure Telnet Using Ssh
A window displays prompting you to store the host key in you computer. Click Yes to continue. Figure 97 SSH Example 1: Store Host Key Enter the password to log in to the NWA3000-N series AP. The CLI screen displays next. 15.6.5.2 Example 2: Linux This section describes how to access the NWA3000-N series AP using the OpenSSH client program that comes with most Linux distributions.
Page 214: Telnet
Enter “ssh –1 192.168.1.2”. This command forces your computer to connect to the NWA3000-N series AP using SSH version 1. If this is the first time you are connecting to the NWA3000-N series AP using SSH, a message displays prompting you to save the host information of the NWA3000-N series AP.
Page 215: Ftp
Apply Click Apply to save your changes back to the NWA3000-N series AP. Reset Click Reset to return the screen to its last-saved settings.
Page 216 NWA3000-N series AP for FTP connections. You must have certificates already configured in the My Certificates screen. Apply Click Apply to save your changes back to the NWA3000-N series AP. Reset Click Reset to return the screen to its last-saved settings.
Page 217: Snmp
Your NWA3000-N series AP supports SNMP agent functionality, which allows a manager station to manage and monitor the NWA3000-N series AP through the network. The NWA3000-N series AP supports SNMP version one (SNMPv1), version two (SNMPv2c), and version three (SNMPv3).
Page 218: Supported Mibs
You can download the NWA3000-N series AP’s MIBs from www.zyxel.com. 15.9.2 SNMP Traps The NWA3000-N series AP will send traps to the SNMP manager when any one of the following events occurs. Table 77 SNMP Traps...
Page 219: Configuring Snmp
Chapter 15 System 15.9.3 Configuring SNMP To change your NWA3000-N series AP’s SNMP settings, click Configuration > System > SNMP tab. The screen appears as shown. Use this screen to configure your SNMP settings. You can also configure profiles that define allowed SNMPv3 access.
Page 220: Adding Or Editing An Snmpv3 User Profile
Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The NWA3000-N series AP confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action.
Page 221: Internal Radius Server
Click Cancel to exit this screen without saving your changes. 15.10 Internal RADIUS Server The NWA3000-N series AP can use its internal Remote Authentication Dial In User Service (RADIUS) server to authenticate the wireless clients of trusted APs. RADIUS is a protocol that enables you to control access to a network by authenticating user credentials.
Page 222: Configuring The Internal Radius Server
Object > Users screen’s list so that the RADIUS server can be authenticated. Note: The NWA3000-N series AP can function as an AP and as a RADIUS server at the same time. 15.10.1 Configuring the Internal RADIUS Server Use this screen to turn the NWA3000-N series AP’s internal RADIUS server off or...
Page 223 The following table describes the labels in this screen. Table 80 Configuration > System > Auth. Server LABEL DESCRIPTION Enable Select this to have the NWA3000-N series AP use its internal RADIUS Authentication server to authenticate wireless clients connecting to trusted APs. Server Authentication Select the certificate the NWA3000-N series AP’s internal RADIUS...
Page 224: Adding Or Editing A Trusted Ap Profile
This field shows the information listed to help identify the trusted AP profile. Apply Click OK to save your changes back to the NWA3000-N series AP. Reset Click Reset to start configuring this screen afresh. 15.10.2 Adding or Editing a Trusted AP Profile This screen allows you to add or edit an internal RADIUS server trusted AP profile.
Page 225: Technical Reference
AP. The key is not sent over the network. This key must be the same on the NWA3000-N series AP and the AP. Both the NWA3000-N series AP’s IP address and this shared secret must also be configured in the “external RADIUS” server fields of the trusted Description Type some information to help identify the trusted AP.
Page 226 Chapter 15 System NWA3000-N Series User’s Guide...
Page 227: Chapter 16 Log And Report
16.2 Email Daily Report Use this screen to start or stop data collection and view various statistics about traffic passing through your NWA3000-N series AP. Note: Data collection may decrease the NWA3000-N series AP’s traffic throughput rate. NWA3000-N Series User’s Guide...
Page 228 Chapter 16 Log and Report Click Configuration > Log & Report > Email Daily Report to display the following screen. Configure this screen to have the NWA3000-N series AP e-mail you system statistics every day. Figure 108 Configuration > Log & Report > Email Daily Report (Standalone Mode)
Page 229: Log Setting
Type the password to provide to the SMTP server when the log is e- mailed. Send Report Click this button to have the NWA3000-N series AP send the daily e-mail report immediately. Time for Select the time of day (hours and minutes) when the log is e-mailed. Use sending 24-hour notation.
Page 230: Log Setting Summary
Log Summary screen to edit this information for all logs at the same time. 16.3.1 Log Setting Summary To access this screen, click Configuration > Log & Report > Log Setting. Figure 109 Configuration > Log & Report > Log Setting NWA3000-N Series User’s Guide...
Page 231 Log Format This field displays the format of the log. Internal - system log; you can view the log on the View Log tab. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Summary This field is a summary of the settings for each log.
Page 232: Edit Log Settings
