Page 1 NWA5120 Series 802.11 a/b/g/n Unified Access Point Version 2.25 Edition 1, 01/2013 Quick Start Guide User’s Guide Default Login Details LAN IP Address http://192.168.1.2 User Name admin Password 1234 www.zyxel.com Copyright © 2013 ZyXEL Communications Corporation...
Page 2 IMPORTANT! READ CAREFULLY BEFORE USE. KEEP THIS GUIDE FOR FUTURE REFERENCE. This is a User’s Guide for a series of products. Not all products support all firmware features. Screenshots and graphics in this book may differ slightly from your product due to differences in your product firmware or your computer operating system.
Page 3: Table Of Contents
Dashboard ...............................33 Monitor ..............................39 LAN Setting .............................51 Wireless ..............................53 User .................................65 AP Profile ..............................73 MON Profile .............................91 Certificates ..............................95 System ..............................113 Log and Report .............................139 File Manager ............................151 Diagnostics ............................163 Reboot ..............................165 Shutdown ..............................167 Troubleshooting ............................169 NWA5120 Series User’s Guide...
Page 4 Contents Overview NWA5120 Series User’s Guide...
Page 5: Table Of Contents
2.3.3 Warning Messages ........................27 2.3.4 Tables and Lists ........................27 Part II: Technical Reference................31 Chapter 3 Dashboard ............................33 3.1 Overview ............................33 3.1.1 What You Can Do in this Chapter ....................33 3.2 Dashboard ............................33 3.2.1 CPU Usage ..........................36 NWA5120 Series User’s Guide...
Page 6 7.1 Overview ............................65 7.1.1 What You Can Do in this Chapter ....................65 7.1.2 What You Need To Know ......................65 7.2 User Summary ..........................66 7.2.1 Add/Edit User ..........................66 7.3 Setting ..............................68 7.3.1 Edit User Authentication Timeout Settings ................70 NWA5120 Series User’s Guide...
Page 7 System ............................... 113 11.1 Overview ............................113 11.1.1 What You Can Do in this Chapter ..................113 11.2 Host Name ............................ 113 11.3 Date and Time ..........................114 11.3.1 Pre-defined NTP Time Servers List ..................116 NWA5120 Series User’s Guide...
Page 8 13.1.2 What you Need to Know ......................151 13.2 Configuration File ..........................152 13.2.1 Example of Configuration File Download Using FTP ............156 13.3 Firmware Package ........................157 13.3.1 Example of Firmware Upload Using FTP ................159 13.4 Shell Script ...........................159 NWA5120 Series User’s Guide...
Page 9 17.3 NWA Access and Login ........................170 17.4 Internet Access ..........................171 17.5 Wireless Connections ........................172 17.6 Resetting the NWA ........................175 17.7 Getting More Troubleshooting Help ....................175 Appendix A Importing Certificates ....................177 Appendix B Legal Information......................191 Index ..............................197 NWA5120 Series User’s Guide...
Page 10 Table of Contents NWA5120 Series User’s Guide...
Page 11: User's Guide
User’s Guide...
Page 13: Introduction
802.1x, Wi-Fi Protected Access (WPA), WPA2 and Wired Equivalent Privacy (WEP) data encryption. Your NWA is easy to install, configure and use. The embedded Web-based configurator enables simple, straightforward management and maintenance. See the Quick Start Guide for how to make hardware connections. NWA5120 Series User’s Guide...
Page 14: Mbssid
(LAN) behind the AP and can access only the Internet. Figure 1 Multiple BSSs 1.1.2 Dual-Radio The NWA5123-NI is equipped with dual wireless radios. This means you can configure two different wireless networks to operate simultaneously. NWA5120 Series User’s Guide...
Page 15: Management Mode
AP mode, you need to check the AP controller for the NWA’s IP address and use FTP to upload firmware. 1.2 Ways to Manage the NWA You can use the following ways to manage the NWA. NWA5120 Series User’s Guide...
Page 16: Good Habits For Managing The Nwa
NWA to its factory default settings. If you backed up an earlier configuration file, you won’t have to totally re-configure the NWA; you can simply restore your last configuration. 1.4 Hardware Connections See your Quick Start Guide for information on making hardware connections. NWA5120 Series User’s Guide...
Page 17: Leds
The WLAN is active. Blinking The WLAN is active, and transmitting or receiving data. The WLAN is not active. 1.6 Starting and Stopping the NWA Here are some of the ways to start and stop the NWA. NWA5120 Series User’s Guide...
Page 18 It does not stop the system processes or write cached data to local storage. The NWA does not stop or start the system processes when you apply configuration files or run shell scripts although you may temporarily lose access to network resources. NWA5120 Series User’s Guide...
Page 19: The Web Configurator
The recommended screen resolution is 1024 x 768 pixels and higher. 2.2 Access Make sure your NWA hardware is properly connected. See the Quick Start Guide. Browse to https://192.168.1.2. The Login screen appears. Enter the user name (default: “admin”) and password (default: “1234”). NWA5120 Series User’s Guide...
Page 20 Otherwise, the dashboard appears. The Update Admin Info screen appears every time you log in using the default user name and default password. If you change the password for the default user account, this screen does not appear anymore. NWA5120 Series User’s Guide...
Page 21: Navigating The Web Configurator
• C - Main Window 2.3.1 Title Bar The title bar provides some useful links that always appear over the screens below, regardless of how deep into the Web Configurator you navigate. Figure 5 Title Bar NWA5120 Series User’s Guide...
Page 22 This shows the version number of the software that handles the booting process of the NWA. Current Version This shows the firmware version of the NWA. Released Date This shows the date (yyyy-mm-dd) and time (hh:mm:ss) when the firmware is released. Click this to close the screen. NWA5120 Series User’s Guide...
