ZyXEL Communications NWA-1100, User Manual

Page 1: ...l com www zyxel com NWA 1100 802 11b g Wireless Access Point Copyright 2009 ZyXEL Communications Corporation Firmware Version 3 6 Edition 2 2 2009 Default Login Details IP Address http 192 168 1 2 Password 1234 ...

Page 2: ......

Page 3: ...ht away It contains information on setting up your network and configuring for Internet access Supporting Disk Refer to the included CD for support documents ZyXEL Web Site Please refer to www zyxel com for additional support documentation and product certifications User Guide Feedback Help us help you Send all User Guide related comments questions or suggestions for improvement to the following a...

Page 4: ...t contact your vendor then contact a ZyXEL office for the region in which you bought the device See http www zyxel com web contact_us php for contact information Please have the following information ready when you contact an office Product model and serial number Warranty Information Date that you received your device Brief description of the problem and the steps you took to sol ...

Page 5: ... denoted by square brackets and uppercase text for example ENTER means the enter or return key on your keyboard Enter means for you to type one or more characters and then press the ENTER key Select or choose means for you to use one of the predefined choices A right angle bracket within a screen name denotes a mouse click For example Maintenance Configuration File Backup means you first click Mai...

Page 6: ...6 Icons Used in Figures Figures in this User s Guide may use the following generic icons The ZyXEL Device icon is not an exact representation of your device ZyXEL Device Computer Notebook computer Server Printer Firewall Ethernet Switch Switch Router ...

Page 7: ...or cord and do NOT place the product where anyone can walk on the power adaptor or cord Do NOT use the device if the power adaptor or cord is damaged as it might cause electrocution If the power adaptor or cord is damaged remove it from the power outlet Do NOT attempt to repair the power adaptor or cord Contact your local vendor to order a new one Do not use the device outside and make sure all th...

Page 8: ...Safety Warnings ZyXEL NWA 1100 User s Guide 8 ...

Page 9: ...g the Web Configurator 29 Status Screens 33 Tutorial 37 The Web Configurator 45 System Screens 47 Wireless Settings Screen 55 Wireless Security Screen 73 RADIUS Screen 89 MAC Filter Screen 93 IP Screen 97 Remote Management 101 Certificate Screen 111 Log Screens 115 Maintenance 123 Troubleshooting 131 Appendices and Index 137 ...

Page 10: ...Contents Overview ZyXEL NWA 1100 User s Guide 10 ...

Page 11: ...s Client 21 1 2 3 Bridge 21 1 2 4 AP Bridge 24 1 3 Ways to Manage the ZyXEL Device 25 1 4 Configuring Your ZyXEL Device s Security Features 25 1 4 1 Control Access to Your Device 25 1 4 2 Wireless Security 26 1 5 Good Habits for Managing the ZyXEL Device 26 1 6 Hardware Connections 26 1 7 LEDs 27 Chapter 2 Introducing the Web Configurator 29 2 1 Accessing the Web Configurator 29 2 2 Resetting the ...

Page 12: ...e Web Configurator 45 Chapter 5 System Screens 47 5 1 Overview 47 5 2 What You Can Do in the System Screens 47 5 3 What You Need To Know About the System Screens 48 5 4 General Screen 49 5 4 1 Password Screen 50 5 5 Time Screen 51 5 6 Technical Reference 53 5 6 1 Pre defined NTP Time Servers List 53 Chapter 6 Wireless Settings Screen 55 6 1 Overview 55 6 2 What You Can Do in the Wireless Settings ...

Page 13: ...02 1x Static 64 bit 802 1x Static 128 bit 81 7 4 4 Security WPA 82 7 4 4 1 Access Point 83 7 4 4 2 Wireless Client 84 7 4 5 Security WPA2 or WPA2 MIX 84 7 4 5 1 Access Point 85 7 4 5 2 Wireless Client 86 7 4 6 Security WPA PSK WPA2 PSK WPA2 PSK MIX 87 7 5 Technical Reference 87 Chapter 8 RADIUS Screen 89 8 1 Overview 89 8 2 What You Can Do in the RADIUS Screen 89 8 3 What You Need to Know About RA...

Page 14: ...ter 12 Certificate Screen 111 12 1 Overview 111 12 2 What You Can Do in the Certificate Screen 111 12 3 What You Need To Know About Certificates 111 12 4 Certificate Screen 112 12 5 Technical Reference 113 12 5 1 Private Public Certificates 113 12 5 2 Certification Authorities 113 12 5 3 Checking the Fingerprint of a Certificate on Your Computer 114 Chapter 13 Log Screens 115 13 1 Overview 115 13 ...

Page 15: ...roubleshooting 131 15 1 Power Hardware Connections and LEDs 131 15 2 ZyXEL Device Access and Login 132 15 3 Internet Access 134 Part III Appendices and Index 137 Appendix A Product Specifications 139 Appendix B Power over Ethernet PoE Specifications 141 Appendix C Power Adaptor Specifications 143 Appendix D Setting up Your Computer s IP Address 145 Appendix E Wireless LANs 157 Appendix F Pop up Wi...

Page 16: ...Table of Contents ZyXEL NWA 1100 User s Guide 16 ...

Page 17: ...17 PART I Introduction Introducing the ZyXEL Device 19 Status Screens 33 Introducing the Web Configurator 29 Tutorial 37 ...

Page 18: ...18 ...

Page 19: ...igh level of network traffic security supporting IEEE 802 1x Wi Fi Protected Access WPA WPA2 and WEP data encryption Its Quality of Service QoS features allow you to prioritize time sensitive or highly important applications such as VoIP Your ZyXEL Device is easy to install configure and use The embedded Web based configurator enables simple straightforward management and maintenance See the Quick...

Page 20: ... The ZyXEL Device is an ideal access solution for wireless Internet connection A typical Internet access application for your ZyXEL Device is shown as follows Stations A B and C can access the wired network through the ZyXEL Devices Figure 1 Access Point Application AP1 AP2 A B C BSS2 BSS1 ...

Page 21: ...wireless links with other APs In the figure below the ZyXEL Devices A B and Z are connected to independent wired networks and have a bridge connection A can communicate with B and Z at the same time Security between bridged APs the Wireless Distribution System or WDS is independent of the security between the wired networks and their respective APs If you do not enable WDS security traffic between...

Page 22: ...r ZyXEL NWA series access points only Refer to your other access point s documentation for details Figure 3 Bridge Application In the example below when both ZyXEL Devices are in Bridge mode they form a WDS Wireless Distribution System allowing the computers in LAN 1 to connect to the computers in LAN 2 Figure 4 Bridging Example ...

Page 23: ...radation and disruption of communications The following examples show two network topologies that can lead to this problem If two or more ZyXEL Devices in bridge mode are connected to the same hub Figure 5 Bridge Loop Two Bridges Connected to Hub If your ZyXEL Device in bridge mode is connected to a wired LAN while communicating with another wireless bridge that is also connected to the same wired...

Page 24: ... the figure below A and B act as AP Bridge devices that forward traffic between associated wireless workstations and the wired LAN When the ZyXEL Device is in AP Bridge mode security between APs the Wireless Distribution System or WDS is independent of the security between the wireless stations and the AP If you do not enable WDS security traffic between APs is not encrypted When WDS security is e...

Page 25: ...y locating devices in secure areas such as locked rooms Most ZyXEL Devices have a reset button If an unauthorized person has access to the reset button they can then reset the device s password to its default password log in and reconfigure its settings Change any default passwords on the ZyXEL Device such as the password used for accessing the ZyXEL Device s web configurator if it has a web confi...