This screen controls the detailed settings for each log in the system log (which includes the e-mail profiles). Go to the Log Settings Summary screen and click the system log Edit icon. Figure 110 Configuration > Log & Report > Log Setting > Edit NWA3000-N Series User’s Guide...
Page 233 (green check mark) - create log messages and alerts for all categories for the system log. If e-mail server 1 or 2 also has normal logs enabled, the NWA3000-N series AP will e- mail logs to them.
Page 234 (green check mark) and/or in alerts (red exclamation point) for the e-mail settings specified in E- Mail Server 1. The NWA3000-N series AP does not e-mail debugging information, even if it is recorded in the System log.
Page 235 Message field. Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. NWA3000-N Series User’s Guide...
Page 236: Edit Remote Server
This screen controls the settings for each log in the remote server (syslog). Go to the Log Settings Summary screen and click a remote server Edit icon. Figure 111 Configuration > Log & Report > Log Setting > Edit Remote Server NWA3000-N Series User’s Guide...
Page 237 Active Log section. Log Format This field displays the format of the log information. It is read-only. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Server Type the server name or the IP address of the syslog server to which to Address send log information.
Page 238: Active Log Summary
Figure 112 Active Log Summary This screen provides a different view and a different way of indicating which messages are included in each log and each alert. (The Default category includes debugging messages generated by open source software.) NWA3000-N Series User’s Guide...
Page 239 Table 86 Configuration > Log & Report > Log Setting > Active Log Summary LABEL DESCRIPTION Active Log If the NWA3000-N series AP is set to controller mode, the AC section Summary controls logs generated by the controller and the AP section controls logs generated by the managed APs.
Page 240 (green check mark) and/or in alerts (red exclamation point) for the e-mail settings specified in E-Mail Server 1. The NWA3000-N series AP does not e-mail debugging information, even if it is recorded in the System log.
Page 241: File Manager
Configuration files define the NWA3000-N series AP’s settings. Shell scripts are files of commands that you can store on the NWA3000-N series AP and run when you need them. You can apply a configuration file or run a shell script without the NWA3000-N series AP restarting.
Page 242 Your configuration files or shell scripts can use “exit” or a command line consisting of a single “!” to have the NWA3000-N series AP exit sub command mode. Note: “exit” or “!'” must follow sub commands if it is to make the NWA3000-N series AP exit sub command mode.
Page 243: Configuration File
Errors in Configuration Files or Shell Scripts When you apply a configuration file or run a shell script, the NWA3000-N series AP processes the file line-by-line. The NWA3000-N series AP checks the first line and applies the line if no errors are detected. Then it continues with the next line. If the NWA3000-N series AP finds an error, it stops applying the configuration file or shell script and generates a log.
Page 244 • If there is a startup-config.conf, the NWA3000-N series AP checks it for errors and applies it. If there are no errors, the NWA3000-N series AP uses it and copies it to the lastgood.conf configuration file as a back up file. If there is an error, the NWA3000-N series AP generates a log and copies the startup- config.conf configuration file to the startup-config-bad.conf configuration...
Page 245 Remove Click a configuration file’s row to select it and click Remove to delete it from the NWA3000-N series AP. You can only delete manually saved configuration files. You cannot delete the system-default.conf, startup-config.conf and lastgood.conf files.
Page 246 LABEL DESCRIPTION Apply Use this button to have the NWA3000-N series AP use a specific configuration file. Click a configuration file’s row to select it and click Apply to have the NWA3000-N series AP use that configuration file. The NWA3000-N series...
Page 247 When you change the NWA3000-N series AP’s operation mode, it backs up the configuration to a xxx-backup.conf file where xxx denotes the mode the NWA3000-N series AP was previously using.
Page 248: Firmware Package
The following table describes the labels in this screen. Table 89 Maintenance > File Manager > Firmware Package LABEL DESCRIPTION Boot This is the version of the boot module that is currently on the NWA3000-N Module series AP. Current This is the firmware version and the date created.
Page 249: Shell Script
Click Maintenance > File Manager > Shell Script to open this screen. Use the Shell Script screen to store, name, download, upload and run shell script files. You can store multiple shell script files on the NWA3000-N series AP at the same time.
Page 250 Use this button to have the NWA3000-N series AP use a specific shell script file. Click a shell script file’s row to select it and click Run to have the NWA3000-N series AP use that shell script file. You may need to wait awhile for the NWA3000-N series AP to finish applying the commands.
Page 251 Table 90 Maintenance > File Manager > Shell Script (continued) LABEL DESCRIPTION Browse... Click Browse... to find the .zysh file you want to upload. Upload Click Upload to begin the upload process. This process may take up to several minutes. NWA3000-N Series User’s Guide...
Page 252 Chapter 17 File Manager NWA3000-N Series User’s Guide...
Page 253: Chapter 18 Diagnostics
