Page 1 Dual Band Wireless AC/N VDSL2 VoIP Combo WAN Gigabit Gateway with USB Version 5.11 Edition 1, 11/2015 Quick Start Guide User’s Guide Default Login Details LAN IP Address http://192.168.1.1 User Name admin, user www.zyxel.com Password 1234, user Copyright © 2015 ZyXEL Communications Corporation...
Page 2 Related Documentation • Quick Start Guide The Quick Start Guide shows how to connect the VMG and get up and running right away. • More Information VMG. Go to support.zyxel.com to find other information on the VMG3925-B10A User’s Guide...
Page 3: Table Of Contents
Traffic Status ............................218 ARP Table .............................221 Routing Table ............................223 Multicast Status ............................225 xDSL Statistics ............................227 3G Statistics ............................230 System ..............................232 User Account ............................233 Remote Management ..........................235 SNMP ..............................238 Time Settings ............................240 E-mail Notification ..........................243 Log Setting ............................245 VMG3925-B10A User’s Guide...
Page 4 Contents Overview Firmware Upgrade ..........................248 Backup Restore .............................250 Diagnostic .............................253 Troubleshooting ............................258 Appendices ............................265 VMG3925-B10A User’s Guide...
Page 5: Table Of Contents
2.2.3 Navigation Panel ........................25 Chapter 3 Quick Start............................29 3.1 Overview ............................29 3.2 Quick Start Setup ..........................29 Chapter 4 Tutorials ...............................31 4.1 Overview ............................31 4.2 Setting Up an ADSL PPPoE Connection ..................31 4.3 Setting Up a Secure Wireless Network .....................34 VMG3925-B10A User’s Guide...
Page 6 6.5.1 Modify 802.1X Settings ......................79 6.6 Technical Reference ..........................79 Chapter 7 Wireless ...............................85 7.1 Overview ............................85 7.1.1 What You Can Do in this Chapter ....................85 7.1.2 What You Need to Know ......................85 7.2 The General Screen .........................86 VMG3925-B10A User’s Guide...
Page 7 8.7 The Wake on LAN Screen ......................127 8.8 The TFTP Server Name Screen .....................128 8.9 Technical Reference ........................128 8.9.1 LANs, WANs and the VMG ....................128 8.9.2 DHCP Setup ..........................129 8.9.3 DNS Server Addresses ......................129 8.9.4 LAN TCP/IP ...........................130 VMG3925-B10A User’s Guide...
Page 8 11.3.1 Add New Application ......................162 11.4 The Port Triggering Screen ......................162 11.4.1 Add/Edit Port Triggering Rule .....................164 11.5 The DMZ Screen ...........................165 11.6 The ALG Screen ..........................166 11.7 The Address Mapping Screen .......................166 11.7.1 Add/Edit Address Mapping Rule ..................167 VMG3925-B10A User’s Guide...
Page 9 15.2.1 Interface Group Configuration .....................184 15.2.2 Interface Grouping Criteria ....................186 Chapter 16 USB Service ............................188 16.1 Overview ............................188 16.1.1 What You Can Do in this Chapter ..................188 16.1.2 What You Need To Know .....................188 16.1.3 Before You Begin .........................189 VMG3925-B10A User’s Guide...
Page 10 21.1.1 What You Can Do in this Chapter ..................208 21.2 What You Need to Know .......................208 21.3 The Local Certificates Screen .......................208 21.3.1 Create Certificate Request ....................209 21.3.2 Load Signed Certificate ...................... 211 21.4 The Trusted CA Screen ........................212 21.4.1 View Trusted CA Certificate ....................213 VMG3925-B10A User’s Guide...
Page 11 26.1 Overview ............................225 26.2 The IGMP Status Screen ......................225 26.3 The MLD Status Screen ........................225 Chapter 27 xDSL Statistics..........................227 27.1 The xDSL Statistics Screen ......................227 Chapter 28 3G Statistics ............................230 28.1 Overview ............................230 28.2 The 3G Statistics Screen .......................230 VMG3925-B10A User’s Guide...
Page 12 34.2 The E-mail Notification Screen ......................243 34.2.1 Email Notification Edit ......................243 Chapter 35 Log Setting ............................245 35.1 Overview ............................245 35.2 The Log Settings Screen .......................245 35.2.1 Example E-mail Log ......................246 Chapter 36 Firmware Upgrade ..........................248 36.1 Overview ............................248 VMG3925-B10A User’s Guide...
Page 13 39.4 Wireless Internet Access .......................262 39.5 USB Device Connection ........................263 39.6 UPnP .............................263 Part III: Appendices ..................265 Appendix A Customer Support ......................266 Appendix B Wireless LANs......................272 Appendix C IPv6 ..........................285 Appendix D Services ........................293 Appendix E Legal Information......................297 Index ..............................304 VMG3925-B10A User’s Guide...
Page 14: User's Guide
User’s Guide...
Page 15: Introducing The Vmg
VMG to its factory default settings. If you backed up an earlier configuration file, you would not have to totally re-configure the VMG. You could simply restore your last configuration. VMG3925-B10A User’s Guide...
Page 16: Applications For The Vmg
This means that probes from the outside to your network are not allowed, but you can safely browse the Internet and download files. 1.4.2 VMG’s USB Support The USB port of the VMG is used for file-sharing and media server. VMG3925-B10A User’s Guide...
Page 17: Leds (Lights)
USB device (B) connected to the VMG’s USB port (without having to copy them to another computer). Figure 3 USB Media Server Application 1.5 LEDs (Lights) The following graphic displays the labels of the LEDs. VMG3925-B10A User’s Guide...
Page 18 The 2.4 GHz wireless network is activated. Blinking The VMG is communicating with 2.4 GHz wireless clients. 2.4G WLAN/ Orange Blinking The VMG is setting up a WPS connection with a 2.4 GHz wireless client. The 2.4 GHz wireless network is not activated. VMG3925-B10A User’s Guide...
Page 19: The Reset Button
To set the device back to the factory default settings, press the RESET button for ten seconds or until the PWR/SYS LED begins to blink and then release it. When the PWR/SYS LED begins to blink, the defaults have been restored and the device restarts. VMG3925-B10A User’s Guide...
Page 20: Wireless Access
Once the connection is successfully made, the 2.4G WLAN/WPS or 5G WLAN/WPS LED shines green. To turn off the wireless network, press the WPS button for one to five seconds. The 2.4G WLAN/ WPS or 5G WLAN/WPS LED turns off when the wireless network is off. VMG3925-B10A User’s Guide...
Page 21: The Web Configurator
If you have changed the password, enter your password and click Login. Figure 6 Password Screen The Quick Start Wizard screen appears. You can configure basic Internet access, and wireless settings. See Chapter 3 on page 29 for more information. VMG3925-B10A User’s Guide...
Page 22 Chapter 2 The Web Configurator After you finished or closed the Quick Start Wizard screen, the Network Map page appears. Figure 7 Network Map Click Status to display the Status screen, where you can view the VMG’s interface and system information. VMG3925-B10A User’s Guide...
Page 23: Web Configurator Layout
2.2.1 Title Bar The title bar provides some icons in the upper right corner. The icons provide the following functions. Table 2 Web Configurator Icons in the Title Bar ICON DESCRIPTION Language: Select the language you prefer. VMG3925-B10A User’s Guide...
Page 24: Main Window
Status screen. If you click Virtual Device on the Status screen, a visual graphic appears, showing the connection status of the VMG’s ports. The connected ports are in color and disconnected ports are gray. Figure 9 Virtual Device VMG3925-B10A User’s Guide...
Page 25: Navigation Panel
Use this screen to forward DNS queries for certain domain names through a specific WAN interface to its DNS server(s). Policy Route Use this screen to configure policy routing on the VMG. Use this screen to configure Routing Information Protocol to exchange routing information with other routers. VMG3925-B10A User’s Guide...
Page 26 (such as parental control) is enforced. Certificates Local Certificates Use this screen to view a summary list of certificates and manage certificates and certification requests. Trusted CA Use this screen to view and manage the list of the trusted CAs. System Monitor VMG3925-B10A User’s Guide...
Page 27 Use this screen to configure up to two mail servers and sender Notification Notification addresses on the VMG. Log Setting Log Setting Use this screen to change your VMG’s log settings. Firmware Firmware Use this screen to upload firmware to your VMG. Upgrade Upgrade VMG3925-B10A User’s Guide...
Page 28 Use this screen to configure CFM (Connectivity Fault Management) MD (maintenance domain) and MA (maintenance association), perform connectivity tests and view test reports. OAM Ping Use this screen to view information to help you identify problems with the DSL connection. VMG3925-B10A User’s Guide...
Page 29: Quick Start
Select the time zone of your location. Click Next. Figure 10 Quick Start - Welcome Enter your Internet connection information in this screen. The screen and fields to enter may vary depending on your current connection type. Click Next. VMG3925-B10A User’s Guide...
Page 30 Turn the wireless LAN on or off. If you keep it on, record the security settings so you can configure your wireless clients to connect to the VMG. Click Save. Figure 12 Quick Start - Wireless Your VMG saves your settings and attempts to connect to the Internet. VMG3925-B10A User’s Guide...
Page 31: Tutorials
Broadband screens. Click Network Setting > Broadband to open the following screen. Click Add New WAN Interface. In this example, the DSL connection has the following information. General Name MyDSLConnection Type ADSL VMG3925-B10A User’s Guide...
Page 32 Then select DNS as Static and enter the DNS server addresses provided to you, such as 192.168.5.2 (DNS server1)/192.168.5.1 (DNS server2). Leave the rest of the fields to the default settings. Click Apply to save your settings. VMG3925-B10A User’s Guide...
Page 33 Chapter 4 Tutorials You should see a summary of your new DSL connection setup in the Broadband screen as follows. VMG3925-B10A User’s Guide...
Page 34: Setting Up A Secure Wireless Network
802.11b/g/n Mixed Click Network Setting > Wireless to open the General screen. Select More Secure as the security level and WPA2-PSK as the security mode. Configure the screen using the provided parameters (see page 34). Click Apply. VMG3925-B10A User’s Guide...
Page 35 Chapter 4 Tutorials Go to the Wireless > Others screen and select 802.11b/g/n Mixed in the 802.11 Mode field. Click Apply. VMG3925-B10A User’s Guide...
Page 36: Using Wps
Make sure that you have installed the wireless client driver and utility in your notebook. In the wireless client utility, go to the WPS setting page. Enable WPS and press the WPS button (Start or WPS button). VMG3925-B10A User’s Guide...
Page 37 The wireless client is then able to communicate with the VMG securely. The following figure shows you an example of how to set up a wireless network and its security by pressing a button on both VMG and wireless client. VMG3925-B10A User’s Guide...
Page 38: Wireless Client
Launch your wireless client’s configuration utility. Go to the WPS settings and select the PIN method to get a PIN number. Log into VMG’s web configurator and go to the Network Setting > Wireless > WPS screen. Enable the WPS function and click Apply. VMG3925-B10A User’s Guide...
Page 39 This may take up to two minutes. The wireless client is then able to communicate with the VMG securely. The following figure shows you how to set up a wireless network and its security on a VMG and a wireless client by using PIN method. VMG3925-B10A User’s Guide...
Page 40: Without Wps
