ZyXEL Communications ZyAIR Wireless Gateway Series User Manual
  1. Manuals
  2. Brands
  3. ZyXEL Communications Manuals
  4. Gateway
  5. ZyAIR Wireless Gateway Series
  6. User manual
ZyXEL Communications ZyAIR Wireless Gateway Series User Manual

ZyXEL Communications ZyAIR Wireless Gateway Series User Manual

Wireless gateway series
Hide thumbs Also See for ZyAIR Wireless Gateway Series:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
Table of Contents

Advertisement

Quick Links

Download this manual
ZyAIR
Wireless Gateway Series
User's Guide
Version 3.50
May 2004

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the ZyAIR Wireless Gateway Series and is the answer not in the manual?

Questions and answers

Related Manuals for ZyXEL Communications ZyAIR Wireless Gateway Series

Summary of Contents for ZyXEL Communications ZyAIR Wireless Gateway Series

  • Page 1 ZyAIR Wireless Gateway Series User's Guide Version 3.50 May 2004...
  • Page 2 Trademarks ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners.

  • Page 3: Federal Communications Commission (Fcc) Interference Statement

    2. Select your product from the drop-down list box on the ZyXEL home page to go to that product's page. 3. Select the certification you wish to view from this page. FCC Statement ZyAIR Wireless Gateway Series User’s Guide (FCC) Interference Statement...

  • Page 4: Safety Warnings

    ZyAIR Wireless Gateway Series User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and...

  • Page 5: Customer Support

    DENMARK support@zyxel.dk sales@zyxel.dk NORWAY support@zyxel.no sales@zyxel.no “+” is the (prefix) number you enter to make an international telephone call. Customer Support ZyAIR Wireless Gateway Series User’s Guide Customer Support TELEPHONE WEB SITE FTP SITE +886-3-578-3942 www.zyxel.com www.europe.zyxel.com +886-3-578-2439 ftp.zyxel.com ftp.europe.zyxel.com...
  • Page 6 ZyAIR Wireless Gateway Series User’s Guide METHOD SUPPORT E-MAIL SALES E-MAIL LOCATION SWEDEN support@zyxel.se sales@zyxel.se FINLAND support@zyxel.fi sales@zyxel.fi TELEPHONE WEB SITE FTP SITE +46 31 744 7700 www.zyxel.se +46 31 744 7701 +358-9-4780-8411 www.zyxel.fi +358-9-4780 8448 REGULAR MAIL ZyXEL Communications A/S Sjöporten 4, 41764 Göteborg...

  • Page 7: Table Of Contents

    List of Figures...xvi List of Tables...xxiii Preface...xxvi OVERVIEW ... I Chapter 1 Getting to Know Your ZyAIR ...1-1 Introducing the ZyAIR Wireless Gateway Series ...1-1 ZyAIR Features...1-1 Application for the ZyAIR ...1-7 1.3.1 Internet Access Application ...1-7 Chapter 2 Introducing the Web Configurator...2-1 Web Configurator Overview...2-1...
  • Page 8 System Overview ...4-1 Configuring General Setup ...4-1 Dynamic DNS...4-2 4.3.1 DYNDNS Wildcard ...4-3 Configuring Dynamic DNS ...4-3 Configuring Password...4-5 Configuring Time Setting ...4-6 Chapter 5 LAN Screens...5-1 LAN Overview ...5-1 LANs and WANs...5-1 5.2.1 LANs, WANs and the ZyAIR...5-1 DHCP Setup...5-2 Factory LAN Defaults...5-2 RIP Setup ...5-2 Multicast ...5-3...
  • Page 9 9.4.1 Configuring Address Mapping Rule ...9-11 Chapter 10 Static Route...10-1 10.1 Static Route Overview ...10-1 10.2 Configuring IP Static Route ...10-1 10.2.1 Configuring Route Entry...10-3 FIREWALL AND REMOTE MANAGEMENT ... V Table of Contents ZyAIR Wireless Gateway Series User’s Guide...
  • Page 10 Chapter 11 Introduction to Firewalls ... 11-1 11.1 Firewall Overview ...11-1 11.2 Types of Firewalls...11-1 11.2.1 Packet Filtering Firewalls ...11-1 11.2.2 Application-level Firewalls...11-1 11.2.3 Stateful Inspection Firewalls...11-2 11.3 Introduction to ZyXEL’s Firewall ...11-2 11.4 Denial of Service ...11-2 11.4.1 Basics ...11-3 11.4.2 Types of DoS Attacks ...11-4 11.5 Stateful Inspection ...11-7...
  • Page 11 Chapter 17 Introducing the SMT ...17-1 17.1 Connect to your ZyAIR Using Telnet ...17-1 17.2 Connect to Your ZyAIR Using the Console Port ...17-1 17.2.1 Initial Screen ...17-2 17.2.2 Entering Password...17-2 Table of Contents ZyAIR Wireless Gateway Series User’s Guide...
  • Page 12 17.3 Changing the System Password ...17-2 17.4 ZyAIR SMT Menu Overview Example...17-3 17.5 Navigating the SMT Interface...17-5 17.5.1 System Management Terminal Interface Summary...17-6 Chapter 18 General and WAN Setup ...18-1 18.1 General Setup...18-1 18.1.1 Dynamic DNS...18-1 18.1.2 Procedure To Configure Menu 1...18-1 18.1.3 Procedure to Configure Dynamic DNS...18-3 18.2 WAN Setup...18-5...
  • Page 13 27.4 Diagnostic ...27-8 Chapter 28 Firmware and Configuration File Maintenance...28-1 28.1 Filename Conventions...28-1 28.2 Backup Configuration ...28-2 28.2.1 Backup Configuration ...28-3 28.2.2 Using the FTP Command from the Command Line...28-3 Table of Contents ZyAIR Wireless Gateway Series User’s Guide xiii...
  • Page 14 28.2.3 Example of FTP Commands from the Command Line...28-4 28.2.4 GUI-based FTP Clients...28-4 28.2.5 TFTP and FTP over WAN Management Limitations ...28-4 28.2.6 Backup Configuration Using TFTP ...28-5 28.2.7 TFTP Command Example ...28-5 28.2.8 GUI-based TFTP Clients ...28-5 28.2.9 Backup Via Console Port (only for ZyAIR B-2000) ...28-6 28.3 Restore Configuration...28-7 28.3.1 Restore Using FTP...28-8...
  • Page 15 Appendix L NetBIOS Filter Commands ...L-1 Appendix M Boot Commands...M-1 Appendix N Triangle Route...N-1 Appendix O Log Descriptions ... O-1 Appendix P Power Adaptor Specifications... P-1 Appendix Q Index ... Q-1 Table of Contents ZyAIR Wireless Gateway Series User’s Guide...

  • Page 16: List Of Figures

    ZyAIR Wireless Gateway Series User’s Guide List of Figures Figure 1-1 Internet Access Application Example ...1-7 Figure 2-1 Web Browser Address Field ...2-1 Figure 2-2 Change Password Screen ...2-2 Figure 2-3 Example Xmodem Upload...2-3 Figure 2-4 The MAIN MENU Screen of the Web Configurator...2-4 Figure 3-1 Wizard 1: General Setup ...3-2...
  • Page 17 ZyAIR Wireless Gateway Series User’s Guide Figure 8-2 Service Type ... 8-2 ... 8-4 Figure 8-3 PPPoE Encapsulation ... 8-6 Figure 8-4 PPTP Encapsulation ... 8-8 Figure 8-5 IP Setup ...8-11 Figure 8-6 MAC Setup Figure 9-1 How NAT Works ... 9-3 Figure 9-2 NAT Application with IP Alias ...
  • Page 18 ZyAIR Wireless Gateway Series User’s Guide Figure 16-4 Association List...16-5 Figure 16-5 Channel Usage (ZyAIR B-2000)...16-6 Figure 16-6 Channel Usage ...16-7 Figure 16-7 Firmware Upload ...16-8 Figure 16-8 Firmware Upload In Process ...16-9 Figure 16-9 Network Temporarily Disconnected...16-9 Figure 16-10 Firmware Upload Error ...16-10 Figure 16-11 Configuration ...16-11...
  • Page 19 ZyAIR Wireless Gateway Series User’s Guide Figure 23-1 Menu 4 Internet Access Setup ... 23-1 Figure 23-2 Menu 11.3 Remote Node Network Layer Options ... 23-2 Figure 23-3 Menu 15 NAT Setup... 23-3 Figure 23-4 Menu 15.1 Address Mapping Sets... 23-3 Figure 23-5 Menu 15.1.255 SUA Address Mapping Rules...
  • Page 20 ZyAIR Wireless Gateway Series User’s Guide Figure 26-5 Menu 23.4 System Security : IEEE802.1x...26-4 Figure 27-1 Menu 24 System Maintenance ...27-1 Figure 27-2 Menu 24.1 System Maintenance : Status ...27-2 Figure 27-3 Menu 24.2 System Information and Console Port Speed...27-3 Figure 27-4 Menu 24.2.1 System Maintenance : Information ...27-3...
  • Page 21 ZyAIR Wireless Gateway Series User’s Guide Figure 31-3 Applying Schedule Set(s) to a Remote Node (PPTP)... 31-4 List of Figures...

  • Page 23: List Of Tables

    ZyAIR Wireless Gateway Series User’s Guide List of Tables Table 1-1 Model Specific Features... 1-1 Table 3-1 Wizard 1: General Setup ... 3-3 Table 3-2 Wizard 2: Wireless LAN Setup ... 3-4 Table 3-3 Wizard 3: Ethernet Encapsulation... 3-6 Table 3-4 Wizard 3: PPTP Encapsulation ... 3-8 Table 3-5 Wizard 3: PPPoE Encapsulation ...
  • Page 24 ZyAIR Wireless Gateway Series User’s Guide Table 11-2 ICMP Commands That Trigger Alerts ...11-6 Table 11-3 Legal NetBIOS Commands ...11-6 Table 11-4 Legal SMTP Commands...11-7 Table 12-1 Firewall Settings ...12-7 Table 12-2 Firewall Filter ...12-9 Table 12-3 Creating/Editing A Firewall Rule ...12-12 Table 12-4 Predefined Services ...12-13...
  • Page 25 ZyAIR Wireless Gateway Series User’s Guide Table 20-1 Internet Account Information... 20-1 Table 20-2 Menu 4 Internet Access Setup... 20-2 Table 21-1 Menu 11.1 Remote Node Profile... 21-2 Table 21-2 Menu 11.3 Remote Node Network Layer Options... 21-5 Table 21-3 Menu 12.1 Edit IP Static Route... 21-8 Table 22-1 Menu 14.1- Edit Dial-in User...

  • Page 26: Related Documentation

    ZyAIR Wireless Gateway Series User’s Guide Congratulations on your purchase from the ZyAIR Wireless Gateway series. A wireless gateway is an access point and router rolled into one. It is a cost-effect solution to share Internet access with multiple computers and expand your wired network.
  • Page 27 • The ZyAIR Wireless Gateway series may be referred to simply as the ZyAIR in the user’s guide. User Guide Feedback Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications...

  • Page 29: Overview

    Overview Part I: OVERVIEW This part introduces the main features and applications of the ZyAIR and shows how to access the web configurator and use the Wizard to configure for Internet Access.

  • Page 31: Chapter 1 Getting To Know Your Zyair

    ZyAIR. ZyAIR Features The following sections describe the features of the ZyAIR Wireless Gateway series. Features vary by ZyAIR model. This table lists the difference between models; it does not include features that are common to all of the ZyAIR models.

  • Page 32: Reset Button

    FEATURES SPI/DoS prevention Firewall, including ACL SSL Passthrough Wi-Fi Protected Access (WPA) Table Key: An “O” in a model’s column shows that the model has the specified feature. A number specific to an individual model may alternately be displayed. The information in this table was correct at the time of writing, although it may be subject to change.

  • Page 33: Limit The Number Of Client Connections

    ZyAIR LED The blue ZyAIR LED (also known as the Breathing LED) is on when the ZyAIR is on and blinks (or breaths) when data is being transmitted to/from its wireless stations. You may use the web configurator to turn this LED off even when the ZyAIR is on and data is being transmitted/received. 802.11b Wireless LAN Standard ZyAIR products containing the letter “B”...

  • Page 34: Wireless Lan Mac Address Filtering

    ZyAIR Wireless Gateway Series User’s Guide connection start with “https” instead of “http”. The ZyAIR allows SSL connections to take place through the ZyAIR. Wi-Fi Protected Access Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i security specification draft. Key differences between WPA and WEP are user authentication and improved data encryption.

  • Page 35: Ip Policy Routing

    ZyAIR Wireless Gateway Series User’s Guide PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using a TCP/IP-based network.

  • Page 36: Embedded Ftp And Tftp Servers

    SNMP SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your ZyAIR supports SNMP agent functionality, which allows a manger station to manage and monitor the ZyAIR through the network.

  • Page 37: Application For The Zyair

    ZyAIR Wireless Gateway Series User’s Guide Application for the ZyAIR Here is an application example of what you can do with your ZyAIR. 1.3.1 Internet Access Application Add a wireless LAN to your existing network without expensive network cables. Wireless stations can move freely anywhere in the coverage area and use resources on the wired network.

  • Page 39: Chapter 2 Introducing The Web Configurator

    Type a new password (and retype it to confirm) and click Apply or click Ignore to allow access without password change. Introducing the Web Configurator ZyAIR Wireless Gateway Series User’s Guide Figure 2-1 Web Browser Address Field Chapter 2 Address field.

  • Page 40: Resetting The Zyair

    Step 7. You should now see the MAIN MENU screen. The ZyAIR automatically times out after five minutes of inactivity. Simply log back Resetting the ZyAIR If you forget your password or cannot access the ZyAIR, you will need to reload the factory-default configuration file or use the RESET button on the side panel of the ZyAIR.

  • Page 41: Uploading A Configuration File Via Console Port

    Click Transfer, then Send File to display the following screen. Step 7. After successful firmware upload, enter "atgo" to restart the ZyAIR. Introducing the Web Configurator ZyAIR Wireless Gateway Series User’s Guide Figure 2-3 Example Xmodem Upload Type the configuration file’s location, or click Browse…...

  • Page 42: Navigating The Zyair Web Configurator

    Navigating the ZyAIR Web Configurator The following summarizes how to navigate the web configurator from the MAIN MENU screen. We use the ZyAIR B-2000v.2 web configurator in this guide as an example. The screen for your model may vary slightly for different ZyAIR models.

  • Page 43: Chapter 3 Wizard Setup

    ZyAIR Wireless Gateway Series User’s Guide Chapter 3 Wizard Setup This chapter provides information on the Wizard Setup screens in the web configurator. Wizard Setup Overview The web configurator’s setup wizard helps you configure your ZyAIR for Internet access and set up wireless LAN.

  • Page 44: Wizard Setup: General Setup

    ZyAIR Wireless Gateway Series User’s Guide Wizard Setup: General Setup General Setup contains administrative and system-related information. Figure 3-1 Wizard 1: General Setup The following table describes the labels in this screen. Wizard Setup...