Page 23 Figure 7 Site Map Object Reference Click Object Reference to open the Object Reference screen. Select the type of object and the individual object and click Refresh to show which configuration settings reference the object. Figure 8 Object Reference NWA5120 Series User’s Guide...
Page 24: Navigation Panel
Use the menu items on the navigation panel to open screens to configure NWA features. Click the arrow in the middle of the right edge of the navigation panel to hide the navigation panel menus or NWA5120 Series User’s Guide...
Page 25: Configuration Menu
Use the configuration menu screens to configure the NWA’s features. Table 9 Configuration Menu Screens Summary FOLDER OR LINK FUNCTION LAN Setting Manage the LAN Ethernet interface including VLAN settings. Wireless AP Management Edit wireless AP information, remove APs, and reboot them. NWA5120 Series User’s Guide...
Page 26 Firmware Package View the current firmware version and to upload firmware. Shell Script Manage and run shell script files for the NWA. Diagnostics Diagnostic Collect diagnostic information. Reboot Restart the NWA. Shutdown Turn off the NWA. NWA5120 Series User’s Guide...
Page 27: Warning Messages
The options available vary depending on the type of fields in the column. Here are some examples of what you can do: • Sort in ascending alphabetical order • Sort in descending (reverse) alphabetical order • Select which columns to display • Group entries by field • Show entries in groups NWA5120 Series User’s Guide...
Page 28 Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. NWA5120 Series User’s Guide...
Page 29 In some lists you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list. Figure 12 Working with Lists NWA5120 Series User’s Guide...
Page 30 Chapter 2 The Web Configurator NWA5120 Series User’s Guide...
Page 31: Technical Reference
Technical Reference...
Page 33: Dashboard
Dashboard icon in the navigation panel. The Dashboard displays general device information, system status, system resource usage, and interface status in widgets that you can re- arrange to suit your needs. You can also collapse, refresh, and close individual widgets. Figure 13 Dashboard NWA5120 Series User’s Guide...
Page 34 This field displays the current date and time in the NWA. The format is yyyy-mm-dd Time hh:mm:ss. Current Login This field displays the user name used to log in to the current session, the amount of User reauthentication time remaining, and the amount of lease time remaining. NWA5120 Series User’s Guide...
Page 35 This displays status information for the WLAN interface. Status Summary Status This displays whether or not the WLAN interface is activated. MAC Address This displays the MAC address of the radio. Radio This indicates the radio number on the NWA. NWA5120 Series User’s Guide...
Page 36: Cpu Usage
The x-axis shows the time period over which the CPU usage occurred Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. NWA5120 Series User’s Guide...
Page 37: Memory Usage
The x-axis shows the time period over which the RAM usage occurred Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. NWA5120 Series User’s Guide...
Page 38 Chapter 3 Dashboard NWA5120 Series User’s Guide...
Page 39: Monitor
Friendly APs are other wireless access points that are detected in your network, as well as any others that you know are not a threat (those from neighboring networks, for example). See Chapter 9 on page 91 for details. NWA5120 Series User’s Guide...
Page 40: Lan Status
IP address (if it is a backup). IP Assignment This field displays how the interface gets its IP address. Static - This interface has a static IP address. DHCP Client - This interface gets its IP address from a DHCP server. NWA5120 Series User’s Guide...
Page 41 Up Time This field displays how long the physical port has been connected. System Up Time This field displays how long the NWA has been running since it last restarted or was turned NWA5120 Series User’s Guide...
Page 42: Lan Status Graph
This line represents the traffic received by the NWA on the physical port since it was last connected. Last Update This field displays the date and time the information in the window was last updated. NWA5120 Series User’s Guide...
Page 43: Radio List
This displays the total number of packets transmitted by the radio. Rx FCS Error This indicates the number of received packet errors accrued by the radio. Count Tx Retry Count This indicates the number of times the radio has attempted to re-transmit packets. NWA5120 Series User’s Guide...
Page 44: Ap Mode Radio Information
24 hours. To access this window, select a radio and click the More Information button in the Radio List screen. Figure 19 Monitor > Wireless > AP Information > Radio List > More Information NWA5120 Series User’s Guide...
Page 45: Station List
4.5 Station List Use this screen to view statistics pertaining to the associated stations (or “wireless clients”). Click Monitor > Wireless > Station Info to access this screen. Figure 20 Monitor > Wireless > Station Info NWA5120 Series User’s Guide...
Page 46: Rogue Ap
Click this button to mark the selected AP as a friendly AP. For more on managing friendly APs, see the Configuration > Wireless > MON Mode screen (Section 6.3 on page 55). This is the detected device’s index number in this list. NWA5120 Series User’s Guide...
Page 47: View Log
To access this screen, click Monitor > Log. The log is displayed in the following screen. Note: When a log reaches the maximum number of log messages, new log messages automatically overwrite existing log messages, starting with the oldest existing log message first. NWA5120 Series User’s Guide...
Page 48 Category is Debug Log. Source Address This displays when you show the filter. Type the source IP address of the incoming packet that generated the log message. Do not include the port in this filter. NWA5120 Series User’s Guide...
Page 49 This field displays the destination IP address and the port number of the event that generated the log message. Note This field displays any additional information about the log message. The Web Configurator saves the filter settings if you leave the View Log screen and return to it later. NWA5120 Series User’s Guide...
Page 50 Chapter 4 Monitor NWA5120 Series User’s Guide...
Page 51: Lan Setting
5.1.1 What You Can Do in this Chapter The LAN Setting screen (Section 5.2 on page 52) configures the NWA’s LAN IP address and VLAN settings. NWA5120 Series User’s Guide...
Page 52: Lan Setting
Select this option to treat this VLAN ID as a VLAN created on the NWA and not one assigned to it from outside the network. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 53: Wireless
