Enable-IT 8424 802.11g / 802.11b / WPA Wireless Access Point User Manual -IT All Rights Reserved 1997 - 2008 NABLE - Proprietary and Confidential...
Page 2
If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation. If you are unable to locate a copy, please contact Enable-IT, Inc and a copy will be provided to you.
ABLE OF ONTENTS CHAPTER 1 INTRODUCTION ..........................4 Features of your Wireless Access Point ......................4 Package Contents ............................. 6 Physical Details ..............................6 CHAPTER 3 ACCESS POINT SETUP ........................8 Overview ................................8 Setup using the Windows Utility ........................8 Access Control ..............................
Chapter 1 Introduction This Chapter provides an overview of the Wireless Access Point's features and capabilities. Congratulations on the purchase of your new Wireless Access Point. The Wireless Access Point links your 802.11g or 802.11b Wireless Stations to your wired LAN. The Wireless stations and devices on the wired LAN are then on the same network, and can communicate with each other without regard for whether they are connected to the network via a Wireless or wired connection.
Page 5
Security Features • For maximum flexibility, wireless security settings are stored in Security Profiles. Up to 8 Security Profiles. Security profiles can be defined, and up to 4 used as any time. • Because each Security Profile has it own SSID, and up to 4 Security Profiles can be active Multiple SSIDs.
Package Contents The following items should be included: • Wireless Access Point If any of the above items are damaged or missing, please contact your dealer immediately. Physical Details Front Panel LEDs Figure 2: Front Panel Status On - Error condition. Off - Normal operation.
Page 7
Rear Panel Figure 3 Rear Panel Antenna One antenna (aerial) is supplied. Best results are usually obtained with the antenna in a vertical position. Console port DB9 female RS232 port. Reset Button This button has two (2) functions: • Reboot. When pressed and released, the Wireless Access Point will reboot (restart).
Chapter 3 Access Point Setup This Chapter provides details of the Setup process for Basic Operation of your Wireless Access Point. Overview This chapter describes the setup procedure to make the Wireless Access Point a valid device on your LAN, and to function as an Access Point for your Wireless Stations.
Page 9
Description Any extra information for the Wireless Access Point, entered by the administrator. Note: If the desired Wireless Access Point is not listed, check that the device is installed and ON, then update the list by clicking the Refresh button. Buttons Click this button to update the Wireless Access Point device Refresh...
Page 10
Setup Procedure 8. Select the desired Wireless Access Point. 9. Click the Set IP Address button. 10. If prompted, enter the user name and password. The default values are admin for the User Name, and password for the Password. 11. Ensure the IP address, Network Mask, and Gateway are correct for your LAN. Save any changes. 12.
Page 11
Figure 5: Password Dialog 21. You will then see the Status screen, which displays the current settings and status. No data input is possible on this screen. See Chapter 5 for details of the Status screen. From the menu, check the following screens, and configure as necessary for your environment. Details of these screens and settings are described in the following sections of this chapter.
Access Control This feature can be used to block access to your LAN by unknown or untrusted wireless stations. Click Access Control on the menu to view a screen like the following. Figure 6: Access Control Screen Data - Access Control Screen Enable Use this checkbox to Enable or Disable this feature as desired.
Page 13
Trusted Wireless Stations To change the list of trusted wireless stations, use the Modify List button on the Access Control screen. You will see a screen like the sample below. Figure 7: Trusted Wireless Stations Data - Trusted Wireless Stations Trusted Wireless This lists any Wireless Stations which you have designated as...
Clear Clear the Name and Address fields. Security Profiles Security Profiles contain the SSID and all the security settings for Wireless connections to this Access Point. • Up to eight (8) Security Profiles can be defined. • Up to four (4) Security Profiles can be enabled at one time, allowing up to 4 different SSIDs to be used simultaneously.