Use the wireless adapter’s utility installed on the notebook to search for the “Example” SSID. Then enter the “DoNotStealMyWirelessNetwork” pre-shared key to establish an wireless Internet connection. Note: The VMG supports IEEE 802.11b and IEEE 802.11g wireless clients. Make sure that your notebook or computer’s wireless adapter supports one of these standards. VMG3925-B10A User’s Guide...
Page 41: Setting Up Multiple Wireless Groups
Pre-Shared Key ForCompanyOnly 123456789 guest123 Click Network Setting > Wireless to open the General screen. Use this screen to set up the company’s general wireless network group. Configure the screen using the provided parameters and click Apply. VMG3925-B10A User’s Guide...
Page 42 Chapter 4 Tutorials Click Network Setting > Wireless > Guest/More AP to open the following screen. Click the Edit icon to configure the second wireless network group. Configure the screen using the provided parameters and click Apply. VMG3925-B10A User’s Guide...
Page 43 Chapter 4 Tutorials In the Guest/More AP screen, click the Edit icon to configure the third wireless network group.Configure the screen using the provided parameters and click Apply. VMG3925-B10A User’s Guide...
Page 44: Configuring Static Route For Routing To Another Network
In the following figure, router R is connected to the VMG’s LAN. R connects to two networks, N1 (192.168.1.x/24) and N2 (192.168.10.x/24). If you want to send traffic from computer A (in N1 VMG3925-B10A User’s Guide...
Page 45 This tutorial uses the following example IP settings: Table 4 IP Settings in this Tutorial DEVICE / COMPUTER IP ADDRESS The VMG’s WAN 172.16.1.1 The VMG’s LAN 192.168.1.1 IP Type IPv4 Use Interface VDSL/ppp1.1 192.168.1.34 R’s N1 192.168.1.253 VMG3925-B10A User’s Guide...
Page 46: Configuring Qos Queue And Class Setup
Now B should be able to receive traffic from A. You may need to additionally configure B’s firewall settings to allow specific traffic to pass through. 4.6 Configuring QoS Queue and Class Setup This section contains tutorials on how you can configure the QoS screen. VMG3925-B10A User’s Guide...
Page 47 Bandwidth to 10,000 kbps (or leave this blank to have the VMG automatically determine this figure). Click Apply. Tutorial: Advanced > QoS Click Queue Setup > Add new Queue to create a new queue. In the screen that opens, select Enable and enter or select the following values: • Name: E-mail VMG3925-B10A User’s Guide...
Page 48 • Weight: 8 • Rate Limit: 5,000 (kbps) Tutorial: Advanced > QoS > Queue Setup Click Class Setup > Add new Classifier to create a new class. Check Active and follow the settings as shown in the screen below. VMG3925-B10A User’s Guide...
Page 49 Type the MAC address of your computer - AA:FF:AA:FF:AA:FF. Type the MAC Mask if you know it. To Queue Link this to an item in the Network Setting > QoS > Queue Setup screen, which is the E- Index mail queue created in this example. VMG3925-B10A User’s Guide...
Page 50: Access The Vmg Using Ddns
• IP Address: Enter the WAN IP address that your VMG is currently using. You can find the IP address on the VMG’s Web Configurator Status page. Then you will need to configure the same account and host name on the VMG later. VMG3925-B10A User’s Guide...
Page 51: Configuring Ddns On Your Vmg
Josephine’s computer connects wirelessly to the Internet through the VMG. Thomas decides to use the Security > MAC Filter screen to grant wireless network access to his computer but not to Josephine’s computer. VMG3925-B10A User’s Guide...
Page 52 Thomas can also grant access to the computers of other members of his family and friends. However, Josephine and others not listed in this screen will no longer be able to access the Internet through the VMG. VMG3925-B10A User’s Guide...
Page 53: Access Your Shared Files From A Computer
In FileZilla enter the IP address of the VMG (the default is 192.168.1.1), your account’s user name and password and port 21 and click Quickconnect. A screen asking for password authentication appears. File Sharing via Windows Explorer Once you log in the USB device displays in the folder. VMG3925-B10A User’s Guide...
Page 54: Technical Reference
Technical Reference...
Page 55: Network Map And Status Screens
5.2 The Network Map Screen Use this screen to view the network connection status of the device and its clients. A warning message appears if there is a connection problem. Figure 13 Network Map: Icon View Mode VMG3925-B10A User’s Guide...
Page 56: The Status Screen
VMG to update this screen in Refresh interval. Figure 14 Network Map: List View Mode 5.3 The Status Screen Use this screen to view the status of the VMG. Click Status to open this screen. Figure 15 Status Screen VMG3925-B10A User’s Guide...
Page 57 This displays the type of security mode the wireless interface is using in the wireless LAN. 802.11 Mode This displays the type of 802.11 mode the wireless interface is using in the wireless LAN. This displays whether WPS is activated on the wireless interface. VMG3925-B10A User’s Guide...
Page 58 For the WLAN interface, it displays the maximum transmission rate or N/A with WLAN disabled. For the 3G interface, this field displays Up when a 3G device is installed in a USB slot and N/A when no device is detected in any USB slot. VMG3925-B10A User’s Guide...
Page 59: Broadband
CONNECTION SETTINGS TYPE ADSL/VDSL Routing PPPoE PPP information, IPv4/IPv6 IP over PTM address, routing feature, DNS server, VLAN, QoS, and MTU IPoE IPv4/IPv6 IP address, routing feature, DNS server, VLAN, QoS, and MTU Bridge VLAN and QoS VMG3925-B10A User’s Guide...
Page 60: What You Need To Know
Packet Transfer Mode (PTM) is packet-oriented and supported by the VDSL2 standard. In PTM, packets are encapsulated directly in the High-level Data Link Control (HDLC) frames. It is designed to provide a low-overhead, transparent way of transporting packets over DSL links, as an alternative to ATM. VMG3925-B10A User’s Guide...
Page 61 ISP’s Border Relay router (BR in the figure) to connect to the native IPv6 Internet. The local network can also use IPv4 services. The VMG uses it’s configured IPv4 WAN IP to route IPv4 traffic to the IPv4 Internet. VMG3925-B10A User’s Guide...
Page 62: Before You Begin
ISP (IPv6) IPv6 Internet IPv6 IPv6 IPv4 IPv4 in IPv6 AFTR IPv4 Internet 6.1.3 Before You Begin You need to know your Internet access settings such as encapsulation and WAN IP address. Get this information from your ISP. VMG3925-B10A User’s Guide...
Page 63: The Broadband Screen
This shows whether Multicast Listener Discovery (MLD) is activated or not for this connection. MLD is not available when the connection uses the bridging service. Modify Click the Edit icon to configure the WAN connection. Click the Delete icon to remove the WAN connection. VMG3925-B10A User’s Guide...
Page 64: Add/Edit Internet Connection
The following example screen displays when you select the ADSL/VDSL over ATM connection type, Routing mode, and PPPoE encapsulation. The screen varies when you select other interface type, encapsulation, and IPv6/IPv4 mode. Figure 20 Network Setting > Broadband > Add New WAN Interface/Edit (Routing Mode) VMG3925-B10A User’s Guide...
Page 65 (VC). To transport multiple protocols, the VMG needs separate VCs. There is a binding between a VC and the type of the network protocol carried on the VC. This reduces payload overhead since there is no need to carry protocol information in each Protocol Data Unit (PDU) payload. VMG3925-B10A User’s Guide...
Page 66 Select Obtain DNS Info Automically if you want the VMG to use the DNS server addresses assigned by your ISP. Select Use Following Static DNS Address if you want the VMG to use the DNS server addresses you configure manually. VMG3925-B10A User’s Guide...
Page 67 Select Obtain an IPv6 Address Automatically if you want to have the VMG use the IPv6 prefix from the connected router’s Router Advertisement (RA) to generate an IPv6 address. Select Static IPv6 Address if you have a fixed IPv6 address assigned by your ISP. VMG3925-B10A User’s Guide...
Page 68: Bridge Mode
Select Bridge as the operating mode. The screen varies depending on the interface type you select. If you select ADSL/VDSL over PTM as the interface type, the following screen appears. VMG3925-B10A User’s Guide...
Page 69 Type the VLAN ID number (from 0 to 4094) for traffic through this connection. Click OK to save your changes. Cancel Click Cancel to exit this screen without saving. If you select ADSL over ATM as the interface type, the following screen appears. VMG3925-B10A User’s Guide...
Page 70 To transport multiple protocols, the VMG needs separate VCs. There is a binding between a VC and the type of the network protocol carried on the VC. This reduces payload overhead since there is no need to carry protocol information in each Protocol Data Unit (PDU) payload. VMG3925-B10A User’s Guide...
Page 71: The 3G Backup Screen
The VMG automatically uses a wired WAN connection when available. Note: This VMG supports connecting one 3G dongle at a time. Figure 23 Internet Access Application: 3G WAN Use this screen to configure your 3G settings. Click Network Setting > Broadband > 3G Backup. VMG3925-B10A User’s Guide...
Page 72 The following table describes the labels in this screen. Table 11 Network Setting > Broadband > 3G Backup LABEL DESCRIPTION General 3G Backup Select Enable to have the VMG use the 3G connection as your WAN or a backup when the wired WAN connection fails. VMG3925-B10A User’s Guide...
Page 73 Enter your WAN IP address in this field if you selected Use the following static IP address. Subnet Mask Obtain DNS Select this to have the VMG get the DNS server addresses from the ISP automatically. info dynamically VMG3925-B10A User’s Guide...
Page 74 VMG3925-B10A User’s Guide...
Page 75: The Advanced Screen
Table 12 VDSL Profiles MAX. NUMBER OF CARRIER BANDWIDTH DOWNSTREAM PROFILE DOWNSTREAM BANDWIDTH POWER (DBM) (MHZ) THROUGHPUT CARRIERS (KHZ) (MBIT/S) 8.832 2048 4.3125 17.5 8.832 2048 4.3125 20.5 1972 4.3125 11.5 8.832 2048 4.3125 14.5 VMG3925-B10A User’s Guide...
Page 76 PhyR DS should be enabled if data being transmitted downstream is sensitive to noise. However, enabling PhyR DS can decrease the DS line rate. Enabling or disabling PhyR will require the CPE to retrain. For PhyR to function, the DSLAM must also support PhyR and have it enabled. VMG3925-B10A User’s Guide...
Page 77 The VMG must comply with at least one profile specified in G.993.2. but compliance with more than one profile is allowed. Apply Click Apply to save your changes back to the VMG. Cancel Click Cancel to return to the previous configuration. VMG3925-B10A User’s Guide...
Page 78: The 802.1X Screen
This shows the certificate used for this authentication. This displays N/A when there is no certificate assigned. Trusted CA This shows the Trusted CA used for this authentication. This displays N/A when there is no Trusted CA assigned. Modify Click this icon to edit an item. VMG3925-B10A User’s Guide...
Page 79: Modify 802.1X Settings
The following section contains additional technical information about the VMG features described in this chapter. Encapsulation Be sure to use the encapsulation method required by your ISP. The VMG can work in bridge mode or routing mode. When the VMG is in routing mode, it supports the following methods. VMG3925-B10A User’s Guide...
Page 80 ATM virtual circuit (VC-based multiplexing). Please refer to RFC 1483 for more detailed information. Multiplexing There are two conventions to identify what protocols the virtual circuit (VC) is carrying. Be sure to use the multiplexing method required by your ISP. VC-based Multiplexing VMG3925-B10A User’s Guide...
Page 81 If the PCR, SCR or MBS is set to the default of "0", the system will assign a maximum value that correlates to your upstream line rate. The following figure illustrates the relationship between PCR, SCR and MBS. Figure 28 Example of Traffic Shaping VMG3925-B10A User’s Guide...
Page 82 When properly configured, VLAN prevents one subscriber from accessing the network resources of another on the same LAN, thus a user will not see the printers and hard disks of another user in the same building. VMG3925-B10A User’s Guide...
Page 83 VMG periodically updates this information. DNS Server Address Assignment Use Domain Name System (DNS) to map a domain name to its corresponding IP address and vice versa, for instance, the IP address of www.zyxel.com is 204.217.0.2. The DNS server is extremely VMG3925-B10A User’s Guide...