AP list. • The Load Balancing screen (Section 6.4 on page 57) configures network traffic load balancing between the APs and the NWA. • The DCS screen (Section 6.5 on page 60) configures dynamic radio channel selection. NWA5120 Series User’s Guide...
Page 54: What You Need To Know
AP does not become overloaded. 6.2 AP Management Use this screen to manage the NWA’s general wireless settings. Click Configuration > Wireless > AP Management to access this screen. Figure 26 Configuration > Wireless > AP Management NWA5120 Series User’s Guide...
Page 55: Mon Mode
Use this screen to assign APs either to the rogue AP list or the friendly AP list. A rogue AP is a wireless access point operating in a network’s coverage area that is not under the control of the network administrator, and which can potentially open up holes in a network’s security. NWA5120 Series User’s Guide...
Page 56 Click this button to export the current list of either rogue APs or friendly APS. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 57: Add/Edit Rogue/Friendly List
6.4 Load Balancing Use this screen to configure wireless network traffic load balancing between the APs on your network. Click Configuration > Wireless > Load Balancing to access this screen. Figure 29 Configuration > Wireless > Load Balancing NWA5120 Series User’s Guide...
Page 58: Disassociating And Delaying Connections
For example, here the AP has a balanced bandwidth allotment of 6 Mbps. If laptop R connects and it pushes the AP over its allotment, say to 7 Mbps, then the AP delays the red laptop’s connection NWA5120 Series User’s Guide...
Page 59 If no connections are idle, the next criteria the NWA analyzes is signal strength. Devices with the weakest signal strength are kicked first. NWA5120 Series User’s Guide...
Page 60: Dcs
If the channel on which it is currently broadcasting suddenly comes into use by another AP, the NWA will then dynamically select the next available clean channel or a channel with lower interference. NWA5120 Series User’s Guide...
Page 61 Available channels list and use the right arrow button to move them to the Channels selected list. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 62: Technical Reference
1, 4, 7 and 11. While they are situated sufficiently close to both each other and the three so-called “safe” channels (1,6 and 11) that interference becomes inevitable, the severity of it is dependent upon other factors: proximity to the affected AP, signal strength, activity, and so on. NWA5120 Series User’s Guide...
Page 63 AP has the bandwidth to spare. If too many people connect and the AP hits its bandwidth cap then all new connections must basically wait for their turn or get shunted to the nearest identical AP. NWA5120 Series User’s Guide...
Page 64 Chapter 6 Wireless NWA5120 Series User’s Guide...
Page 65: User
Perform basic diagnostics (CLI) Access Users user Used for the embedded RADIUS server and SNMPv3 user access Browse user-mode commands (CLI) Note: The default admin account is always authenticated locally, regardless of the authentication method setting. NWA5120 Series User’s Guide...
Page 66: User Summary
The User Add/Edit screen allows you to create a new user account or edit an existing one. 7.2.1.1 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only contain the following characters: NWA5120 Series User’s Guide...
Page 67 • shutdown • sshd • sync • uucp • zyxel To access this screen, go to the User screen, and click Add or Edit. Figure 37 Configuration > Object > User > Add/Edit A User NWA5120 Series User’s Guide...
Page 68: Setting
Click OK to save your changes back to the NWA. Cancel Click Cancel to exit this screen without saving your changes. 7.3 Setting This screen controls default settings, login settings, lockout settings, and other user settings for the NWA. NWA5120 Series User’s Guide...
Page 69 This is the default lease time in minutes for each type of user account. It defines the number of minutes the user has to renew the current session before the user is logged out. Admin users renew the session every time the main screen refreshes in the Web Configurator. NWA5120 Series User’s Guide...
Page 70: Edit User Authentication Timeout Settings
To access this screen, go to the Configuration > Object > User > Setting screen, select one of the Default Authentication Timeout Settings entry and click the Edit icon. Figure 39 User > Setting > Edit User Authentication Timeout Settings NWA5120 Series User’s Guide...
Page 71 0 to make the number of minutes unlimited. Unlike Lease Time, the user has no opportunity to renew the session without logging out. Click OK to save your changes back to the NWA. Cancel Click Cancel to exit this screen without saving your changes. NWA5120 Series User’s Guide...
Page 72 Chapter 7 User NWA5120 Series User’s Guide...
Page 73: Ap Profile
The SSID (Service Set IDentifier) is the name that identifies the Service Set with which a wireless station is associated. Wireless stations associating to the access point (AP) must have the same SSID. In other words, it is the name of the wireless network that clients use to connect to it. NWA5120 Series User’s Guide...
Page 74: Radio
The following table describes the labels in this screen. Table 34 Configuration > Object > AP Profile > Radio LABEL DESCRIPTION Click this to add a new radio profile. Edit Click this to edit the selected radio profile. NWA5120 Series User’s Guide...
Page 75 This field indicates the name assigned to the radio profile. Frequency Band This field indicates the frequency band which this radio profile is configured to use. Channel ID This field indicates the broadcast channel which this radio profile is configured to use. NWA5120 Series User’s Guide...
Page 76: Add/Edit Radio Profile
This screen allows you to create a new radio profile or edit an existing one. To access this screen, click the Add button or select a radio profile from the list and click the Edit button. Figure 41 Configuration > Object > AP Profile > Add/Edit Profile NWA5120 Series User’s Guide...
Page 77 Message Protocol Data Unit (MPDU) aggregation collects Ethernet frames along with their 802.11n headers and wraps them in a 802.11n MAC header. This method is useful for increasing bandwidth throughput in environments that are prone to high error rates. NWA5120 Series User’s Guide...