  • Page 45: Wizard Setup: Wireless Lan Setup

    Next Click Next to proceed to the next screen. Wizard Setup: Wireless LAN Setup Set up your wireless LAN using the second wizard screen. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide Table 3-1 Wizard 1: General Setup DESCRIPTION...

  • Page 46: Figure 3-2 Wizard 2: Wireless Lan Setup

    The following table describes the labels in this screen. LABEL ESSID Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN. If you change this field on the ZyAIR, make sure all wireless stations use the same ESSID in order to access the network.

  • Page 47: Wizard Setup: Isp Parameters

    The ZyAIR offers three choices of encapsulation. They are Ethernet, PPTP or PPPoE. The screen varies depending upon the type chosen. 3.4.1 Ethernet Choose Ethernet when the WAN port is used as a regular Ethernet. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide Table 3-2 Wizard 2: Wireless LAN Setup DESCRIPTION...

  • Page 48: Figure 3-3 Wizard 3: Ethernet Encapsulation

    Figure 3-3 Wizard 3: Ethernet Encapsulation The following table describes the labels in this screen. Table 3-3 Wizard 3: Ethernet Encapsulation LABEL ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.

  • Page 49: Pptp Encapsulation

    PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the Internet. Refer to the appendix for more information on PPTP. The ZyAIR supports one PPTP server connection at any given time. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION...

  • Page 50: Figure 3-4 Wizard 3: Pptp Encapsulation

    The following table describes the labels in this screen. LABEL ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. User Name Type the user name given to you by your ISP. Password Type the password associated with the User Name above. Figure 3-4 Wizard 3: PPTP Encapsulation Table 3-4 Wizard 3: PPTP Encapsulation DESCRIPTION...

  • Page 51: Pppoe Encapsulation

    One of the benefits of PPPoE is the ability to let end users access one of multiple network services, a function known as dynamic service selection. This enables the service provider to easily create and offer new IP services for specific users. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION...

  • Page 52: Figure 3-5 Wizard 3: Pppoe Encapsulation

    ZyAIR Wireless Gateway Series User’s Guide Operationally, PPPoE saves significant effort for both the subscriber and the ISP/carrier, as it requires no specific configuration of the broadband modem at the subscriber’s site. By implementing PPPoE directly on the ZyAIR (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyAIR does that part of the task.

  • Page 53: Wizard Setup: Wan And Dns

    Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Table 3-6 Private IP Address Ranges 10.0.0.0...

  • Page 54: Ip Address And Subnet Mask

    Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space. 3.5.2 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.

  • Page 55: Wan Mac Address

    LAN side. Table 3-7 Example of Network Properties for LAN Servers with Fixed IP Addresses Choose an IP address Subnet mask Gateway (or default route) Wizard Setup ZyAIR Wireless Gateway Series User’s Guide 192.168.1.2-192.168.1.32; 192.168.1.65-192.168.1.254. 255.255.255.0 192.168.1.1(ZyAIR LAN IP) 3-13...

  • Page 56: Figure 3-6 Wizard 4: Wan And Dns

    The following table describes the labels in this screen. LABEL WAN IP Address Assignment Get automatically from Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Use fixed IP address Select this option If the ISP assigned a fixed IP address.
  • Page 57 MAC address from a workstation on your LAN. Factory Default Select this option to use the factory assigned default MAC address. Wizard Setup ZyAIR Wireless Gateway Series User’s Guide Table 3-8 Wizard 4: WAN and DNS DESCRIPTION 3-15...

  • Page 58: Basic Setup Complete

    LABEL Spoof this Computer's Select this option and enter the IP address of the computer on the LAN whose MAC address - IP MAC address you are cloning. Once it is successfully configured, the MAC Address address will be copied to the rom file (ZyNOS configuration file). It will not change unless you change the setting or upload a different rom file.

  • Page 59: Figure 3-7 Setup Complete

    ZyAIR Wireless Gateway Series User’s Guide Figure 3-7 Setup Complete Well done! You have successfully set up your ZyAIR to operate on your network and access the Internet. Wizard Setup 3-17...

  • Page 61: System, Lan And Wireless

    System, LAN and Wireless Part II: SYSTEM, LAN AND WIRELESS This part discusses the System, LAN, and Wireless setup screens.

  • Page 63: Chapter 4 System Screens

    Click ADVANCED and then SYSTEM to open the General screen. The following table describes the labels in this screen. System Screens ZyAIR Wireless Gateway Series User’s Guide This chapter provides information on the System screens. Figure 4-1 System General Setup...

  • Page 64: Dynamic Dns

    LABEL System Name Type a descriptive name for identification purposes. Some ISPs check this name, so it is recommended you enter your computer's "Computer name" This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes "-"...

  • Page 65: Dyndns Wildcard

    ZyAIR Wireless Gateway Series User’s Guide First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a DNS name. The dynamic DNS service provider will give you a password or key.

  • Page 66: Figure 4-2 Ddns

    The following table describes the labels in this screen. LABEL Enable DDNS Select this check box to activate DDNS. Service Provider Select the name of your DDNS service provider. DDNS Type Select the type of service that you are registered for from your DDNS service provider.

  • Page 67: Configuring Password

    If you forget your password (or the ZyAIR IP address), you will need to reset the ZyAIR or upload the default configuration file via console port (on ZyAIR B-2000 only). See the Resetting the ZyAIR section for details. System Screens ZyAIR Wireless Gateway Series User’s Guide Table 4-2 DDNS DESCRIPTION...

  • Page 68: Configuring Time Setting

    The following table describes the labels in this screen. LABEL Old Password Type in your existing system password (1234 is the default password). New Password Type your new system password (up to 31 characters). Note that as you type a password, the screen displays an asterisk (*) for each character you type.

  • Page 69: Figure 4-4 Time Setting

    1970/1/1 at 0:0:0. The default, NTP (RFC 1305), is similar to Time (RFC 868). Select None to enter the time and date manually. System Screens ZyAIR Wireless Gateway Series User’s Guide Figure 4-4 Time Setting Table 4-4 Time Setting DESCRIPTION...
  • Page 70 LABEL Time Server Enter the IP address or the URL of your time server. Check with your ISP/network Address administrator if you are unsure of this information (the default is tick.stdtime.gov.tw). Current Time This field displays the time of your ZyAIR. (hh:mm:ss) Each time you reload this page, the ZyAIR synchronizes the time with the time server.

  • Page 71: Chapter 5 Lan Screens

    The actual physical connection determines whether the ZyAIR ports are LAN or WAN ports. There are two separate IP networks, one inside, the LAN network; the other outside: the WAN network as shown next: LAN Screens ZyAIR Wireless Gateway Series User’s Guide This chapter describes how to configure LAN settings. Figure 5-1 LAN & WAN IPs...

  • Page 72: Dhcp Setup

    DHCP Setup DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyAIR as a DHCP server or disable it. When configured as a server, the ZyAIR provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.

  • Page 73: Multicast

    WAN interfaces in the web configurator (LAN; WAN). Select None to disable IP multicasting on these interfaces. Configuring the LAN IP Screens Click ADVANCED and then LAN to open the IP screen. LAN Screens ZyAIR Wireless Gateway Series User’s Guide...

  • Page 74: Figure 5-2 Ip

    The following table describes the labels in this screen. LABEL DHCP Setup DHCP Server Select this option to allow your ZyAIR to assign IP addresses, an IP default gateway and DNS servers to Windows 95, Windows NT and other systems that support the DHCP client.
  • Page 75 Select this option to forward NetBIOS packets between the LAN port and the WAN LAN and WAN port. Apply Click Apply to save your changes back to the ZyAIR. LAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 5-1 IP DESCRIPTION...
  • Page 76 ZyAIR Wireless Gateway Series User’s Guide Table 5-1 IP LABEL DESCRIPTION Reset Click Reset to reload the previous configuration for this screen. LAN Screens...

  • Page 77: Chapter 6 Wireless Configuration And Roaming

    ZyAIR Wireless Gateway Series User’s Guide Chapter 6 Wireless Configuration and Roaming This chapter discusses how to configure the Wireless and Roaming screens on the ZyAIR. Wireless LAN Overview This section introduces the wireless LAN(WLAN) and some basic scenarios. 6.1.1 IBSS An Independent Basic Service Set (IBSS), also called an Ad-hoc network, is the simplest WLAN configuration.

  • Page 78: Ess

    ZyAIR Wireless Gateway Series User’s Guide Figure 6-2 Basic Service set 6.1.3 ESS An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS).

  • Page 79: Wireless Lan Basics

    ZyAIR Wireless Gateway Series User’s Guide Figure 6-3 Extended Service Set Wireless LAN Basics Refer also to the Wizard Setup chapter for more background information on Wireless LAN features, such as channels. 6.2.1 RTS/CTS A hidden node occurs when two stations are within range of the same access point, but are not within range of each other.

  • Page 80: Fragmentation Threshold

    ZyAIR Wireless Gateway Series User’s Guide Figure 6-4 RTS/CTS When station A sends data to the ZyAIR, it might not know that station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.

  • Page 81: Configuring Wireless

    ZyAIR Wireless Gateway Series User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set, then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.

  • Page 82: Figure 6-5 Wireless

    ZyAIR Wireless Gateway Series User’s Guide Figure 6-5 Wireless The following table describes the general wireless LAN labels in this screen. Wireless Configuration and Roaming...
  • Page 83 Click Reset to reload the previous configuration for this screen. See the Wireless Security chapter for information on the other labels in this screen. Wireless Configuration and Roaming ZyAIR Wireless Gateway Series User’s Guide Table 6-1 Wireless DESCRIPTION your computer to match the ZyAIR’s new settings.

  • Page 84: Configuring Roaming

    ZyAIR Wireless Gateway Series User’s Guide Configuring Roaming A wireless station is a device with an IEEE 802.11b compliant wireless adapter. An access point (AP) acts as a bridge between the wireless and wired networks. An AP creates its own wireless coverage area. A wireless station can associate with a particular access point only if it is within the access point’s coverage area.

  • Page 85: Requirements For Roaming

    To enable roaming on your ZyAIR, click ADVANCED, WIRELESS and then the Roaming tab. The screen appears as shown. The following table describes the labels in this screen. Wireless Configuration and Roaming ZyAIR Wireless Gateway Series User’s Guide Figure 6-7 Roaming...

  • Page 86: Table 6-2 Roaming

    LABEL Active Select Yes from the drop-down list box to enable roaming on the ZyAIR if you have two or more ZyAIRs on the same subnet. All APs on the same subnet and the wireless stations must have Port Enter the port number to communicate roaming information between APs. The port number must be the same on all APs.

  • Page 87: Chapter 7 Wireless Security

    WEP Overview WEP (Wired Equivalent Privacy) as specified in the IEEE 802.11 standard provides methods for both data encryption and wireless station authentication. Wireless Security ZyAIR Wireless Gateway Series User’s Guide Chapter 7 Wireless Security configure wireless security on your ZyAIR.

  • Page 88: Data Encryption

    ZyAIR Wireless Gateway Series User’s Guide 7.2.1 Data Encryption WEP provides a mechanism for encrypting data using encryption keys. Both the AP and the wireless stations must use the same WEP key to encrypt and decrypt data. Your ZyAIR allows you to configure up to four 64- bit or 128-bit WEP keys, but only one key can be enabled at any one time.

  • Page 89: Configuring Wep Encryption

    ZyAIR Wireless Gateway Series User’s Guide Shared key authentication involves a four-message procedure. A wireless station sends a shared key authentication request to the AP, which will then reply with a challenge text message. The wireless station must then use the AP’s default WEP key to encrypt the challenge text and return it to the AP, which attempts to decrypt the message using the AP’s default WEP key.

  • Page 90: Figure 7-3 Wireless

    ZyAIR Wireless Gateway Series User’s Guide Figure 7-3 Wireless The following table describes the wireless LAN security labels in this screen. Wireless Security...

  • Page 91: Table 7-1 Wireless : Wep Fields

    The options are 17dBm (50mW), 15dBm (32mW), 13dBm (20mW) or 11dBm (12.6mW). Apply Click Apply to save your changes back to the ZyAIR. Reset Click Reset to reload the previous configuration for this screen. Wireless Security ZyAIR Wireless Gateway Series User’s Guide Table 7-1 Wireless : WEP Fields DESCRIPTION...

  • Page 92: Mac Filter

    ZyAIR Wireless Gateway Series User’s Guide MAC Filter The MAC filter screen allows you to configure the ZyAIR to give exclusive access to up to 32 devices (Allow Association) or exclude up to 32 devices from accessing the ZyAIR (Deny Association). Every Ethernet device has a unique MAC (Media Access Control) address.

  • Page 93: Figure 7-4 Mac Address Filter

    ZyAIR Wireless Gateway Series User’s Guide Figure 7-4 MAC Address Filter The following table describes the labels in this menu. Wireless Security...

  • Page 94: Overview

    LABEL Active Select Yes from the drop down list box to enable MAC address filtering. Filter Action Define the filter action for the list of MAC addresses in the MAC Address table. Select Deny Association to block access to the ZyAIR, MAC addresses not listed will be allowed to access the ZyAIR Select Allow Association to permit access to the ZyAIR, MAC addresses not listed will be denied access to the ZyAIR.

  • Page 95: Introduction To Wpa

    WPA-PSK susceptible to brute-force password-guessing attacks but it’s still an improvement over WEP as it employs an easier-to-use, consistent, single, alphanumeric password. WPA-PSK Application Example A WPA-PSK application looks as follows. Wireless Security ZyAIR Wireless Gateway Series User’s Guide...

  • Page 96: Wpa With Radius Application Example

    Step 1. First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters (including spaces and symbols). Step 2. The AP checks each client’s password and (only) allows it to join the network if it matches its password.

  • Page 97: Security Parameters Summary

    ZyAIR Wireless Gateway Series User’s Guide Figure 7-6 WPA with RADIUS Application Example 7.10 Security Parameters Summary Refer to this table to see what other security parameters you should configure for each Authentication Method/ key management protocol type. You enter manual keys by first selecting 64-bit WEP or 128-bit WEP from the WEP Encryption field and then typing the keys (in ASCII or hexadecimal format) in the key text boxes.

  • Page 98: Wireless Client Wpa Supplicants

    Table 7-3 Wireless Security Relational Matrix AUTHENTICATION METHOD/ KEY MANAGEMENT PROTOCOL Open Open Shared WPA-PSK WPA-PSK 7.11 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client.

  • Page 99: Authentication Required: 802.1X

    Select Authentication Required in the Wireless Port Control field and 802.1x in the Key Management Protocol field to display the next screen. Wireless Security ZyAIR Wireless Gateway Series User’s Guide Figure 7-7 Wireless LAN: 802.1x/WPA Table 7-4 Wireless LAN: 802.1x/WPA...