Page 84 IPv6 prefix length specifies how many most significant bits (start from the left) in the address compose the network address. The prefix length is written as “/x” where x is a number. For example, 2001:db8:1a2b:15::1a2f:0/32 means that the first 32 bits (2001:db8) is the subnet prefix. VMG3925-B10A User’s Guide...
Page 85: Wireless
However, wireless networking is different from that of most traditional radio communications in that there a number of wireless networking standards available with different methods of data encryption. VMG3925-B10A User’s Guide...
Page 86: The General Screen
Apply to confirm. You must then change the wireless settings of your computer to match the VMG’s new settings. Click Network Setting > Wireless to open the General screen. Figure 29 Network Setting > Wireless > General VMG3925-B10A User’s Guide...
Page 87 Specify the maximum rate for downstream wireless traffic to this WLAN from the WAN in Downstream kilobits per second (Kbps). Bandwidth BSSID This shows the MAC address of the wireless interface on the VMG when wireless LAN is enabled. VMG3925-B10A User’s Guide...
Page 88: No Security
RADIUS server. If your wireless devices support nothing stronger than WEP, use the highest encryption level available. Your VMG allows you to configure up to four 64-bit or 128-bit WEP keys but only one key can be enabled at any one time. VMG3925-B10A User’s Guide...
Page 89: More Secure (Wpa(2)-Psk)
This dictates the length of the security key that the network is going to use. 7.2.3 More Secure (WPA(2)-PSK) The WPA-PSK security mode provides both improved data encryption and user authentication over WEP. Using a Pre-Shared Key (PSK), both the VMG and the connecting client share a common VMG3925-B10A User’s Guide...
Page 90 Select TKIP+AES to allow the wireless clients to use either TKIP or AES. Group Key The Group Key Update Timer is the rate at which the RADIUS server sends a new group Update Timer key out to all clients. VMG3925-B10A User’s Guide...
Page 91: The Guest / More Ap Screen
Click the Edit icon to configure the SSID profile. 7.3.1 Edit Guest / More AP Use this screen to edit an SSID profile. Click the Edit icon next to an SSID in the Guest / More AP screen. The following screen displays. VMG3925-B10A User’s Guide...
Page 92 Select None to set the VMG’s password generation to not be based on a passphrase. Select Fixed to use a 16-character passphrase for generating a password. Select Variable to use a 16 to 63 character passphrase for generating a password. Wireless Network Settings VMG3925-B10A User’s Guide...
Page 93: The Mac Authentication Screen
This screen allows you to configure the VMG to give exclusive access to specific devices (Allow) or exclude specific devices from accessing the VMG (Deny). Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six VMG3925-B10A User’s Guide...
Page 94: The Wps Screen
Click the Edit icon to change the MAC address. Apply Click Apply to save your changes. Cancel Click Cancel to exit this screen without saving. 7.5 The WPS Screen Use this screen to configure WiFi Protected Setup (WPS) on your VMG. VMG3925-B10A User’s Guide...
Page 95 Method 2 Use this section to set up a WPS wireless network by entering the PIN of the client into the VMG. Select Enable and click Apply to activate WPS method 2 on the VMG. VMG3925-B10A User’s Guide...
Page 96: The Wmm Screen
Use this screen to enable Wi-Fi MultiMedia (WMM) and WMM Power Save in wireless networks for multimedia applications. Click Network Setting > Wireless > WMM. The following screen displays. Figure 37 Network Setting > Wireless > WMM VMG3925-B10A User’s Guide...
Page 97: The Wds Screen
Note: At the time of writing, WDS is compatible with other ZyXEL APs only. Not all models support WDS links. Check your other AP’s documentation. Click Network Setting > Wireless > WDS. The following screen displays. VMG3925-B10A User’s Guide...
Page 98: Wds Scan
You can click the Scan icon in Wireless > WDS to have the VMG automatically search and display the available APs within range. Select an AP and click Apply to have the VMG establish a wireless link with the selected wireless device. VMG3925-B10A User’s Guide...
Page 99: The Others Screen
7.8 The Others Screen Use this screen to configure advanced wireless settings. Click Network Setting > Wireless > Others. The screen appears as shown. Section 7.10.2 on page 104 for detailed definitions of the terms listed in this screen. VMG3925-B10A User’s Guide...
Page 100 Delivery Traffic Indication Message (DTIM) is the time period after which broadcast and multicast packets are transmitted to mobile clients in the Power Saving mode. A high DTIM value can cause clients to lose connectivity with the network. This value can be set from 1 to 255. VMG3925-B10A User’s Guide...
Page 101: The Channel Status Screen
Use the Channel Status screen to scan wireless LAN channel noises and view the results. Click Network Setting > Wireless > Channel Status. The screen appears as shown. Click Scan to scan the wireless LAN channels. You can view the results in the Channel Scan Result section. VMG3925-B10A User’s Guide...
Page 102: Technical Reference
• A bridge is a radio that relays communications between access points and wireless clients, extending a network’s range. Traditionally, a wireless network operates in one of two ways. VMG3925-B10A User’s Guide...
Page 103 Radio Channels In the radio spectrum, there are certain frequency bands allocated for unlicensed, civilian use. For the purposes of wireless networking, these bands are divided into numerous channels. This allows a VMG3925-B10A User’s Guide...
Page 104: Additional Wireless Terms
- for example, a twenty-letter long string of apparently random numbers and letters - but it is not very secure if you use a short key which is very easy to guess - for example, a three-letter word from the dictionary. VMG3925-B10A User’s Guide...
Page 105 Some wireless devices, such as scanners, can detect wireless networks but cannot use wireless networks. These kinds of wireless devices might not have MAC addresses. Hexadecimal characters are 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F. VMG3925-B10A User’s Guide...
Page 106: Signal Problems
Problems with distance occur when the two radios are too far apart. Problems with interference occur when other radio waves interrupt the data signal. Interference may come from other radio transmissions, such as military or air traffic control communications, or from machines that are VMG3925-B10A User’s Guide...
Page 107: Bss
BSSs simultaneously. You can then assign varying QoS priorities and/or security modes to different SSIDs. Wireless devices can use different BSSIDs to associate with the same AP. 7.10.6.1 Notes on Multiple BSSs • A maximum of eight BSSs are allowed on one AP simultaneously. VMG3925-B10A User’s Guide...
Page 108: Preamble Type
AP 2 7.10.9 WiFi Protected Setup (WPS) Your VMG supports WiFi Protected Setup (WPS), which is an easy way to set up a secure wireless network. WPS is an industry standard specification, defined by the WiFi Alliance. VMG3925-B10A User’s Guide...
Page 109 Take the following steps to set up a WPS connection between an access point or wireless router (referred to here as the AP) and a client device using the PIN method. VMG3925-B10A User’s Guide...
Page 110 If you cannot connect, check the list of associated wireless clients in the AP’s configuration utility. If you see the wireless client in the list, WPS was successful. The following figure shows a WPS-enabled wireless client (installed in a notebook computer) connecting to the WPS-enabled AP via the PIN method. VMG3925-B10A User’s Guide...
Page 111: How Wps Works
If the registrar is already part of a network, it sends the existing information. If not, it generates the SSID and WPA(2)-PSK randomly. The following figure shows a WPS-enabled client (installed in a notebook computer) connecting to a WPS-enabled access point. VMG3925-B10A User’s Guide...
Page 112: Example Wps Network Setup
When WPS is activated on both, they perform the handshake. In this example, AP1 is the registrar, and Client 1 is the enrollee. The registrar randomly generates the security information to set up the network, since it is unconfigured and has no existing information. VMG3925-B10A User’s Guide...
Page 113 In step 3, you add another access point (AP2) to your network. AP2 is out of range of AP1, so you cannot use AP1 for the WPS handshake with the new access point. However, you know that Client 2 supports the registrar function, so you use it to perform the WPS handshake instead. VMG3925-B10A User’s Guide...
Page 114: Limitations Of Wps
If this happens, open the access point’s configuration interface and look at the list of associated clients (usually displayed by MAC address). It does not matter if the VMG3925-B10A User’s Guide...
Page 115 Check the MAC addresses of your wireless clients (usually printed on a label on the bottom of the device). If there is an unknown MAC address you can remove it or reset the AP. VMG3925-B10A User’s Guide...
Page 116: Home Networking
• Use the Wake on Lan screen to remotely turn on a device on the network. (Section 8.7 on page 127). • Use the TFTP Server Name screen to identify a TFTP server for configuration file download using DHCP option 66. (Section 8.8 on page 128). VMG3925-B10A User’s Guide...
Page 117: What You Need To Know
UPnP devices and enable exchange of simple product and service descriptions. NAT traversal allows the following: • Dynamic port mapping • Learning public IP addresses VMG3925-B10A User’s Guide...
Page 118: Before You Begin
This will become the IP address of your VMG. Enter the IP subnet mask into the IP Subnet Mask field. Unless instructed otherwise it is best to leave this alone, the configurator will automatically compute a subnet mask based upon the IP address you entered. VMG3925-B10A User’s Guide...
Page 119 Table 30 Network Setting > Home Networking > LAN Setup LABEL DESCRIPTION Interface Group Group Name Select the interface group name for which you want to configure LAN settings. See Chapter 15 on page 183 for how to create a new interface group. VMG3925-B10A User’s Guide...
Page 120 Select this to have the VMG generate an interface ID for the LAN interface’s link-local address using the EUI-64 format. Manual Select this to manually enter an interface ID for the LAN interface’s link-local address. Lan Global Identifier Type VMG3925-B10A User’s Guide...
Page 121 IPv4 DNS server. Then it sends clients the first DNS information it receives. • IPv4 DNS Server First: The VMG forwards the requests to the IPv4 DNS server first and then the IPv6 DNS server. Then it sends clients the first DNS information it receives. VMG3925-B10A User’s Guide...
Page 122: The Static Dhcp Screen
Click the Delete icon to delete a static DHCP entry. A window displays asking you to confirm that you want to delete the selected entry. If you click Static DHCP Configuration in the Static DHCP screen or the Edit icon next to a static DHCP entry, the following screen displays. VMG3925-B10A User’s Guide...
Page 123: The Upnp Screen
IP address, convey its capabilities and learn about other devices on the network. In turn, a device can leave a network smoothly and automatically when it is no longer in use. page 117 for more information on UPnP. VMG3925-B10A User’s Guide...
Page 124: Turning On Upnp In Windows 7 Example
Windows 7. Activate UPnP on the VMG. Make sure the computer is connected to a LAN port of the VMG. Turn on your computer and the VMG. Click the start icon, Control Panel and then the Network and Sharing Center. VMG3925-B10A User’s Guide...
Page 125 Select Turn on network discovery and click Save Changes. Network discovery allows your computer to find other computers and devices on the network and other computers on the network to find your computer. This makes it easier to share files and printers. VMG3925-B10A User’s Guide...
Page 126: The Additional Subnet Screen
Enter the public IPv4 subnet mask provided by your ISP. Offer Public IP Select Enable to enable the VMG to provide public IP addresses by DHCP server. by DHCP Enable ARP Select Enable to enable the ARP (Address Resolution Protocol) proxy. Proxy VMG3925-B10A User’s Guide...
Page 127: The Stb Vendor Id Screen
You need to know the MAC address of the LAN device. It may be on a label on the device or in its documentation. Click Network Setting > Home Networking > Wake on Lan to open this screen. Figure 56 Network Setting > Home Networking > Wake on Lan VMG3925-B10A User’s Guide...
Page 128: The Tftp Server Name Screen