Page 78 MCS Rate - Set the MCS rate configuration. EEE 802.11n supports many different data rates which are called MCS rates. MCS stands for Modulation and Coding Scheme. This is an 802.11n feature that increases the wireless network performance in terms of throughput. NWA5120 Series User’s Guide...
Page 79: Ssid
(such as the WiFi adapter in a laptop), and is displayed as the wireless network name when a person makes a connection to it. To access this screen click Configuration > Object > AP Profile > SSID. NWA5120 Series User’s Guide...
Page 80 This field indicates which (if any) MAC filter Profile is associated with the SSID profile. Profile Layer-2 Isolation This field indicates which (if any) layer-2 isolation Profile is associated with the SSID Profile profile. VLAN ID This field indicates the VLAN ID associated with the SSID profile. NWA5120 Series User’s Guide...
Page 81 MAC filtering allows you to limit the wireless clients connecting to your network through a particular SSID by wireless client MAC addresses. Any clients that have MAC addresses not in the MAC filtering profile of allowed addresses are denied connections. The disable setting means no MAC filtering is used. NWA5120 Series User’s Guide...
Page 82: Security List
This screen allows you to manage wireless security configurations that can be used by your SSIDs. Wireless security is implemented strictly between the AP broadcasting the SSID and the stations that are connected to it. To access this screen click Configuration > Object > AP Profile > SSID > Security List. NWA5120 Series User’s Guide...
Page 83 This screen allows you to create a new security profile or edit an existing one. To access this screen, click the Add button or select a security profile from the list and click the Edit button. NWA5120 Series User’s Guide...
Page 84 Chapter 8 AP Profile Note: This screen’s options change based on the Security Mode selected. Only the default screen is displayed here. Figure 45 SSID > Security Profile > Add/Edit Security Profile NWA5120 Series User’s Guide...
Page 85 Enter 26 hexadecimal digits in the range of “A-F”, “a-f” and “0-9” (for example, 0x00112233445566778899AABBCC) for each Key used. • Enter 13 ASCII characters (case sensitive) ranging from “a-z”, “A-Z” and “0-9” (for example, MyKey12345678) for each Key used. NWA5120 Series User’s Guide...
Page 86: Mac Filter List
SSIDs. To access this screen click Configuration > Object > AP Profile > SSID > MAC Filter List. Note: You can have a maximum of 32 MAC filtering profiles on the NWA. Figure 46 Configuration > Object > AP Profile > SSID > MAC Filter List NWA5120 Series User’s Guide...
Page 87 Filter Action Select allow to permit the wireless client with the MAC addresses in this profile to connect to the network through the associated SSID; select deny to block the wireless clients with the specified MAC addresses. NWA5120 Series User’s Guide...
Page 88: Layer-2 Isolation List
NWA’s wireless clients except for broadcast packets. Layer-2 isolation does not check the traffic between wireless clients that are associated with the same AP. Intra-BSS traffic allows wireless clients associated with the same AP to communicate with each other. NWA5120 Series User’s Guide...
Page 89 This screen allows you to create a new layer-2 isolation profile or edit an existing one. To access this screen, click the Add button or select a layer-2 isolation profile from the list and click the Edit button. NWA5120 Series User’s Guide...
Page 90 Enter up to 60 characters, spaces and underscores allowed. Click OK to save your changes back to the NWA. Cancel Click Cancel to exit this screen without saving your changes. NWA5120 Series User’s Guide...
Page 91: Mon Profile
Click this to add a new monitor mode profile. Edit Click this to edit the selected monitor mode profile. Remove Click this to remove the selected monitor mode profile. Activate To turn on an entry, select it and click Activate. NWA5120 Series User’s Guide...
Page 92: Add/Edit Mon Profile
This screen allows you to create a new monitor mode profile or edit an existing one. To access this screen, click the Add button or select and existing monitor mode profile and click the Edit button. Figure 52 Configuration > Object > MON Profile > Add/Edit MON Profile NWA5120 Series User’s Guide...
Page 93: Technical Reference
Rogue APs are wireless access points operating in a network’s coverage area that are not under the control of the network’s administrators, and can open up holes in a network’s security. Attackers can take advantage of a rogue AP’s weaker (or non-existent) security to gain access to the network, NWA5120 Series User’s Guide...
Page 94 (those from recognized networks, for example). It is recommended that you export (save) your list of friendly APs often, especially if you have a network with a large number of access points. NWA5120 Series User’s Guide...
Page 95: Certificates
Jenny receives the message and uses Tim’s public key to verify it. Jenny knows that the message is from Tim, and that although other people may have been able to read the message, no-one can have altered it (because they cannot re-sign the message with Tim’s private key). NWA5120 Series User’s Guide...
Page 96 The NWA currently allows the importation of a PKS#7 file that contains a single certificate. • PEM (Base-64) encoded PKCS#7: This Privacy Enhanced Mail (PEM) format uses lowercase letters, uppercase letters and numerals to convert a binary PKCS#7 certificate into a printable form. NWA5120 Series User’s Guide...
Page 97: Verifying A Certificate
Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. NWA5120 Series User’s Guide...
Page 98: My Certificates
Use the My Certificate Import screen to import the certificate and replace the request. SELF represents a self-signed certificate. CERT represents a certificate issued by a certification authority. NWA5120 Series User’s Guide...
Page 99 Expired! message if the certificate has expired. Import Click Import to open a screen where you can save a certificate to the NWA. Refresh Click Refresh to display the current validity status of the certificates. NWA5120 Series User’s Guide...
Page 100: Add My Certificates
Add My Certificates screen. Use this screen to have the NWA create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request. Figure 55 Configuration > Object > Certificate > My Certificates > Add NWA5120 Series User’s Guide...
Page 101 Certificate Edit screen to view the certification request and copy it to send to the locally for later certification authority. manual enrollment Copy the certification request from the My Certificate Edit screen and then send it to the certification authority. NWA5120 Series User’s Guide...