Page 26: ...log in This method is more common in business environments Hide your wireless network name SSID The SSID can be regularly broadcast and unauthorized users may use this information to access your network See Section 6 4 on page 57 for directions on using the web configurator to hide the SSID Enable the MAC filter to allow only trusted users to access your wireless network or deny unwanted users acc...

Page 27: ...ribution System WDS connection Amber Flashing The ZyXEL Device is starting up Off Either The ZyXEL Device is in Access Point or mode and is functioning normally The ZyXEL Device is in AP Bridge or Bridge mode and has not established a Wireless Distribution System WDS connection or The ZyXEL Device is not receiving power 2 WLAN Green On The wireless adaptor WLAN is active Blinking The wireless adap...

Page 28: ...t connection Blinking The ZyXEL Device has a 10 Mbps Ethernet connection and is sending or receiving data Yellow On The ZyXEL Device has a 100 Mbps Ethernet connection Blinking The ZyXEL Device has a 100 Mbps Ethernet connection and is sending receiving data Off The ZyXEL Device does not have an Ethernet connection Table 1 LEDs continued LABEL LED COLOR STATUS DESCRIPTION ...

Page 29: ...our computer or computer network to connect to the ZyXEL Device refer to the Quick Start Guide 2 Launch your web browser 3 Type 192 168 1 2 as the URL default 4 Type 1234 default as the password and click Login In some versions the default password appears automatically if this is the case click Login 5 You should see a screen asking you to change your password highly recommended as shown next Typ...

Page 30: ...rator you will need to use the RESET button This replaces the current configuration file with the factory default configuration file This means that you will lose all the settings you previously configured The password will be reset to 1234 2 2 1 Methods of Restoring Factory Defaults You can erase the current configuration and restore factory defaults in two ways Use the RESET button to upload the...

Page 31: ...ure advanced features such as SYSTEM General Password and Time WIRELESS Wireless Settings Security RADIUS MAC Filter IP REMOTE MGNT Telnet FTP WWW and SNMP CERTIFICATES and LOGS View Log and Log Settings Click MAINTENANCE to view information about your ZyXEL Device or upgrade configuration and firmware files Maintenance features include Association List Channel Usage F W firmware Upload Configurat...

Page 32: ...Chapter 2 Introducing the Web Configurator ZyXEL NWA 1100 User s Guide 32 ...

Page 33: ...ok at the current status of the device system resources and interfaces The Status screens also provide detailed information about system statistics associated wireless clients and logs 3 1 The Status Screen Use this screen to get a quick view of system Ethernet WLAN and other information regarding your ZyXEL Device Click Status The following screen displays Figure 11 The Status Screen ...

Page 34: ...the current IP address of the ZyXEL Device on the network Subnet Mask Subnet masks determine the maximum number of possible hosts on a network You can also use subnet masks to divide one network into multiple sub networks Gateway IP Address This is the IP address of the gateway The gateway is a router or switch on the same network segment as the device s LAN port The gateway helps forward packets ...

Page 35: ...els are currently in use in the local area See Section 14 5 on page 124 Rate For the LAN port this displays the port speed and duplex setting For the WLAN interface it displays the downstream and upstream transmission rate or N A if the interface is not in use LAN This field displays the number of wireless clients currently associated to the first wireless module Each wireless module supports up t...

Page 36: ...e ZyXEL Device is using Channel ID Click this to see which wireless channels are currently in use in the local area See Section 14 5 on page 124 RX PKT This is the number of received packets on this port TX PKT This is the number of transmitted packets on this port Retry Count This is the total number of retries for transmitted packets TX FCS Error This is the ratio percentage showing the total nu...

Page 37: ... QoS settings See Section 1 2 1 on page 20 for details Use Wireless Client operating mode if you want to use the ZyXEL Device to access a wireless network See Section 1 2 2 on page 21 for details Use Bridge operating mode if you want to use the ZyXEL Device to communicate with other access points See Section 1 2 3 on page 21 for details The ZyXEL Device is a bridge when other APs access your wired...

Page 38: ...7 4 1 on page 77 Configuring an external RADIUS server see Section 8 4 on page 90 Configuring MAC Filtering see Section 9 1 on page 93 Select the WLAN Adaptor you want to configure Select Operating Mode Access Point Bridge Mode AP Bridge Mode Wireless Client Mode Select 802 11 Mode and Channel ID Configure RADIUS authentication optional Configure MAC Filter optional Select AP you Select 802 11 Mod...

Page 39: ...l FTP server You want only specified wireless clients to be able to access station B You also want to allow wireless traffic between B and wireless clients connected to A W Y and Z Other wireless devices X must not be able to connect to the FTP server Figure 14 FTP Server Connected to a Wireless Client 4 2 2 Configuring the ZyXEL Device in Access Point Mode Before setting up the ZyXEL Device as a ...

Page 40: ...t Mode Wireless Setttings 1 Set the Operation Mode to AP 2 Enter an SSID name such as NWA 1100 A 3 Choose the channel you want the ZyXEL Device to use 4 Select the Wireless Mode 5 Set the Intra BSS Traffic to Enable 6 Go to Wireless Security to configure the ZyXEL Device to use WPA PSK security mode Figure 16 Access Point Mode Security Setttings ...

Page 41: ...eless Client as Operating Mode Wait for the screen to refresh 2 You should now see a tab that says Site Survey refer to Figure 18 Click on this A window should pop up which contains a list of all available wireless devices within your ZyXEL Device s range Copy the SSID of the AP you want your wireless client to connect to refer to Figure 19 3 For this example you want to connect to the access poin...

Page 42: ...Chapter 4 Tutorial ZyXEL NWA 1100 User s Guide 42 5 Set the Wireless Mode to the same one set for the access point Click Apply Figure 17 Wireless Client Mode Wireless Settings Figure 18 Site Survey ...

Page 43: ...o configure the ZyXEL Device to use WPA PSK security mode Figure 20 Wireless Client Mode Security Setttings 7 One way to ensure that only specified wireless clients can access the FTP server is by enabling MAC filtering on the ZyXEL Device See Chapter 9 on page 93 for more information on the MAC Filter screen ...

Page 44: ... you can check if you have correctly configured your network setup as described in this tutorial Try accessing the FTP server from wireless clients W Y or Z Test if you can send or retrieve a file If you cannot establish a connection with the FTP server do the following steps 1 Make sure W Y and Z use the same wireless security settings as A and can access A 2 Make sure B uses the same wireless an...

Page 45: ...rator System Screens 47 Wireless Settings Screen 55 Wireless Security Screen 73 RADIUS Screen 89 MAC Filter Screen 93 IP Screen 97 Remote Management 101 Certificate Screen 111 Log Screens 115 Maintenance 123 Troubleshooting 131 ...

Page 46: ...46 ...

Page 47: ... NTP server to set the time on the device 5 2 What You Can Do in the System Screens Use the System General screen see Section on page 49 to specify the Device name and Administrator Inactivity Timer value You can also configure your System DNS Servers in this screen Use the System Password screen see Section 5 4 1 on page 50 to manage the password for your ZyXEL Device Use the System Time Setting ...

Page 48: ...e For more information on address assignment please refer to RFC 1597 Address Allocation for Private Internets and RFC 1466 Guidelines for Management of IP Address Space IP Address and Subnet Mask Similar to the way houses on a street share a common street name computers on a LAN share one common network number Where you obtain your network number depends on your particular situation If the ISP or...