Primary Profile Select the primary profile for 802.11b and 802.11g (2.4 GHz 802.11b/g AP Mode band) AP mode. Only enabled profiles are listed. The SSID associated with this profile will be broadcast if the "Broadcast SSID" setting on the Basic screen is enabled. 802.11b/g Bridge Select the primary profile for 802.11b and 802.11g (2.4 GHz...
Page 16
Security Settings Select the desired option, and then enter the settings for the selected method. The available options are: • None - No security is used. Anyone using the correct SSID can connect to your network. • WEP - The 802.11b standard. Data is encrypted before transmission, but the encryption system is not very strong.
Page 17
Security Settings - None Figure 10: Wireless Security - None No security is used. Anyone using the correct SSID can connect to your network. The only settings available from this screen are Radius MAC Authentication and UAM (Universal Access Method). Radius MAC Authentication Radius MAC Authentication provides for MAC address checking which is centralized on your Radius server.
Page 18
Radius-based MAC authentication Screen This screen will look different depending on the current security setting. If you have already provided the address of your Radius server, you won't be prompted for it again. Otherwise, you must enter the details of your Radius Server on this screen.
Page 19
UAM (Universal Access Method) is intended for use in Internet cafes, Hot Spots, and other sites where the Access Point is used to provide Internet Access. If enabled, then HTTP (TCP, port 80) connections are checked. (UAM only works on HTTP connections; all other traffic is ignored.) If the user has not been authenticated, Internet access is blocked, and the user is re-directed to another web page.
Page 20
• Clients which pass the authentication are listed as “ ” in the log table, xx:xx:xx:xx:xx:xx WEB authentication and station status would show as “Authenticated” on the station list table. • If a client fails authentication, “ ” is shown in the log, and station xx:xx:xx:xx:xx:xx WEB authentication failed status is shown as “Authenticating”...
Page 21
Figure 13: WEP Wireless Security Data - WEP Screen Data Select the desired option, and ensure your Wireless stations have Encryption the same setting: • 64 Bit Encryption - Keys are 10 Hex (5 ASCII) characters. • 128 Bit Encryption - Keys are 26 Hex (13 ASCII) characters.
Page 22
The current status is displayed. Click the "Configure" button to configure this feature if required. Page 22 of...
Page 23
Security Settings - WPA-PSK Like WEP, data is encrypted before transmission. WPA is more secure than WEP, and should be used if possible. The PSK (Pre-shared Key) must be entered on each Wireless station. The 256Bit encryption key is derived from the PSK, and changes frequently.
Page 24
AES-CCMP and multicast (broadcast) transmissions are encrypted using TKIP. Pairwise Key Update This refers to the key used for point-to-point transmissions. Enable this if you want the keys to be updated regularly. Key Lifetime This field determines how often Pairwise keys are dynamically updated.
System Screen Click System on the menu to view a screen like the following. Figure 15: System Screen Data - System Screen Identification Access Point Enter a suitable name for this Access Point. Name If desired, you can enter a description for the Access Point. Descrip tion Select the country or domain matching your current location.
Wireless Screens There are two (2) configuration screens available: • Basic Settings • Advanced Basic Settings Screen The settings on this screen must match the settings used by Wireless Stations. Click Basic on the menu to view a screen like the following. Figure 16: Basic Settings Screen Data - Basic Settings Screen Operation...
Page 27
Select this option only if all wireless stations support this "Atheros Super G" mode. AP Mode Both Bridge mode and AP mode can be used simultaneously, unless AP mode is "Client/Repeater". Select the desired AP mode: • None (disable) - Disable AP mode. Use this if you want to act a Bridge only.
Page 28
Parameters • Channel No If "Automatic" is selected, the Access Point will select the best available Channel. • If you experience interference (shown by lost connections and/or slow data transfers) you may need to experiment with manually setting different channels to see which is the best. Current This displays the current channel used by the Access Point.
Advanced Settings Clicking the Advanced link on the menu will result in a screen like the following. Figure 17: Advanced Settings Data - Advanced Settings Screen Basic Rate The Basic Rate is used for broadcasting. It does not Basic Rate determine the data transmission rate, which is determined by "Mode"...