Page 102 Add My Certificates screen. Click Return and check your information in the Add My Certificates screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the NWA to enroll a certificate online. NWA5120 Series User’s Guide...
Page 103: Edit My Certificates
Click Configuration > Object > Certificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificate’s name. Figure 56 Configuration > Object > Certificate > My Certificates > Edit NWA5120 Series User’s Guide...
Page 104 This field displays general information about the certificate. For example, Subject Type=CA means that this is a certification authority’s certificate and “Path Length Constraint=1” means that there can only be one certification authority in the certificate’s path. This field does not display for a certification request. NWA5120 Series User’s Guide...
Page 105: Import Certificates
Note: You can import a certificate that matches a corresponding certification request that was generated by the NWA. You can also import a certificate in PKCS#12 format, including the certificate’s public and private keys. The certificate you import replaces the corresponding request in the My Certificates screen. NWA5120 Series User’s Guide...
Page 106: Trusted Certificates
Click Configuration > Object > Certificate > Trusted Certificates to open the Trusted Certificates screen. This screen displays a summary list of certificates that you have set the NWA to accept as trusted. The NWA also accepts any valid certificate signed by a certificate on this list as NWA5120 Series User’s Guide...
Page 107 Click Import to open a screen where you can save the certificate of a certification authority that you trust, from your computer to the NWA. Refresh Click this button to display the current validity status of the certificates. NWA5120 Series User’s Guide...
Page 108: Edit Trusted Certificates
NWA to check a certification authority’s list of revoked certificates before trusting a certificate issued by the certification authority. Figure 59 Configuration > Object > Certificate > Trusted Certificates > Edit NWA5120 Series User’s Guide...
Page 109 Common Name (CN), Organizational Unit (OU), Organization (O) and Country (C). Issuer This field displays identifying information about the certificate’s issuing certification authority, such as Common Name, Organizational Unit, Organization and Country. With self-signed certificates, this is the same information as in the Subject Name field. NWA5120 Series User’s Guide...
Page 110: Import Trusted Certificates
10.3.2 Import Trusted Certificates Click Configuration > Object > Certificate > Trusted Certificates > Import to open the Import Trusted Certificates screen. Follow the instructions in this screen to save a trusted certificate to the NWA. NWA5120 Series User’s Guide...
Page 111: Technical Reference
The second is a reduction in network traffic since the NWA only gets information on the certificates that it needs to verify, not a huge list. When the NWA requests certificate status information, the OCSP server returns a “expired”, “current” or “unknown” response. NWA5120 Series User’s Guide...
Page 112 Chapter 10 Certificates NWA5120 Series User’s Guide...
Page 113: System
11.2 Host Name A host name is the unique name by which a device is known on a network. Click Configuration > System > Host Name to open this screen. Figure 61 Configuration > System > Host Name NWA5120 Series User’s Guide...
Page 114: Date And Time
> Date/Time. The screen displays as shown. You can manually set the NWA’s time and date or have the NWA get the date and time from a time server. Figure 62 Configuration > System > Date/Time NWA5120 Series User’s Guide...
Page 115 Sunday, March. The time you type in the at field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). NWA5120 Series User’s Guide...
Page 116: Pre-Defined Ntp Time Servers List
Click the Sync. Now button to get the time and date from the time server you specified in the Time Server Address field. When the Loading message appears, you may have to wait up to one minute. Figure 63 Loading NWA5120 Series User’s Guide...
Page 117 Click System > Date/Time. Select Get from Time Server under Time and Date Setup. Under Time Zone Setup, select your Time Zone from the list. Under Time and Date Setup, enter a Time Server Address. Click Apply. NWA5120 Series User’s Guide...
Page 118: Www Overview
(one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys (see Chapter 10 on page 95 for more information). NWA5120 Series User’s Guide...
Page 119 HTTP connection requests from a web browser go to port 80 (by default) on the NWA’s web server. Figure 65 HTTP/HTTPS Implementation Note: If you disable HTTP in the WWW screen, then the NWA blocks all HTTP connection attempts. NWA5120 Series User’s Guide...
Page 120: Configuring Www Service Control
Configurator using HTTP connections. Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service to access the NWA. NWA5120 Series User’s Guide...
Page 121: Https Example
Click Technical Details if you want to verify more information about the certificate from the NWA. Select I Understand the Risks and then click Add Exception to add the NWA to the security exception list. Click Confirm Security Exception. NWA5120 Series User’s Guide...
Page 122 • The issuing certificate authority of the NWA’s HTTPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authority of the NWA's factory default certificate is the NWA itself since the certificate is a self-signed certificate. NWA5120 Series User’s Guide...
Page 123 Apply for a certificate from a Certification Authority (CA) that is trusted by the NWA (see the NWA’s Trusted Certificates Web Configurator screen). Figure 70 Trusted Certificates The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). NWA5120 Series User’s Guide...
Page 124 You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next NWA5120 Series User’s Guide...
Page 125 Chapter 11 System Click Next to begin the wizard. The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. NWA5120 Series User’s Guide...
Page 126 Enter the password given to you by the CA. Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. NWA5120 Series User’s Guide...
Page 127 You should see the following screen when the certificate is correctly installed on your computer. 11.4.5.7 Using a Certificate When Accessing the NWA To access the NWA via HTTPS: Enter ‘https://NWA IP Address/ in your browser’s web address field. NWA5120 Series User’s Guide...
Page 128: Ssh