Page 49: ...l compute the subnet mask automatically based on the IP address that you entered You don t need to change the subnet mask computed by the device unless you are instructed to do otherwise 5 4 General Screen Use the General screen to identify your ZyXEL Device over the network Click System General The following screen displays Figure 23 System General The following table describes the labels in this...

Page 50: ... DNS Servers First DNS Server Second DNS Server Third DNS Server The field to the right displays the read only DNS server IP address that the DHCP assigns Select User Defined if you have the IP address of a DNS server Enter the DNS server s IP address in the field to the right Select None if you do not want to configure DNS servers If you do not configure a DNS server you must know the IP address ...

Page 51: ...assword for confirmation Apply Click Apply to save your changes Reset Click Reset to reload the previous configuration for this screen Table 6 System Password LABEL DESCRIPTIONS Table 7 System Time LABEL DESCRIPTION Current Time and Date Current Date This field displays the last updated date from the time server Current Time This field displays the time of your ZyXEL Device Each time you reload th...

Page 52: ...cond Sunday March and 2 00 Daylight Saving Time starts in the European Union on the last Sunday of March All of the time zones in the European Union start using Daylight Saving Time at the same moment 1 A M GMT or UTC So in the European Union you would select Last Sunday March The time you type in the at field depends on your time zone In Germany for instance you would type 2 because Germany s tim...

Page 53: ... the following pre defined list of NTP time servers if you do not specify a time server or it cannot synchronize with the time server you specified When the ZyXEL Device uses the pre defined list of NTP time servers it randomly selects one server and tries to synchronize with it If the synchronization fails then the ZyXEL Device goes through the rest of the list in order from the first one tried u...

Page 54: ...Chapter 5 System Screens ZyXEL NWA 1100 User s Guide 54 ...

Page 55: ...EL Device It also introduces the wireless LAN WLAN and some basic scenarios Figure 26 Wireless Mode In the figure above the ZyXEL Device allows access to another bridge device A and a notebook computer B upon verifying their settings and credentials It denies access to other devices C and D with configurations that do not match those specified in your ZyXEL Device ...

Page 56: ...ng an access point with each access point connected together by a wired network This wired connection between APs is called a Distribution System DS Operating Mode The ZyXEL Device can run in four operating modes as follows AP Access Point The ZyXEL Device is wireless access point that allows wireless communication to other devices in the network Wireless Client The ZyXEL Device acts as a wireless...

Page 57: ... addition unauthorized wireless devices can still see the information that is sent in the wireless network Channel A channel is the radio frequency ies used by IEEE 802 11a b g wireless devices Channels available depend on your geographical area You may have a choice of channels for your region so you should use a different channel than an adjacent AP access point to reduce interference Wireless M...

Page 58: ...ur ZyXEL Device as an access point Select AP as the Operation Mode The following screen displays Figure 27 Wireless Access Point The following table describes the general wireless LAN labels in this screen Table 9 Wireless Access Point LABEL DESCRIPTION Basic Settings Operation Mode Select AP from the drop down list ...

Page 59: ...creen to make sure the channel is not already used by another AP or independent peer to peer wireless network To have the ZyXEL Device automatically select a channel click Scan instead Wireless Mode Select 802 11b Only to allow only IEEE 802 11b compliant WLAN devices to associate with the ZyXEL Device Select 802 11g Only to allow only IEEE 802 11g compliant WLAN devices to associate with the ZyXE...

Page 60: ...Select Dynamic to have the AP automatically use short preamble when wireless adapters support it otherwise the AP uses long preamble Select Long if you are unsure what preamble mode the wireless adapters support and to provide more reliable communications in busy wireless networks RTS CTS Threshold Request To Send The threshold number of bytes for enabling RTS CTS handshake Data with its frame siz...

Page 61: ...ing Tree Control STP R STP detects and breaks network loops and provides backup links between switches bridges or routers It allows a bridge to interact with other R STP compliant bridges in your network to ensure that only one path exists between any two stations on the network Select the check box to activate STP on the ZyXEL Device Apply Click Apply to save your changes Reset Click Reset to beg...

Page 62: ...e Select 802 11b Only to allow only IEEE 802 11b compliant WLAN devices to associate with the ZyXEL Device Select 802 11g Only to allow only IEEE 802 11g compliant WLAN devices to associate with the ZyXEL Device Select 802 11b g to allow both IEEE802 11b and IEEE802 11g compliant WLAN devices to associate with the ZyXEL Device The transmission rate of your ZyXEL Device might be reduced Advanced Se...

Page 63: ...n number between 256 and 2346 Rates Configuration This section controls the data rates permitted for clients For each Rate select an option from the Configuration list The options are Basic 1 11 Mbps only Clients can always connect to the access point at this speed Optional Clients can connect to the access point at this speed when permitted to do so by the AP Disable Clients cannot connect to the...

Page 64: ...creen to use the ZyXEL Device as a wireless bridge Select Bridge as the Operation Mode Figure 29 Wireless Bridge The following table describes the bridge labels in this screen Table 11 Wireless Bridge LABEL DESCRIPTIONS Basic Settings Operation Mode Select Bridge in this field ...

Page 65: ...e MAC address of your ZyXEL Device You can specify up to 4 remote devices MAC addresses in this section Advanced Settings Radio Enable Select Yes to enable WLAN radio and No to turn it off The ZyXEL Device cannot be accessed wirelessly if radio is turned off Output Power Management Set the output power of the ZyXEL Device in this field If there is a high density of APs in an area decrease the outp...

Page 66: ...eed Optional Clients can connect to the access point at this speed when permitted to do so by the AP Disable Clients cannot connect to the access point at this speed Enable Antenna Diversity Select this to use antenna diversity Antenna diversity uses multiple antennas to reduce signal interference Enable Spanning Tree Protocol STP R STP detects and breaks network loops and provides backup links be...

Page 67: ...to have the ZyXEL Device function as a bridge and access point simultaneously Select AP Bridge as the Operation Mode The following screen diplays Figure 30 Wireless AP Bridge See the tables describing the fields in the Access Point and Bridge operating modes for descriptions of the fields in this screen ...

Page 68: ...educes the throughput of the other traffic streams The ZyXEL Device uses WMM QoS to prioritize traffic streams according to the IEEE 802 1q or DSCP information in each packet s header The ZyXEL Device automatically determines the priority to use for an individual traffic stream This prevents reductions in data transmission for applications that are sensitive to latency and jitter variations in del...

Page 69: ...P it enables the root port and the ports that are the designated ports for connected LANs and disables all other ports that participate in STP Network packets are therefore only forwarded between enabled ports eliminating any possible network loops STP aware bridges exchange Bridge Protocol Data Units BPDUs periodically When the bridged LAN topology changes a new spanning tree is constructed Once ...

Page 70: ...ork You might disable this kind of communication to enhance security within your wireless network RTS CTS Threshold In a wireless network which covers a large area wireless devices are sometimes not aware of each other s presence This may cause them to send information to the AP at the same time and result in information colliding and not getting through By setting this value lower than the defaul...

Page 71: ...having to log in again This is useful for devices such as notebooks that move around a lot Antenna An antenna couples Radio Frequency RF signals onto air A transmitter within a wireless device sends an RF signal to the antenna which propagates the signal through the air The antenna also operates in reverse by capturing RF signals from the air Positioning the antennas properly increases the range a...

Page 72: ...Chapter 6 Wireless Settings Screen ZyXEL NWA 1100 User s Guide 72 ...

Page 73: ...Securing the Wireless Network In the figure above the ZyXEL Device checks the identity of devices before giving them access to the network In this scenario Computer A is denied access to the network while Computer B is granted connectivity The ZyXEL Device secure communications via data encryption wireless client authentication and MAC address filtering It can also hide its identity in the network...