Page 30
Output Power Level Select the desired power output. Higher levels will give a greater range, but are also more likely to cause interference with other devices. If your Access Point has only 1 antenna, there is only 1 option Antenna Selection available.
Chapter 4 PC and Server Configuration This Chapter details the PC Configuration required for each PC on the local LAN. Overview All Wireless Stations need to have settings which match the Wireless Access Point. These settings depend on the mode in which the Access Point is being used.
Using WPA-802.1x This is the most secure and most complex system. 802.1x mode provides greater security and centralized management, but it is more complex to configure. Wireless Station Configuration For each of the following items, each Wireless Station must have the same settings as the Wireless Access Point. On each PC, the mode must be set to Infrastructure.
802.1x Server Setup (Windows 2000 Server) This section describes using Microsoft Internet Authentication Server as the Radius Server, since it is the most common Radius Server available that supports the EAP-TLS authentication method. The following services on the Windows 2000 Domain Controller (PDC) are also required: •...
Page 34
Figure 19: Certification Screen 54. Enter the information for the Certificate Authority, and click Next. Figure 20: CA Screen 55. Click Next if you don't want to change the CA's configuration data. 56. Installation will warn you that Internet Information Services are running, and must be stopped before continuing.
Page 35
Figure 21: DHCP Screen 59. Click Next when the New Scope Wizard Begins. 60. Enter the name and description for the scope, click Next. 61. Define the IP address range. Change the subnet mask if necessary. Click Next. Figure 22:IP Address Screen 62.
Page 36
Figure 23: DNS Screen 67. If you don't want a WINS server, just click Next. 68. Select Yes, I want to activate this scope now. Click Next, then Finish. 69. Right-click on the server, and select Authorize. It may take a few minutes to complete. Page 36 of...
Page 37
Certificate Authority Setup 70. Select Start - Programs - Administrative Tools - Certification Authority. 71. Right-click Policy Settings, and select New - Certificate to Issue. Figure 24: Certificate Authority Screen 72. Select Authenticated Session and Smartcard Logon (select more than one by holding down the Ctrl key). Click OK.
Page 38
Figure 26: Active Directory Screen 75. Select the Group Policy tab, choose Default Domain Policy then click Edit. Figure 27: Group Policy Tab 76. Select Computer Configuration - Windows Settings - Security Settings - Public Key Policies, right-click Automatic Certificate Request Settings - New - Automatic Certificate Request. Page 38 of...
Page 39
Figure 28: Group Policy Screen 77. When the Certificate Request Wizard appears, click Next. 78. Select Computer, then click Next. Figure 29: Certificate Template Screen 79. Ensure that your certificate authority is checked, then click Next. 80. Review the policy change information and click Finish. 81.
Page 40
Internet Authentication Service (Radius) Setup 82. Select Start - Programs - Administrative Tools - Internet Authentication Service 83. Right-click on Clients, and select New Client. Figure 30: Service Screen 84. Enter a name for the access point, click Next. 85. Enter the address or name of the Wireless Access Point, and set the shared secret, as entered on the Security Settings of the Wireless Access Point.
Page 41
Figure 32: Authentication Screen 94. Select No if you don't want to view the help for EAP. Click Finish. Page 41 of...
Page 42
Remote Access Login for Users 95. Select Start - Programs - Administrative Tools- Active Directory Users and Computers. 96. Double click on the user who you want to enable. 97. Select the Dial-in tab, and enable Allow access. Click OK. Figure 33: Dial-in Screen Page 42 of...
802.1x Client Setup on Windows XP Windows XP ships with a complete 802.1x client implementation. If using Windows 2000, you can install SP3 (Service Pack 3) to gain the same functionality. If you don't have either of these systems, you must use the 802.1x client software provided with your wireless adapter. Refer to your vendor's documentation for setup instructions.