In the following figure, computer B on the Internet uses SSH to securely connect to the NWA (A) for a management session. Figure 71 SSH Communication Over the WAN Example NWA5120 Series User’s Guide...
Page 129: How Ssh Works
After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server. The client then sends its authentication information (user name and password) to the server to log in to the server. NWA5120 Series User’s Guide...
Page 130: Ssh Implementation On The Nwa
Certificate SSH connections. You must have certificates already configured in the My Certificates screen. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 131: Examples Of Secure Telnet Using Ssh
22 on the NWA (using the default IP address of 192.168.1.2). A message displays indicating the SSH protocol version supported by the NWA. Figure 75 SSH Example 2: Test $ telnet 192.168.1.2 22 Trying 192.168.1.2... Connected to 192.168.1.2. Escape character is '^]'. SSH-1.5-1.0.0 NWA5120 Series User’s Guide...
Page 132: Telnet
You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 133: Ftp
Simple Network Management Protocol is a protocol used for exchanging management information between network devices. Your NWA supports SNMP agent functionality, which allows a manager station to manage and monitor the NWA through the network. The NWA supports SNMP version one NWA5120 Series User’s Guide...
Page 134 Get operation, followed by a series of GetNext operations. • Set - Allows the manager to set values for object variables within an agent. • Trap - Used by the agent to inform the manager of some events. NWA5120 Series User’s Guide...
Page 135: Supported Mibs
To change your NWA’s SNMP settings, click Configuration > System > SNMP tab. The screen appears as shown. Use this screen to configure your SNMP settings. You can also configure user profiles that define allowed SNMPv3 access. Figure 80 Configuration > System > SNMP NWA5120 Series User’s Guide...
Page 136 This field displays whether the SNMPv3 user can have read-only or read and write access to the NWA using this SNMPv3 user profile. Apply Click Apply to save your changes back to the NWA. Reset Click Reset to return the screen to its last-saved settings. NWA5120 Series User’s Guide...
Page 137: Adding Or Editing An Snmpv3 User Profile
Select whether the SNMPv3 user can have read-only or read and write access to the NWA using this SNMPv3 user profile. Click OK to save your changes back to the NWA. Cancel Click Cancel to exit this screen without saving your changes. NWA5120 Series User’s Guide...
Page 138 Chapter 11 System NWA5120 Series User’s Guide...
Page 139: Log And Report
12.2 Email Daily Report Use this screen to start or stop data collection and view various statistics about traffic passing through your NWA. Note: Data collection may decrease the NWA’s traffic throughput rate. NWA5120 Series User’s Guide...
Page 140 Table 63 Configuration > Log & Report > Email Daily Report LABEL DESCRIPTION Enable Email Select this to send reports by e-mail every day. Daily Report Mail Server Type the name or IP address of the outgoing SMTP server. NWA5120 Series User’s Guide...
Page 141: Log Setting
Alternatively, if you want to edit what events is included in each log, you can also use the Active Log Summary screen to edit this information for all logs at the same time. NWA5120 Series User’s Guide...
Page 142: Log Setting
Internal - system log; you can view the log on the View Log tab. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Summary This field is a summary of the settings for each log. NWA5120 Series User’s Guide...
Page 143: Edit System Log Settings
This screen controls the detailed settings for each log in the system log (which includes the e-mail profiles). Select a system log entry in the Log Setting screen and click the Edit icon. Figure 84 Configuration > Log & Report > Log Setting > Edit System Log Setting NWA5120 Series User’s Guide...
Page 144 Using the System Log drop-down list to disable all logs overrides your e-mail server 1 settings. enable normal logs (green check mark) - e-mail log messages for all categories to e-mail server 1. enable alert logs (red exclamation point) - e-mail alerts for all categories to e-mail server 1. NWA5120 Series User’s Guide...
Page 145 “[count=x]”, where x is the number of original log messages, appended at the end of the Message field. Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. NWA5120 Series User’s Guide...
Page 146: Edit Remote Server
This screen controls the settings for each log in the remote server (syslog). Select a remote server entry in the Log Setting screen and click the Edit icon. Figure 85 Configuration > Log & Report > Log Setting > Edit Remote Server NWA5120 Series User’s Guide...
Page 147: Active Log Summary
This screen allows you to view and to edit what information is included in the system log, e-mail profiles, and remote servers at the same time. It does not let you change other log settings (for NWA5120 Series User’s Guide...
Page 148 Figure 86 Active Log Summary This screen provides a different view and a different way of indicating which messages are included in each log and each alert. (The Default category includes debugging messages generated by open source software.) NWA5120 Series User’s Guide...
Page 149 (green checkmark) - create log messages and alerts from this category enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information from this category; the NWA does not e-mail debugging information, however, even if this setting is selected. NWA5120 Series User’s Guide...
Page 150 (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. NWA5120 Series User’s Guide...
Page 151: File Manager
# enter configuration mode configure terminal # change administrator password username admin password 4321 user-type admin #configure default radio profile, change 2GHz channel to 11 & Tx output power # to wlan-radio-profile default 2g-channel 11 output-power 50% exit write NWA5120 Series User’s Guide...
Page 152: Configuration File
The NWA still generates a log for any errors. 13.2 Configuration File Click Maintenance > File Manager > Configuration File to open this screen. Use the Configuration File screen to store, run, and name configuration files. You can also download NWA5120 Series User’s Guide...
Page 153 The NWA still generates a log for any errors. Figure 87 Maintenance > File Manager > Configuration File Do not turn off the NWA while configuration file upload is in progress. NWA5120 Series User’s Guide...