Page 74: ...s network Furthermore there are ways for unauthorized wireless users to get a valid user name and password Then they can use that user name and password to use the wireless network The following table shows the relative effectiveness of wireless security methods The available security modes in your ZyXEL Device are as follows None No data encryption WEP Wired Equivalent Privacy WEP encryption scra...

Page 75: ...erted by the ZyXEL Device into a complicated string that is referred to as the key This key is requested from all devices wishing to connect to a wireless network PSK The Pre Shared Key PSK is a password shared by a wireless access point and a client during a previous secure connection The key can then be used to establish a connection between the two parties Encryption Wireless networks can use e...

Page 76: ...these terms can be found in Appendix E on page 157 7 4 The Security Screen Use this screen to choose the security mode for your ZyXEL Device Click Wireless Security The screen varies depending upon the security mode you select Figure 32 Security None The default security mode is set to None Note that some screens display differently depending on the operating mode selected in the Wireless Wireless...

Page 77: ...DESCRIPTION Security Mode Choose WEP in this field Authentication Method Select Open or Shared Key from the drop down list box The default setting is Auto Data Encryption Select Disable to allow wireless stations to communicate with the access points without any data encryption Select 64 bit WEP 128 bit WEP or 152 bit WEP to enable data encryption Passphrase Enter the passphrase or string of text ...

Page 78: ... Key 1 to Key 4 The WEP keys are used to encrypt data Both the ZyXEL Device and the wireless stations must use the same WEP key for data transmission If you chose 64 bit WEP then enter any 5 ASCII characters or 10 hexadecimal characters 0 9 A F If you chose 128 bit WEP then enter 13 ASCII characters or 26 hexadecimal characters 0 9 A F If you chose 152 bit WEP then enter 16 ASCII characters or 32 ...

Page 79: ...econds The default time interval is 1800 seconds 30 minutes Alternatively enter 0 to turn reauthentication off Note If wireless station authentication is done using a RADIUS server the reauthentication timer on the RADIUS server has priority Group Key Update The ZyXEL Device automatically disconnects a wireless station from the wired network after a period of inactivity The wireless station needs ...

Page 80: ... the same security mode used by the AP Data Encryption Select between None and Dynamic WEP Refer to Section on page 166 for information on using Dynamic WEP IEEE802 1x Authentication EAP Type The options on the left refer to EAP methods You can choose either TLS LEAP PEAP or TTLS The default value is PEAP The options on the right refer to authentication protocols You can choose between MSCHAPv2 an...

Page 81: ...ollowing screen Figure 36 Security 802 1x Static 64 bit 802 1x Static 128 bit AP mode The following table describes the labels in this screen Table 19 Security 802 1x Static 64 bit 802 1x Static 128 bit LABEL DESCRIPTION Security Settings Security Mode Choose 802 1x Static 64 or 802 1x Static 128 in this field Passphrase Enter the passphrase or string of text used for automatic WEP key generation ...

Page 82: ...four keys but only one key can be activated at any one time The default key is key 1 Rekey Options ReAuthenticatio n Timer Specify how often wireless stations have to resend user names and passwords in order to stay connected Enter a time interval between 10 and 9999 seconds The default time interval is 1800 seconds 30 minutes Alternatively enter 0 to turn reauthentication off Note If wireless sta...

Page 83: ...ords in order to stay connected Enter a time interval between 10 and 9999 seconds The default time interval is 1800 seconds 30 minutes Alternatively enter 0 to turn reauthentication off Note If wireless station authentication is done using a RADIUS server the reauthentication timer on the RADIUS server has priority Group Key Update The Group Key Update Timer is the rate at which the AP sends a new...

Page 84: ...creen Table 21 Security WPA for Wireless Client LABEL DESCRIPTION Security Settings Security Mode Choose the same security mode used by the AP Data Encryption Select between None and TKIP IEEE802 1x Authentication EAP Type The options on the left refer to EAP methods You can choose either TLS LEAP PEAP or TTLS The default value is PEAP The options on the right refer to authentication protocols You...

Page 85: ...ve to resend usernames and passwords in order to stay connected Enter a time interval between 10 and 9999 seconds The default time interval is 1800 seconds 30 minutes Alternatively enter 0 to turn reauthentication off Note If wireless station authentication is done using a RADIUS server the reauthentication timer on the RADIUS server has priority Group Key Update Timer The Group Key Update Timer i...

Page 86: ...r Wireless Client LABEL DESCRIPTION Security Settings Security Mode Choose the same security mode used by the AP IEEE802 1x Authentication EAP Type The options on the left refer to EAP methods You can choose either TLS LEAP PEAP or TTLS The default value is PEAP The options on the right refer to authentication protocols You can choose between MSCHAPv2 and GTC The default value is MSCHAPv2 User Inf...

Page 87: ...Device Use WPA 2 PSK if you have WPA 2 aware wireless clients but no RADIUS server Use WPA 2 security if you have WPA 2 aware wireless clients and a RADIUS server WPA has user authentication and improved data encryption over WEP Use WPA 2 PSK if you have WPA 2 aware wireless clients but no RADIUS server Table 24 Security WPA PSK WPA2 PSK or WPA2 PSK MIX LABEL DESCRIPTION Security Mode Choose WPA P...

Page 88: ...Guide 88 If you don t have WPA 2 aware wireless clients then use WEP key encrypting A higher bit key offers better security You can manually enter 64 bit 128 bit or 152 bit WEP keys More information on Wireless Security can be found in Appendix E on page 157 ...

Page 89: ...rver is the RADIUS server Figure 42 RADIUS Server Setup In the figure above wireless clients A and B are trying to access the Internet via the ZyXEL Device The ZyXEL Device in turn queries the RADIUS server if the identity of clients A and U are allowed access to the Internet In this scenario only client U s identity is verified by the RADIUS server and allowed access to the Internet 8 2 What You ...

Page 90: ...ctivity RADIUS is a simple package exchange in which your AP acts as a message relay between the wireless client and the network RADIUS server You should know the IP addresses ports and share secrets of the external RADIUS server and or the external RADIUS accounting server you want to use with your ZyXEL Device You can configure a primary and backup RADIUS and RADIUS accounting server for your Zy...

Page 91: ... the port number of the external authentication server The default port number is 1812 You need not change this value unless your network administrator instructs you to do so This field is not available when you select Internal Share Secret Enter a password up to 128 alphanumeric characters as the key to be shared between the external authentication server and the ZyXEL Device The key must be the ...

Page 92: ...Chapter 8 RADIUS Screen ZyXEL NWA 1100 User s Guide 92 ...

Page 93: ...EL Device Deny Association Figure 44 MAC Filtering In the figure above wireless client U is able to connect to the Internet because its MAC address is in the allowed association list specified in the ZyXEL Device The MAC address of client A is either denied association or is not in the list of allowed wireless clients specified in the ZyXEL Device 9 2 What You Can Do in the MAC Filter Use the Wire...

Page 94: ...x pairs of hexadecimal characters for example 00 A0 C5 00 00 02 You need to know the MAC address of each device to configure MAC filtering on the ZyXEL Device 9 4 MAC Filter Screen Use this screen to enable MAC address filtering in your ZyXEL Device You can specify up to 64 MAC addresses to either allow or deny association with your ZyXEL Device Click Wireless MAC Filter The screen displays as sho...