  • Page 100: Figure 7-8 Wireless Lan: 802.1X/Wpa For 802.1X Protocol

    Figure 7-8 Wireless LAN: 802.1x/WPA for 802.1x Protocol The following table describes the labels in this screen. Table 7-5 Wireless LAN: 802.1x/WPA for 802.1x Protocol LABEL Wireless Port To control wireless stations access to the wired network, select a control method from Control the drop-down list box.
  • Page 101 This field is not available when you set Key Management Protocol to WPA or WPA- PSK. This feature is not available on the ZyAIR B-2000. Wireless Security ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION If wireless station authentication is done using a RADIUS priority.

  • Page 102: Authentication Required: Wpa

    Table 7-5 Wireless LAN: 802.1x/WPA for 802.1x Protocol LABEL Authentication The authentication database contains wireless station login information. The local Databases user database is the built-in database on the ZyAIR. The RADIUS is an external server. Use this drop-down list box to select which database the ZyAIR should use (first) to authenticate a wireless station.

  • Page 103: Figure 7-9 Wireless Lan: 802.1X/Wpa For Wpa Protocol

    WEP key for an AP and all stations in a WLAN on a periodic basis. Setting of the WPA Group Key Update Timer is also supported in WPA-PSK mode. The ZyAIR default is 1800 seconds (30 minutes). Wireless Security ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION 7-17...

  • Page 104: Authentication Required: Wpa-Psk

    Table 7-6 Wireless LAN: 802.1x/WPA for WPA Protocol LABEL Authentication When you configure Key Management Protocol to WPA, the Authentication Databases Databases must be RADIUS Only. You can only use the Local User Database Only with 802.1x Key Management Protocol. 7.12.3 Authentication Required: WPA-PSK Select Authentication Required in the Wireless Port Control field and WPA-PSK in the Key Management Protocol field to display the next screen.

  • Page 105: Introduction To Local User Database

    To change your ZyAIR’s local user database, click ADVANCED, WIRELESS and then the Local User Database tab. The screen appears as shown (some of the screen’s blank rows are not shown). Wireless Security ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION 7-19...

  • Page 106: Figure 7-11 Local User Database

    ZyAIR Wireless Gateway Series User’s Guide Figure 7-11 Local User Database The following table describes the labels in this screen. 7-20 Wireless Security...

  • Page 107: Introduction To Radius

    Sent by an access point requesting authentication. • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access. Wireless Security ZyAIR Wireless Gateway Series User’s Guide Table 7-8 Local User Database DESCRIPTION 7-21...

  • Page 108: Eap Authentication Overview

    • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access-Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...

  • Page 109: Configuring Radius

    Use RADIUS if you want to authenticate wireless users using an external server. To specify a RADIUS server, click ADVANCED, WIRELESS and then the RADIUS tab. The screen appears as shown. The following table describes the labels in this screen. Wireless Security ZyAIR Wireless Gateway Series User’s Guide Figure 7-13 RADIUS 7-23...

  • Page 110: Table 7-9 Radius

    LABEL Authentication Server Select Yes from the drop down list box to enable user authentication through an Active external authentication server. Server IP Address Enter the IP address of the external authentication server in dotted decimal notation. Port Number Enter the port number of the external authentication server. The default port number is 1812.

  • Page 111: Wan

    Part III: This part covers the web configurator screen and information about WAN.

  • Page 113: Chapter 8 Wan Screens

    The screen shown next is for Ethernet encapsulation. The following table describes the labels in this screen. WAN Screens ZyAIR Wireless Gateway Series User’s Guide This chapter describes how to configure the ZyAIR WAN screens. Figure 8-1 Ethernet Encapsulation Chapter 8...

  • Page 114: Figure 8-2 Service Type

    LABEL Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet. Service Type Select from Standard, RR-Toshiba (RoadRunner Toshiba authentication method), RR-Manager (Roadrunner Manager authentication method), RR-Telstra or Telia Login. Choose a Roadrunner service type if your ISP is Time Warner's Roadrunner; otherwise choose Standard.

  • Page 115: Pppoe Encapsulation

    (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPP over Ethernet option is for a dial-up connection using PPPoE. The screen shown next is for PPP over Ethernet encapsulation. WAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 8-2 Service Type DESCRIPTION...

  • Page 116: Figure 8-3 Pppoe Encapsulation

    The following table describes the labels in this screen. LABEL ISP Parameters for Internet Access Encapsulation The PPP over Ethernet choice is for a dial-up connection using PPPoE. The ZyAIR supports PPPoE (Point-to-Point Protocol over Ethernet). Service Name Type the PPPoE service name provided to you. PPPoE uses a service name to identify and reach the PPPoE server.

  • Page 117: Pptp Encapsulation

    Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet. The screen shown next is for PPTP encapsulation. WAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 8-3 PPPoE Encapsulation DESCRIPTION...

  • Page 118: Figure 8-4 Pptp Encapsulation

    The following table describes the labels in this screen. LABEL ISP Parameters for Internet Access Encapsulation PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the Internet. The ZyAIR supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.

  • Page 119: Tcp/Ip Priority (Metric)

    "15" means the link is down. The smaller the number, the lower the "cost". The metric sets the priority for the ZyAIR’s routes to the Internet. If any two of the default routes have the same metric. WAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 8-4 PPTP Encapsulation DESCRIPTION...

  • Page 120: Configuring Wan Ip

    ZyAIR Wireless Gateway Series User’s Guide Configuring WAN IP To change your ZyAIR’s WAN IP settings, click ADVANCED, WAN and then the IP tab. Figure 8-5 IP Setup The following table describes the labels in this screen. Table 8-5 IP Setup...
  • Page 121 1 for directly connected networks. The number need not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good number. WAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 8-5 IP Setup DESCRIPTION...
  • Page 122 LABEL Private (PPPoE This parameter determines if the ZyAIR will include the route to this remote node in and PPTP only) its RIP broadcasts. If select Yes, this route is kept private and not included in RIP broadcast. If select No, the route to this remote node will be propagated to other hosts through RIP broadcasts.

  • Page 123: Configuring Wan Mac

    MAC address from a computer on your LAN. Choose Factory Default to select the factory assigned default MAC address. WAN Screens ZyAIR Wireless Gateway Series User’s Guide Table 8-5 IP Setup DESCRIPTION Figure 8-6 MAC Setup...

  • Page 125: Sua/Nat And Static Route

    SUA/NAT and Static Route Part IV: SUA/NAT AND STATIC ROUTE This part covers the information about SUA/NAT and Static Route setup.

  • Page 127: Chapter 9 Single User Account (Sua) / Network Address Translation (Nat)

    Global This refers to the packet address (source or destination) as the packet travels on the WAN. SUA/NAT ZyAIR Wireless Gateway Series User’s Guide Address Translation (NAT) This chapter discusses how to configure SUA/NAT on the ZyAIR. Table 9-1 NAT Definitions...

  • Page 128: What Nat Does

    ZyAIR Wireless Gateway Series User’s Guide NAT never changes the IP address (either local or global) of an outside host. 9.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side.

  • Page 129: Nat Application

    ZyAIR Wireless Gateway Series User’s Guide Figure 9-1 How NAT Works 9.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyAIR can communicate with three distinct WAN networks. More examples follow at the end of this chapter.

  • Page 130: Nat Mapping Types

    9.1.5 NAT Mapping Types NAT supports five types of IP/port mapping. They are: One to One: In One-to-One mode, the ZyAIR maps one local IP address to one global IP address. Many to One: In Many-to-One mode, the ZyAIR maps multiple local IP addresses to one global IP address.

  • Page 131: Sua (Single User Account) Versus Nat

    Many-to-One and Server. The ZyAIR also supports Full Feature NAT to map multiple global IP addresses to multiple private LAN IP addresses of clients or servers using mapping types. Select either SUA Only or Full Feature in WAN IP. SUA/NAT ZyAIR Wireless Gateway Series User’s Guide types. Table 9-2 NAT Mapping Types IP MAPPING...

  • Page 132: Sua Server

    SUA Server An SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though SUA makes your whole inside network appear as a single computer to the outside world.

  • Page 133: Configuring Servers Behind Sua (Example)

    Click ADVANCED and then SUA/NAT to open the SUA Server screen. Refer to the Table 9-3 for port numbers commonly used for particular services. SUA/NAT ZyAIR Wireless Gateway Series User’s Guide Table 9-3 Services and Port Numbers SERVICES PORT NUMBER...

  • Page 134: Figure 9-4 Sua/Nat Setup

    The following table describes the labels in this screen. LABEL Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. This field displays the number of an individual SUA server entry. Active Select this check box to enable the SUA server entry.

  • Page 135: Configuring Address Mapping

    4, rules 5 to 7 will be pushed up by 1 rule, so old rules 5, 6 and 7 become new rules 4, 5 and To change your ZyAIR’s address mapping settings, click ADVANCED, SUA/NAT and then the Address Mapping tab. The screen appears as shown. SUA/NAT ZyAIR Wireless Gateway Series User’s Guide Table 9-4 SUA/NAT Setup DESCRIPTION...

  • Page 136: Figure 9-5 Address Mapping

    The following table describes the labels in this screen. LABEL This field displays the index number of the address mapping rule. Local Start IP This refers to the Inside Local Address (ILA), that is the starting local IP address. Local IP addresses are N/A for Server port mapping.

  • Page 137: Configuring Address Mapping Rule

    Local Start IP This is the starting local IP address (ILA). Local IP addresses are N/A for Server port mapping. SUA/NAT ZyAIR Wireless Gateway Series User’s Guide Table 9-5 Address Mapping DESCRIPTION Figure 9-6 Address Mapping Rule Table 9-6 Address Mapping Rule...
  • Page 138 LABEL Local End IP This is the end local IP address (ILA). If your rule is for all local IP addresses, then enter 0.0.0.0 as the Local Start IP address and 255.255.255.255 as the Local End IP address. This field is N/A for One-to-One and Server mapping types. Global Start IP This is the starting global IP address (IGA).

  • Page 139: Chapter 10 Static Route

    ZyAIR Wireless Gateway Series User’s Guide Chapter 10 Static Route This chapter shows you how to configure static routes for your ZyAIR. 10.1 Static Route Overview Each remote node specifies only the network to which the gateway is directly connected, and the ZyAIR has no knowledge of the networks beyond.

  • Page 140: Figure 10-2 Ip Static Route Summary

    The following table describes the labels in this screen. LABEL This field displays an individual static route index number. Name This field displays the name that describes or identifies this route. Active This field shows whether this static route is active (Yes) or not (No). Destination This parameter specifies the IP network address of the final destination.

  • Page 141: Configuring Route Entry

    Enter a descriptive name for this route. This is for identification purposes only. Active Select this check box to activate this static route. Static Route ZyAIR Wireless Gateway Series User’s Guide Table 10-1 IP Static Route Summary DESCRIPTION Figure 10-3 Edit IP Static Route...
  • Page 142 LABEL Destination IP Type the IP network address of the final destination. Routing is always based on Address network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.

  • Page 143: Firewall And Remote Management

    Firewall and Remote Management Part V: FIREWALL AND REMOTE MANAGEMENT This part introduces firewalls in general and the ZyAIR firewall. It also explains custom ports and gives example firewall rules and information on Remote Management.

  • Page 145: Chapter 11 Introduction To Firewalls

    ZyAIR Wireless Gateway Series User’s Guide Chapter 11 Introduction to Firewalls This chapter gives some background information on firewalls and introduces the ZyAIR firewall. This chapter is not applicable to the ZyAIR B-2000. 11.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another.

  • Page 146: Stateful Inspection Firewalls

    Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.

  • Page 147: Basics

    Some of the most common IP ports are: Introduction to Firewalls ZyAIR Wireless Gateway Series User’s Guide Figure 11-1 Firewall Application Table 11-1 Common IP Ports...

  • Page 148: Types Of Dos Attacks

    11.4.2 Types of DoS Attacks There are four types of DoS attacks: 1. Those that exploit bugs in a TCP/IP implementation. 2. Those that exploit weaknesses in the TCP/IP specification. 3. Brute-force attacks that flood a network with useless data. 4.

  • Page 149: Figure 11-3 Syn Flood

    "intermediary" network, but will also congest the network of the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic consumes all available bandwidth, making communications impossible. Introduction to Firewalls ZyAIR Wireless Gateway Series User’s Guide Figure 11-3 SYN Flood 11-5...

  • Page 150: Figure 11-4 Smurf Attack

    ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 11-2 ICMP Commands That Trigger Alerts Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are the following - all others are illegal. All SMTP commands are illegal except for those displayed in the following tables.

  • Page 151: Stateful Inspection

    The default rules allow LAN-to-WAN traffic and deny traffic initiated from WAN-to-LAN. Introduction to Firewalls ZyAIR Wireless Gateway Series User’s Guide Table 11-4 Legal SMTP Commands ETRN...

  • Page 152: Figure 11-5 Stateful Inspection

    ZyAIR Wireless Gateway Series User’s Guide Figure 11-5 Stateful Inspection The previous figure shows the ZyAIR’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed.

  • Page 153: Chapter 12 Firewall Screens

    WAN and/or managing the ZyAIR. You may define additional rules and sets or modify existing ones but please exercise extreme caution in doing so. Firewall Screens ZyAIR Wireless Gateway Series User’s Guide Firewall Screens • WAN to LAN •...

  • Page 154: Rule Logic Overview

    If you configure firewall rules without a good understanding of how they work, you might inadvertently introduce security risks to the firewall and to the protected network. Make sure you test your rules after you configure them. For example, you may create rules to: ♦...

  • Page 155: Key Fields For Configuring Rules

    6. Protect against IP spoofing by making sure the firewall is active. 7. Keep the firewall in a secured (locked) room. Firewall Screens ZyAIR Wireless Gateway Series User’s Guide 12-3...

  • Page 156: Connection Direction Examples

    ZyAIR Wireless Gateway Series User’s Guide 12.5 Connection Direction Examples This section describes examples for firewall rules for connections going from LAN to WAN and from WAN to LAN. LAN to LAN/ZyAIR and WAN to WAN/ZyAIR rules apply to packets coming in on the associated interface (LAN or WAN respectively).

  • Page 157: Wan To Lan Rules

    Allow NetBIOS traffic from the WAN to the LAN using the WAN IP web screen or SMT menu 24.8 commands. Forwarded WAN-to-LAN packets are not considered alerts. Firewall Screens ZyAIR Wireless Gateway Series User’s Guide Figure 12-1 LAN to WAN Traffic 12-5...

  • Page 158: Enabling Firewall

    ZyAIR Wireless Gateway Series User’s Guide Figure 12-2 WAN to LAN Traffic 12.6 Enabling Firewall The ordering of your rules is very important as rules are applied in turn. The default rules allow LAN-to-WAN traffic and deny traffic initiated from WAN-to-LAN. You may block traffic initiated from the LAN by configuring blocked services in the Services screen.

  • Page 159: Figure 12-3 Firewall Settings

    To log packets related to firewall rules, make sure that Access Control under Log is selected in the Logs, Log Settings screen. Firewall Screens ZyAIR Wireless Gateway Series User’s Guide Select this check box to enable the firewall. Figure 12-3 Firewall Settings...