Page 44
Figure 35: Wireless CA Screen 102. Select User certificate request and select User Certificate, the click Next. 103. Page 44 of...
Page 46
Figure 37: Identifying Information Screen 105. A message will be displayed, then the certificate will be returned to you. Click Install this certificate. Page 46 of...
Page 47
Figure 38:Certificate Issued Screen 106. . You will receive a confirmation message. Click Yes. Figure 39: Root Certificate Screen 107. Certificate setup is now complete. 802.1x Authentication Setup 108. Open the properties for the wireless connection, by selecting Start - Control Panel - Network Connections.
Page 48
110. Select the Authentication Tab, and ensure that Enable network access control using IEEE 802.1X is selected, and Smart Card or other Certificate is selected from the EAP type. Figure 40: Authentication Tab Encryption Settings The Encryption settings must match the APs (Access Points) on the Wireless network you wish to join. •...
Page 49
Figure 41: Wireless Networks Screen 112. Select the wireless network from the Available Networks list, and click Configure. 113. Select and enter the correct values, as advised by your Network Administrator. For example, to use EAP-TLS, you would enable Data encryption, and click the checkbox for the setting The key is provided for me automatically, as shown below.
Page 50
Figure 42: Properties Screen Setup for Windows XP and 802.1x client is now complete. Page 50 of...
Using 802.1x Mode (without WPA) This is very similar to using WPA-802.1x. The only difference is that on your client, you must NOT enable the setting The key is provided for me automatically. Instead, you must enter the WEP key manually, ensuring it matches the WEP key used on the Access Point. Figure 43: Properties Screen Page 51 of...
Using WPA-PSK For each of the following items, each Wireless Station must have the same settings as the Wireless Access Point. Mode On each PC, the mode must be set to Infrastructure. SSID (ESSID) This must match the value used on the Wireless Access Point. The default value is wireless Note! The SSID is case sensitive.
Using WPA-802.1x This is the most secure and most complex system. 802.1x mode provides greater security and centralized management, but it is more complex to configure. Wireless Station Configuration For each of the following items, each Wireless Station must have the same settings as the Wireless Access Point. On each PC, the mode must be set to Infrastructure.
802.1x Server Setup (Windows 2000 Server) This section describes using Microsoft Internet Authentication Server as the Radius Server, since it is the most common Radius Server available that supports the EAP-TLS authentication method. The following services on the Windows 2000 Domain Controller (PDC) are also required: •...
Page 55
Figure 45: Certification Screen 121. Enter the information for the Certificate Authority, and click Next. Figure 46: CA Screen 122. Click Next if you don't want to change the CA's configuration data. 123. Installation will warn you that Internet Information Services are running, and must be stopped before continuing.
Page 56
Figure 47: DHCP Screen 126. Click Next when the New Scope Wizard Begins. 127. Enter the name and description for the scope, click Next. 128. Define the IP address range. Change the subnet mask if necessary. Click Next. Figure 48:IP Address Screen 129.
Page 57
Figure 49: DNS Screen 134. If you don't want a WINS server, just click Next. 135. Select Yes, I want to activate this scope now. Click Next, then Finish. 136. Right-click on the server, and select Authorize. It may take a few minutes to complete. Page 57 of...
Page 58
Certificate Authority Setup 137. Select Start - Programs - Administrative Tools - Certification Authority. 138. Right-click Policy Settings, and select New - Certificate to Issue. Figure 50: Certificate Authority Screen 139. Select Authenticated Session and Smartcard Logon (select more than one by holding down the Ctrl key). Click OK.
Page 59
Figure 52: Active Directory Screen 142. Select the Group Policy tab, choose Default Domain Policy then click Edit. Figure 53: Group Policy Tab 143. Select Computer Configuration - Windows Settings - Security Settings - Public Key Policies, right-click Automatic Certificate Request Settings - New - Automatic Certificate Request. Page 59 of...