Page 95: ...ermit access to the ZyXEL Device MAC addresses not listed will be denied access to the ZyXEL Device Deny the following MAC Address to associate Select this to block access to theZyXEL Device MAC addresses not listed will be allowed to access the ZyXEL Device MAC Address Enter the MAC addresses in XX XX XX XX XX XX format of the wireless station to be allowed or denied access to the ZyXEL Device De...

Page 96: ...Chapter 9 MAC Filter Screen ZyXEL NWA 1100 User s Guide 96 ...

Page 97: ...to communicate across the network These networking devices are also known as hosts Figure 46 IP Setup The figure above illustrates one possible setup of your ZyXEL Device The gateway IP address is 192 168 1 2 and the IP address of the ZyXEL Device is 192 168 1 2 default The gateway and the device must belong in the same subnet mask to be able to communicate with each other 10 2 What You Can Do in ...

Page 98: ...en Table 27 IP Setup LABEL DESCRIPTION Get automatically from DHCP Select this option if your ZyXEL Device is using a dynamically assigned IP address from a DHCP server each time Note You must know the IP address assigned to the ZyXEL Device by the DHCP server to access the ZyXEL Device again Use fixed IP address Select this option if your ZyXEL Device is using a static IP address When you select ...

Page 99: ...ks On the other hand if you are part of a much larger organization you should consult your network administrator for the appropriate IP addresses Note Regardless of your particular situation do not create an arbitrary IP address always follow the guidelines above For more information on address assignment please refer to RFC 1597 Address Allocation for Private Internets and RFC 1466 Guidelines for...

Page 100: ...Chapter 10 IP Screen ZyXEL NWA 1100 User s Guide 100 ...

Page 101: ...Device s interfaces Remote Management allows a user to administrate the device over the network You can manage your ZyXEL Device from a remote location via the following interfaces WLAN LAN Both WLAN and LAN Neither Disable Figure 48 Remote Management Example In the figure above the ZyXEL Device A is being managed by a desktop computer B connected via LAN Land Area Network It is also being accesse...

Page 102: ...es you can use the Web Browser to manage the ZyXEL Device Use the SNMP screen see Section 11 7 on page 107 to configure through which interface s and from which IP address es a network systems manager can access the ZyXEL Device 11 3 What You Need To Know About Remote Management Telnet Telnet is short for Telecommunications Network which is a client side protocol that enables you to access a devic...

Page 103: ...a managed device the ZyXEL Device An agent translates the local management information from the managed device into a form compatible with SNMP The manager is the console through which network administrators perform network management functions It executes applications that control and monitor managed devices SNMP allows a manager and agents to communicate for the purpose of accessing information ...

Page 104: ...timeout period The management session does not time out when a statistics screen is polling You can change the timeout period in the SYSTEM screen 11 4 The Telnet Screen Use this screen to configure your ZyXEL Device for remote Telnet access You can use Telnet to access the ZyXEL Device s Command Line Interface CLI Click REMOTE MGNT TELNET The following screen displays Figure 50 Remote Management ...

Page 105: ...allow the computer with the IP address that you specify to access the ZyXEL Device using this service Secured Client MAC Address Select All to allow any computer to access the ZyXEL Device using this service Choose Selected to just allow the computer with the MAC address that you specify to access the ZyXEL Device using this service Apply Click Apply to save your customized settings and exit this ...

Page 106: ...low any computer to access the ZyXEL Device using this service Choose Selected to just allow the computer with the IP address that you specify to access the ZyXEL Device using this service Secured Client MAC Address Select All to allow any computer to access the ZyXEL Device using this service Choose Selected to just allow the computer with the MAC address that you specify to access the ZyXEL Devi...

Page 107: ...is allowed to communicate with the ZyXEL Device using this service Select All to allow any computer to access the ZyXEL Device using this service Choose Selected to just allow the computer with the IP address that you specify to access the ZyXEL Device using this service Secured Client MAC Address Select All to allow any computer to access the ZyXEL Device using this service Choose Selected to jus...

Page 108: ...MP Version field Configure SNMPv3 User Profile Click this to go to the SNMPv3 User Profile screen where you can configure administration and user login details SNMP Service Port You may change the server port number for a service if needed however you must use the same port number in order to use that service for remote management Service Access Select the interface s through which a computer may ...

Page 109: ...s Set Allows the manager to set values for object variables within an agent Trap Used by the agent to inform the manager of some events 11 8 2 Supported MIBs The ZyXEL Device supports MIB II that is defined in RFC 1213 and RFC 1215 as well as the proprietary ZyXEL private MIB The purpose of the MIBs is to let administrators collect statistical data and monitor status and performance 11 8 3 SNMP Tr...

Page 110: ...MIB whyReboot 1 3 6 1 4 1 890 1 5 1 3 0 1 This trap is sent with the reason for restarting before the system reboots warm start System reboot by user is added for an intentional reboot for example download new files CI command sys reboot If the system reboots because of fatal errors a code for the error is listed pwTFTPStatus 1 3 6 1 4 1 890 1 9 2 3 3 1 This trap is sent to indicate the status and...

Page 111: ...ample In the figure above the ZyXEL Device Z checks the identity of the notebook A using a certificate before granting access to the network 12 2 What You Can Do in the Certificate Screen Use the CERTIFICATES Certificate screen seen Section 12 4 on page 112 to view delete and import certificates 12 3 What You Need To Know About Certificates The certification authority certificate that you can impo...

Page 112: ...ollowing figure Figure 55 Certificate The following table describes the labels in this screen Table 35 Certificate LABEL DESCRIPTION Delete Certificate You can delete a certificate Select the certificate from the list that you want to delete Delete Click this to delete the selected certificate Import Certificate File Path Enter the location of a previously saved certificate to upload to the ZyXEL ...

Page 113: ...altered by anyone else along the way Tim generates a public key pair one public key and one private key 2 Tim keeps the private key and makes the public key openly available This means that anyone who receives a message seeming to come from Tim can read it and verify whether it is really from him or not 3 Tim uses his private key to sign the message and sends it to Jenny 4 Jenny receives the messa...

Page 114: ... saved on your computer 2 Make sure that the certificate has a cer or crt file name extension Figure 56 Certificates on Your Computer 3 Double click the certificate s icon to open the Certificate window Click the Details tab and scroll down to the Thumbprint Algorithm and Thumbprint fields Figure 57 Certificate Details 4 Use a secure method to verify that the certificate owner has the same informa...

Page 115: ...strators to effectively monitor events errors progress etc so that when network problems or system failures occur the cause or origin can be traced Logs are also essential for auditing and keeping track of changes made by users Figure 58 Accessing Logs in the Network The figure above illustrates three ways to access logs The user U can access logs directly from the ZyXEL Device A via the Web confi...

Page 116: ...ystem Errors consist of both logs and alerts You can differentiate them by their color in the View Log screen Alerts are displayed in red and logs are displayed in black Receiving Logs via E mail If you want to receive logs in your e mail account you need to have the necessary details ready such as the Server Name or Simple Mail Transfer Protocol SMTP Address of your e mail account Ensure that you...

Page 117: ... this screen to configure to where and when the ZyXEL Device is to send the logs and which logs and or immediate alerts it is to send Table 36 View Log LABEL DESCRIPTION Time This field displays the time the log was recorded Source This field lists the source IP address and the port number of the incoming packet Message This field states the reason for the log Refresh Click Refresh to renew the lo...

Page 118: ...ow If this field is left blank logs and alert messages will not be sent via e mail Mail Subject Type a title that you want to be in the subject line of the log e mail message that the ZyXEL Device sends Send Log to Logs are sent to the e mail address specified in this field If this field is left blank logs will not be sent via e mail SMTP Authentication If you use SMTP authentication the mail rece...