• The Diagnostics screen (Section 18.2 on page 253) generates a file containing the NWA3000-N series AP’s configuration and diagnostic information if you need to provide it to customer support during troubleshooting. • The Packet Capture screen (Section 18.3 on page 254) captures data packets going through the NWA3000-N series AP.
Page 254: Packet Capture
Download Click this to save the most recent diagnostic file to a computer. 18.3 Packet Capture Use this screen to capture network traffic going through the NWA3000-N series AP’s interfaces. Studying these packet captures may help you identify network problems.
Page 255 Select User Defined to be able to enter an IP address. Host Port This field is configurable when you set the IP Type to any, tcp, or udp. Specify the port number of traffic to capture. NWA3000-N Series User’s Guide...
Page 256: Packet Capture Files
Note: If you have existing capture files you may need to set this size larger or delete existing capture files. The valid range is 1 to 10000. The NWA3000-N series AP stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires.
Page 257: Example Of Viewing A Packet Capture File
Here is an example of a packet capture file viewed in the Wireshark packet analyzer. Notice that the size of frame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes. The NWA3000-N series AP truncated the frame NWA3000-N Series User’s Guide...
Page 258: Wireless Frame Capture
18.4 Wireless Frame Capture Use this screen to capture wireless network traffic going through the AP interfaces connected to your NWA3000-N series AP. Studying these frame captures may help you identify network problems. Click Maintenance > Diagnostics > Wireless Frame Capture to display this screen.
Page 259 Table 94 Maintenance > Diagnostics > Wireless Frame Capture > Capture LABEL DESCRIPTION AP Operating Mode This section appears when the NWA3000-N series AP is set to the standalone AP mode. Wireless Radio 1 This field shows whether the radio is set to function as an AP or a operating mode monitor.
Page 260 Note: If you have existing capture files you may need to set this size larger or delete existing capture files. The valid range is 1 to 50000. The NWA3000-N series AP stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires.
Page 261: Wireless Frame Capture Files
18.4.1 Wireless Frame Capture Files Click Maintenance > Diagnostics > Wireless Frame Capture > Files to open this screen. This screen lists the files of wireless frame captures the NWA3000-N series AP has performed. You can download the files to your computer where you can study them using a packet analyzer (also known as a network or protocol analyzer) such as Wireshark.
Page 262 Chapter 18 Diagnostics NWA3000-N Series User’s Guide...
Page 263: Chapter 19 Reboot
Maintenance > Reboot. Figure 123 Maintenance > Reboot Click the Reboot button to restart the NWA3000-N series AP. Wait a few minutes until the login screen appears. If the login screen does not appear, type the IP address of the device in your Web browser.
Page 264 Chapter 19 Reboot NWA3000-N Series User’s Guide...
Page 265: Chapter 20 Shutdown
To access this screen, click Maintenance > Shutdown. Figure 124 Maintenance > Shutdown Click the Shutdown button to shut down the NWA3000-N series AP. Wait for the device to shut down before you manually turn off or remove the power. It does not turn off the power.
Page 266 Chapter 20 Shutdown NWA3000-N Series User’s Guide...
Page 267: Troubleshooting
Resetting the NWA3000-N series AP 21.2 Power, Hardware Connections, and LEDs The NWA3000-N series AP does not turn on. None of the LEDs turn on. Make sure you are using the power adaptor included with the NWA3000-N series AP or a PoE power injector.
Page 268: Nwa3000-N Series Ap Access And Login
If the problem continues, contact the vendor. 21.3 NWA3000-N series AP Access and Login I forgot the IP address for the NWA3000-N series AP. The default IP address is 192.168.1.2. Use the commands through the console port to check the IP address. Connect your computer to the CONSOLE port using a console cable.
Page 269 If this does not work, you have to reset the device to its factory defaults. See Section 21.6 on page 277. I can see the Login screen, but I cannot log in to the NWA3000-N series AP. NWA3000-N Series User’s Guide...
Page 270: Internet Access
You cannot log in to the web configurator while someone is using Telnet to access the NWA3000-N series AP. Log out of the NWA3000-N series AP in the other session, or ask the person who is logged in to log out.
Page 271 Internet, especially peer-to- peer applications. Check the signal strength. If the signal is weak, try moving the NWA3000-N series AP closer to the AP (if possible), and look around to see if there are any devices that might be interfering with the wireless network (microwaves, other wireless networks, and so on).
Page 272: Wireless Ap Troubleshooting
21.5 Wireless AP Troubleshooting I cannot access the NWA3000-N series AP or ping any computer from the WLAN. Make sure the wireless LAN is enabled on the NWA3000-N series AP Make sure the wireless adapter on the wireless station is working properly.
Page 273 NWA3000- N series AP. • If you have multiple NWA3000-N series AP virtual routers on your network, use a different cluster ID to identify each virtual router. There can only be one master NWA3000-N series AP in each virtual router (same cluster ID).
Page 274 Exporting a PKCS #12 file creates this and you must provide it to decrypt the contents when you import the file into the NWA3000-N series Note: Be careful not to convert a binary file to text during the transfer process. It is easy for this to occur since many programs use text files by default.