  • Page 160: Configuring Content Filtering

    LABEL Packets to Log Choose what LAN to WAN packets to log. Choose from: • No Log • Log Blocked (blocked LAN to WAN services appear in the Blocked Services textbox in the Services screen (with Enable Services Blocking selected)) •...

  • Page 161: Figure 12-4 Firewall Filter

    The following table describes the labels in this screen. LABEL Restrict Web Select the categories of web features that you want to restrict. Features Firewall Screens ZyAIR Wireless Gateway Series User’s Guide Figure 12-4 Firewall Filter Table 12-2 Firewall Filter DESCRIPTION 12-9...
  • Page 162 LABEL ActiveX ActiveX is a tool for building dynamic and active Web pages and distributed object applications. When you visit an ActiveX Web site, ActiveX controls are downloaded to your browser, where they remain in case you visit the site again. Java Java is a programming language and development environment for building downloadable Web components or Internet and intranet business applications of all...

  • Page 163: Configuring Firewall Services

    ZyAIR Wireless Gateway Series User’s Guide 12.6.2 Configuring Firewall Services Click ADVANCED, FIREWALL and then the Services tab to open the Services screen. Use this screen to enable service blocking, enter/delete/modify the services you want to block and the date/time you want to block them.

  • Page 164: Table 12-3 Creating/Editing A Firewall Rule

    Table 12-3 Creating/Editing A Firewall Rule LABEL Enable Services Select the check box to activate service blocking. Blocking Available Services This is a list of pre-defined services (ports) you may prohibit your LAN computers from using. Select the port you want to block using the drop-down list and click Add to add the port to the Blocked Service field.

  • Page 165: Predefined Services

    ICQ(UDP:4000) IPSEC_TUNNEL(ESP:0) IRC(TCP/UDP:6667) MULTICAST(IGMP:0) NEWS(TCP:144) NFS(UDP:2049) Firewall Screens ZyAIR Wireless Gateway Series User’s Guide means UDP port 53 and TCP port 53. Up to 128 entries are (UDP/TCP:53) Table 12-4 Predefined Services DESCRIPTION Border Gateway Protocol. DHCP Client. DHCP Server.
  • Page 166 SERVICE NNTP(TCP:119) PING(ICMP:0) PPTP(TCP:1723) PPTP_TUNNEL(GRE:0) RCMD(TCP:512) REAL_AUDIO(TCP:7070) REXEC(TCP:514) RLOGIN(TCP:513) RTELNET(TCP:107) RTSP(TCP/UDP:554) SFTP(TCP:115) SMTP(TCP:25) SNMP(TCP/UDP:161) SNMP- TRAPS(TCP/UDP:162) SQL-NET(TCP:1521) SSH(TCP/UDP:22) STRM WORKS(UDP:1558) TELNET(TCP:23) 12-14 Table 12-4 Predefined Services Network News Transport Protocol is the delivery mechanism for the USENET newsgroup service. Packet INternet Groper is a protocol that sends out ICMP echo requests to test whether or not a remote host is reachable.
  • Page 167 SERVICE TFTP(UDP:69) VDOLIVE(TCP:7000) Firewall Screens ZyAIR Wireless Gateway Series User’s Guide Table 12-4 Predefined Services DESCRIPTION Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol).

  • Page 169: Chapter 13 Remote Management

    2. Telnet 3. HTTP 13.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: Remote Management ZyAIR Wireless Gateway Series User’s Guide Remote Management details on configuring firewall rules. ALL (LAN and WAN) Neither (Disable). firewall rule to allow access.

  • Page 170: Remote Management And Nat

    1. A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 2. You have disabled that service in one of the remote management screens. 3. The IP address in the Secured Client IP Address field does not match the client IP address. If it does not match, the ZyAIR will disconnect the session immediately.

  • Page 171: Configuring Telnet

    ZyAIR using this service. Apply Click Apply to save your changes back to the ZyAIR. Reset Click Reset to begin configuring this screen afresh. Remote Management ZyAIR Wireless Gateway Series User’s Guide Figure 13-2 Telnet Table 13-1 Telnet DESCRIPTION 13-3...

  • Page 172: Configuring Ftp

    13.4 Configuring FTP You can upload and download the ZyAIR’s firmware and configuration files using FTP, please see the chapter on firmware and configuration file maintenance for details. To use this feature, your computer must have an FTP client. To change your ZyAIR’s FTP settings, click ADVANCED, REMOTE MGNT and then the FTP tab. The screen appears as shown.

  • Page 173: Configuring Www

    Server Access Select the interface(s) through which a computer may access the ZyAIR using this service. Remote Management ZyAIR Wireless Gateway Series User’s Guide Table 13-2 FTP DESCRIPTION Figure 13-4 WWW Table 13-3 WWW...

  • Page 174: Configuring Snmp

    LABEL Secured Client A secured client is a “trusted” computer that is allowed to communicate with the ZyAIR IP Address using this service. Select All to allow any computer to access the ZyAIR using this service. Choose Selected to just allow the computer with the IP address that you specify to access the ZyAIR using this service.

  • Page 175: Figure 13-5 Snmp Management Model

    SNMPv1, when a manager wants to retrieve all elements of a table from an agent, it initiates a Get operation, followed by a series of GetNext operations. Remote Management ZyAIR Wireless Gateway Series User’s Guide Figure 13-5 SNMP Management Model 13-7...

  • Page 176: Supported Mibs

    • Set - Allows the manager to set values for object variables within an agent. • Trap - Used by the agent to inform the manager of some events. 13.6.1 Supported MIBs The ZyAIR supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance.

  • Page 177: Remote Management: Snmp

    LABEL SNMP Configuration Enter the Get Community, which is the password for the incoming Get and GetNext Get Community requests from the management station. Remote Management ZyAIR Wireless Gateway Series User’s Guide Figure 13-6 SNMP Table 13-6 SNMP DESCRIPTION 13-9...

  • Page 178: Configuring Dns

    LABEL Set Community Enter the Set community, which is the password for incoming Set requests from the management station. Trusted Host If you enter a trusted host, your ZyAIR will only respond to SNMP messages from this address. A blank (default) field means your ZyAIR will respond to all SNMP messages it receives, regardless of source.

  • Page 179: Configuring Security

    If an outside user attempts to probe an unsupported port on your ZyAIR, an ICMP response packet is automatically returned. This allows the outside user to know the ZyAIR exists. The ZyAIR series support Remote Management ZyAIR Wireless Gateway Series User’s Guide Figure 13-7 DNS Table 13-7 DNS...

  • Page 180: Figure 13-8 Security

    anti-probing, which prevents the ICMP response packet from being sent. This keeps outsiders from discovering your ZyAIR when unsupported ports are probed. The following table describes the labels in this screen. LABEL ICMP Internet Control Message Protocol is a message control and error-reporting protocol between a host server and a gateway to the Internet.
  • Page 181 UDP packet, it drops the packet without sending a response packet. Apply Click Apply to save your changes back to the ZyAIR. Reset Click Reset to begin configuring this screen afresh. Remote Management ZyAIR Wireless Gateway Series User’s Guide Table 13-8 Security DESCRIPTION 13-13...

  • Page 183: Upnp And Logs

    UPnP and Logs Part VI: UPNP AND LOGS This part provides information and configuration instructions for UPnP (Universal Plug and Play) and the logs.

  • Page 185: Chapter 14 Upnp Screen

    Windows Messenger is an example of an application that supports NAT traversal and UPnP. See the SUA/NAT chapter for further information about NAT. UPnP Screens ZyAIR Wireless Gateway Series User’s Guide This chapter introduces the Universal Plug and Play feature. Chapter 14...

  • Page 186: Cautions With Upnp

    ZyAIR Wireless Gateway Series User’s Guide 14.1.3 Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments.

  • Page 187: Figure 14-1 Configuring Upnp

    Allow users to make configuration changes through UPnP UPnP Screens ZyAIR Wireless Gateway Series User’s Guide Figure 14-1 Configuring UPnP Table 14-1 Configuring UPnP This identifies the ZyAIR in UPnP applications. Select this check box to activate UPnP. Be aware that anyone could use a...

  • Page 188: Installing Upnp In Windows Example

    ZyAIR Wireless Gateway Series User’s Guide LABEL Allow UPnP to pass through Firewall Apply Reset 14.4 Installing UPnP in Windows Example This section shows how to install UPnP in Windows Me and Windows XP. 14.4.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me.

  • Page 189: Installing Upnp In Windows Xp

    Advanced in the main menu and select Optional Networking Components …. The Windows Optional Networking Components Wizard window displays. Step 4. Select Networking Service in the Components selection box and click Details. UPnP Screens ZyAIR Wireless Gateway Series User’s Guide 14-5...

  • Page 190: Using Upnp In Windows Xp Example

    ZyAIR Wireless Gateway Series User’s Guide Step 5. In the Networking Services window, select the Universal Plug and Play check box. Step 6. Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 14.5 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP.
  • Page 191 In the Internet Connection Properties window, click Settings to see the port mappings that were automatically created. UPnP Screens ZyAIR Wireless Gateway Series User’s Guide Step 4. You may edit or delete the port mappings or click Add to manually add port mappings.

  • Page 192: Web Configurator Easy Access

    ZyAIR Wireless Gateway Series User’s Guide When the UPnP-enabled device is disconnected from your computer, all port Step 5. Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray Step 6.
  • Page 193 Step 4. An icon with the description for each UPnP-enabled device displays under Local Network. Step 5. Right-click the icon for your ZyAIR and select Invoke. The web configurator login screen displays. UPnP Screens ZyAIR Wireless Gateway Series User’s Guide 14-9...
  • Page 194 ZyAIR Wireless Gateway Series User’s Guide Step 6. Right-click the icon for your ZyAIR and select Properties. A properties window displays with basic information about the ZyAIR. 14-10 UPnP Screens...

  • Page 195: Chapter 15 Logs Screens

    ZyAIR Wireless Gateway Series User’s Guide Chapter 15 Logs Screens This chapter contains information about configuring general log settings and viewing the ZyAIR’s logs. Refer to the appendix for example log message explanations. 15.1 Using the View Log Screen The web configurator allows you to look at all of the ZyAIR’s logs in one location.

  • Page 196: Figure 15-1 View Log

    ZyAIR Wireless Gateway Series User’s Guide The following table describes the labels in this screen. LABEL Display Select a log category from the drop down list box to display logs within the selected category. To view all logs, select All Logs.

  • Page 197: Configuring Log Settings

    Active X and so on. Some categories such as System Errors consist of both logs and alerts. You may differentiate them by their color in the View Log screen. Alerts are displayed in red and logs are displayed in black. Logs Screens ZyAIR Wireless Gateway Series User’s Guide Table 15-1 View Log DESCRIPTION 15-3...

  • Page 198: Figure 15-2 Log Settings

    ZyAIR Wireless Gateway Series User’s Guide Figure 15-2 Log Settings 15-4 Logs Screens...

  • Page 199: Table 15-2 Log Settings

    This field is only available when you select Weekly in the Log Schedule field. Use the drop down list box to select which day of the week to send the logs. Logs Screens ZyAIR Wireless Gateway Series User’s Guide Table 15-2 Log Settings DESCRIPTION...

  • Page 200: Configuring Reports

    ZyAIR Wireless Gateway Series User’s Guide LABEL Time for Sending Log Enter the time of the day in 24-hour format (for example 23:00 equals 11:00 pm) to send the logs. Select the categories of logs that you want to record.

  • Page 201: Figure 15-3 Reports

    100% accurate. Enabling the ZyAIR’s reporting function decreases the overall throughput by The following table describes the labels in this screen. Logs Screens ZyAIR Wireless Gateway Series User’s Guide get counted as hits. Figure 15-3 Reports about 1 Mbps. 15-7...

  • Page 202: Viewing Protocol/Port

    ZyAIR Wireless Gateway Series User’s Guide LABEL Report Type Use the drop-down list box to select the type of reports to display. Web Site Hits displays the web sites that have been visited the most often from the LAN and how many times they have been visited.

  • Page 203: Figure 15-4 Protocol/Port Report

    Stop Collection when the ZyAIR is recording report data. Click Start Collection to have the ZyAIR record report data. Click Stop Collection to halt the ZyAIR from recording more data. Logs Screens ZyAIR Wireless Gateway Series User’s Guide Figure 15-4 Protocol/Port Report Table 15-4 Protocol/Port Report DESCRIPTION...

  • Page 204: Viewing Lan Ip Address

    ZyAIR Wireless Gateway Series User’s Guide LABEL Click Refresh to update the report display. The report also refreshes automatically when Refresh you close and reopen the screen. Direction This field displays Incoming to denote traffic that is coming in from the WAN to the LAN.

  • Page 205: Reports Specifications

    Number of web sites/protocols or ports/IP addresses listed: Hit count limit: Bytes count limit: Logs Screens ZyAIR Wireless Gateway Series User’s Guide Table 15-5 LAN IP Address Report DESCRIPTION Table 15-6 Report Specifications Up to 2 hits can be counted per web site. The count starts over at 0 if it passes four billion.

  • Page 207: Maintenance

    Maintenance Part VII: MAINTENANCE This part describes the Maintenance web configurator screens.

  • Page 209: Chapter 16 Maintenance

    ZyAIR Wireless Gateway Series User’s Guide Chapter 16 Maintenance This chapter displays system information such as ZyNOS firmware, port IP addresses and port traffic statistics. 16.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyAIR.

  • Page 210: System Statistics

    LABEL System Name This is the System Name you enter in the first Internet Access Wizard screen. It is for identification purposes. Model Name The model name identifies your device type. The model name should also be on a sticker on your device. If you are uploading firmware, be sure to upload firmware for this exact model name.

  • Page 211: Figure 16-2 Status: Show Statistics

    Enter the time interval for refreshing statistics. Set Interval Click this button to apply the new poll interval you entered above. Maintenance ZyAIR Wireless Gateway Series User’s Guide Figure 16-2 Status: Show Statistics Table 16-2 Status: Show Statistics DESCRIPTION 16-3...

  • Page 212: Dhcp Table Screen

    LABEL Stop Click this button to stop refreshing statistics. 16.3 DHCP Table Screen DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyAIR as a DHCP server or disable it. When configured as a server, the ZyAIR provides the TCP/IP configuration for the clients.

  • Page 213: Association List

    This field displays the time a wireless station first associated with the ZyAIR. Refresh Click Refresh to reload the screen. Maintenance ZyAIR Wireless Gateway Series User’s Guide Table 16-3 DHCP Table DESCRIPTION Figure 16-4 Association List Table 16-4 Association List...

  • Page 214: Channel Usage

    ZyAIR Wireless Gateway Series User’s Guide 16.5 Channel Usage The Channel Usage screen displays whether a channel is used by another wireless network or not. If a channel is being used, you should select a channel removed from it by five channels to completely avoid overlap.

  • Page 215: Figure 16-6 Channel Usage

    This field displays the MAC address of the AP in an Infrastructure wireless network. It is Address randomly generated (so ignore it) in an Ad-Hoc wireless network. Maintenance ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Figure 16-6 Channel Usage Table 16-6 Channel Usage...