LANs, WANs and the VMG The actual physical connection determines whether the VMG ports are LAN or WAN ports. There are two separate IP networks, one inside the LAN network and the other outside the WAN network as shown next. VMG3925-B10A User’s Guide...
Page 129: Dhcp Setup
DNS servers out of the DHCP setup under all circumstances. If your ISP gives you explicit DNS servers, make sure that you enter their IP addresses in the DHCP Setup screen. VMG3925-B10A User’s Guide...
Page 130: Lan Tcp/Ip
If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses. VMG3925-B10A User’s Guide...
Page 131 Note: Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, “Address Allocation for Private Internets” and RFC 1466, “Guidelines for Management of IP Address Space”. VMG3925-B10A User’s Guide...
Page 132: Routing
9.2 The Routing Screen Use this screen to view and configure the static route rules on the VMG. Click Network Setting > Routing > Static Route to open the following screen. Figure 60 Network Setting > Routing > Static Route VMG3925-B10A User’s Guide...
Page 133: Add/Edit Static Route
Use this screen to add or edit a static route. Click Add new static route in the Routing screen or the Edit icon next to the static route you want to edit. The screen shown next appears. Figure 61 Routing: Add/Edit VMG3925-B10A User’s Guide...
Page 134: The Dns Route Screen
This field displays whether the DNS route is active or not. A yellow bulb signifies that this DNS route is active. A gray bulb signifies that this DNS route is not active. Domain Name This is the host name or domain name of the DNS route entry. VMG3925-B10A User’s Guide...
Page 135: The Dns Route Add Screen
Policy route allows the VMG to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator. Policy-based routing is applied to outgoing packets, prior to the normal routing. VMG3925-B10A User’s Guide...
Page 136 This is the WAN interface through which the traffic is routed. Modify Click the Edit icon to edit this policy. Click the Delete icon to remove a policy from the VMG. A window displays asking you to confirm that you want to delete the policy. VMG3925-B10A User’s Guide...
Page 137: Add/Edit Policy Route
Select a WAN interface through which the traffic is sent. You must have the WAN interface(s) already configured in the Broadband screens. Click OK to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 138: Rip
Select Active to have the VMG advertise its route information and also listen for routing updates from neighboring routers. Enable Select the check box to activate the settings. Disable DefaultGateway Apply Click Apply to save your changes back to the VMG. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 139: Quality Of Service (Qos)
• The Shaper Setup screen limits outgoing traffic transmission rate on the selected interface (Section 10.6 on page 149). • The Policer Setup screen to control incoming traffic transmission rate and bursts (Section 10.7 on page 150). VMG3925-B10A User’s Guide...
Page 140: What You Need To Know
(or queues). Your VMG uses the Token Bucket algorithm to allow a certain amount of large bursts while keeping a limit at the average rate. Traffic Rate Traffic Rate Time Time (Before Traffic Shaping) (After Traffic Shaping) VMG3925-B10A User’s Guide...
Page 141: The Quality Of Service General Screen
Click Network Setting > QoS > General to open the screen as shown next. Use this screen to enable or disable QoS and set the upstream bandwidth. See Section 10.1 on page 139 for more information. Figure 67 Network Settings > QoS > General VMG3925-B10A User’s Guide...
Page 142: The Queue Setup Screen
Cancel Click Cancel to restore your previously saved settings. 10.4 The Queue Setup Screen Click Network Setting > QoS > Queue Setup to open the screen as shown next. Use this screen to configure QoS queue assignment. VMG3925-B10A User’s Guide...
Page 143 This shows the maximum transmission rate allowed for traffic on this queue. Modify Click the Edit icon to edit the queue. Click the Delete icon to delete an existing queue. Note that subsequent rules move up by one when you take this action. VMG3925-B10A User’s Guide...
Page 144: Adding A Qos Queue
Click Cancel to exit this screen without saving. 10.5 The Classification Setup Screen Use this screen to add, edit or delete QoS classifiers. A classifier groups traffic into data flows according to specific criteria such as the source address, destination address, source port number, VMG3925-B10A User’s Guide...
Page 145: Add/Edit Qos Classifier
Click the Delete icon to delete an existing classifier. Note that subsequent rules move up by one when you take this action. 10.5.1 Add/Edit QoS Classifier Click Add New Classification in the Classification Setup screen or the Edit icon next to a classifier to open the following screen. VMG3925-B10A User’s Guide...
Page 146 Chapter 10 Quality of Service (QoS) Figure 71 Classification Setup: Add/Edit VMG3925-B10A User’s Guide...
Page 147 For example, if you set the MAC address to 00:13:49:00:00:00 and the mask to ff:ff:ff:00:00:00, a packet with a MAC address of 00:13:49:12:34:56 matches this criteria. Exclude Select this option to exclude the packets that match the specified criteria from this classifier. VMG3925-B10A User’s Guide...
Page 148 If you select Unchange, the VMG keep the DSCP field in the packets. 802.1P Mark Select a priority level with which the VMG replaces the IEEE 802.1p priority field in the packets. If you select Unchange, the VMG keep the 802.1p priority field in the packets. VMG3925-B10A User’s Guide...
Page 149: The Qos Shaper Setup Screen
This shows the average rate limit of traffic bursts for this shaper. (kbps) Modify Click the Edit icon to edit the shaper. Click the Delete icon to delete an existing shaper. Note that subsequent rules move up by one when you take this action. VMG3925-B10A User’s Guide...
Page 150: Add/Edit A Qos Shaper
The following table describes the labels in this screen. Table 52 Network Setting > QoS > Policer Setup LABEL DESCRIPTION Add New Click this to create a new entry. Policer This is the index number of the entry. VMG3925-B10A User’s Guide...
Page 151: Add/Edit A Qos Policer
Figure 75 Policer Setup: Add/Edit The following table describes the labels in this screen. Table 53 Policer Setup: Add/Edit LABEL DESCRIPTION Active Select enable or disable this policer. Name Enter the descriptive name of this policer. VMG3925-B10A User’s Guide...
Page 152: Technical Reference
A VLAN tag includes the 12-bit VLAN ID and 3-bit user priority. The VLAN ID associates a frame with a specific VLAN and provides the information that devices need to process the frame across the network. VMG3925-B10A User’s Guide...
Page 153 The DSCP value determines the forwarding behavior, the PHB (Per-Hop Behavior), that each packet gets across the DiffServ network. Based on the marking rule, different kinds of traffic can be marked for different kinds of forwarding. Resources can then be allocated according to the DSCP values and the configured policies. VMG3925-B10A User’s Guide...
Page 154: Automatic Priority Queue Assignment
QUEUE PRIORITY TOS (IP IP PACKET DSCP (ETHERNET PRECEDENCE) LENGTH (BYTE) PRIORITY) 000000 000000 >1100 001110 250~1100 001100 001010 001000 010110 010100 010010 010000 011110 <250 011100 011010 011000 100110 100100 100010 100000 101110 101000 110000 111000 VMG3925-B10A User’s Guide...
Page 155 CBS bucket is equal to or greater than the size of the packet (in bytes). • After a packet is transmitted, a number of tokens corresponding to the packet size is removed from the CBS bucket. VMG3925-B10A User’s Guide...
Page 156 • If the PBS bucket has enough tokens, the VMG checks the CBS bucket. The packet is marked green and can be transmitted if the number of tokens in the CBS bucket is equal to or greater than the size of the packet (in bytes). Otherwise, the packet is marked yellow. VMG3925-B10A User’s Guide...
Page 157: Network Address Translation (Nat)
IP address of a host when the packet is in the local network, while the global address refers to the IP address of the host when the same packet is traveling in the WAN side. VMG3925-B10A User’s Guide...
Page 158: The Port Forwarding Screen
80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet. VMG3925-B10A User’s Guide...
Page 159 Protocol This shows the IP protocol supported by this virtual server, whether it is TCP, UDP, or TCP/ UDP. Modify Click the Edit icon to edit this rule. Click the Delete icon to delete an existing rule. VMG3925-B10A User’s Guide...
Page 160: Add/Edit Port Forwarding
To forward only one port, enter the port number again in the End Port field. To forward a series of ports, enter the start port number here and the end port number in the End Port field. VMG3925-B10A User’s Guide...
Page 161: The Applications Screen
Click this to add a new NAT application rule. Application Application This field shows the type of application that the service forwards. Forwarded WAN Interface This field shows the WAN interface through which the service is forwarded. VMG3925-B10A User’s Guide...
Page 162: Add New Application
The problem is that port forwarding only forwards a service to a single LAN IP address. In order to use the same service on a different LAN computer, you have to manually replace the LAN computer's IP address in the forwarding port with another LAN computer's IP address. VMG3925-B10A User’s Guide...
Page 163 This is the index number of the entry. Status This field displays whether the port triggering rule is active or not. A yellow bulb signifies that this rule is active. A gray bulb signifies that this rule is not active. VMG3925-B10A User’s Guide...
Page 164: Add/Edit Port Triggering Rule
Select to enable or disable this rule. Service Name Enter a name to identify this rule using keyboard characters (A-Z, a-z, 1-2 and so on). WAN Interface Select a WAN interface for which you want to configure port triggering rules. VMG3925-B10A User’s Guide...
Page 165: The Dmz Screen
Note: If you do not assign a Default Server Address, the VMG discards all packets received for ports that are not specified in the NAT Port Forwarding screen. Apply Click Apply to save your changes. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 166: The Alg Screen
When a rule matches the current packet, the VMG takes the corresponding action and the remaining rules are ignored. Click Network Setting > NAT > Address Mapping to display the following screen. Figure 86 Network Setting > NAT > Address Mapping VMG3925-B10A User’s Guide...
Page 167: Add/Edit Address Mapping Rule
11.7.1 Add/Edit Address Mapping Rule To add or edit an address mapping rule, click Add new rule or the rule’s edit icon in the Address Mapping screen to display the screen shown next. Figure 87 Address Mapping: Add/Edit VMG3925-B10A User’s Guide...
Page 168: The Sessions Screen
With heavy peer-to-peer application use, lower this number to ensure no single client uses too many of the available NAT sessions. Apply Click this to save your changes on this screen. Cancel Click this to exit this screen without saving any changes. VMG3925-B10A User’s Guide...
Page 169: Technical Reference
Many-to-Many Overload mapping), NAT offers the additional benefit of firewall protection. With no servers defined, your VMG filters out all incoming inquiries, thus preventing intruders from probing your network. For more information on IP address translation, refer to RFC 1631, The IP Network Address Translator (NAT). VMG3925-B10A User’s Guide...
Page 170: How Nat Works
Inside Global Address (ILA) Address (IGA) 192.168.1.11 192.168.1.10 11.9.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP alias) behind the VMG can communicate with three distinct WAN networks. VMG3925-B10A User’s Guide...
Page 171 Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a VMG3925-B10A User’s Guide...
Page 172 (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet. Figure 91 Multiple Servers Behind NAT Example A=192.168.1.33 192.168.1.1 B=192.168.1.34 IP address assigned by ISP C=192.168.1.35 D=192.168.1.36 VMG3925-B10A User’s Guide...
Page 173: Dns Setup
Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use, for example, www.yourhost.dyndns.org and still reach your hostname. VMG3925-B10A User’s Guide...
Page 174: The Dns Entry Screen
You can manually add or edit the VMG’s DNS name and IP address entry. Click Add New DNS Entry in the DNS Entry screen or the Edit icon next to the entry you want to edit. The screen shown next appears. Figure 93 DNS Entry: Add/Edit VMG3925-B10A User’s Guide...