Page 154 Specify a name for the duplicate configuration file. Use up to 25 characters (including a-zA- Z0-9;‘~!@#$%^&()_+[]{}’,.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. NWA5120 Series User’s Guide...
Page 155 This column displays the number for each configuration file entry. This field is a sequential value, and it is not associated with a specific address. The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space. NWA5120 Series User’s Guide...
Page 156: Example Of Configuration File Download Using Ftp
Enter your password as requested. Use “cd” to change to the directory that contains the files you want to download. Use “dir” or “ls” if you need to display a list of the files in the directory. NWA5120 Series User’s Guide...
Page 157: Firmware Package
See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. Find the firmware package at www.zyxel.com in a file that (usually) uses a .bin extension. NWA5120 Series User’s Guide...
Page 158 The NWA automatically restarts causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 89 Network Temporarily Disconnected After five minutes, log in again and check your new firmware version in the Dashboard screen. NWA5120 Series User’s Guide...
Page 159: Example Of Firmware Upload Using Ftp
10 Enter “quit” to exit the ftp prompt. 13.4 Shell Script Use shell script files to have the NWA use commands that you specify. Use a text editor to create the shell script files. They must use a “.zysh” filename extension. NWA5120 Series User’s Guide...
Page 160 Use this button to have the NWA use a specific shell script file. Click a shell script file’s row to select it and click Run to have the NWA use that shell script file. You may need to wait awhile for the NWA to finish applying the commands. NWA5120 Series User’s Guide...
Page 161 Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click Browse... to find the .zysh file you want to upload. Upload Click Upload to begin the upload process. This process may take up to several minutes. NWA5120 Series User’s Guide...
Page 162 Chapter 13 File Manager NWA5120 Series User’s Guide...
Page 163: Diagnostics
This is the name of the most recently created diagnostic file. Last modified This is the date and time that the last diagnostic file was created. The format is yyyy-mm-dd hh:mm:ss. Size This is the size of the most recently created diagnostic file. NWA5120 Series User’s Guide...
Page 164 Chapter 14 Diagnostics Table 72 Maintenance > Diagnostics LABEL DESCRIPTION Collect Now Click this to have the NWA create a new diagnostic file. Download Click this to save the most recent diagnostic file to a computer. NWA5120 Series User’s Guide...
Page 165: Reboot
Click the Reboot button to restart the NWA. Wait a few minutes until the login screen appears. If the login screen does not appear, type the IP address of the device in your Web browser. You can also use the CLI command reboot to restart the NWA. NWA5120 Series User’s Guide...
Page 166 Chapter 15 Reboot NWA5120 Series User’s Guide...
Page 167: Shutdown
Click the Shutdown button to shut down the NWA. Wait for the device to shut down before you manually turn off or remove the power. It does not turn off the power. You can also use the CLI command shutdown to shutdown the NWA. NWA5120 Series User’s Guide...
Page 168 Chapter 16 Shutdown NWA5120 Series User’s Guide...
Page 169: Troubleshooting
Section 1.5 on page Check the hardware connections. See the Quick Start Guide. Inspect your cables for damage. Contact the vendor to replace any damaged cables. Disconnect and re-connect the power adaptor or PoE power injector to the NWA. NWA5120 Series User’s Guide...
Page 170: Nwa Access And Login
Reset the device to its factory defaults, and try to access the NWA with the default IP address. See Section 17.6 on page 175. If the problem continues, contact the network administrator or vendor, or try one of the advanced suggestions. Advanced Suggestions NWA5120 Series User’s Guide...
Page 171: Internet Access
Ignore the suggestions about your browser. 17.4 Internet Access I cannot access the Internet. Check the hardware connections, and make sure the LED is behaving as expected. See the Quick Start Guide and Section 17.2 on page 169. NWA5120 Series User’s Guide...
Page 172: Wireless Connections
Check the settings for QoS. If it is disabled, you might consider activating it. If it is enabled, you might consider raising or lowering the priority for some applications. 17.5 Wireless Connections I cannot access the NWA or ping any computer from the WLAN. NWA5120 Series User’s Guide...
Page 173 A PKCS #7 file is used to transfer a public key certificate. The private key is not included. The NWA currently allows the importation of a PKS#7 file that contains a single certificate. NWA5120 Series User’s Guide...
Page 174 • Make sure that all the APs are in the same broadcast domain. • Make sure that the wireless clients are in range of the other APs; if they are only in range of a single AP, then load balancing may not be as effective. NWA5120 Series User’s Guide...
Page 175: Resetting The Nwa
Release the RESET button, and wait for the NWA to restart. You should be able to access the NWA using the default settings. 17.7 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions. NWA5120 Series User’s Guide...
Page 176 Chapter 17 Troubleshooting NWA5120 Series User’s Guide...
Page 177: Appendix A Importing Certificates
) somewhere in the main browser window (not all browsers show the padlock in the same location). Internet Explorer The following example uses Microsoft Internet Explorer 7 on Windows XP Professional; however, they can also apply to Internet Explorer on Windows Vista. NWA5120 Series User’s Guide...
Page 178 If your device’s Web Configurator is set to use SSL certification, then the first time you browse to it you are presented with a certification error. Click Continue to this website (not recommended). In the Address Bar, click Certificate Error > View certificates. NWA5120 Series User’s Guide...
Page 179 Appendix A Importing Certificates In the Certificate dialog box, click Install Certificate. In the Certificate Import Wizard, click Next. NWA5120 Series User’s Guide...
Page 180 Next again and then go to step 9. Otherwise, select Place all certificates in the following store and then click Browse. In the Select Certificate Store dialog box, choose a location in which to save the certificate and then click OK. NWA5120 Series User’s Guide...