Page 60
Figure 54: Group Policy Screen 144. When the Certificate Request Wizard appears, click Next. 145. Select Computer, then click Next. 146. Figure 55: Certificate Template Screen 147. Ensure that your certificate authority is checked, then click Next. 148. Review the policy change information and click Finish. 149.
Page 61
Internet Authentication Service (Radius) Setup 150. Select Start - Programs - Administrative Tools - Internet Authentication Service 151. Right-click on Clients, and select New Client. Figure 56: Service Screen 152. Enter a name for the access point, click Next. 153. Enter the address or name of the Wireless Access Point, and set the shared secret, as entered on the Security Settings of the Wireless Access Point.
Page 62
Figure 58: Authentication Screen 161. Select No if you don't want to view the help for EAP. Click Finish. Page 62 of...
Page 63
Remote Access Login for Users 162. Select Start - Programs - Administrative Tools- Active Directory Users and Computers. 163. Double click on the user who you want to enable. 164. Select the Dial-in tab, and enable Allow access. Click OK. Figure 59: Dial-in Screen Page 63 of...
802.1x Client Setup on Windows XP Windows XP ships with a complete 802.1x client implementation. If using Windows 2000, you can install SP3 (Service Pack 3) to gain the same functionality. If you don't have either of these systems, you must use the 802.1x client software provided with your wireless adapter. Refer to your vendor's documentation for setup instructions.
Page 65
Figure 61: Wireless CA Screen 169. Select User certificate request and select User Certificate, the click Next. Page 65 of...
Page 67
Figure 63: Identifying Information Screen 171. A message will be displayed, then the certificate will be returned to you. Click Install this certificate. Page 67 of...
Page 68
Figure 64:Certificate Issued Screen 172. . You will receive a confirmation message. Click Yes. 173. Figure 65: Root Certificate Screen 174. Certificate setup is now complete. 802.1x Authentication Setup 175. Open the properties for the wireless connection, by selecting Start - Control Panel - Network Connections.
Page 69
177. Select the Authentication Tab, and ensure that Enable network access control using IEEE 802.1X is selected, and Smart Card or other Certificate is selected from the EAP type. Figure 66: Authentication Tab Encryption Settings The Encryption settings must match the APs (Access Points) on the Wireless network you wish to join. •...
Page 70
Figure 67: Wireless Networks Screen 179. Select the wireless network from the Available Networks list, and click Configure. 180. Select and enter the correct values, as advised by your Network Administrator. For example, to use EAP-TLS, you would enable Data encryption, and click the checkbox for the setting The key is provided for me automatically, as shown below.
Page 71
Figure 68: Properties Screen Setup for Windows XP and 802.1x client is now complete. Page 71 of...
Using 802.1x Mode (without WPA) This is very similar to using WPA-802.1x. The only difference is that on your client, you must NOT enable the setting The key is provided for me automatically. Instead, you must enter the WEP key manually, ensuring it matches the WEP key used on the Access Point. Figure 69: Properties Screen Note: On some systems, the "64 bit"...
Page 74
Data - Status Screen Access Point Access Point Name The current name will be displayed. MAC Address The MAC (physical) address of the Wireless Access Point. Domain The region or domain, as selected on the Basic Wireless screen. Firmware Version The version of the firmware currently installed.
Page 75
Statistics Screen This screen is displayed when the 2.4GHz Statistics button on the Status screen is clicked. It shows details of the traffic flowing through the Wireless Access Point. Figure 71: Statistics Screen Data - Statistics Screen System Up Time System Up Time This indicates how long the system has been running since the last restart or reboot.
Page 76
Profile Status The Profile Status screen is displayed when the Profile Status button on the Status screen is clicked. Figure 72: Profile Screen For each profile, the following data is displayed: Name The name you gave to this profile; if you didn't change the name, the default name is used.
Page 77
Activity Log This screen is displayed when the Log button on the Status screen is clicked. Figure 73: Activity Log Screen Data - Activity Log Data The system date and time is displayed. Current Time The Log shows details of the connections to the Wireless Access Point.