Page 175: The Dynamic Dns Screen
This shows the last time the IP address the Dynamic DNS provider has associated with Time the hostname was updated. Current Dynamic This shows the IP address your Dynamic DNS provider has currently associated with the hostname. VMG3925-B10A User’s Guide...
Page 176 Chapter 12 DNS Setup Table 71 Network Setting > DNS > > Dynamic DNS (continued) LABEL DESCRIPTION Apply Click Apply to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 177: Igmp/Mld
13.2 The IGMP/MLD Screen Use this screen to configure multicast groups the VMG has joined and which ports have joined it. To open this screen, click Network Setting > IGMP/MLD. VMG3925-B10A User’s Guide...
Page 178 IGMP or MLD join report frames are dropped by the interface. Maximum Enter a number to limit the number of multicast data sources (1-24) a multicast group is Multicast Data allowed to have. Sources Note: The setting only works for IGMPv3 and MLDv2. VMG3925-B10A User’s Guide...
Page 179 Select this to have the VMG add a host to a multicast group immediately once the VMG Join Immediate receives an IGMP or MLD join message. (IPTV) Apply Click Apply to save your changes back to the VMG. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 180: Vlan Group
Use these screens to group separate VLAN groups together to be treated as one VLAN group. 14.2 The Vlan Group Screen Click Network Setting > Vlan Group to open the following screen. Figure 97 Network Setting > Vlan Group VMG3925-B10A User’s Guide...
Page 181: Add/Edit A Vlan Group
Select Txtagging to tag outgoing traffic from the associated LAN port with the VLAN ID number entered above. Note: LAN5 displays if the WAN port was configured as a LAN port in the Home Networking > 5th Ethernet port screen. VMG3925-B10A User’s Guide...
Page 182 Chapter 14 VLAN Group Table 74 Add/Edit VLAN Group (continued) LABEL DESCRIPTION Click OK to save your changes back to the VMG. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 183: Interface Group
In the following example, the client that sends packets with the DHCP Vendor ID option set to MSFT 5.0 (meaning it is a Windows 2000 DHCP client) is assigned the IP address 192.168.2.2 and uses the WAN VDSL_PoE/ppp0.1 interface. VMG3925-B10A User’s Guide...
Page 184: Interface Group Configuration
Click the Add New Interface Group button in the Interface Group screen to open the following screen. Use this screen to create a new interface group. Note: An interface can belong to only one group at a time. VMG3925-B10A User’s Guide...
Page 185 This shows if wildcard on DHCP option 60 is enabled. Support Remove Click the Remove icon to delete this rule from the VMG. Click OK to save your changes back to the VMG. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 186: Interface Grouping Criteria
Enter the device’s hardware type, assigned by the IANA. Type Time Enter the time that the DUID is generated. Link-layer Enter the VMG’s hardware address, that is the MAC address. address Enterprise Enter the vendor’s registered private enterprise number. Number VMG3925-B10A User’s Guide...
Page 187 Enter the serial number of the device. Number VLAN Group Select this and choose a pre-defined VLAN group. Click OK to save your changes back to the VMG. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 188: Usb Service
• Use the Media Server screen to enable or disable the sharing of media files (Section 16.3 on page 191). 16.1.2 What You Need To Know The following terms and concepts may help as you read this chapter. VMG3925-B10A User’s Guide...
Page 189: Before You Begin
Use this screen to set up file sharing through the VMG. The VMG’s LAN users can access the shared folder (or share) from the USB device inserted in the VMG. To access this screen, click Network Setting > USB Service > File Sharing. VMG3925-B10A User’s Guide...
Page 190: The Add New User Screen
Use this screen to create a user account that can access the secured shares on the USB device. To access this screen, click the Add New User button in the Network Setting > USB Service > File Sharing screen. VMG3925-B10A User’s Guide...
Page 191: The Media Server Screen
The media server is enabled by default with the video, photo, and music shares published. To change your VMG’s media server settings, click Network Setting > USB Service > Media Server. The screen appears as shown. VMG3925-B10A User’s Guide...
Page 192 Media Library Enter the path clients use to access the media files on a USB storage device connected to Path the VMG. Apply Click Apply to save your changes. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 193: Firewall
• Use the Access Control screen to view and configure incoming/outgoing filtering rules (Section 17.4 on page 197). • Use the DoS screen to activate protection against Denial of Service (DoS) attacks (.Section 17.5 on page 199). VMG3925-B10A User’s Guide...
Page 194: What You Need To Know
Use this screen to set the security level of the firewall on the VMG. Firewall rules are grouped based on the direction of travel of packets to which they apply. Click Security > Firewall to display the General screen. VMG3925-B10A User’s Guide...
Page 195: The Protocol Screen
IANA (Internet Assigned Number Authority) website. See Appendix D on page 293 for some examples. Click Security > Firewall > Protocol to display the following screen. Figure 109 Security > Firewall > Protocol VMG3925-B10A User’s Guide...
Page 196: Add/Edit A Protocol
Type a single port number or the range of port numbers that define your customized service. Protocol This field is displayed if you select Other as the protocol. Number Enter the protocol number of your customized port. VMG3925-B10A User’s Guide...
Page 197: The Access Control Screen
Click the Move To icon to change the order of the rule. Enter the number in the # field. 17.4.1 Add/Edit an ACL Rule Click Add new ACL rule or the Edit icon next to an existing ACL rule in the Access Control screen. The following screen displays. VMG3925-B10A User’s Guide...
Page 198 Select the transport layer protocol that defines your customized port from the drop-down list box. The specific protocol rule sets you add in the Security > Firewall > Service > Add screen display in this list. If you want to configure a customized protocol, select Specific Service. VMG3925-B10A User’s Guide...
Page 199: The Dos Screen
DoS Protection Select Enable to enable protection against DoS attacks. Blocking Deny Ping Select Enable to block ping request packets. Response Apply Click Apply to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 200: Mac Filter
18.2 The MAC Filter Screen Use this screen to allow wireless and LAN clients access to the VMG. Click Security > MAC Filter. The screen appears as shown. Figure 114 Security > MAC Filter VMG3925-B10A User’s Guide...
Page 201 VMG in these address fields. Enter the MAC addresses in a valid MAC address format, that is, six hexadecimal character pairs, for example, 12:34:56:78:9a:bc. Apply Click Apply to save your changes. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 202: Parental Control
This shows the day(s) and time on which parental control is enabled. Schedule Network This shows whether the network service is configured. If not, None will be shown. Service Website Block This shows whether the website block is configured. If not, None will be shown. VMG3925-B10A User’s Guide...
Page 203: Add/Edit A Parental Control Profile
Use this screen to configure a restricted access schedule and/or URL filtering settings to block the users on your network from accessing certain web sites. Figure 116 Parental Control Rule: Add/Edit Rule VMG3925-B10A User’s Guide...
Page 204 This shows the index number of the rule. Select the checkbox next to the rule to activate it. Service Name This shows the name of the service. Protocol:Port This shows the protocol and the port of the service. VMG3925-B10A User’s Guide...
Page 205 If you select Allow the Web URLs, the VMG blocks access to all URLs except ones listed below. Apply Click this button to save your settings back to the VMG. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 206: Scheduler Rule
20.2.1 Add/Edit a Schedule Click the Add New Rule button in the Scheduler Rule screen or click the Edit icon next to a schedule rule to open the following screen. Use this screen to configure a restricted access schedule. VMG3925-B10A User’s Guide...
Page 207 Enter the time period of each day, in 24-hour format, during which the rule will be enforced. Range Description Enter a description for this scheduler rule. Click OK to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 208: Certificates
21.3 The Local Certificates Screen Click Security > Certificates to open the Local Certificates screen. This is the VMG’s summary list of certificates and certification requests. Figure 121 Security > Certificates > Local Certificates VMG3925-B10A User’s Guide...
Page 209: Create Certificate Request
21.3.1 Create Certificate Request Click Security > Certificates > Local Certificates and then Create Certificate Request to open the following screen. Use this screen to have the VMG generate a certification request. VMG3925-B10A User’s Guide...
Page 210 After you click Apply to generate a request, you still need to get the certificate request signed by a Certificate Authority. If you already have, click the request’s Edit icon and then Load_Signed to import the signed certificate into the VMG. VMG3925-B10A User’s Guide...
Page 211: Load Signed Certificate
After you create a certificate request and have it signed by a Certificate Authority, in the View Certificate screen click the certificate request’s Load_Signed button to import the signed certificate into the VMG. Note: You must remove any spaces from the certificate’s filename before you can import VMG3925-B10A User’s Guide...
Page 212: The Trusted Ca Screen
The VMG accepts any valid certificate signed by a certification authority on this list as being trustworthy; thus you do not need to import any certificate that is signed by one of these certification authorities. Figure 125 Security > Certificates > Trusted CA VMG3925-B10A User’s Guide...
Page 213: View Trusted Ca Certificate
21.4.1 View Trusted CA Certificate Click the View icon in the Trusted CA screen to open the following screen. Use this screen to view in-depth information about the certification authority’s certificate. Figure 126 Trusted CA: View VMG3925-B10A User’s Guide...
Page 214: Import Trusted Ca Certificate
Type in the location of the certificate you want to upload in this field or click Choose File to Path find it. Apply Click Apply to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 215: Log
CODE SEVERITY Emergency: The system is unusable. Alert: Action must be taken immediately. Critical: The system condition is critical. Error: There is an error condition on the system. Warning: There is a warning condition on the system. VMG3925-B10A User’s Guide...
Page 216: The System Log Screen
This field states the reason for the log. 22.3 The Security Log Screen Use the Security Log screen to see the security-related logs for the categories that you select. Click System Monitor > Log > Security Log to open the following screen. VMG3925-B10A User’s Guide...
Page 217 This field displays the severity level of the log that the device is to send to this syslog server. Category This field displays the type of the log. Messages This field states the reason for the log. VMG3925-B10A User’s Guide...
Page 218: Traffic Status
23.2 The WAN Status Screen Click System Monitor > Traffic Status to open the WAN screen. The figure in this screen shows the number of bytes received and sent on the VMG. Figure 130 System Monitor > Traffic Status > WAN VMG3925-B10A User’s Guide...
Page 219: The Lan Status Screen
Click System Monitor > Traffic Status > LAN to open the following screen. The figure in this screen shows the interface that is currently connected on the VMG. Figure 131 System Monitor > Traffic Status > LAN VMG3925-B10A User’s Guide...
Page 220: The Nat Status Screen
This displays what percentage of NAT sessions the VMG can support is currently being used by all connected hosts. You can also see the number of active NAT sessions and the maximum number of NAT sessions the VMG can support. VMG3925-B10A User’s Guide...
Page 221: Arp Table
MAC address that replied. 24.2 ARP Table Screen Use the ARP table to view IP-to-MAC address mapping(s). To open this screen, click System Monitor > ARP Table. Figure 133 System Monitor > ARP Table VMG3925-B10A User’s Guide...