  • Page 216: F/W Upload Screen

    LABEL Channel This is the index number of the channel currently used by the associated AP in an Infrastructure wireless network or wireless station in an Ad-Hoc wireless network. Signal This field displays the strength of the AP’s signal. If you must choose a channel that’s currently in use, choose one with low signal strength for minimum interference.

  • Page 217: Figure 16-8 Firmware Upload In Process

    Figure 16-9 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the System Status screen. Maintenance ZyAIR Wireless Gateway Series User’s Guide Table 16-7 Firmware Upload DESCRIPTION 16-9...

  • Page 218: Configuration Screen

    ZyAIR Wireless Gateway Series User’s Guide If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen. Figure 16-10 Firmware Upload Error 16.7 Configuration Screen See the Firmware and Configuration File Maintenance chapter for transferring configuration files using FTP/TFTP commands.

  • Page 219: Backup Configuration

    ZyAIR Wireless Gateway Series User’s Guide Figure 16-11 Configuration 16.7.1 Backup Configuration Backup configuration allows you to back up (save) the ZyAIR’s current configuration to a file on your computer. Once your ZyAIR is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes.

  • Page 220: Restore Configuration

    Click Backup to save your current ZyAIR configuration to your computer. 16.7.2 Restore Configuration Restore configuration replaces your ZyAIR's current configuration (content filters, firewall settings, etc.) with a previously saved configuration. Restore files (usually) have a .ROM extension, e.g., "zyair.rom". The system reboots automatically after the file transfer is complete and uses the configured values in the file.

  • Page 221: Back To Factory Defaults

    ZyAIR Wireless Gateway Series User’s Guide The ZyAIR automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 16-13 Network Temporarily Disconnected If you uploaded the default configuration file you may need to change the IP address of your computer to be in the same subnet as that of the default ZyAIR IP address (192.168.1.1).

  • Page 222: Restart Screen

    ZyAIR Wireless Gateway Series User’s Guide Figure 16-15 Reset Warning Message You can also press the RESET button on the side panel to reset the factory defaults of your ZyAIR. Refer to the Resetting the ZyAIR section for more information on the RESET button.

  • Page 223: Smt Getting Started Menus

    SMT Getting Started Menus Part VIII: SMT GETTING STARTED MENUS This part introduces the SMT (System Management Terminal) and discusses the “Getting Started” SMT menus. See the web configurator parts of this guide for background information on features configurable by web configurator and SMT. VIII...

  • Page 225: Chapter 17 Introducing The Smt

    No parity, 8 data bits, 1 stop bit No flow control Step 3. Turn on your ZyAIR and you should see the initial screen shown next. Introducing the SMT ZyAIR Wireless Gateway Series User’s Guide Chapter 17 Introducing the SMT 17-1...

  • Page 226: Initial Screen

    When you turn on your ZyAIR, it performs several internal tests as well as line initialization. After the initialization, the ZyAIR asks you to press [ENTER] to continue, as shown. Copyright (c) 1994 - 2002 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:00:15:37...

  • Page 227: Zyair Smt Menu Overview Example

    The following figure gives you an example overview of the various SMT menu screens for your ZyAIR B-2000 v.2. Introducing the SMT ZyAIR Wireless Gateway Series User’s Guide Menu 23.1 – System Security – Change Password Old Password= **** New Password= ?

  • Page 228: Figure 13-6 Snmp

    ZyAIR Wireless Gateway Series User’s Guide ZyAIR B-2000 v.2 Main Menu Menu 3 Menu 1 Menu 2 LAN Setup General Setup WAN Setup Menu 1.1 Menu 3.1 LAN Port Filter Configure Dynamic Setup Menu 3.2 TCP/IP and DHCP Setup Menu 3.5.1 Menu 3.5...

  • Page 229: Navigating The Smt Interface

    After you enter the password, the SMT displays the main menu, as shown next. Introducing the SMT ZyAIR Wireless Gateway Series User’s Guide Table 17-1 Main Menu Commands To move forward to a submenu, type in the number of the desired submenu and press [ENTER].

  • Page 230: System Management Terminal Interface Summary

    ZyAIR Wireless Gateway Series User’s Guide Copyright (c) 1994 - 2003 ZyXEL Communications Corp. Getting Started 1. General Setup 2. WAN Setup 3. LAN Setup 4. Internet Access Setup Advanced Applications 11. Remote Node Setup 12. Static Routing Setup 14. Dial-in User Setup 15.
  • Page 231 ZyAIR Wireless Gateway Series User’s Guide Table 17-2 Main Menu Summary MENU TITLE DESCRIPTION Exit Use this to exit from SMT and return to a blank screen. Introducing the SMT 17-7...

  • Page 233: Chapter 18 General And Wan Setup

    ZyAIR Wireless Gateway Series User’s Guide Chapter 18 General and WAN Setup The chapter shows you the information on general setup and how to configure the WAN. 18.1 General Setup Menu 1 – General Setup contains administrative and system-related information (shown next). The System Name field is for identification purposes.

  • Page 234: Figure 18-1 Menu 1 General Setup

    ZyAIR Wireless Gateway Series User’s Guide System Name= Domain Name= zyxel.com.tw First System DNS Server= From ISP Second System DNS Server= From ISP Third System DNS Server= None Edit Dynamic DNS= No Press ENTER to Confirm or ESC to Cancel: Step 2.

  • Page 235: Procedure To Configure Dynamic Dns

    Table 18-2 Menu 1.1 Configure Dynamic DNS FIELD Service Provider This is the name of your Dynamic DNS service provider. General and WAN Setup ZyAIR Wireless Gateway Series User’s Guide Table 18-1 Menu 1 General Setup DESCRIPTION Menu 1.1 - Configure Dynamic DNS...
  • Page 236 ZyAIR Wireless Gateway Series User’s Guide Table 18-2 Menu 1.1 Configure Dynamic DNS FIELD Active Press [SPACE BAR] to select Yes and then press [ENTER] to make dynamic DNS active. DDNS Type Press [SPACE BAR] and then [ENTER] to select DynamicDNS if you have a dynamic IP address(es).

  • Page 237: Wan Setup

    From the main menu, enter 2 to display Menu 2-WAN Setup screen as shown. The following table describes the fields in this menu. FIELD MAC Address General and WAN Setup ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Menu 2 - WAN Setup MAC Address: Assigned By= Factory default...
  • Page 238 ZyAIR Wireless Gateway Series User’s Guide FIELD Assigned By Press [SPACE BAR] to select Factory default and press [ENTER] to use the factory assigned MAC address. Select IP address attached on LAN and enter the IP address in the IP Address field below to clone the MAC address of the computer on the Ethernet.

  • Page 239: Chapter 19 Lan Setup

    Figure 19-2 Menu 3.1 LAN Port Filter Setup LAN Setup ZyAIR Wireless Gateway Series User’s Guide This chapter shows you how to configure the LAN on your ZyAIR. Menu 3 - LAN Setup 1. LAN Port Filter Setup 2.

  • Page 240: Tcp/Ip Ethernet And Dhcp Setup

    ZyAIR Wireless Gateway Series User’s Guide If you need to define filters, please read the Filter Set Configuration chapter first, then return to this menu to define the filter sets. 19.2 TCP/IP Ethernet and DHCP Setup Use menu 3.2 to configure your ZyAIR for TCP/IP.

  • Page 241: Table 19-1 Menu 3.2 Dhcp Ethernet Setup

    ZyAIR. SPACE BAR RIP Direction Press [ Only, Out Only or None. LAN Setup ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION DESCRIPTION ] to select the RIP direction. Choices are Both, In EXAMPLE...

  • Page 242: Ip Alias

    ZyAIR Wireless Gateway Series User’s Guide Table 19-2 Menu3.2 TCP/IP Ethernet Setup FIELD Version Press [ SPACE BAR] RIP-2B or RIP-2M. Multicast IGMP (Internet Group Multicast Protocol) is a session-layer protocol used to establish membership in a Multicast group. The ZyAIR supports both IGMP version 1(IGMP-v1) and version 2 (IGMP-v2).

  • Page 243: Ip Alias Setup

    Press [ENTER] to display Menu 3.2.1-IP Alias Setup, as shown next. Follow the instructions in the table below to configure IP Alias parameters. LAN Setup ZyAIR Wireless Gateway Series User’s Guide Menu 3.2 - TCP/IP and DHCP Ethernet Setup TCP/IP Setup: IP Address= 192.168.1.1...

  • Page 244: Wireless Lan Setup

    ZyAIR Wireless Gateway Series User’s Guide FIELD IP Alias Choose Yes to configure the LAN network for the ZyAIR. IP Address Enter the IP address of your ZyAIR in dotted decimal notation IP Subnet Mask Your ZyAIR will automatically calculate the subnet mask based on the IP address that you assign.

  • Page 245: Figure 19-8 Menu 3.5 Wireless Lan Setup

    This is the maximum data fragment size that can be sent. Enter a value Threshold between 256 and 2432. LAN Setup ZyAIR Wireless Gateway Series User’s Guide Menu 3.5 - Wireless LAN Setup ESSID= Wireless Hide ESSID= No Channel ID= CH01 2412MHz RTS Threshold= 0 Frag.
  • Page 246 ZyAIR Wireless Gateway Series User’s Guide FIELD Select Disable to allow wireless stations to communicate with the access points without any data encryption. Select 64-bit WEP or 128-bit WEP to enable data encryption. Default Key Enter the key number (1 to 4) in this field. Only one key can be enabled at any one time.

  • Page 247: Configuring Mac Address Filter

    In the Edit MAC Address Filtering field, press [SPACE BAR] to select Yes and press [ENTER]. Menu 3.5.1 – WLAN MAC Address Filter displays as shown next. LAN Setup ZyAIR Wireless Gateway Series User’s Guide Table 19-4 Menu 3.5 Wireless LAN Setup DESCRIPTION Menu 3.5 - Wireless LAN Setup...

  • Page 248: Figure 19-10 Menu 3.5.1 Wlan Mac Address Filter

    ZyAIR Wireless Gateway Series User’s Guide ------------------------------------------------------------------------------ 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 00:00:00:00:00:00 ------------------------------------------------------------------------------ Figure 19-10 Menu 3.5.1 WLAN MAC Address Filter The following table describes the fields in this menu. Table 19-5 Menu 3.5.1 WLAN MAC Address Filter...

  • Page 249: Configuring Roaming On The Zyair

    Press ENTER to Confirm or ESC to Cancel: Figure 19-12 Menu 3.5.2 Roaming Configuration The following table describes the fields in this menu. LAN Setup ZyAIR Wireless Gateway Series User’s Guide Menu 3.5 - Wireless LAN Setup ESSID= Wireless Hide ESSID= No...

  • Page 250: Table 19-6 Menu 3.5.2 Roaming Configuration

    ZyAIR Wireless Gateway Series User’s Guide Table 19-6 Menu 3.5.2 Roaming Configuration FIELD Active Press [SPACE BAR] and then [ENTER] to select Yes to enable roaming on the ZyAIR if you have two or more ZyAIRs on the same subnet.

  • Page 251: Chapter 20 Internet Access

    Network Select Full Feature, SUA Only or None. Address Translation Internet Access ZyAIR Wireless Gateway Series User’s Guide This chapter describes how to configure the ZyAIR for Internet Access. Table 20-1 Internet Account Information DESCRIPTION Chapter 20 Internet Access...

  • Page 252: Internet Access Setup

    ZyAIR Wireless Gateway Series User’s Guide FIELD DNS Server Primary DNS server Secondary DNS server Address Assignment Enter when using RFC 1483 Encapsulation or a static IP address. 20.2 Internet Access Setup From the main menu, type 4 to display Menu 4 – Internet Access Setup, as shown next.
  • Page 253 Refer to the System Security chapter for the wireless LAN security setup. Internet Access ZyAIR Wireless Gateway Series User’s Guide Table 20-2 Menu 4 Internet Access Setup DESCRIPTION...

  • Page 255: Smt Advanced Application Menus

    SMT Advanced Applications Menus Part IX: SMT ADVANCED APPLICATION MENUS This part shows how to configure Remote Node, Static Routing, Dial-in User and NAT.

  • Page 257: Chapter 21 Remote Node Configuration

    ZyAIR Wireless Gateway Series User’s Guide Chapter 21 Remote Node Configuration This chapter shows you how to set up remote nodes on the WAN side. A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection.

  • Page 258: Figure 21-1 Menu 11.1 Remote Node Profile

    ZyAIR Wireless Gateway Series User’s Guide Rem Node Name= ChangeMe Active= Yes Encapsulation= PPTP Service Type= Standard Service Name= N/A Outgoing: My Login= My Password= ******** Authen= CHAP/PAP PPTP: My IP Addr= My IP Mask= Server IP Addr= Connection ID/Name= Figure 21-1 Menu 11.1 Remote Node Profile...
  • Page 259 Allocated This sets a ceiling for outgoing call time for this remote node. The Budget (min) default for this field is 0 meaning no budget control. Remote Node Configuration ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE 10.11.12.13 (default) (default)

  • Page 260: Outgoing Authentication Protocol

    ZyAIR Wireless Gateway Series User’s Guide Table 21-1 Menu 11.1 Remote Node Profile FIELD Period (hr) This field is the time period that the budget should be reset. For example, if we are allowed to call this remote node for a maximum of 10 minutes every hour, then the Allocated Budget is (10 minutes) and the Period (hr) is 1 (hour).

  • Page 261: Figure 21-2 Menu 11.3 Remote Node Network Layer Options

    IP network numbers for the WAN and LAN links and each end to have a unique address within the WAN network number. In that case, type the IP address assigned to the WAN port of your ZyAIR. Remote Node Configuration ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE Static...

  • Page 262: Remote Node Filter

    ZyAIR Wireless Gateway Series User’s Guide Table 21-2 Menu 11.3 Remote Node Network Layer Options FIELD Network Press [SPACE BAR] and then [ENTER] to select Full Feature if you Address have multiple public WAN IP addresses for your ZyAIR. Translation Select SUA Only if you have just one public WAN IP address for your ZyAIR.

  • Page 263: Ip Static Route Setup

    Router 1 (via Router 2). The static routes allow you to tell the ZyAIR about the networks beyond the remote nodes. Remote Node Configuration ZyAIR Wireless Gateway Series User’s Guide Menu 11.5 - Remote Node Filter Input Filter Sets:...

  • Page 264: Figure 21-5 Menu 12.1 Ip Static Route Setup

    ZyAIR Wireless Gateway Series User’s Guide Configuration Step 1. To configure an IP static route, use Menu 12 - Static Route Setup as shwon next. Figure 21-5 Menu 12.1 IP Static Route Setup Step 2. Now, type the route number of a static route you want to configure.
  • Page 265 When you have completed this menu, press [ENTER] at the prompt “Press ENTER to confirm or ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen. Remote Node Configuration ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION 21-9...