Page 119: ...og fills up If you select None no log messages are sent Day for Sending Log This field is only available when you select Weekly in the Log Schedule field Use the drop down list box to select which day of the week to send the logs Time for Sending Log Enter the time of the day in 24 hour format for example 23 00 equals 11 00 pm to send the logs Clear log after sending mail Select the check box to c...

Page 120: ... Station authentication failed AP received the request for authentication from station but the authentication failed Station deauthenticated AP receive the deauthenticated packet from the STA which connected with AP Station associated AP receive the association request packet from the STA which connected with AP Station disassociated AP receive the disassociation request packet from the STA which ...

Page 121: ...s log Use the sys logs category display command to show the log settings for all of the log categories Use the sys logs display log category command to show the logs in an individual ZyXEL Device log category Use the sys logs clear command to erase all of the ZyXEL Device s logs 13 7 3 Command List The following table provides the commands that can be used for your ZyXEL Device to configure the lo...

Page 122: ...le when e mail log Email User E mail user name Email Password E mail password Email Schedule E mail schedule mode Email Day E mail schedule day Email Hour E mail schedule hour Email Minute E mail schedule minute Email Clear Clear log after e mail Email Now Send e mail now KEYWORD DESCRIPTION ...

Page 123: ...s being used you should select a channel removed from it by five channels to completely avoid overlap Use the F W Upload screen see Section 14 6 on page 126 to upload the latest firmware for your ZyXEL Device Use the Configuration screen see Section 14 7 on page 127 to view information related to factory defaults backup configuration and restoring configuration Use Restart screen see Section 14 8 ...

Page 124: ...ng used you should select a channel removed from it by five channels to completely avoid overlap Click Maintenance Channel Usage to display the screen shown next Table 41 Association List LABEL DESCRIPTION This is the index number of an associated wireless station MAC Address This field displays the MAC address of an associated wireless station IP Address This identifies the individual devices on ...

Page 125: ...tion for more information on basic service sets BSS and extended service sets ESS BSSID This field displays the MAC address of the AP in an Infrastructure wireless network It is randomly generated so ignore it in an Ad Hoc wireless network Channel This is the index number of the channel currently used by the associated AP in an Infrastructure wireless network or wireless station in an Ad Hoc wirel...

Page 126: ...while firmware upload is in progress After you see the Firmware Upload in Process screen wait two minutes before logging into the ZyXEL Device again Figure 64 Firmware Upload In Process Table 43 Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it Browse Click Browse to find the bin file you want to upload Remember...

Page 127: ... your desktop Figure 65 Network Temporarily Disconnected After two minutes log in again and check your new firmware version in the System Status screen If the upload was not successful the following screen will appear Click Return to go back to the F W Upload screen Figure 66 Firmware Upload Error 14 7 Configuration Screen Use this screen to backup restore and reset the configuration of your ZyXEL...

Page 128: ...mended that you back up your configuration file before making configuration changes The backup configuration file will be useful in case you need to return to your previous settings Click Backup to save the ZyXEL Device s current configuration to your computer 14 7 2 Restore Configuration Restore configuration allows you to upload a new or previously saved configuration file from your computer to ...

Page 129: ...erating systems you may see the following icon on your desktop Figure 69 Network Temporarily Disconnected If you uploaded the default configuration file you may need to change the IP address of your computer to be in the same subnet as that of the default ZyXEL Device IP address 192 168 1 2 See your Quick Start Guide for details on how to set up your computer s IP address Browse Click Browse to fi...

Page 130: ...yXEL Device to its factory defaults as shown on the screen The following warning screen will appear Figure 71 Reset Warning Message You can also press the RESET button to reset your ZyXEL Device to its factory default settings Refer to Section 2 2 on page 30 for more information 14 8 Restart Screen Use this screen to reboot the ZyXEL Device without turning the power off Click Maintenance Restart T...

Page 131: ... the LEDs turn on 1 Make sure you are using the power adaptor or cord included with the ZyXEL Device 2 Make sure the power adaptor or cord is connected to the ZyXEL Device and plugged in to an appropriate power source Make sure the power source is turned on 3 Disconnect and re connect the power adaptor or cord to the ZyXEL Device 4 If the problem continues contact the vendor One of the LEDs does n...

Page 132: ...mputer To do this in most Windows computers click Start Run enter cmd and then enter ipconfig The IP address of the Default Gateway might be the IP address of the ZyXEL Device it depends on the network so enter this IP address in your Internet browser 3 If this does not work you have to reset the device to its factory defaults See Section 2 2 on page 30 I forgot the password 1 The default password...

Page 133: ...t Guide 6 If the problem continues contact the network administrator or vendor or try one of the advanced suggestions Advanced Suggestions Try to access the ZyXEL Device using another service such as Telnet If you can access the ZyXEL Device check the remote management settings to find out why the ZyXEL Device does not respond to HTTP If your computer is connected to the WAN port or is connected w...

Page 134: ...et access 3 If you are trying to access the Internet wirelessly make sure the wireless settings on the wireless client are the same as the settings on the AP 4 Disconnect all the cables from your device and follow the directions in the Quick Start Guide again 5 If the problem continues contact your ISP I cannot access the Internet anymore I had access to the Internet with the ZyXEL Device but my I...

Page 135: ...2 Check the signal strength If the signal is weak try moving the ZyXEL Device in wireless client mode closer to the AP if possible and look around to see if there are any devices that might be interfering with the wireless network microwaves other wireless networks and so on 3 Reboot the ZyXEL Device 4 If the problem continues contact the network administrator or vendor or try one of the advanced ...

Page 136: ...Chapter 15 Troubleshooting ZyXEL NWA 1100 User s Guide 136 ...

Page 137: ...r Adaptor Specifications 143 Setting up Your Computer s IP Address 145 Wireless LANs 157 Pop up Windows JavaScripts and Java Permissions 173 IP Addresses and Subnetting 181 Text File Based Auto Configuration 191 How to Access and Use the CLI 199 Open Software Announcements 203 Legal Information 215 Index 219 ...

Page 138: ...138 ...

Page 139: ...mperature 0 50 º C Storage Temperature 30 60 º C Operation Humidity 20 90 non condensing Storage Humidity 10 90 non condensing Dimensions 152mm x 92mm x 45mm Table 46 Firmware Specifications Default IP Address 192 168 1 2 Default Subnet Mask 255 255 255 0 24 bits Default Password 1234 Wireless LAN Standards IEEE 802 11b IEEE 802 11g Wireless security WEP WPA 2 WPA 2 PSK 802 1x STP Spanning Tree Pr...

Page 140: ...sses Wireless Association List With the wireless association list you can see the list of the wireless stations that are currently using the ZyXEL Device to access your wired network Logging and Tracing Built in message logging and packet tracing Embedded FTP and TFTP Servers The embedded FTP and TFTP servers enable fast firmware upgrades as well as configuration file backups and restoration Auto ...

Page 141: ...ust comply to IEEE 802 3af 7 Table 47 Power over Ethernet Injector Specifications Power Output 15 4 Watts maximum Power Current 400 mA maximum Table 48 Power over Ethernet Injector RJ 45 Port Pin Assignments PIN NO RJ 45 SIGNAL ASSIGNMENT 1 Output Transmit Data 2 Output Transmit Data 3 Receive Data 4 Power 5 Power 6 Receive Data 7 Power 8 Power 1 2 3 4 5 6 7 8 ...

Page 142: ...Appendix B Power over Ethernet PoE Specifications ZyXEL NWA 1100 User s Guide 142 ...