Page 222 This is the MAC address of the device with the listed IP address. Device This is the type of interface used by the device. You can click on the device type to go to its configuration screen. VMG3925-B10A User’s Guide...
Page 223: Routing Table
DESCRIPTION IPv4/IPv6 Routing Table Destination This indicates the destination IPv4 address or IPv6 address and prefix of this route. Gateway This indicates the IPv4 address or IPv6 address of the gateway that helps forward this route’s traffic. VMG3925-B10A User’s Guide...
Page 224 This indicates the name of the interface through which the route is forwarded. brx indicates a LAN interface where x can be 0~3 to represent LAN1 to LAN4 respectively. ptm0 indicates a WAN interface using IPoE or in bridge mode. ppp0 indicates a WAN interface using PPPoE. VMG3925-B10A User’s Guide...
Page 225: Multicast Status
26.3 The MLD Status Screen Use this screen to look at the current list of multicast groups the VMG has joined and which ports have joined it. To open this screen, click System Monitor > Multicast Status > MLD Status. VMG3925-B10A User’s Guide...
Page 226 Source List This is the list of IP addresses that are allowed or not allowed to receive the multicast group’s traffic depending on the filter mode. Member This is the list of members in the multicast group. VMG3925-B10A User’s Guide...
Page 227: Xdsl Statistics
This displays the ITU standard used for this connection. Traffic Type This displays the type of traffic the DSL port is sending and receiving. Inactive displays if the DSL port is not currently sending or receiving traffic. VMG3925-B10A User’s Guide...
Page 228 This is the number of Far End Corrected blocks. This is the number of Cyclic Redundancy Checks. This is the number of Errored Seconds meaning the number of seconds containing at least one errored block or at least one defect. VMG3925-B10A User’s Guide...
Page 229 30% or more errored blocks or at least one defect. This is a subset of ES. This is the number of UnAvailable Seconds. This is the number of Loss Of Signal seconds. This is the number of Loss Of Frame seconds. This is the number of Loss of Margin seconds. VMG3925-B10A User’s Guide...
Page 230: Statistics
To open this screen, click System Monitor > 3G Statistics. The 3G status is available on this screen only when you insert a compatible 3G dongle in a USB port on the VMG. Figure 138 System Monitor > 3G Statistics VMG3925-B10A User’s Guide...
Page 231 The International Mobile Subscriber Identity or IMSI is a unique identification number associated with all cellular networks. This number is provisioned in the SIM card. VID/PID This field displays the USB Vendor ID and Product ID of the 3G card. VMG3925-B10A User’s Guide...
Page 232: System
Type a hostname for your VMG. Enter a descriptive name of up to 16 alphanumeric characters, not including spaces, underscores, and dashes. Domain Name Type a Domain name for your host VMG. Apply Click Apply to save your changes. Cancel Click Cancel to abandon this screen without saving. VMG3925-B10A User’s Guide...
Page 233: User Account
Click the Delete icon to remove the entry. 30.2.1 The User Account Add/Edit Screen Click Add New Account or the Edit icon of an existing account in the Maintenance > User Account to open the following screen. VMG3925-B10A User’s Guide...
Page 234 Enter the length of time a user must wait before attempting to log in again after a number if consecutive wrong passwords have been entered as defined in Retry Times. Group Specify whether this user will have Administrator or User privleges. ClickOK to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 235: Remote Management
Select the Enable check box for the corresponding services that you want to allow access to the VMG from the LAN/WLAN. Select the Enable check box for the corresponding services that you want to allow access to the VMG from all WAN connections. VMG3925-B10A User’s Guide...
Page 236: The Trust Domain Screen
Use this screen to configure a public IP address which is allowed to access the VMG. Click the Add Trust Domain button in the Maintenance > Remote MGMT > Turst Domain screen to open the following screen. VMG3925-B10A User’s Guide...
Page 237 Enter a public IPv4 IP address which is allowed to access the service on the VMG from the WAN. Click OK to save your changes back to the VMG. Cancel Click Cancel to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 238: Snmp
Examples of variables include such as number of packets received, node port status etc. A Management Information Base (MIB) is a collection of managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects. VMG3925-B10A User’s Guide...
Page 239 Enter the SNMP system contact. Trap Destination Type the IP address of the station to send your SNMP traps to. Apply Click this to save your changes back to the VMG. Cancel Click this to restore your previously saved settings. VMG3925-B10A User’s Guide...
Page 240: Time Settings
33.2 The Time Screen To change your VMG’s time and date, click Maintenance > Time. The screen appears as shown. Use this screen to configure the VMG’s time based on your local time zone. Figure 147 Maintenance > Time VMG3925-B10A User’s Guide...
Page 241 October. The time you select in the o'clock field depends on your time zone. In Germany for instance, you would select 2 in the Hour field because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). VMG3925-B10A User’s Guide...
Page 242 Chapter 33 Time Settings Table 117 Maintenance > Time (continued) LABEL DESCRIPTION Apply Click Apply to save your changes. Cancel Click Cancel to exit this screen without saving. VMG3925-B10A User’s Guide...
Page 243: E-Mail Notification
Delete Click this button to delete the selected entry(ies). 34.2.1 Email Notification Edit Click the Add button in the Email Notification screen. Use this screen to configure the required information for sending e-mail via a mail server. VMG3925-B10A User’s Guide...
Page 244 Select STARTTLS to upgrade a plain text connection to a secure connection using SSL/TLS. Click this button to save your changes and return to the previous screen. Cancel Click this button to begin configuring this screen afresh. VMG3925-B10A User’s Guide...
Page 245: Log Setting
The following table describes the fields in this screen. Table 120 Maintenance > Logs Setting LABEL DESCRIPTION Syslog Setting Syslog Logging The VMG sends a log to an external syslog server. Select Enable to enable syslog logging. VMG3925-B10A User’s Guide...
Page 246: Example E-Mail Log
• You may edit the subject title. • The date format here is Day-Month-Year. • The date format here is Month-Day-Year. The time format is Hour-Minute-Second. • "End of Log" message shows that a complete log has been sent. VMG3925-B10A User’s Guide...
Page 247 |<1,02> 127|Apr 7 00 |From:192.168.1.131 To:192.168.1.255 |match |forward | 10:05:17 |UDP src port:00520 dest port:00520 |<1,02> 128|Apr 7 00 |From:192.168.1.1 To:192.168.1.255 |match |forward | 10:05:30 |UDP src port:00520 dest port:00520 |<1,02> End of Firewall Log VMG3925-B10A User’s Guide...
Page 248: Firmware Upgrade
Upgrade Firmware Current This is the present Firmware version and the date created. Firmware Version File Path Type in the location of the file you wasnt to upload in this field or click Choose File to find VMG3925-B10A User’s Guide...
Page 249 After two minutes, log in again and check your new firmware version in the Status screen. If the upload was not successful, the following screen will appear. Click OK to go back to the Firmware Upgrade screen. Figure 155 Error Message VMG3925-B10A User’s Guide...
Page 250: Backup Restore
The backup configuration file will be useful in case you need to return to your previous settings. Click Backup to save the VMG’s current configuration to your computer. VMG3925-B10A User’s Guide...
Page 251 If the upload was not successful, the following screen will appear. Click OK to go back to the Configuration screen. Figure 158 Configuration Upload Error Reset to Factory Defaults Click the Reset button to clear all user-entered configuration information and return the VMG to its factory defaults. The following warning screen appears. VMG3925-B10A User’s Guide...
Page 252: The Reboot Screen
System restart allows you to reboot the VMG remotely without turning the power off. You may need to do this if the VMG hangs, for example. Click Maintenance > Reboot. Click Reboot to have the VMG reboot. This does not affect the VMG's configuration. Figure 161 Maintenance > Reboot VMG3925-B10A User’s Guide...
Page 253: Diagnostic
If an MEP port does not respond to the source MEP, this may indicate a fault. Administrators can take further action to check and resume services from the fault according to the line connectivity status report. VMG3925-B10A User’s Guide...
Page 254: Ping & Traceroute & Nslookup
Click this button to perform a DNS lookup on the IP address of a computer you enter. 38.4 802.1ag Click Maintenance > Diagnostic > 8.2.1ag to open the following screen. Use this screen to perform CFM actions. VMG3925-B10A User’s Guide...
Page 255: Oam Ping
OAM (Operation, Administration and Maintenance) F4 or F5 loopback test on a PVC. The VMG sends an OAM F4 or F5 packet to the DSLAM or ATM switch and then returns it to the VMG. The test result then displays in the text box. VMG3925-B10A User’s Guide...
Page 256 ATM device. End-to-end loopback tests allow you to verify integrity of an end-to-end PVC. Note: The DSLAM to which the VMG is connected must also support ATM F4 and/or F5 to use this test. Note: This screen is available only when you configure an ATM layer-2 interface. VMG3925-B10A User’s Guide...
Page 257 Press this to perform an OAM F4 segment loopback test. F4 end-end Press this to perform an OAM F4 end-to-end loopback test. F5 segment Press this to perform an OAM F5 segment loopback test. F5 end-end Press this to perform an OAM F5 end-to-end loopback test. VMG3925-B10A User’s Guide...
Page 258: Troubleshooting
Make sure you understand the normal behavior of the LED. See Section 1.5 on page Check the hardware connections. Inspect your cables for damage. Contact the vendor to replace any damaged cables. Turn the VMG off and on. VMG3925-B10A User’s Guide...
Page 259: Vmg Access And Login
Make sure your Internet browser does not block pop-up windows and has JavaScripts and Java enabled. If it is possible to log in from another interface, check the service control settings for HTTP and HTTPS (Maintenance > Remote Management). VMG3925-B10A User’s Guide...
Page 260 I cannot use FTP to upload / download the configuration file. / I cannot use FTP to upload new firmware. See the troubleshooting suggestions for I cannot see or access the Login screen in the web configurator. Ignore the suggestions about your browser. VMG3925-B10A User’s Guide...
Page 261: Internet Access
ADSL or VDSL connection at one time. I cannot connect to the Internet using an Ethernet connection. The DSL connection has priority. If the DSL connection is up, then the Ethernet connection will be down. VMG3925-B10A User’s Guide...
Page 262: Wireless Internet Access
39.4 Wireless Internet Access What factors may cause intermittent or unstabled wireless connection? How can I solve this problem? The following factors may cause interference: • Obstacles: walls, ceilings, furniture, and so on. • Building Materials: metal doors, aluminum studs. VMG3925-B10A User’s Guide...
Page 263: Usb Device Connection
Re-connect your USB device to the VMG. 39.6 UPnP When using UPnP and the VMG reboots, my computer cannot detect UPnP and refresh My Network Places > Local Network. Disconnect the Ethernet cable from the VMG’s LAN port or from your computer. VMG3925-B10A User’s Guide...
Page 264 Chapter 39 Troubleshooting Re-connect the Ethernet cable. The Local Area Connection icon for UPnP disappears in the screen. Restart your computer. VMG3925-B10A User’s Guide...
Page 265: Appendices
Appendices Appendices contain general information. Some information may not apply to your device.
Page 266: Appendix A Customer Support
• Brief description of the problem and the steps you took to solve it. Corporate Headquarters (Worldwide) Taiwan • ZyXEL Communications Corporation • http://www.zyxel.com Asia China • ZyXEL Communications (Shanghai) Corp. ZyXEL Communications (Beijing) Corp. ZyXEL Communications (Tianjin) Corp. • http://www.zyxel.cn India • ZyXEL Technology India Pvt Ltd • http://www.zyxel.in Kazakhstan •...