Page 181 Appendix A Importing Certificates In the Completing the Certificate Import Wizard screen, click Finish. 10 If you are presented with another Security Warning, click Yes. 11 Finally, click OK when presented with the successful certificate installation message. NWA5120 Series User’s Guide...
Page 182 Double-click the public key certificate file. In the security warning dialog box, click Open. Refer to steps 4-12 in the Internet Explorer procedure beginning on page 177 to complete the installation process. NWA5120 Series User’s Guide...
Page 183 This section shows you how to remove a public key certificate in Internet Explorer 7 on Windows XP. Open Internet Explorer and click Tools > Internet Options. In the Internet Options dialog box, click Content > Certificates. NWA5120 Series User’s Guide...
Page 184 In the Certificates confirmation, click Yes. In the Root Certificate Store dialog box, click Yes. The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. NWA5120 Series User’s Guide...
Page 185 The certificate is stored and you can now connect securely to the Web Configurator. A sealed padlock appears in the address bar, which you can click to open the Page Info > Security window to view the web page’s security information. NWA5120 Series User’s Guide...
Page 186 Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted, you can install a stand-alone certificate file if one has been issued to you. Open Firefox and click Tools > Options. In the Options dialog box, click Advanced > Encryption > View Certificates. NWA5120 Series User’s Guide...
Page 187 The next time you visit the web site, click the padlock in the address bar to open the Page Info > Security window to see the web page’s security information. Removing a Certificate in Firefox This section shows you how to remove a public key certificate in Firefox 2. NWA5120 Series User’s Guide...
Page 188 Appendix A Importing Certificates Open Firefox and click Tools > Options. In the Options dialog box, click Advanced > Encryption > View Certificates. NWA5120 Series User’s Guide...
Page 189 Delete. In the Delete Web Site Certificates dialog box, click OK. The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. NWA5120 Series User’s Guide...
Page 190 Appendix A Importing Certificates NWA5120 Series User’s Guide...
Page 191: Appendix B Legal Information
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Page 192: Zyxel Limited Warranty
To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http://www.zyxel.com/web/support_warranty_info.php. Registration Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com. NWA5120 Series User’s Guide...
Page 193: Regulatory Information
Erklærer herved ZyXEL at dette utstyret er I samsvar med de grunnleggende kravene og andre relevante bestemmelser I direktiv 1999/5/EF. [Romanian] Prin prezenta, ZyXEL declară că acest echipament este în conformitate cu cerinţele esenţiale şi alte prevederi relevante ale Directivei 1999/5/EC. NWA5120 Series User’s Guide...
Page 194 2. The regulatory limits for maximum output power are specified in EIRP. The EIRP level (in dBm) of a device can be calculated by adding the gain of the antenna used(specified in dBi) to the output power available at the connector (specified in dBm). NWA5120 Series User’s Guide...
Page 195: Safety Warnings
Your product is marked with this symbol, which is known as the WEEE mark. WEEE stands for Waste Electronics and Electrical Equipment. It means that used electrical and electronic products should not be mixed with general waste. Used electrical and electronic equipment should be treated separately. NWA5120 Series User’s Guide...
Page 196 Deklaration undertecknad av: Nome/titolo: Thomas Wei / Quality Management Naam/titel: Thomas Wei / Quality Management Namn/Titel: Thomas Wei / Quality Management Department/ Senior Director. Department/ Senior Director. Department/ Senior Director. Data (aaaa/mm/gg): 2012/07/09 Datum(jjjj/mm/dd): 2012/07/09 Datum (åååå/mm/dd): 2012/07/09 NWA5120 Series User’s Guide...
Page 197: Index
CA (Certificate Authority), see certificates configuration CEF (Common Event Format) 142, 147 information Certificate Authority (CA) configuration files see certificates at restart Certificate Management Protocol (CMP) backing up Certificate Revocation List (CRL) downloading vs OCSP downloading with FTP NWA5120 Series User’s Guide...
Page 198 SSL, see HTTPS dual radios redirect to HTTPS dual-radio application vs HTTPS dynamic channel selection HTTPS and certificates authenticating clients avoiding warning messages example vs HTTP e-mail with Internet Explorer daily statistics report with Netscape Navigator encryption NWA5120 Series User’s Guide...
Page 199 153, 156 mode changge layer-2 isolation model name example My Certificates, see also certificates LEDs Blinking Flashing load balancing Netscape Navigator log messages network access control categories 145, 147, 148, 149 Network Time Protocol (NTP) debugging NWA5120 Series User’s Guide...
Page 200 Simple Certificate Enrollment Protocol (SCEP) product Simple Network Management Protocol, see SNMP related documentation SNMP 133, 134 remote management agents FTP, see FTP Telnet GetNext WWW, see WWW Manager reports managers NWA5120 Series User’s Guide...
Page 201 70, 71 syslog 142, 147 lease time syslog servers, see also logs limited-admin (type) system log, see logs lockout reauthentication time system name 34, 114 types of system uptime user (type) system-default.conf user names Telnet NWA5120 Series User’s Guide...
Page 202 LAN Wireless network overview wireless network example wireless profile layer-2 isolation MAC filtering radio security SSID wireless security 14, 173 wireless station WLAN interface WPA2 and certificates see also HTTP, HTTPS NWA5120 Series User’s Guide...

This manual is also suitable for:

Nwa5121-n Nwa5121-ni Nwa5123-ni

ZyXEL Communications NWA5120 Series User Manual

Contents Overview

Table of Contents

User's Guide

PART I User's Guide

Chapter 1 Introduction

Chapter 2 The Web Configurator

Technical Reference

Part II: Technical Reference

Chapter 3 Dashboard

Chapter 4 Monitor

Chapter 5 LAN Setting

Chapter 6 Wireless

Chapter 7 User

Chapter 8 AP Profile

Chapter 9 MON Profile

Chapter 10 Certificates

Chapter 11 System

Chapter 12 Log and Report

Chapter 13 File Manager

Chapter 14 Diagnostics

Chapter 15 Reboot

Chapter 16 Shutdown

Chapter 17 Troubleshooting

Appendix A Importing Certificates

Appendix B Legal Information

Index

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications NWA5120 Series

Summary of Contents for ZyXEL Communications NWA5120 Series

This manual is also suitable for:

Table of Contents