Page 143: ...wer 100 240 Volts AC 50 60 Hz 0 5 A Output Power 12 Volts DC 1 5 A 18 W Power Consumption 6 W Max Safety Standards TUV GS CE EN 60950 Table 51 United Kingdom Plug Standards AC Power Adaptor Model ADS6818 1812 D 1215 Input Power 100 240 Volts AC 50 60 Hz 0 5 A Output Power 12 Volts DC 1 5 A 18 W Power Consumption 6 W Max Safety Standards TUV GS BS EN 60950 Table 52 Australia and New Zealand Plug St...

Page 144: ...Appendix C Power Adaptor Specifications ZyXEL NWA 1100 User s Guide 144 ...

Page 145: ... IP on your computer Windows 3 1 requires the purchase of a third party TCP IP application package TCP IP should already be installed on computers using Windows NT 2000 XP Macintosh OS 7 and later operating systems After the appropriate TCP IP components are installed configure the TCP IP settings in order to communicate with your network If you manually assign IP information instead of using dyna...

Page 146: ...n Installing Components The Network window Configuration tab displays a list of installed components You need a network adapter the TCP IP protocol and Client for Microsoft Networks If you need the adapter 1 In the Network window click Add 2 Select Adapter and then click Add 3 Select the manufacturer and model of your network adapter and then click OK If you need TCP IP 1 In the Network window cli...

Page 147: ...ct Client for Microsoft Networks from the list of network clients and then click OK 5 Restart your computer so the changes you made take effect Configuring 1 In the Network window Configuration tab select your network adapter s TCP IP entry and click Properties 2 Click the IP Address tab If your IP address is dynamic select Obtain an IP address automatically If you have a static IP address select ...

Page 148: ...operties DNS Configuration 4 Click the Gateway tab If you do not know your gateway s IP address remove previously installed gateways If you have a gateway IP address type it in the New gateway field and click Add 5 Click OK to save and close the TCP IP Properties window 6 Click OK to close the Network window Insert the Windows CD if prompted 7 Turn on your ZyXEL Device and restart your computer wh...

Page 149: ...mputer s IP address subnet mask and default gateway Windows 2000 NT XP 1 For Windows XP click start Control Panel In Windows 2000 NT click Start Settings Control Panel Figure 76 Windows XP Start Menu 2 For Windows XP click Network Connections For Windows 2000 NT click Network and Dial up Connections Figure 77 Windows XP Control Panel ...

Page 150: ...Windows XP Control Panel Network Connections Properties 4 Select Internet Protocol TCP IP under the General tab in Win XP and click Properties Figure 79 Windows XP Local Area Connection Properties 5 The Internet Protocol TCP IP Properties window opens the General tab in Windows XP If you have a dynamic IP address click Obtain an IP address automatically ...

Page 151: ...s tab in IP addresses click Add In TCP IP Address type an IP address in IP address and a subnet mask in Subnet mask and then click Add Repeat the above two steps for each IP address you want to add Configure additional default gateways in the IP Settings tab by clicking Add in Default gateways In TCP IP Gateway Address type the IP address of the default gateway in Gateway To manually configure a d...

Page 152: ... servers click Advanced and then the DNS tab to order them Figure 81 Windows XP Internet Protocol TCP IP Properties 8 Click OK to close the Internet Protocol TCP IP Properties window 9 Click OK to close the Local Area Connection Properties window 10 Turn on your ZyXEL Device and restart your computer if prompted Verifying Settings 1 Click Start All Programs Accessories and then Command Prompt 2 In...

Page 153: ...ting up Your Computer s IP Address ZyXEL NWA 1100 User s Guide 153 Macintosh OS 8 9 1 Click the Apple menu Control Panel and double click TCP IP to open the TCP IP Control Panel Figure 82 Macintosh OS 8 9 Apple Menu ...

Page 154: ...ssigned settings do the following From the Configure box select Manually Type your IP address in the IP Address box Type your subnet mask in the Subnet mask box Type the IP address of your ZyXEL Device in the Router address box 5 Close the TCP IP Control Panel 6 Click Save if prompted to save changes to your configuration 7 Turn on your ZyXEL Device and restart your computer if prompted Verifying ...

Page 155: ...System Preferences window Figure 84 Macintosh OS X Apple Menu 2 Click Network in the icon bar Select Automatic from the Location list Select Built in Ethernet from the Show list Click the TCP IP tab 3 For dynamically assigned settings select Using DHCP from the Configure list Figure 85 Macintosh OS X Network 4 For statically assigned settings do the following ...

Page 156: ... your IP address in the IP Address box Type your subnet mask in the Subnet mask box Type the IP address of your ZyXEL Device in the Router address box 5 Click Apply Now and close the window 6 Turn on your ZyXEL Device and restart your computer if prompted Verifying Settings Check your TCP IP properties in the Network window ...

Page 157: ...endent network which is commonly referred to as an ad hoc network or Independent Basic Service Set IBSS The following diagram shows an example of notebook computers using wireless adapters to form an ad hoc wireless LAN Figure 86 Peer to Peer Communication in an Ad hoc Network BSS A Basic Service Set BSS exists when all communications between wireless clients or between a wireless client and a wir...

Page 158: ...tended Service Set ESS consists of a series of overlapping BSSs each containing an access point with each access point connected together by a wired network This wired connection between APs is called a Distribution System DS This type of wireless LAN topology is called an Infrastructure WLAN The Access Points not only provide communication with the wired network but also mediate wireless network ...

Page 159: ...raphical area You may have a choice of channels for your region so you should use a different channel than an adjacent AP access point to reduce interference Interference occurs when radio signals from different access points overlap causing interference and degrading performance Adjacent channels partially overlap however To avoid interference due to overlap your AP should be on a channel at leas...

Page 160: ...of messages for both stations RTS CTS is designed to prevent collisions due to hidden nodes An RTS CTS defines the biggest size data frame you can send before an RTS Request To Send CTS Clear to Send handshake is invoked When a data frame exceeds the RTS CTS value you set between 1 to 2432 bytes the station that wants to transmit this frame must first send an RTS Request To Send message to the AP ...

Page 161: ...hreshold for busy networks or networks that are prone to interference If the Fragmentation Threshold value is smaller than the RTS CTS value see previously you set then the RTS Request To Send CTS Clear to Send handshake will never occur as data frames will be fragmented before they reach RTS CTS size Preamble Type Preamble is used to signal that data is coming to the receiver Short and Long refer...

Page 162: ...n wireless client authentication restricting access by device MAC address and hiding the ZyXEL Device identity The following figure shows the relative effectiveness of these wireless security methods available on your ZyXEL Device Note You must enable the same wireless security settings on the ZyXEL Device and on all wireless clients that you want to associate with it Table 53 IEEE 802 11g DATA RA...

Page 163: ...the wireless clients RADIUS RADIUS is based on a client server model that supports authentication authorization and accounting The access point is the client and the server is the RADIUS server The RADIUS server handles the following tasks Authentication Determines the identity of the users Authorization Determines the network services available to authenticated users once they are connected to th...

Page 164: ...and LEAP Your wireless LAN device may not support all authentication types EAP Extensible Authentication Protocol is an authentication protocol that runs on top of the IEEE 802 1x transport mechanism in order to support multiple types of user authentication By using EAP to interact with an EAP compatible RADIUS server an access point helps a wireless station and a RADIUS server perform authenticat...