  • Page 267: Chapter 22 Dial-In User Setup

    Type a number and press [ENTER] to edit the user profile. The following table describes the fields in this screen. Dial-in User Setup ZyAIR Wireless Gateway Series User’s Guide This chapter shows you how to create user accounts on the ZyAIR. Menu 14 - Dial-in User Setup ________ 17.

  • Page 268: Table 22-1 Menu 14.1- Edit Dial-In User

    ZyAIR Wireless Gateway Series User’s Guide FIELD User Name Enter a username up to 31 alphanumeric characters long for this user profile. This field is case sensitive. Active Press [SPACE BAR] to select Yes and press [ENTER] to enable the user profile.

  • Page 269: Chapter 23 Network Address Translation (Nat)

    Move the cursor to the Edit IP field, press [SPACE BAR] to select Yes and press [ENTER] to bring up Menu 11.3 - Remote Node Network Layer Options. ZyAIR Wireless Gateway Series User’s Guide This chapter discusses how to configure NAT on the ZyAIR.

  • Page 270: Nat Setup

    ZyAIR Wireless Gateway Series User’s Guide Figure 23-2 Menu 11.3 Remote Node Network Layer Options The following table describes the options for Network Address Translation. Table 23-1 Applying NAT in Menus 4 & 11.3 FIELD Network Press [SPACE BAR] and then [ENTER] to select Full Feature if you Address have multiple public WAN IP addresses for your ZyAIR.

  • Page 271: Address Mapping Sets

    Figure 23-4 Menu 15.1 Address Mapping Sets SUA Address Mapping Set Enter 255 to display the next screen. The fields in this menu cannot be changed. ZyAIR Wireless Gateway Series User’s Guide Menu 15 – NAT Setup 1. Address Mapping Sets 2.

  • Page 272: Figure 23-5 Menu 15.1.255 Sua Address Mapping Rules

    ZyAIR Wireless Gateway Series User’s Guide Menu 15.1.1 - Address Mapping Rules Set Name= SUA Local Start IP --------------- 0.0.0.0 Figure 23-5 Menu 15.1.255 SUA Address Mapping Rules The following table explains the fields in this menu. Table 23-2 Menu 15.1.255 SUA Address Mapping Rules...

  • Page 273: User-Defined Address Mapping Sets

    When you choose Edit, Insert Before or Delete in the previous field the Rule cursor jumps to this field to allow you to select the rule to apply the action in question. ZyAIR Wireless Gateway Series User’s Guide Menu 15.1.1 - Address Mapping Rules Local End IP Global Start IP...

  • Page 274: Configuring Individual Rule

    ZyAIR Wireless Gateway Series User’s Guide You must press [ENTER] at the bottom of the screen to save the whole set. You must do this again if you make any changes to the set – including deleting a rule. No changes to the set take place until this action is taken.

  • Page 275: Ordering Your Rules

    21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers. ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE 0.0.0.0...

  • Page 276: Configuring A Server Behind Nat

    ZyAIR Wireless Gateway Series User’s Guide In addition to the servers for specified services, NAT supports a default server. A service request that does not have a server explicitly designated for it is forwarded to the default server. If the default is not defined, the service request is simply discarded.

  • Page 277: General Nat Examples

    In the following Internet access example, you only need one rule where your ILAs (Inside Local addresses) all map to one dynamic IGA (Inside Global Address) assigned by your ISP. ZyAIR Wireless Gateway Series User’s Guide Menu 15.2 – Port Forwarding Setup Rule Start Port No.

  • Page 278: Figure 23-9 Nat Example 1

    ZyAIR Wireless Gateway Series User’s Guide Figure 23-10 Menu 4 Internet Access Setup From menu 4, choose the SUA Only option from the Network Address Translation field. This is the Many-to-One mapping discussed in section 23.4. The SUA Only read-only option from the Network Address Translation field in menus 4 and 11.3 is specifically pre-configured to handle this case.

  • Page 279: Example 2: Internet Access With An Inside Server

    In this example, there are 3 IGAs from our ISP. There are many departments but two have their own FTP server. All departments share the same router. The example will reserve one IGA for each department with ZyAIR Wireless Gateway Series User’s Guide Figure 23-11 NAT Example 2 Menu 15.2 - NAT Server Setup...

  • Page 280: Figure 23-13 Nat Example 3

    ZyAIR Wireless Gateway Series User’s Guide an FTP server and all departments use the other IGA. Map the FTP servers to the first two IGAs and the other LAN traffic to the remaining IGA. Map the third IGA to an inside web server and mail server. Four rules need to be configured, two bi-directional and two uni-directional as follows.

  • Page 281: Figure 23-14 Menu 11.3 Remote Node Network Layer Options

    (our first IGA). The following figure shows how to configure the first rule. Figure 23-15 Menu 15.1.1.1 Address Mapping Rule Step 6. Repeat the previous step for rules 2 to 4 as outlined above. ZyAIR Wireless Gateway Series User’s Guide IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A...

  • Page 282: Figure 23-16 Menu 15.1.1 Address Mapping Rules

    ZyAIR Wireless Gateway Series User’s Guide Step 7. When finished, menu 15.1.1 should look like as shown next. Set Name= Eample3 Local Start IP --------------- 192.168.1.10 192.168.1.11 0.0.0.0 Figure 23-16 Menu 15.1.1 Address Mapping Rules Now configure the IGA3 to map to our web server and mail server on the LAN.

  • Page 283: Example 4: Nat Unfriendly Application Programs

    = 192.168.1.12 Global IP: Start= 10.132.50.1 = 10.132.50.3 Figure 23-18 Menu 15.1.1.1 Address Mapping Rule ZyAIR Wireless Gateway Series User’s Guide Figure 23-17 NAT Example 4 types. Menu 15.1.1.1 Address Mapping Rule Press ENTER to Confirm or ESC to Cancel:...

  • Page 284: Trigger Port Setup

    ZyAIR Wireless Gateway Series User’s Guide After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as shown next. Set Name= Example4 Local Start IP --------------- 192.168.1.10 Figure 23-19 Menu 15.1.1 Address Mapping Rules 23.5 Trigger Port Setup...

  • Page 285: Two Points To Remember About Trigger Ports

    Name Enter a unique name for identification purposes. You may enter up to 15 characters in this field. All characters are permitted - including spaces. ZyAIR Wireless Gateway Series User’s Guide Menu 15.3 - Trigger Port Setup Incoming Start Port...
  • Page 286 ZyAIR Wireless Gateway Series User’s Guide FIELD Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The ZyAIR forwards the traffic with this port (or range of ports) to the wireless station on the LAN that requested the service.

  • Page 287: Smt Advanced Management Menus

    SMT Advanced Management Menus Part X: SMT ADVANCED MANAGEMENT MENUS This part discusses Filtering and Firewall setup, SNMP, System Security, System Information and Diagnosis, Firmware and Configuration File Maintenance, System Maintenance and Information, Call Scheduling and Remote Management.

  • Page 289: About Filtering

    Outgoing Data Packet Filtering Match Drop packet Figure 24-1 Outgoing Packet Filtering Process Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Call Filtering match Built-in User-defined default Call Filters Call Filters (if applicable) Match Match...

  • Page 290: Filter Set

    ZyAIR Wireless Gateway Series User’s Guide Two sets of factory filter rules have been configured in menu 21 to prevent NetBIOS traffic from triggering calls. A summary of their filter rules is shown in the figures that follow. The following figure illustrates the logic flow when executing a filter rule.

  • Page 291: Configuring A Filter Set

    Rules Summary (that is, if you selected filter set 1 in menu 21.1). The following figures show the summary of three filter sets of your ZyAIR. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Filter Comments Set #...

  • Page 292: Figure 24-4 Netbios_Wan Filter Rules Summary

    ZyAIR Wireless Gateway Series User’s Guide # A Type - - ---- --------------------------------------------------------------- - - - 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=137 2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=138 3 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=139 4 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=137...

  • Page 293: Filter Rules Summary Menus

    “D” means to drop the packet. “N” means to check the next rule. The protocol dependent filter rules abbreviation are listed as follows: FILTER TYPE Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Table 24-2 Rule Abbreviations Used DESCRIPTION Protocol...

  • Page 294: Configuring A Filter Rule

    ZyAIR Wireless Gateway Series User’s Guide FILTER TYPE 24.3 Configuring a Filter Rule To configure a filter rule, type its number in Menu 21.1.1 – Filter Rules Summary and press [ENTER] to open menu 21.1.1.x for the rule. There are two types of filter rules: TCP/IP and Generic. Depending on the type of rule, the parameters for each type will be different.

  • Page 295: Figure 24-7 Menu 21.1.1 Tcp/Ip Filter Rule

    IP source route. The majority of IP packets do not have source route. Destination: Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Menu 21.1.1.1 - TCP/IP Filter Rule Filter #: 1,1 Filter Type= TCP/IP Filter Rule...
  • Page 296 ZyAIR Wireless Gateway Series User’s Guide Table 24-3 Menu 21.1.1 TCP/IP Filter Rule FIELD IP Addr Type the destination IP address of the packet you want to filter. This field is ignored if it is 0.0.0.0. IP Mask Type the IP mask to apply to the Destination: IP Addr field.
  • Page 297 [ESC] to cancel and go back to the previous screen. The following figure illustrates the logic flow of an IP filter. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE...

  • Page 298: Figure 24-8 Executing An Ip Filter

    ZyAIR Wireless Gateway Series User’s Guide Packet into IP Filter Filter Active? Apply SrcAddrMask to Src Addr Check Src IP Addr Matched Apply DestAddrMask to Dest Addr Check Dest IP Addr Matched Check IP Protocol Matched Check Src & Dest Port...

  • Page 299: Generic Filter Rule

    Active Press [SPACE BAR] to select Yes and press [ENTER] to turn on the filter rule. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Menu 21.1.4.1 - Generic Filter Rule Filter #: 4,1 Filter Type= Generic Filter Rule...

  • Page 300: Filter Types And Nat

    ZyAIR Wireless Gateway Series User’s Guide Table 24-4 Menu 21.1.4.1 Generic Filter Rule FIELD Offset Type the starting byte of the data portion in the packet that you want to compare. The range for this field is from 0 to 255.

  • Page 301: Example Filter

    Enter the index number of the filter set you want to configure (in this example, 3) Step 3. Type a descriptive name or comment in the Edit Comments field (for example, TELNET_WAN) and press [ENTER]. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Figure 24-11 Sample Telnet Filter 24-13...

  • Page 302: Figure 24-12 Sample Filter - Menu 21.1.3.1

    ZyAIR Wireless Gateway Series User’s Guide Step 4. Press [ENTER] at the message 21.1.3.1 – TCP/IP Filter Rule. Step 5. Type 1 to configure the first filter rule. Make the entries in this menu as shown next. Menu 21.1.3.1 - TCP/IP Filter Rule...

  • Page 303: Applying Filters And Factory Defaults

    See earlier in this section for information on types of filters. Call Filter Sets: Apply filters to decide if a packet should be allowed to trigger a call. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Menu 21.1.3 - Filter Rules Summary Filter Rules DP=23 M = N means an action can be taken immediately.

  • Page 304: Ethernet Traffic

    ZyAIR Wireless Gateway Series User’s Guide 24.6.1 Ethernet Traffic You seldom need to filter Ethernet traffic; however, the filter sets may be useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and type the number(s) of the filter set(s) that you want to apply as appropriate.

  • Page 305: Firewall Setup

    Active: No You can use the Web Configurator to configure the firewall. Filter and Firewall Configuration ZyAIR Wireless Gateway Series User’s Guide Menu 21.2 - Firewall Setup Press ENTER to Confirm or ESC to Cancel: 24-17...

  • Page 307: Chapter 25 Snmp Configuration

    A blank (default) field means your ZyAIR will respond to all SNMP messages it receives, regardless of source. Trap: SNMP Configuration ZyAIR Wireless Gateway Series User’s Guide SNMP Configuration This chapter explains SNMP Configuration menu 22. Menu 22 - SNMP Configuration SNMP:...
  • Page 308 ZyAIR Wireless Gateway Series User’s Guide FIELD Community Type the trap community, which is the password sent with each trap to the SNMP manager. Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press ENTER to confirm or ESC to cancel”...

  • Page 309: Chapter 26 System Security

    Enter 23 in the main menu to display Menu 23 – System Security. From Menu 23- System Security, enter 2 to display Menu 23.2 - System Security-RADIUS Server as shown next. System Security ZyAIR Wireless Gateway Series User’s Guide Menu 23 - System Security 1. Change Password 2. RADIUS Server 4.

  • Page 310: Figure 26-3 Menu 23.2 System Security : Radius Server

    ZyAIR Wireless Gateway Series User’s Guide Figure 26-3 Menu 23.2 System Security : RADIUS Server The following table describes the fields in this screen. Table 26-1 Menu 23.2 System Security : RADIUS Server FIELD Authentication Server Active Press [SPACE BAR] to select Yes and press [ENTER] to enable user authentication through an external authentication server.

  • Page 311: Ieee802.1X

    From the main menu, enter 23 to display Menu23 – System Security. Step 2. Enter 4 to display Menu 23.4 – System Security – IEEE802.1x. System Security ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Menu 23 - System Security 1. Change Password 2.

  • Page 312: Figure 26-5 Menu 23.4 System Security : Ieee802.1X

    ZyAIR Wireless Gateway Series User’s Guide Wireless Port Control= Authentication Required ReAuthentication Timer (in second)= 1800 Idle Timeout (in second)= 3600 Key Management Protocol= 802.1x Dynamic WEP Key Exchange= Disable PSK= N/A WPA Mixed Mode= N/A Group Data Privacy= N/A...
  • Page 313 WEP key for an AP and all stations in a WLAN on a periodic basis. Setting of the WPA Group Key Update Timer is also supported in WPA-PSK mode. The ZyAIR default is 1800 seconds (30 minutes). System Security ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION 26-5...
  • Page 314 ZyAIR Wireless Gateway Series User’s Guide Table 26-2 Menu 23.4 System Security : IEEE802.1x FIELD Authentication The authentication database contains wireless station login information. The local user Databases database is the built-in database on the ZyAIR. The RADIUS is an external server. Use this field to decide which database the ZyAIR should use (first) to authenticate a wireless station.

  • Page 315: Chapter 27 System Information And Diagnosis

    [ESC] takes you back to the previous screen. To display menu 24.1 properly, make sure you use the console cable supplied to System Information and Diagnosis ZyAIR Wireless Gateway Series User’s Guide System Maintenance, as shown in the following figure. Menu 24 - System Maintenance...

  • Page 316: Figure 27-2 Menu 24.1 System Maintenance : Status

    ZyAIR Wireless Gateway Series User’s Guide Port Status 100M/Full 100M/Full WLAN Port Ethernet Address 00:A0:C5:01:23:46 00:A0:C5:01:23:45 WLAN 00:A0:C5:01:23:45 System up Time: Name: Routing: IP ZyNOS F/W Version: V3.50(HF.3)b4 | 03/12/2004 COMMANDS: 1-Drop WAN 9-Reset Counters Figure 27-2 Menu 24.1 System Maintenance : Status The following table describes the fields present in Menu 24.1 –...