Page 275 NWA3000-N series AP restarts. You could use multiple write commands in a long script. Note: “exit” or “!'” must follow sub commands if it is to make the NWA3000-N series AP exit sub command mode. I cannot get the firmware uploaded using the commands.
Page 276 NWA3000-N series AP. For example, if the security mode on the AP is set to WPA/WPA2 then make sure the authentication server is running and able to complete the 802.1x authentication sequence.
Page 277: Resetting The Nwa3000-N Series Ap
APs in question is no longer required. 21.6 Resetting the NWA3000-N series AP If you cannot access the NWA3000-N series AP by any method, try restarting it by turning the power off and then on again. If you still cannot access the NWA3000-N series AP by any method or you forget the administrator password(s), you can reset the NWA3000-N series AP to its factory-default settings.
Page 278: Getting More Troubleshooting Help
Chapter 21 Troubleshooting 21.7 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions. NWA3000-N Series User’s Guide...
Page 279: Product Specifications
H A P T E R Product Specifications The following tables summarize the NWA3000-N series AP’s hardware and firmware features. Table 96 Hardware Specifications Power Specification 12 V DC, 1.5 A Reset button Returns all settings to their factory defaults.
Page 280 Plenum Rating The NWA3000-N series AP’s housing is treated with fire-retardant chemicals. In the event of fire, plenum-rated materials burn more slowly and produce less smoke than non-plenum-rated materials, decreasing the quantity of toxic or asphyxiating material produced.
Page 281 NWA3000-N series AP allows SSL connections to take place through the NWA3000-N series AP. MAC Address Filter Your NWA3000-N series AP checks the MAC address of the wireless station against a list of allowed or denied MAC addresses. Wireless Association List...
Page 282: Wall-Mounting Instructions
Make sure the screws are snugly fastened to the wall. They need to hold the weight of the NWA3000-N series AP with the connection cables. Align the holes on the back of the NWA3000-N series AP with the screws on the wall. Hang the NWA3000-N series AP on the screws.
Page 283 Chapter 22 Product Specifications The following are dimensions of an M4 tap screw and masonry plug used for wall mounting. All measurements are in millimeters (mm). Figure 126 Masonry Plug and M4 Tap Screw NWA3000-N Series User’s Guide...
Page 284 Chapter 22 Product Specifications NWA3000-N Series User’s Guide...
Page 285: Appendix A Log Descriptions
1st:zysh entry name can't alloc entry: %s! 1st:zysh entry name can't retrieve entry: 1st:zysh entry name can't get entry: %s! 1st:zysh entry name can't print entry: %s! 1st:zysh list name %s: cannot retrieve entries from list! NWA3000-N Series User’s Guide...
Page 286 1st:zysh entry num Unable to move entry #%d! 1st:zysh table name %s: apply failed at initial stage! 1st:zysh table name %s: apply failed at main stage! 1st:zysh table name %s: apply failed at closing stage! NWA3000-N Series User’s Guide...
Page 287 2nd %s: The user’s user name. 3rd %s: The name of the service the user is using (HTTP, HTTPS, FTP, Telnet, SSH, or console). The NWA3000-N series AP is signing the specified user out %s %s from %s has been due to a re-authentication timeout.
Page 288 (reach the max. number of simultaneous logon) %s: service name The NWA3000-N series AP blocked a login according to the User %s has been denied access control configuration. access from %s %s: service name...
Page 289 %d. %d is default baud rate An administrator changed the time zone. Set timezone to %s. %s is time zone value An administrator changed the time zone back to the default Set timezone to (0). default. NWA3000-N Series User’s Guide...
Page 290 %s is dead at %s system). 1st %s: Daemon Name, 2nd %s: date and time The count of the listed process is incorrect. %s process count is incorrect at %s 1st %s: Daemon Name, 2nd %s: date and time NWA3000-N Series User’s Guide...
Page 291 IP address. arp response packets for the requested IP address The ARP cache was cleared successfully. Clear arp cache successfully. A client MAC address is not an Ethernet address. Client MAC address is not an Ethernet address NWA3000-N Series User’s Guide...
Page 292 Skip syncing it Configuration), But in fact, there should be something in the for %s. Master for the device to synchronize with, 1st %s: The syncing object, 2ed %s: The feature name for the syncing object. NWA3000-N Series User’s Guide...
Page 293 Updating a certain object failed when updating (AS/AV/IDP/ Update %s for %s has Certificate/System Configuration) due to some reason. 1st failed: %s. %s: The object to be synchronized, 2ed %s: The feature name for the object to be synchronized. NWA3000-N Series User’s Guide...
Page 294 1st %s: the syncing object, 2ed %s: the feature name for the Device HA Sync has syncing object failed when syncing %s for %s due to transmission timeout. %s: The name of the VRRP interface. VRRP interface %s has been shutdown. NWA3000-N Series User’s Guide...
Page 295 CRL is not currently valid, but in the future. CRL contains duplicate serial numbers. Time interval is not continuous. Time information not available. Database method failed due to timeout. Database method failed. Path was not verified. Maximum path length reached. NWA3000-N Series User’s Guide...