Page 267 • ZyXEL Singapore Pte Ltd. • http://www.zyxel.com.sg Taiwan • ZyXEL Communications Corporation • http://www.zyxel.com/tw/zh/ Thailand • ZyXEL Thailand Co., Ltd • http://www.zyxel.co.th Vietnam • ZyXEL Communications Corporation-Vietnam Office • http://www.zyxel.com/vn/vi Europe Austria • ZyXEL Deutschland GmbH • http://www.zyxel.de Belarus • ZyXEL BY • http://www.zyxel.by...
Page 268 Appendix A Customer Support Belgium • ZyXEL Communications B.V. • http://www.zyxel.com/be/nl/ • http://www.zyxel.com/be/fr/ Bulgaria • ZyXEL България • http://www.zyxel.com/bg/bg/ Czech Republic • ZyXEL Communications Czech s.r.o • http://www.zyxel.cz Denmark • ZyXEL Communications A/S • http://www.zyxel.dk Estonia • ZyXEL Estonia • http://www.zyxel.com/ee/et/ Finland •...
Page 269 • ZyXEL Communications Poland • http://www.zyxel.pl Romania • ZyXEL Romania • http://www.zyxel.com/ro/ro Russia • ZyXEL Russia • http://www.zyxel.ru Slovakia • ZyXEL Communications Czech s.r.o. organizacna zlozka • http://www.zyxel.sk Spain • ZyXEL Communications ES Ltd • http://www.zyxel.es Sweden • ZyXEL Communications • http://www.zyxel.se Switzerland •...
Page 270 Appendix A Customer Support • http://www.zyxel.ch/ Turkey • ZyXEL Turkey A.S. • http://www.zyxel.com.tr • ZyXEL Communications UK Ltd. • http://www.zyxel.co.uk Ukraine • ZyXEL Ukraine • http://www.ua.zyxel.com Latin America Argentina • ZyXEL Communication Corporation • http://www.zyxel.com/ec/es/ Brazil • ZyXEL Communications Brasil Ltda.
Page 271 Appendix A Customer Support North America • ZyXEL Communications, Inc. - North America Headquarters • http://www.zyxel.com/us/en/ Oceania Australia • ZyXEL Communications Corporation • http://www.zyxel.com/au/en/ Africa South Africa • Nology (Pty) Ltd. • http://www.zyxel.co.za VMG3925-B10A User’s Guide...
Page 272: Appendix B Wireless Lans
Intra-BSS traffic is traffic between wireless clients in the BSS. When Intra-BSS is enabled, wireless client A and B can access the wired network and communicate with each other. When Intra-BSS is disabled, wireless client A and B can still access the wired network but cannot communicate with each other. VMG3925-B10A User’s Guide...
Page 273 An ESSID (ESS IDentification) uniquely identifies each ESS. All access points and their associated wireless clients within the same ESS must have the same ESSID in order to communicate. VMG3925-B10A User’s Guide...
Page 274 (AP) or wireless gateway, but out-of-range of each other, so they cannot "hear" each other, that is they do not know if the channel is currently being used. Therefore, they are considered hidden from each other. VMG3925-B10A User’s Guide...
Page 275 If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size. VMG3925-B10A User’s Guide...
Page 276 It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are: • User based identification that allows for roaming. VMG3925-B10A User’s Guide...
Page 277 In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. The key is not sent over the network. In addition to the VMG3925-B10A User’s Guide...
Page 278 Client authentication is then done by sending username and password through the secure connection, thus client identity is protected. For client authentication, EAP-TTLS supports EAP methods and legacy authentication methods such as PAP, CHAP, MS-CHAP and MS-CHAP v2. VMG3925-B10A User’s Guide...
Page 279 Key differences between WPA or WPA2 and WEP are improved data encryption and user authentication. If both an AP and the wireless clients support WPA2 and you have an external RADIUS server, use WPA2 for stronger data encryption. If you don't have an external RADIUS server, you should use VMG3925-B10A User’s Guide...
Page 280 RADIUS database. WPA2 reduces the number of key exchange messages from six to four (CCMP 4-way handshake) and shortens the time required to connect to a network. Other WPA2 authentication features that are different from WPA include key caching and VMG3925-B10A User’s Guide...
Page 281 The RADIUS server distributes the PMK to the AP. The AP then sets up a key hierarchy and management system, using the PMK to dynamically generate unique data encryption keys. The keys are used to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients. VMG3925-B10A User’s Guide...
Page 282 The AP and wireless clients use the TKIP or AES encryption process, the PMK and information exchanged in a handshake to create temporal encryption keys. They use these keys to encrypt data exchanged between them. Figure 171 WPA(2)-PSK Authentication VMG3925-B10A User’s Guide...
Page 283 Antenna gain, measured in dB (decibel), is the increase in coverage within the RF beam width. Higher antenna gain improves the range of the signal for better communications. For an indoor site, each 1 dB increase in antenna gain results in a range increase of approximately VMG3925-B10A User’s Guide...
Page 284 For a single AP application, place omni-directional antennas as close to the center of the coverage area as possible. For directional antennas, point the antenna in the direction of the desired coverage area. VMG3925-B10A User’s Guide...
Page 285: Appendix C Ipv6
“private IP address” in IPv4. You can have the same link-local address on multiple interfaces on a device. A link-local unicast address has a predefined prefix of fe80::/10. The link-local unicast address format is as follows. Table 130 Link-local Unicast Address Format 1111 1110 10 Interface ID 10 bits 54 bits 64 bits VMG3925-B10A User’s Guide...
Page 286 All DHCP severs on a local site. FF05:0:0:0:0:0:1:3 The following table describes the multicast addresses which are reserved and can not be assigned to a multicast group. Table 132 Reserved Multicast Address MULTICAST ADDRESS FF00:0:0:0:0:0:0:0 FF01:0:0:0:0:0:0:0 FF02:0:0:0:0:0:0:0 FF03:0:0:0:0:0:0:0 FF04:0:0:0:0:0:0:0 FF05:0:0:0:0:0:0:0 FF06:0:0:0:0:0:0:0 FF07:0:0:0:0:0:0:0 VMG3925-B10A User’s Guide...
Page 287 DHCPv6 server uses T1 and T2 to control the time at which the client contacts with the server to extend the lifetimes on any addresses in the IA_NA before the lifetimes expire. After T1, the client sends the server (S1) (from which the addresses in the IA_NA were obtained) a Renew message. If VMG3925-B10A User’s Guide...
Page 288 • Neighbor solicitation: A request from a host to determine a neighbor’s link-layer address (MAC address) and detect if the neighbor is still reachable. A neighbor being “reachable” means it responds to a neighbor solicitation message (from the host) with a neighbor advertisement message. VMG3925-B10A User’s Guide...
Page 289 Done message to the router or switch. The router or switch then sends a group-specific query to the port on which the Done message is received to determine if other devices connected to this port should remain in the group. VMG3925-B10A User’s Guide...
Page 290 Install Dibbler and select the DHCPv6 client option on your computer. After the installation is complete, select Start > All Programs > Dibbler-DHCPv6 > Client Install as service. Select Start > Control Panel > Administrative Tools > Services. Double click Dibbler - a DHCPv6 client. VMG3925-B10A User’s Guide...
Page 291 Windows 7 supports IPv6 by default. DHCPv6 is also enabled when you enable IPv6 on a Windows 7 computer. To enable IPv6 in Windows 7: Select Control Panel > Network and Sharing Center > Local Area Connection. Select the Internet Protocol Version 6 (TCP/IPv6) checkbox to enable it. Click OK to save the change. VMG3925-B10A User’s Guide...
Page 292 IPv4 Address... : 172.16.100.61 Subnet Mask ... : 255.255.255.0 Default Gateway ..: fe80::213:49ff:feaa:7125%11 172.16.100.254 VMG3925-B10A User’s Guide...
Page 293: Appendix D Services
• If the Protocol is TCP, UDP, or TCP/UDP, this is the IP port number. • If the Protocol is USER, this is the IP protocol number. • Description: This is a brief explanation of the applications that use this service or the situations in which this service is used. VMG3925-B10A User’s Guide...
Page 294 Microsoft Networks’ messenger service uses this protocol. NetBIOS TCP/UDP The Network Basic Input/Output System is used for communication between computers in a LAN. TCP/UDP TCP/UDP TCP/UDP NEW-ICQ 5190 An Internet chat program. NEWS A protocol for news groups. VMG3925-B10A User’s Guide...
Page 295 UNIX systems and network servers. SSDP 1900 The Simple Service Discovery Protocol supports Universal Plug-and-Play (UPnP). TCP/UDP Secure Shell Remote Login Program. STRM WORKS 1558 Stream Works Protocol. VMG3925-B10A User’s Guide...
Page 296 Internet and in UNIX environments. It operates over TCP/IP networks. Its primary function is to allow users to log into remote host systems. VDOLIVE 7000 A videoconferencing solution. The UDP port number is specified in the application. user- defined VMG3925-B10A User’s Guide...
Page 297: Appendix E Legal Information
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Page 298: European Union
Hrvatski ZyXEL ovime izjavljuje da je radijska oprema tipa u skladu s Direktivom 1999/5/EC. (Croatian) Íslenska Hér með lýsir, ZyXEL því yfir að þessi búnaður er í samræmi við grunnkröfur og önnur viðeigandi ákvæði tilskipunar (Icelandic) 1999/5/EC. VMG3925-B10A User’s Guide...
Page 299 Italia. Se non viene installato all 'interno del proprio fondo, l'utilizzo di prodotti Wireless LAN richiede una “Autorizzazione Generale”. Consultare http://www.sviluppoeconomico.gov.it/ per maggiori dettagli. Latvia The outdoor usage of the 2.4 GHz band requires an authorization from the Electronic Communications Office. Please check http:// www.esd.lv for more details. VMG3925-B10A User’s Guide...
Page 300: Safety Warnings
FOR COUNTRY CODE SELECTION USAGE (WLAN DEVICES) Note: The country code selection is for non-US model only and is not available to all US model. Per FCC regulation, all Wi-Fi product marketed in US must fixed to US operation channels only. VMG3925-B10A User’s Guide...
Page 301 Symbolen innebär att enligt lokal lagstiftning ska produkten och/eller dess batteri kastas separat från hushållsavfallet. När den här produkten når slutet av sin livslängd ska du ta den till en återvinningsstation. Vid tiden för kasseringen bidrar du till en bättre miljö och mänsklig hälsa genom att göra dig av med den på ett återvinningsställe. VMG3925-B10A User’s Guide...
Page 302 Appendix E Legal Information Environmental Product Declaration VMG3925-B10A User’s Guide...
Page 303: Zyxel Limited Warranty
You can download the latest firmware at www.zyxel.com. If you cannot find it there, contact your vendor or ZyXEL Technical Support at support@zyxel.com.tw. To obtain the source code covered under those Licenses, please contact your vendor or ZyXEL Technical Support at support@zyxel.com.tw. VMG3925-B10A User’s Guide...
Page 304: Index
79, 133, 135, 174 Connectivity Check Messages, see CCMs broadcast copyright example CoS technologies creating certificates CTS threshold 100, 104 Canonical Format Indicator See CFI CCMs data fragment threshold certificate 100, 104 factory default DDoS certificates default server address VMG3925-B10A User’s Guide...
Page 305 Inside Local Address, see ILA interface group Internet wizard setup Internet access FCC interference statement wizard setup file sharing Internet Protocol version 6 filters introduction MAC address 94, 105 IP address 117, 130 Finger ping firewalls private VMG3925-B10A User’s Guide...
Page 306 Loop Back Response, see LBR loopback inside local outside port forwarding port number services SIP ALG activation NAT example MAC address 94, 122 Network Address Translation, see NAT filter 94, 105 Network Map MAC authentication network map VMG3925-B10A User’s Guide...
Page 307 Single Rate Three Color Marker, see srTCM SIP ALG activation SMTP SNMP 171, 239 139, 153 agents marking setup GetNext tagging Manager versus CoS managers Quality of Service, see QoS network components Trap SNMP trap RADIUS server srTCM registration VMG3925-B10A User’s Guide...
Page 308 Tag Control Information See TCI status Tag Protocol Identifier See TPID Wide Area Network, see WAN warranty note thresholds 97, 108 data fragment 100, 104 compatibility RTS/CTS 100, 104 example TPID web configurator trademarks login traffic shaping passwords VMG3925-B10A User’s Guide...
Page 309 RADIUS server RTS/CTS threshold 100, 104 security SSID activation status 97, 108 compatibility example WPA-PSK 108, 111 example limitations push button 20, 109 Wireless tutorial wizard setup Internet WPA-PSK 108, 111 example limitations example push button 20, 109 VMG3925-B10A User’s Guide...