  • Page 317: System Information

    IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Figure 27-4 Menu 24.2.1 System Maintenance : Information System Information and Diagnosis ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION 1. System Information 2. Console Port Speed Please enter selection: the ZyAIR as it will void your warranty.

  • Page 318: Figure 27-5 Menu 24.2.2 System Maintenance : Change Console Port Speed

    Refers to the routing protocol used. ZyNOS F/W Version Refers to the ZyNOS (ZyXEL Network Operating System) system firmware version. ZyNOS is a registered trademark of ZyXEL Communications Corporation. Ethernet Address Refers to the Ethernet MAC (Media Access Control) of your ZyAIR.

  • Page 319: Log And Trace

    After the ZyAIR finishes displaying the error log, you will have the option to clear it. Samples of typical error and information messages are presented in the next figure. System Information and Diagnosis ZyAIR Wireless Gateway Series User’s Guide 1. View Error Log 2. UNIX Syslog 4.

  • Page 320: Syslog Logging

    ZyAIR Wireless Gateway Series User’s Guide 45 Sat Jan 1 00:00:00 2000 PP0e 46 Sat Jan 47 Sat Jan 48 Sat Jan 49 Sat Jan 50 Sat Jan 51 Sat Jan 52 Sat Jan 53 Sat Jan 54 Sat Jan...

  • Page 321: Call-Triggering Packet

    Call-triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hexadecimal format. System Information and Diagnosis ZyAIR Wireless Gateway Series User’s Guide Syslog: Active= No Syslog Server IP Address= 0.0.0.0...

  • Page 322: Diagnostic

    ZyAIR Wireless Gateway Series User’s Guide 27.4 Diagnostic The diagnostic facility allows you to test the different aspects of your ZyAIR to determine if it is working properly. Menu 24.4 allows you to choose among various types of diagnostic tests to evaluate your system, as shown in the following figure.

  • Page 323: Chapter 28 Firmware And Configuration File Maintenance

    ZyAIR Wireless Gateway Series User’s Guide Chapter 28 Firmware and Configuration File Maintenance This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 28.1 Filename Conventions The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup, TCP/IP Setup, etc.

  • Page 324: Backup Configuration

    ZyAIR Wireless Gateway Series User’s Guide FILE TYPE INTERNAL NAME Configuration Rom-0 File Firmware 28.2 Backup Configuration The ZyAIR displays different messages explaining different ways to backup, restore and upload files in menus 24.5, 24.6, 24. 7.1 and 24.7.2; depending on whether you use the console port or Telnet.

  • Page 325: Backup Configuration

    Step 7. Enter “quit” to exit the ftp prompt. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide Menu 24.5 - Backup Configuration For details on backup using TFTP (note that you must remain Press ENTER to Exit: Figure 28-1 Telnet in Menu 24.5...

  • Page 326: Example Of Ftp Commands From The Command Line

    ZyAIR Wireless Gateway Series User’s Guide 28.2.3 Example of FTP Commands from the Command Line 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec.

  • Page 327: Backup Configuration Using Tftp

    ZyAIR) to the file destination on the computer and renames it config.rom. 28.2.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide 28-5...

  • Page 328: Backup Via Console Port (Only For Zyair B-2000)

    ZyAIR Wireless Gateway Series User’s Guide Table 28-3 General Commands for GUI-based TFTP Clients COMMAND Host Enter the IP address of the ZyAIR. 192.168.1.1 is the ZyAIR’s default IP address when shipped. Send/Fetch Use “Send” to upload the file to the ZyAIR and “Fetch” to back up the file on your computer.

  • Page 329: Restore Configuration

    Please note that you must wait for the system to automatically restart after the file transfer is complete. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide ** Backup Configuration completed. OK. ### Hit any key to continue.###...

  • Page 330: Restore Using Ftp

    ZyAIR Wireless Gateway Series User’s Guide DO NOT INTERUPT THE FILE TRANSFER PROCESS AS THIS MAY PERMANENTLY DAMAGE YOUR ZYAIR. WHEN THE RESTORE CONFIGURATION PROCESS IS COMPLETE, THE ZYAIR WILL AUTOMATICALLY RESTART. 28.3.1 Restore Using FTP For details about backup using (T)FTP please refer to earlier sections on FTP and TFTP file upload in this chapter.

  • Page 331: Restore Using Ftp Session Example

    CCCCCCCCC Figure 28-10 System Maintenance : Starting Xmodem Download Screen Step 3. Run the HyperTerminal program by clicking Transfer, then Send File as shown in the following screen. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide 28-9...

  • Page 332: Uploading Firmware And Configuration Files

    ZyAIR Wireless Gateway Series User’s Guide Figure 28-11 Restore Configuration Example Step 4. After a successful restoration you will see the following screen. Press any key to restart the ZyAIR and return to the SMT menu. Figure 28-12 Successful Restoration Confirmation Screen 28.4 Uploading Firmware and Configuration Files...

  • Page 333: Configuration File Upload

    Figure 28-14 Telnet Into Menu 24.7.2 System Maintenance To upload the firmware and the configuration file, follow these examples Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide Then type "root" and Press ENTER to Exit: Press ENTER to Exit:...

  • Page 334: Ftp File Upload Command From The Dos Prompt Example

    ZyAIR Wireless Gateway Series User’s Guide 28.4.3 FTP File Upload Command from the DOS Prompt Example Step 1. Launch the FTP client on your computer. Step 2. Enter “open”, followed by a space and the IP address of your ZyAIR.

  • Page 335: Tftp Upload Command Example

    Uploading files via the console port under normal conditions is not recommended since FTP or TFTP is faster. Any serial communications program should work fine; however, you must use the Xmodem protocol to perform the download/upload. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide 28-13...

  • Page 336: Uploading Firmware File Via Console Port (Only For Zyair B-2000)

    ZyAIR Wireless Gateway Series User’s Guide 28.4.8 Uploading Firmware File Via Console Port (only for ZyAIR B-2000) Step 1. Select 1 from Menu 24.7 – System Maintenance – Upload Firmware to display Menu 24.7.1 – System Maintenance – Upload System Firmware, then follow the instructions as shown in the following screen.

  • Page 337: Uploading Configuration File Via Console Port (Only For Zyair B-2000)

    Step 3. Enter “atgo” to restart the ZyAIR. 28.4.11Example Xmodem Configuration Upload Using HyperTerminal Click Transfer, then Send File to display the following screen. Firmware and Configuration File Maintenance ZyAIR Wireless Gateway Series User’s Guide Do You Wish To Proceed:(Y/N) 28-15...

  • Page 338: Figure 28-19 Example Xmodem Upload

    ZyAIR Wireless Gateway Series User’s Guide After the configuration upload process has completed, restart the ZyAIR by entering “atgo”. 28-16 Figure 28-19 Example Xmodem Upload Firmware and Configuration File Maintenance Type the configuration file’s location, or click Browse to search for it.

  • Page 339: Chapter 29 System Maintenance And Smt Menu 24.8 To 24.10

    ? at the command prompt. Type exit to return to the SMT main menu when finished. Figure 29-1 Menu 24 System Maintenance Copyright (c) 1994 - 2003 ZyXEL Communications Corp. ras> ? Valid commands are:...

  • Page 340: Call Control Support

    ZyAIR Wireless Gateway Series User’s Guide 29.2 Call Control Support The ZyAIR provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.

  • Page 341: Call History

    Enter 2 from Menu 24.9 - System Maintenance - Call Control to bring up the following menu. Phone Number The following table describes the fields in this menu. System Maintenance and SMT Menu 24.8 to 24.10 ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION Menu 24.9.2 - Call History Rate #call Enter Entry to Delete(0 to exit): Figure 29-5 Menu 24.9.2 Call History...

  • Page 342: Time And Date Setting

    ZyAIR Wireless Gateway Series User’s Guide FIELD Phone Number The PPPoE service names are shown here. This shows whether the call was incoming or outgoing. Rate This is the transfer rate of the call. #call This is the number of calls made to or received from that telephone number.

  • Page 343: Figure 29-6 Menu 24.10 System Maintenance : Time And Date Setting

    When you select None in the Time Protocol field, enter the new time in hour, minute and second format. System Maintenance and SMT Menu 24.8 to 24.10 ZyAIR Wireless Gateway Series User’s Guide 00 : 12 : 30 00 : 12 : 22...

  • Page 344: Resetting The Time

    ZyAIR Wireless Gateway Series User’s Guide Table 29-3 Menu 24.10 System Maintenance : Time and Date Setting FIELD Current Date This field displays an updated date only when you re-enter this menu. New Date This field displays the last updated date from the time server.

  • Page 345: Chapter 30 Remote Management

    ZyAIR Wireless Gateway Series User’s Guide Chapter 30 Remote Management This chapter covers remote management (SMT menu 24.11). 30.1 Telnet You can configure your ZyAIR for remote Telnet access as shown next. Figure 30-1 Telnet Configuration on a TCP/IP Network 30.2 FTP...

  • Page 346: Remote Management Setup

    ZyAIR Wireless Gateway Series User’s Guide 30.4.1 Remote Management Setup Remote management setup is for managing Telnet, FTP and Web services. You can customize the service port, access interface and the secured client IP address to enhance security and flexibility.

  • Page 347: Remote Management Limitations

    5. There is a web remote management session running with a Telnet session. A Telnet session will be disconnected if you begin a web session; it will not begin if there already is a web session. Remote Management ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE LAN only 0.0.0.0...

  • Page 348: Remote Management And Nat

    ZyAIR Wireless Gateway Series User’s Guide 30.5 Remote Management and NAT When NAT is enabled: Use the ZyAIR’s WAN IP address when configuring from the WAN. Use the ZyAIR’s LAN IP address when configuring from the LAN. 30.6 System Timeout There is a system timeout of five minutes (300 seconds) for Telnet/web/FTP connections.

  • Page 349: Chapter 31 Call Scheduling

    You can design up to 12 schedule sets but you can only apply up to four schedule sets for a remote node. Call Scheduling ZyAIR Wireless Gateway Series User’s Guide remote node should be called and for how long. Menu 26 - Schedule Setup...

  • Page 350: Figure 31-2 Menu 26.1 Schedule Set Setup

    ZyAIR Wireless Gateway Series User’s Guide To delete a schedule set, enter the set number and press [SPACE BAR] and then [ENTER] (or delete) in the Edit Name field. To setup a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 - Schedule Set Setup as shown next.
  • Page 351 Main Menu and then enter the target remote node index. Using [SPACE BAR], select PPPoE or PPTP in the Encapsulation field and then press [ENTER] to make the schedule sets field available as shown next. Call Scheduling ZyAIR Wireless Gateway Series User’s Guide DESCRIPTION EXAMPLE 2000-01-01...
  • Page 352 ZyAIR Wireless Gateway Series User’s Guide Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Active= Yes Encapsulation= PPTP Service Type= Standard Service Name= N/A Outgoing: My Login= My Password= ******** Authen= CHAP/PAP PPTP: My IP Addr= My IP Mask=...

  • Page 353: Appendices

    Appendices Part XI: APPENDICES This part provides contains troubleshooting and additional background information on setting up your computer’s IP address, wireless LAN, 802.1x, PPPoE, PPTP and IP subnetting. It also provides information on the command interpreter interface, NetBIOS commands and logs.

  • Page 355: Appendix A Troubleshooting

    Use the RESET button on the side panel of the ZyAIR to restore the factory default configuration file (hold this button in for more than five seconds). This will restore all of the factory defaults including the password. Troubleshooting ZyAIR Wireless Gateway Series User’s Guide Appendix A Troubleshooting CORRECTIVE ACTION VT100 terminal emulation.

  • Page 356: Problems With The Ethernet Interface

    ZyAIR Wireless Gateway Series User’s Guide Problems with the Ethernet Interface Chart A-3 Troubleshooting the Ethernet Interface PROBLEM I cannot access If all of the LAN LEDs on the front panel are off, check the Ethernet cable the ZyAIR from connection between your ZyAIR and the computer connected to the LAN port.

  • Page 357: Problems With Internet Access

    Problems with Telnet PROBLEM I cannot access Refer to the Problems with the Ethernet Interface section for instructions on checking the ZyAIR through your Ethernet connection. Telnet. Troubleshooting ZyAIR Wireless Gateway Series User’s Guide CORRECTIVE ACTION Chart A-6 Troubleshooting Telnet CORRECTIVE ACTION...

  • Page 358: Problems With The Wlan Interface

    ZyAIR Wireless Gateway Series User’s Guide Problems with the WLAN Interface Chart A-7 Troubleshooting the WLAN Interface PROBLEM I cannot ping any Make sure the wireless card is properly inserted in the ZyAIR and the WLAN LED is computer on the WLAN.

  • Page 359: Appendix B Brute-Force Password Guessing Protection

    This command sets the password protection to block all access attempts for five minutes after the third time an incorrect password is entered. By default, the brute-force password guessing protection is turned ON with a 3-minute wait time. Brute-Force Password Guessing Protection ZyAIR Wireless Gateway Series User’s Guide Appendix B Protection DESCRIPTION...

  • Page 361: Appendix C Setting Up Your Computer's Ip Address

    ZyAIR Wireless Gateway Series User’s Guide Appendix C Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer.
  • Page 362 ZyAIR Wireless Gateway Series User’s Guide If you need the adapter: In the Network window, click Add. Select Adapter and then click Add. Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: In the Network window, click Add.
  • Page 363 Disable DNS. -If you know your DNS information, select Enable DNS and type the information in the fields below (you may not need to fill them all in). Setting Up Your Computer’s IP Address ZyAIR Wireless Gateway Series User’s Guide...

  • Page 364: Verifying Your Computer's Ip Address

    ZyAIR Wireless Gateway Series User’s Guide Click the Gateway tab. -If you do not know your gateway’s IP address, remove previously installed gateways. -If you have a gateway IP address, type it in the New gateway field and click Add.
  • Page 365 Windows 2000/NT, click Start, Settings, Control Panel. For Windows XP, click Network Connections. For Windows 2000/NT, click Network and Dial-up Connections. Setting Up Your Computer’s IP Address ZyAIR Wireless Gateway Series User’s Guide Right-click Local Area Connection and then click Properties.
  • Page 366 ZyAIR Wireless Gateway Series User’s Guide Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties. The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP). -If you have a dynamic IP address click Obtain an IP address automatically.
  • Page 367 ZyAIR Wireless Gateway Series User’s Guide -If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK. Do one or more of the following if you want to configure additional IP addresses: -In the IP Settings tab, in IP addresses, click Add.
  • Page 368 ZyAIR Wireless Gateway Series User’s Guide In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): -Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). -If you know your DNS server IP address(es),...
  • Page 369 Click the Apple menu, Control Panel and double-click TCP/IP to open the TCP/IP Control Panel. Select Ethernet built-in from the Connect via list. For dynamically assigned settings, select Using DHCP Server from the Configure: list. Setting Up Your Computer’s IP Address ZyAIR Wireless Gateway Series User’s Guide...