Page 296 IEEE 802.1x or WPA is not enabled. System internal error. No 802.1X or WPA enabled! The NWA3000-N series AP was not able to configure the System internal error. wireless device to use WPA. Remove the wireless device and Error configuring WPA reinstall it.
Page 297 2nd %s is warning message when apply CLI command. Run script failed, this log will be what wrong CLI command is ERROR:#%s, %s and what error message is. 1st %s is CLI command. 2nd %s is error message when apply CLI command. NWA3000-N Series User’s Guide...
Page 298 The DHCP server feature gave the listed IP address to the DHCP server offered %s computer with the listed hostname and MAC address. to %s(%s) The NWA3000-N series AP received a DHCP request for the Requested %s from specified IP address from the computer with the listed %s(%s) hostname and MAC address.
Page 299 (listed) SMTP e-mail is inconsistent with account. SMTP account %s2. The NWA3000-N series AP could not connect to the SMTP e- Failed to connect to mail server (%s). The address configured for the server may mail server %s.
Page 300 Sucess Send from an AP on the Managed List. Configuration to Managed AP. 1st %02x ~ 6th %02x: Managed AP MAC Address. MACAddr:%02x%02x%02x%0 2x%02x%02x, 7th %s: Managed AP Model Name. Model:%s, Name:%s 8th %s: Managed AP Description. NWA3000-N Series User’s Guide...
Page 301 8th %s: Destination AP's description. Indicates that the number of stations connecting to the STA List Full. STA specified AP has reached its upper limit. List of Managed AP [%s] is Full 1st %s: Managed AP's description. NWA3000-N Series User’s Guide...
Page 302 WLAN Controller IP: %s 2nd %s: WLAN Controller IP Address" The managed AP is receiving total configuration from the Managed AP Receiving WLAN Controller during CAPWAP protocol handshaking. Complete ZySH (Configuration Change State) Configuration from AC NWA3000-N Series User’s Guide...
Page 303 DESCRIPTION Managed AP Receiving The AP is receiving configuration settings from the NWA3000- Updating ZySH N series AP because the NWA3000-N series AP changed Configuration from AC configuration. (RUN State) STA Association. Indicates the specified station associated with the specified Addr:%02x:%02x:%02x: 1st %02x~6th%02x: Station MAC Address.
Page 304 Table 113 DCS Logs LOG MESSAGE DESCRIPTION Indicates that the NWA3000-N series AP failed to initialize the dcs init failed!\n dcs daemon. Indicates that the NWA3000-N series AP failed to initialize init zylog fail\n zylog.
Page 305: Appendix B Importing Certificates
However, because the certificates were not issued by one of the several organizations officially recognized by the most common web browsers, you will need to import the ZyXEL-created certificate into your web browser and flag that certificate as a trusted authority.
Page 306 If your device’s Web Configurator is set to use SSL certification, then the first time you browse to it you are presented with a certification error. Click Continue to this website (not recommended). In the Address Bar, click Certificate Error > View certificates. NWA3000-N Series User’s Guide...
Page 307 Appendix B Importing Certificates In the Certificate dialog box, click Install Certificate. In the Certificate Import Wizard, click Next. NWA3000-N Series User’s Guide...
Page 308 Next again and then go to step 9. Otherwise, select Place all certificates in the following store and then click Browse. In the Select Certificate Store dialog box, choose a location in which to save the certificate and then click OK. NWA3000-N Series User’s Guide...
Page 309 Appendix B Importing Certificates In the Completing the Certificate Import Wizard screen, click Finish. 10 If you are presented with another Security Warning, click Yes. 11 Finally, click OK when presented with the successful certificate installation message. NWA3000-N Series User’s Guide...
Page 310 Appendix B Importing Certificates 12 The next time you start Internet Explorer and go to a ZyXEL Web Configurator page, a sealed padlock icon appears in the address bar. Click it to view the page’s Website Identification information. Installing a Stand-Alone Certificate File in Internet Explorer...
Page 311 This section shows you how to remove a public key certificate in Internet Explorer 7 on Windows XP. Open Internet Explorer and click Tools > Internet Options. In the Internet Options dialog box, click Content > Certificates. NWA3000-N Series User’s Guide...
Page 312 In the Certificates confirmation, click Yes. In the Root Certificate Store dialog box, click Yes. The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. NWA3000-N Series User’s Guide...
Page 313 The certificate is stored and you can now connect securely to the Web Configurator. A sealed padlock appears in the address bar, which you can click to open the Page Info > Security window to view the web page’s security information. NWA3000-N Series User’s Guide...
Page 314 Appendix B Importing Certificates Installing a Stand-Alone Certificate File in Firefox Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted, you can install a stand-alone certificate file if one has been issued to you.
Page 315 Use the Select File dialog box to locate the certificate and then click Open. The next time you visit the web site, click the padlock in the address bar to open the Page Info > Security window to see the web page’s security information. NWA3000-N Series User’s Guide...
Page 316 Removing a Certificate in Firefox This section shows you how to remove a public key certificate in Firefox 2. Open Firefox and click Tools > Options. In the Options dialog box, click Advanced > Encryption > View Certificates. NWA3000-N Series User’s Guide...