Station List This screen is displayed when the Stations button on the Status screen is clicked. Figure 74 Station List Screen Data - Station List Screen Station List Name The name of each Wireless Station is displayed. If the name is not know, "unknown"...
Page 79
Figure 75: Admin Login Screen Data - Admin Login Screen Login Enter the login name for the Administrator. User Name Change Admin If you wish to change the Admin password, check this field Password and enter the new login password in the fields below. New Password Enter the desired login password.
Auto Config/Update The Auto Config/Update screen provides two (2) features: • Auto Config - The Access Point will configure itself by copying data from another (compatible) Access Point. • Auto Update - The Access Point will update it Firmware by downloading the Firmware file from your FTP Server.
Page 81
Auto Update If enabled, this AP will check to see if a Firmware (FW) Check Firmware upgrade upgrade is available on the specified FTP Server. If enabled: • Enter the desired time interval (in days) between checks. • Select the desired option for installation (see next item).
Config File This screen allows you to Backup (download) the configuration file, and to restore (upload) a previously-saved configuration file. You can also set the Wireless Access Point back to its factory default settings. To reach this screen, select Config File in the Management section of the menu. Figure 77: Config File Screen Data - Config File Screen Backup...
Log Settings (Syslog) If you have a Syslog Server on your LAN, this screen allows you to configure the Access Point to send log data to your Syslog Server. Figure 78: Log Settings (Syslog) Screen Data - Log Settings Screen Select the desired Option: Syslog Server •...
Rogue APs A "Rouge AP" is an Access Point which should not be in use, and so can be considered to be providing unauthorized access to your LAN. This Access Point can assist to locate 2 types of Rogue APs: •...
SNMP SNMP (Simple Network Management Protocol) is only useful if you have a SNMP program on your PC. To reach this screen, select SNMP in the Management section of the menu. Figure 80: SNMP Screen Data - SNMP Screen General Enable SNMP Use this to enable or disable SNMP as required Community...
Upgrade Firmware The firmware (software) in the Wireless Access Point can be upgraded using your Web Browser. You must first download the upgrade file, and then select Upgrade Firmware in the Management section of the menu. You will see a screen like the following. Figure 81: Firmware Upgrade Screen To perform the Firmware Upgrade: 184.
Page 87
Maximum Receive Level min. -5dBm Transmit Power 18 dBm Modulation Direct Sequence Spread Spectrum BPSK / QPSK / Throughput Up to 19 Mbps Operating Range Indoors • 30 Meters (100ft.) @ 11Mbps • 50 Meters (165ft.) @ 5.5Mbps • 70 Meters (230ft.) @ 2Mbps •...
Page 88
• Configuration file Backup/Restore • Statistics support • Device discovery program • Windows Utility • Other Features DHCP client • WINS client Firmware Upgrade HTTP, FTP network protocol download Page 88 of...
FCC Statement This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.
Page 90
If authorized by Enable-IT to return a Product which does not conform to the warranty set forth above, the End User must: (1) obtain a return materials authorization (RMA) number from Enable-IT by contacting the Customer Service Dept.
Page 91
Remedies for Breach of Warranty In the event of a breach of the foregoing warranty, Enable-IT will, in its sole discretion and at its cost and subject to the terms of the following paragraph, repair the non-conforming Product, replace the non-conforming Product with a new or reconditioned Product or refund of the purchase price for the Product.
Page 92
Enable-IT; (ii) modification (including but not limited to opening the Product housing) or repair by any party in any manner other than as approved by Enable-IT in writing; (iii) fraud, tampering, unusual physical or electrical stress, unsuitable operating or physical conditions, negligence or accidents;...
Page 93
Enable-IT and/or its licensors. You acknowledge and agree that you may not, and may not allow any...
Need help?
Do you have a question about the 8424 and is the answer not in the manual?
Questions and answers