ZyXEL Communications VMG3925-B10A User Manual

Contents Overview

Table of Contents

User's Guide

PART I User's Guide

Chapter 1 Introducing the VMG

Chapter 2 The Web Configurator

Chapter 3 Quick Start

Chapter 4 Tutorials

Technical Reference

Part II: Technical Reference

Chapter 5 Network Map and Status Screens

Chapter 6 Broadband

Chapter 7 Wireless

Chapter 8 Home Networking

Chapter 9 Routing

Chapter 10 Quality of Service (Qos)

Chapter 11 Network Address Translation (NAT)

Chapter 12 DNS Setup

Chapter 13 IGMP/MLD

Chapter 14 VLAN Group

Chapter 15 Interface Group

Chapter 16 USB Service

Chapter 17 Firewall

Chapter 18 MAC Filter

Chapter 19 Parental Control

Chapter 20 Scheduler Rule

Chapter 21 Certificates

Chapter 22 Log

Chapter 23 Traffic Status

Chapter 24 ARP Table

Chapter 25 Routing Table

Chapter 26 Multicast Status

Chapter 27 Xdsl Statistics

Chapter 28 3G Statistics

Chapter 29 System

Chapter 30 User Account

Chapter 31 Remote Management

Chapter 32 SNMP

Chapter 33 Time Settings

Chapter 34 E-Mail Notification

Chapter 35 Log Setting

Quick Links

Need help?

Questions and answers

Related Manuals for ZyXEL Communications VMG3925-B10A

Summary of Contents for ZyXEL Communications VMG3925-B10A