Page 317 Delete. In the Delete Web Site Certificates dialog box, click OK. The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. NWA3000-N Series User’s Guide...
Page 318 Appendix B Importing Certificates NWA3000-N Series User’s Guide...
Page 319: Appendix C Wireless Lans
(AP). Intra-BSS traffic is traffic between wireless clients in the BSS. When Intra-BSS is enabled, wireless client A and B can access the wired network and communicate NWA3000-N Series User’s Guide...
Page 320 This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN. The Access Points not only provide communication with the wired network but also mediate wireless network traffic in the immediate neighborhood. NWA3000-N Series User’s Guide...
Page 321 AP is using channel 1, then you need to select a channel between 6 or 11. RTS/CTS A hidden node occurs when two stations are within range of the same access point, but are not within range of each other. The following figure illustrates a NWA3000-N Series User’s Guide...
Page 322 RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size. Note: Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy. NWA3000-N Series User’s Guide...
Page 323: Preamble Type
Use the dynamic setting to automatically use short preamble when all wireless devices on the network support it, otherwise the NWA3000-N series AP uses long preamble. Note: The wireless devices MUST use the same preamble mode in order to communicate.
Page 324 IEEE802.1x EAP with RADIUS Server Authentication Wi-Fi Protected Access (WPA) WPA2 Most Secure Note: You must enable the same wireless security settings on the NWA3000-N series AP and on all wireless clients that you want to associate with it. NWA3000-N Series User’s Guide...
Page 325 The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication: • Access-Request Sent by an access point requesting authentication. • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access. NWA3000-N Series User’s Guide...
Page 326 The wireless client ‘proves’ that it knows the password by encrypting the password with the challenge and sends back the information. Password is not sent in plain text. NWA3000-N Series User’s Guide...
Page 327 However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication. EAP-GTC is implemented only by Cisco. LEAP LEAP (Lightweight Extensible Authentication Protocol) is a Cisco implementation of IEEE 802.1x. NWA3000-N Series User’s Guide...
Page 328 RADIUS server, you should use WPA2-PSK (WPA2-Pre-Shared Key) that only requires a single (identical) password entered into each access point, wireless gateway and wireless client. As long as the passwords match, a wireless client will be granted access to a WLAN. NWA3000-N Series User’s Guide...
Page 329 The common-password approach makes WPA(2)-PSK susceptible to brute-force password-guessing attacks but it’s still an improvement over WEP as it employs a consistent, single, alphanumeric password to derive a PMK which is used to generate unique temporal encryption NWA3000-N Series User’s Guide...
Page 330 The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly. A 256-bit Pairwise Master Key (PMK) is derived from the authentication process by the RADIUS server and the client. NWA3000-N Series User’s Guide...
Page 331 The AP checks each wireless client's password and allows it to join the network only if the password matches. The AP and wireless clients generate a common PMK (Pairwise Master Key). The key itself is not sent over the network, but is derived from the PSK and the SSID. NWA3000-N Series User’s Guide...
Page 332 Enable without Dynamic WEP Open Enable with Dynamic WEP Key Enable without Dynamic WEP Disable Shared Enable with Dynamic WEP Key Enable without Dynamic WEP Disable TKIP/AES Enable WPA-PSK TKIP/AES Disable WPA2 TKIP/AES Enable WPA2-PSK TKIP/AES Disable NWA3000-N Series User’s Guide...
Page 333: Appendix D Open Software Announcements
License Agreement remains in full force and effect. Ownership of the Software, Documentation and all intellectual property rights therein shall remain at all times with ZyXEL. Any other use of the Software by any other entity is strictly forbidden and is a violation of this License Agreement.
Page 334 Appendix D Open Software Announcements any proprietary notice of ZyXEL or any of its licensors from any copy of the Software or Documentation. 4.Restrictions You may not publish, display, disclose, sell, rent, lease, modify, store, loan, distribute, or create derivative works of the Software, or any part thereof. You may not assign, sublicense, convey or otherwise transfer, pledge as security or otherwise encumber the rights and licenses granted hereunder with respect to the Software.
Page 335 ZyXEL may terminate this License Agreement for any reason, including, but not limited to, if ZyXEL finds that you have violated any of the terms of this License Agreement. Upon notification of termination, you agree to destroy or return to ZyXEL all copies of the Software and Documentation and to certify in writing that all known copies, including backup copies, have been destroyed.
Page 336 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. NWA3000-N Series User’s Guide...
Page 337 OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org. OpenSSL License --------------- NWA3000-N Series User’s Guide...
Page 338 * 5. Products derived from this software may not be called "OpenSSL" nor may "OpenSSL" appear in their names without prior written permission of the OpenSSL Project. * 6. Redistributions of any form whatsoever must retain the following NWA3000-N Series User’s Guide...