  • Page 370: Macintosh Os X

    ZyAIR Wireless Gateway Series User’s Guide For statically assigned settings, do the following: -From the Configure box, select Manually. -Type your IP address in the IP Address box. -Type your subnet mask in the Subnet mask box. -Type the IP address of your ZyAIR in the Router address box.
  • Page 371 Click Apply Now and close the window. Turn on your ZyAIR and restart your computer (if prompted). Verifying Your Computer’s IP Address Check your TCP/IP properties in the Network window. Setting Up Your Computer’s IP Address ZyAIR Wireless Gateway Series User’s Guide C-11...

  • Page 373: Benefits Of A Wireless Lan

    Two of the methods use spread spectrum RF signals, Direct Sequence Spread Spectrum (DSSS) and Frequency-Hopping Spread Spectrum (FHSS), in the 2.4 to 2.4825 GHz Wireless LAN and IEEE 802.11 ZyAIR Wireless Gateway Series User’s Guide Appendix D...

  • Page 374: Infrastructure Wireless Lan Configuration

    ZyAIR Wireless Gateway Series User’s Guide unlicensed ISM (Industrial, Scientific and Medical) band. The third method is infrared technology, using very high frequencies, just below visible light in the electromagnetic spectrum to carry data. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless nodes or stations (STA), which is called a Basic Service Set (BSS).
  • Page 375 ZyAIR Wireless Gateway Series User’s Guide The Extended Service Set (ESS) shown in the next figure consists of a series of overlapping BSSs (each containing an Access Point) connected together by means of a Distribution System (DS). Although the DS could be any type of network, it is almost invariably an Ethernet LAN.

  • Page 377: Appendix E Wireless Lan With Ieee 802.1X

    Support for EAP (Extensible Authentication Protocol, RFC 2486) that allows additional authentication methods to be deployed with no changes to the access point or the wireless stations. Wireless LAN with IEEE 802.1x ZyAIR Wireless Gateway Series User’s Guide Appendix E...
  • Page 378 ZyAIR Wireless Gateway Series User’s Guide The following figure depicts a typical wireless network with a remote RADIUS server for user authentication using EAPOL (EAP Over LAN). Diagram E-1 Sequences for EAP MD5–Challenge Authentication RADIUS Server Authentication Sequence Client computer access authorized.

  • Page 379: Appendix F Types Of Eap Authentication

    ZyAIR Wireless Gateway Series User’s Guide Appendix F Types of EAP Authentication This appendix discusses the four popular EAP authentication types: EAP-MD5, EAP-TLS, EAP-TTLS and PEAP. The type of authentication you use depends on the RADIUS server or the AP. Consult your network administrator for more information.

  • Page 380: Comparison Of Eap Authentication Types

    ZyAIR Wireless Gateway Series User’s Guide hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5 and EAP- MSCHAPv2, for client authentication. For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, simple user name and password pair is more practical.

  • Page 381: Antenna Characteristics

    (like a donut) which makes these antennas ideal for a room environment. With a wide coverage area, it is possible to make circular overlapping coverage areas with multiple access points. Antenna Selection and Positioning Recommendation ZyAIR Wireless Gateway Series User’s Guide Appendix G Recommendation...

  • Page 382: Positioning Antennas

    ZyAIR Wireless Gateway Series User’s Guide • Directional antennas concentrate the RF signal in a beam, like a flashlight. The angle of the beam width determines the direction of the coverage pattern; typically ranges from 20 degrees (less directional) to 90 degrees (very directional). The directional antennas are ideal for hallways and outdoor point-to-point applications.

  • Page 383: Pppoe In Action

    3. It allows the ISP to use the existing dial-up model to authenticate and (optionally) to provide differentiated services. Traditional Dial-up Scenario The following diagram depicts a typical hardware configuration where the PCs use traditional dial-up networking. Diagram H-1 Single-PC per Modem Hardware Configuration PPPoE ZyAIR Wireless Gateway Series User’s Guide Appendix H PPPoE...

  • Page 384: How Pppoe Works

    ZyAIR Wireless Gateway Series User’s Guide How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC is acting as a L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the PPP frames to the ISP.

  • Page 385: Appendix Ipptp

    ZyAIR Wireless Gateway Series User’s Guide Appendix I PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a PC to a broadband modem over...

  • Page 386: Pptp Protocol Overview

    ZyAIR Wireless Gateway Series User’s Guide PPTP Protocol Overview PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2 Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network Server), the PAC (PPTP Access Concentrator) and the PPTP user.

  • Page 387: Ppp Data Connection

    ZyAIR Wireless Gateway Series User’s Guide Diagram I-3 Example Message Exchange between PC and an ANT PPP Data Connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
  • Page 389 Therefore: A class “C” network (8 host bits) can have 2 A class “B” address (16 host bits) can have 2 IP Subnetting ZyAIR Wireless Gateway Series User’s Guide Chart J-1 Classes of IP Addresses OCTET 2 Host ID Network number Network number –2 or 254 hosts.

  • Page 390: Subnet Masks

    ZyAIR Wireless Gateway Series User’s Guide A class “A” address (24 host bits) can have 2 Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127.
  • Page 391 Subnet Mask (Binary) The first three octets of the address make up the network number (class “C”). You want to have two separate networks. IP Subnetting ZyAIR Wireless Gateway Series User’s Guide SUBNET MASK “1” BITS NETWORK NUMBER 192.168.1. 11000000.10101000.00000001.
  • Page 392 ZyAIR Wireless Gateway Series User’s Guide Divide the network 192.168.1.0 into two separate subnets by converting one of the host ID bits of the IP address to a network number bit. The “borrowed” host ID bit can be either “0” or “1” thus giving two subnets;...

  • Page 393: Example: Four Subnets

    Subnet Address: 192.168.1.64 Broadcast Address: 192.168.1.127 IP Address IP Address (Binary) Subnet Mask (Binary) Subnet Address: 192.168.1.128 IP Subnetting ZyAIR Wireless Gateway Series User’s Guide Chart J-7 Subnet 1 NETWORK NUMBER 192.168.1. 11000000.10101000.00000001. 11111111.11111111.11111111. Lowest Host ID: 192.168.1.1 Highest Host ID: 192.168.1.62...

  • Page 394: Example Eight Subnets

    ZyAIR Wireless Gateway Series User’s Guide Broadcast Address: 192.168.1.191 IP Address IP Address (Binary) Subnet Mask (Binary) Subnet Address: 192.168.1.192 Broadcast Address: 192.168.1.255 Example Eight Subnets Similarly use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110).

  • Page 395: Subnetting With Class A And Class B Networks

    ID octets (see Chart J-1) available for subnetting. The following table is a summary for class “B” subnet planning. NO. “BORROWED” HOST BITS IP Subnetting ZyAIR Wireless Gateway Series User’s Guide Chart J-12 Class C Subnet Planning SUBNET MASK NO. SUBNETS 255.255.255.128 (/25)

  • Page 396: Appendix J Ip Subnetting

    ZyAIR Wireless Gateway Series User’s Guide NO. “BORROWED” HOST BITS Chart J-13 Class B Subnet Planning SUBNET MASK NO. SUBNETS 255.255.255.192 (/26) 255.255.255.224 (/27) 255.255.255.240 (/28) 255.255.255.248 (/29) 255.255.255.252 (/30) 255.255.255.254 (/31) NO. HOSTS PER SUBNET 1024 2048 4096 8192...

  • Page 397: Command Syntax

    ZyAIR Wireless Gateway Series User’s Guide Appendix K Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode. See the included disk or zyxel.com for more detailed information on these commands.

  • Page 399: Display Netbios Filter Settings

    NAME LAN to WAN This field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN. NetBIOS Filter Commands ZyAIR Wireless Gateway Series User’s Guide NetBIOS Filter Commands LAN to WAN: WAN to LAN: IPSec Packets:...

  • Page 400: Netbios Filter Configuration

    ZyAIR Wireless Gateway Series User’s Guide NAME WAN to LAN This field displays whether NetBIOS packets are blocked or forwarded from the WAN to the LAN. IPSec This field displays whether NetBIOS packets sent through a VPN Packets connection are blocked or forwarded.

  • Page 401: Appendix M Boot Commands

    Most other commands aid in advanced troubleshooting and should only be used by qualified engineers. Boot Commands ZyAIR Wireless Gateway Series User’s Guide 8192K OK ATSE displays the seed that is used to generate a password to turn on the...
  • Page 402 ZyAIR Wireless Gateway Series User’s Guide just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time...

  • Page 403: The Ideal Setup

    The reply from the WAN goes directly to the computer on the LAN without going through the ZyAIR. As a result, the ZyAIR resets the connection, as the connection has not been acknowledged. Triangle Route ZyAIR Wireless Gateway Series User’s Guide Diagram N-1 Ideal Setup Appendix N Triangle Route...

  • Page 404: The "Triangle Route" Solutions

    ZyAIR Wireless Gateway Series User’s Guide The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Your ZyAIR supports up to three logical LAN interfaces with the ZyAIR being the gateway for each logical network.

  • Page 405: Gateways On The Wan Side

    ZyAIR Wireless Gateway Series User’s Guide Diagram N-3 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyAIR to your LAN.

  • Page 407: Appendix O Log Descriptions

    TELNET Login Successfully TELNET Login Fail Log Descriptions ZyAIR Wireless Gateway Series User’s Guide Log Descriptions Chart O-1 System Error Logs This attempt to create a NAT session exceeds the maximum number of NAT session table entries allowed to be created per host.
  • Page 408 ZyAIR Wireless Gateway Series User’s Guide LOG MESSAGE FTP Login Successfully FTP Login Fail NAT Session Table is Full! LOG MESSAGE UPnP pass through Firewall TYPE CODE Echo Reply Echo reply message Destination Unreachable Net unreachable Host unreachable Protocol unreachable...
  • Page 409 Fragment reassembly time exceeded Parameter Problem Pointer indicates the error Timestamp Timestamp request message Timestamp Reply Timestamp reply message Information Request Information request message Information Reply Information reply message Log Descriptions ZyAIR Wireless Gateway Series User’s Guide Chart O-4 ICMP Notes DESCRIPTION...

  • Page 410: Log Commands

    ZyAIR Wireless Gateway Series User’s Guide LOG MESSAGE Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" msg="<msg>" note="<note>" Log Commands Go to the command interpreter interface (the Command Interpreter Appendix explains how to access and use the commands). Configuring What You Want the ZyAIR to Log Use the sys logs load command to load the log setting buffer that allows you to configure which logs the ZyAIR is to record.

  • Page 411: Log Command Example

    |ACCESS BLOCK Firewall default policy: UDP(set:8) 2|11/11/2002 15:10:11 |172.17.2.1 |ACCESS BLOCK Firewall default policy: IGMP(set:8) 3|11/11/2002 15:10:11 |172.22.3.80:137 |ACCESS BLOCK Firewall default policy: UDP(set:8) Log Descriptions ZyAIR Wireless Gateway Series User’s Guide Displaying Logs source destination |172.22.255.255:137 |172.21.255.255:138 |224.0.1.60 |172.22.255.255:137...
  • Page 412 ZyAIR Wireless Gateway Series User’s Guide 4|11/11/2002 15:10:10 |192.168.10.1:520 |ACCESS BLOCK Firewall default policy: UDP(set:8) 5|11/11/2002 15:10:10 |172.21.4.67:137 |ACCESS BLOCK |192.168.10.255:520 |172.21.255.255:137 Log Descriptions...

  • Page 413: Appendix P Power Adaptor Specifications

    Safety Standards AC Power Adaptor Model Input Power Output Power Power Consumption Safety Standards Power Adaptor Specifications ZyAIR Wireless Gateway Series User’s Guide NORTH AMERICAN PLUG STANDARDS AD48-1201200DUY AC120Volts/60Hz/0.25A DC12Volts/1.2A 10 W UL, CUL (UL 1950, CSA C22.2 No.234-M90) NORTH AMERICAN PLUG STANDARDS...
  • Page 414 ZyAIR Wireless Gateway Series User’s Guide AC Power Adaptor Model Input Power Output Power Power Consumption Safety Standards AUSTRALIA AND NEW ZEALAND PLUG STANDARDS AC Power Adaptor Model Input Power Output Power Power Consumption Safety Standards JAPAN PLUG STANDARDS JOD-48-1124 AC100Volts/ 50/60Hz/ 27VA DC12Volts/1.2A...

  • Page 415: Appendix Q Index

    CA... F-1 Call Control...29-2 Call Filtering ...24-1 Call Filters Built-In...24-1 User-Defined...24-1 Index ZyAIR Wireless Gateway Series User’s Guide Appendix Q Call History ... 29-3, 29-4 Call Scheduling ...31-1 Maximum Number of Schedule Sets...31-1 PPPoE...31-3 Precedence ...31-1 Precedence Example ...See precedence CDR ...27-7...
  • Page 416 ZyAIR Wireless Gateway Series User’s Guide DMZ Setup ... 8-1 DNS ...13-10, 19-3 Domain Name... 3-3, 3-12, 9-6, 23-8 Basics... 11-3 Types ... 11-4 DoS (Denial of Service)...1-4, 24-17 DS ... See Distribution System DSSS...See Direct Sequence Spread Spectrum Dynamic DNS... 1-4, 4-2, 4-3, 18-1, 18-3 Dynamic WEP Key Exchange ...
  • Page 417 Internet access...19-1 Internet Access... 1-5, 17-6, 20-1, 20-2 Internet Access Setup...A-2, 23-1 Index ZyAIR Wireless Gateway Series User’s Guide Internet Control Message Protocol (ICMP) ..11-5 IP Address .. 3-11, 3-12, 5-5, 9-6, 9-7, 16-4, 19-3, 21-9, 24-8, 27-4, 27-8 IP Addressing... J-1 IP Alias Setup...19-5...
  • Page 418 ZyAIR Wireless Gateway Series User’s Guide Management Information Base (MIB)... 13-7 Many to Many No Overload...See NAT Many to Many Overload...See NAT Many to One ...See NAT MD5...F-1 Message Digest Algorithm 5 ... See MD5 Message Integrity Check ... 7-9 Message Logging...
  • Page 419 Smurf ... 11-5, 11-6 SNMP... 9-7, 12-3, 13-6 Configuration ...25-1 Get...13-7 Manager ...13-7 MIBs ...13-8 Index ZyAIR Wireless Gateway Series User’s Guide Trap ...13-8 Trusted Host...25-1 Stateful Inspection...1-4, 11-1, 11-2, 11-7, 11-8, 24-17 Static Route ...10-1 Static Route Setup ...21-7 Static Routing Topology ...21-7...
  • Page 420 ZyAIR Wireless Gateway Series User’s Guide And FTP Over WAN} ... 30-3 Restrictions ... 30-3 TFTP and FTP over WAN Will Not Work When…... 28-4 TFTP and FTP Over WAN} ... 13-1 TFTP File Transfer ... 28-12 TFTP Restrictions...13-1, 28-4 Three-Way Handshake ...

Table of Contents