Page 339 * This product includes cryptographic software written by Eric Young * (eay@cryptsoft.com). This product includes software written by Tim * Hudson (tjh@cryptsoft.com). Original SSLeay License ----------------------- /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. NWA3000-N Series User’s Guide...
Page 340 * 3. All advertising materials mentioning features or use of this software must display the following acknowledgement: "This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)" The word 'cryptographic' can be left out if the rouines from the library NWA3000-N Series User’s Guide...
Page 341 This is the BSD license without the obnoxious advertising clause. It's also known as the "modified BSD license." Note that the University of California now prefers this license to the BSD license with advertising clause, and now allows BSD itself to be used under the three-clause license. ________________________________________ NWA3000-N Series User’s Guide...
Page 342 WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This Product includes bind and dhcp software under the ISC License ISC license Copyright (c) 4-digit year, Company or Person's Name NWA3000-N Series User’s Guide...
Page 343 "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). NWA3000-N Series User’s Guide...
Page 344 License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, NWA3000-N Series User’s Guide...
Page 345 The end-user documentation included with the redistribution, if any, must include the following acknowledgment: “This product includes software developed by the Apache Software Foundation (http://www.apache.org/).” Alternately, this acknowledgment may appear in the software itself, if and wherever such third-party acknowledgments normally appear. NWA3000-N Series User’s Guide...
Page 346 Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. [This is the first released version of the Lesser GPL. It also counts as the successor of the GNU Library Public License, version 2, hence the version number 2.1. Preamble NWA3000-N Series User’s Guide...
Page 347 A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so NWA3000-N Series User’s Guide...
Page 348 (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. NWA3000-N Series User’s Guide...
Page 349 You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this NWA3000-N Series User’s Guide...
Page 350 Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License. NWA3000-N Series User’s Guide...
Page 351 INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH NWA3000-N Series User’s Guide...
Page 352 If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. NWA3000-N Series User’s Guide...
Page 353 Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. NWA3000-N Series User’s Guide...
Page 354 NWA3000-N Series User’s Guide...
Page 355 END OF TERMS AND CONDITIONS All other trademarks or trade names mentioned herein, if any, are the property of their respective owners. This Product includes ppp, tcpdump, unzip, zip, libnet, openssh, hostapd and ftp-tls software under BSD license NWA3000-N Series User’s Guide...
Page 356 Copyright 1989, 1991, 1992 by Carnegie Mellon University Derivative Work - 1996, 1998-2000 Copyright 1996, 1998-2000 The Regents of the University of California All Rights Reserved Permission to use, copy, modify and distribute this software and its NWA3000-N Series User’s Guide...
Page 357 * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the NWA3000-N Series User’s Guide...
Page 358 * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright NWA3000-N Series User’s Guide...
Page 359 Use is subject to license terms below. This distribution may include materials developed by third parties. Sun, Sun Microsystems, the Sun logo and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. NWA3000-N Series User’s Guide...
Page 360 WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ---- Part 5: Sparta, Inc copyright notice (BSD) ----- Copyright (c) 2003-2009, Sparta, Inc NWA3000-N Series User’s Guide...
Page 361 OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ---- Part 6: Cisco/BUPTNIC copyright notice (BSD) ----- Copyright (c) 2004, Cisco, Inc and Information Network NWA3000-N Series User’s Guide...
Page 362 WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ---- Part 7: Fabasoft R&D Software GmbH & Co KG copyright notice (BSD) ----- NWA3000-N Series User’s Guide...
Page 363 BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NWA3000-N Series User’s Guide...
Page 364 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NWA3000-N Series User’s Guide...
Page 365 OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH NWA3000-N Series User’s Guide...
Page 366 2. Redistributions in binary form must reproduce applicable copyright statements and notices, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution, and 3. Redistributions must contain a verbatim copy of this document. NWA3000-N Series User’s Guide...
Page 367 COPYRIGHT NOTICE, DISCLAIMER, and LICENSE: If you modify libpng you may insert additional notices immediately following this sentence. This code is released under the libpng license. NWA3000-N Series User’s Guide...
Page 368 0.97, January 1998, through 1.0.6, March 20, 2000, are Copyright (c) 1998, 1999 Glenn Randers-Pehrson, and are distributed according to the same disclaimer and license as libpng-0.96, with the following individuals added to the list of Contributing Authors: Tom Lane NWA3000-N Series User’s Guide...
Page 369 The PNG Reference Library is supplied "AS IS". The Contributing Authors and Group 42, Inc. disclaim all warranties, expressed or implied, including, without limitation, the warranties of merchantability and of fitness for any purpose. The Contributing Authors and Group 42, Inc. NWA3000-N Series User’s Guide...
Page 370 A "png_get_copyright" function is available, for convenient use in "about" boxes and the like: printf("%s",png_get_copyright(NULL)); Also, the PNG logo (in PNG format, of course) is supplied in the files "pngbar.png" and "pngbar.jpg (88x31) and "pngnow.png" (98x31). NWA3000-N Series User’s Guide...
Page 371 2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software. 3. This notice may not be removed or altered from any source distribution. NWA3000-N Series User’s Guide...
Page 372 Appendix D Open Software Announcements NWA3000-N Series User’s Guide...
Page 373: Appendix E Legal Information
Published by ZyXEL Communications Corporation. All rights reserved. Disclaimers ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice.
Page 374 20 cm must be maintained between the antenna of this device and all persons. Industry Canada Statement This device complies with RSS-210 of the Industry Canada Rules. Operation is subject to the following two conditions: NWA3000-N Series User’s Guide...
Page 375 注意 ! 依據低功率電波輻射性電機管理辦法第十二條經型式認證合格之低功率射頻電機，非經許可，公司、商號或使用者均不得擅自變更頻率、加大功率或變更原設計之特性及功能。第十四條低功率射頻電機之使用不得影響飛航安全及干擾合法通信；經發現有干擾現象時，應立即停用，並改善至無干擾時方得繼續使用。前項合法通信，指依電信規定作業之無線電信。低功率射頻電機須忍受合法通信或工業、科學及醫療用電波輻射性電機設備之干擾。本機限在不干擾合法電臺與不受被干擾保障條件下於室內使用。減少電磁波影響，請妥適使用。 Notices Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. NWA3000-N Series User’s Guide...
Page 376: Zyxel Limited Warranty
Canada. Viewing Certifications Go to http://www.zyxel.com. Select your product on the ZyXEL home page to go to that product's page. Select the certification you wish to view from this page. ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in material or workmanship for a specific period (the Warranty Period) from the date of purchase.
Page 377 Appendix E Legal Information purpose. ZyXEL shall in no event be held liable for indirect or consequential damages of any kind to the purchaser. To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http:// www.zyxel.com/web/support_warranty_info.php.
Page 378 Appendix E Legal Information NWA3000-N Series User’s Guide...
Page 379: Index
182, 189 backing up configuration files storage space 175, 185 Basic Service Set thumbprint algorithms see BSS thumbprints used for authentication Basic Service Set, See BSS verifying fingerprints boot module where used bridge 18, 22 certification requests NWA3000-N Series User’s Guide...
Page 380 Points dynamic WEP key exchange See CAPWAP cookies copyright CPU usage 77, 80 CTS (Clear to Send) EAP Authentication current date/time 78, 194 e-mail daylight savings daily statistics report setting manually encryption 22, 329 time server NWA3000-N Series User’s Guide...
Page 381 JavaScripts hidden node HTTP over SSL, see HTTPS redirect to HTTPS vs HTTPS key pairs HTTPS and certificates authenticating clients avoiding warning messages example vs HTTP lastgood.conf 244, 247 with Internet Explorer LEDs humidity log messages NWA3000-N Series User’s Guide...
Page 382 MBSSID 18, 22 power off memory usage 77, 81 power on message bar power specifications Message Integrity Check (MIC) preamble mode messages product registration warning mobile access Public-Key Infrastructure (PKI) mode public-private key pairs model name NWA3000-N Series User’s Guide...
Page 383 Telnet how connection is established versions with Linux with Microsoft Windows safety warnings SSID SCEP (Simple Certificate Enrollment Protocol) starting the device screen resolution startup-config.conf screws if errors Secure Socket Layer, see SSL missing at restart NWA3000-N Series User’s Guide...
Page 384 Vantage Report (VRPT) Transport Layer Security (TLS) 231, 237 virtual router troubleshooting VRPT (Vantage Report) Trusted Certificates, see also certificates 231, 237 warm start upgrading firmware warning message popup uploading warranty configuration files note firmware 18, 20, 22 NWA3000-N Series User’s Guide...
Page 385 RADIUS application example WPA2 148, 328 user authentication vs WPA2-PSK wireless client supplicant with RADIUS application example WPA2-Pre-Shared Key WPA2-PSK 328, 329 application example WPA-PSK application example and certificates see also HTTP, HTTPS NWA3000-N Series User’s Guide...
Page 386 Index NWA3000-N Series User’s Guide...

This manual is also suitable for:

Nwa-3160 Nwa3160-n

ZyXEL Communications NWA3000-N Series User Manual

About this User's Guide

Document Conventions

Safety Warnings

Table of Contents

PART I User's Guide

Chapter 1 Introduction

Chapter 2 The Web Configurator

Chapter 3

Configuration Basics

Chapter 4 Tutorials

Part II: Technical Reference

Chapter 5 Dashboard

Chapter 6 Monitor

Chapter 7 Management Mode

Chapter 8 LAN Setting

Chapter 9 Wireless

Chapter 10 Device HA

Chapter 11 User

Chapter 12 AP Profile

Chapter 13 MON Profile

Chapter 14 Certificates

Chapter 15 System

Chapter 16 Log and Report

Chapter 17 File Manager

Chapter 18 Diagnostics

Chapter 19 Reboot

Chapter 20 Shutdown

Chapter 21 Troubleshooting

Chapter 22 Product Specifications

Appendix A Log Descriptions

Appendix B Importing Certificates

Appendix C Wireless Lans

Appendix D Open Software Announcements

Appendix E Legal Information

Index

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications NWA3000-N Series

Summary of Contents for ZyXEL Communications NWA3000-N Series