Page 165: ...ssive attacks A digital certificate is an electronic ID card that authenticates the sender s identity However to implement EAP TLS you need a Certificate Authority CA to handle certificates which imposes a management overhead EAP TTLS Tunneled Transport Layer Service EAP TTLS is an extension of the EAP TLS authentication that uses certificates for only the server side authentications to establish ...

Page 166: ...2 Wi Fi Protected Access WPA is a subset of the IEEE 802 11i standard WPA2 IEEE 802 11i is a wireless security standard that defines stronger encryption authentication and key management than WPA Key differences between WPA or WPA2 and WEP are improved data encryption and user authentication If both an AP and the wireless clients support WPA2 and you have an external RADIUS server use WPA2 for str...

Page 167: ...Pairwise Master Key PMK key to the AP that then sets up a key hierarchy and management system using the PMK to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients This all happens in the background automatically The Message Integrity Check MIC is designed to prevent an attacker from capturing data pac...

Page 168: ...tication enables fast roaming by allowing the wireless client already connecting to an AP to perform IEEE 802 1x authentication with another AP before connecting to it Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA At the time of writing the most widely available supplicant is the WPA patc...

Page 169: ...wireless clients Figure 90 WPA 2 with RADIUS Application Example WPA 2 PSK Application Example A WPA 2 PSK application looks as follows 1 First enter identical passwords into the AP and all wireless clients The Pre Shared Key PSK must consist of between 8 and 63 ASCII characters or 64 hexadecimal characters including spaces and symbols 2 The AP checks each wireless client s password and only allow...

Page 170: ...l type MAC address filters are not dependent on how you configure these security features Table 56 Wireless Security Relational Matrix AUTHENTICATION METHOD KEY MANAGEMENT PROTOCOL ENCRYPTIO N METHOD ENTER MANUAL KEY IEEE 802 1X Open None No Disable Enable without Dynamic WEP Key Open WEP No Enable with Dynamic WEP Key Yes Enable without Dynamic WEP Key Yes Disable Shared WEP No Enable with Dynami...

Page 171: ...overage area Antenna Gain Antenna gain measured in dB decibel is the increase in coverage within the RF beam width Higher antenna gain improves the range of the signal for better communications For an indoor site each 1 dB increase in antenna gain results in a range increase of approximately 2 5 For an unobstructed outdoor site each 1dB increase in gain results in a range increase of approximately...

Page 172: ...grees very directional to 120 degrees less directional Directional antennas are ideal for hallways and outdoor point to point applications Positioning Antennas In general antennas should be mounted as high as practically possible and free of obstructions In point to point application position both antennas at the same height and in a direct line of sight to each other to attain the best performanc...

Page 173: ...rnet Explorer versions may vary Internet Explorer Pop up Blockers You may have to disable pop up blocking to log into your device Either disable pop up blocking enabled by default in Windows XP SP Service Pack 2 or allow pop up blocking and create an exception for your device s IP address Disable pop up Blockers 1 In Internet Explorer select Tools Pop up Blocker and then select Turn Off Pop up Blo...

Page 174: ...x in the Pop up Blocker section of the screen This disables any web pop up blockers you may have enabled Figure 93 Internet Options Privacy 3 Click Apply to save this setting Enable pop up Blockers with Exceptions Alternatively if you only want to allow pop up windows from your device see the following steps 1 In Internet Explorer select Tools Internet Options and then the Privacy tab ...

Page 175: ...EL NWA 1100 User s Guide 175 2 Select Settings to open the Pop up Blocker Settings screen Figure 94 Internet Options Privacy 3 Type the IP address of your device the web page that you do not want to have blocked with the prefix http For example http 192 168 167 1 ...

Page 176: ...ck Add to move the IP address to the list of Allowed sites Figure 95 Pop up Blocker Settings 5 Click Close to return to the Privacy screen 6 Click Apply to save this setting JavaScripts If pages of the web configurator do not display properly in Internet Explorer check that JavaScripts are allowed ...

Page 177: ...xplorer click Tools Internet Options and then the Security tab Figure 96 Internet Options Security 2 Click the Custom Level button 3 Scroll down to Scripting 4 Under Active scripting make sure that Enable is selected the default 5 Under Scripting of Java applets make sure that Enable is selected the default ...

Page 178: ...lick OK to close the window Figure 97 Security Settings Java Scripting Java Permissions 1 From Internet Explorer click Tools Internet Options and then the Security tab 2 Click the Custom Level button 3 Scroll down to Microsoft VM 4 Under Java permissions make sure that a safety level is selected ...

Page 179: ...ions ZyXEL NWA 1100 User s Guide 179 5 Click OK to close the window Figure 98 Security Settings Java JAVA Sun 1 From Internet Explorer click Tools Internet Options and then the Advanced tab 2 Make sure that Use Java 2 for applet under Java Sun is selected ...

Page 180: ...Appendix F Pop up Windows JavaScripts and Java Permissions ZyXEL NWA 1100 User s Guide 180 3 Click OK to close the window Figure 99 Java Sun ...

Page 181: ...ber and the other part is the host ID In the same way that houses on a street share a common street name the hosts on a network share a common network number Similarly as each house has its own house number each host on the network has its own unique identifying number the host ID Routers use the network number to send packets to the correct network while the host ID determines to which host on th...

Page 182: ...and which bits are part of the host ID using a logical AND operation The term subnet is short for sub network A subnet mask has 32 bits If a bit in the subnet mask is a 1 then the corresponding bit in the IP address is part of the network number If a bit in the subnet mask is 0 then the corresponding bit in the IP address is part of the host ID The following example shows a subnet mask identifying...

Page 183: ...k number determines the maximum number of possible hosts you can have on your network The larger the number of network number bits the smaller the number of remaining host ID bits An IP address with host IDs of all zeros is the IP address of the network 192 168 1 0 with a 24 bit subnet mask for example An IP address with host IDs of all ones is the broadcast address for that network 192 168 1 255 ...

Page 184: ...ess For example 192 1 1 0 25 is equivalent to saying 192 1 1 0 with subnet mask 255 255 255 128 The following table shows some possible subnet masks using both notations Table 59 Maximum Host Numbers SUBNET MASK HOST ID SIZE MAXIMUM NUMBER OF HOSTS 8 bits 255 0 0 0 24 bits 224 2 16777214 16 bits 255 255 0 0 16 bits 216 2 65534 24 bits 255 255 255 0 8 bits 28 2 254 29 bits 255 255 255 2 48 3 bits 2...

Page 185: ... is 192 168 1 0 The first three octets of the address 192 168 1 are the network number and the remaining octet is the host ID allowing a maximum of 28 2 or 254 possible hosts The following figure shows the company network before subnetting Figure 101 Subnetting Example Before Subnetting You can borrow one of the host ID bits to divide the network 192 168 1 0 into two separate sub networks The subn...

Page 186: ...55 255 128 is subnet A itself and 192 168 1 127 with mask 255 255 255 128 is its broadcast address Therefore the lowest IP address that can be assigned to an actual host for subnet A is 192 168 1 1 and the highest is 192 168 1 126 Similarly the host ID range for subnet B is 192 168 1 129 to 192 168 1 254 Example Four Subnets The previous example illustrated using a 25 bit subnet mask to divide a 2...

Page 187: ...MBER LAST OCTET BIT VALUE IP Address 192 168 1 64 IP Address Binary 11000000 10101000 00000001 01000000 Subnet Mask Binary 11111111 11111111 11111111 11000000 Subnet Address 192 168 1 64 Lowest Host ID 192 168 1 65 Broadcast Address 192 168 1 127 Highest Host ID 192 168 1 126 Table 63 Subnet 3 IP SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192 168 1 128 IP Address Binary 11000000 10...

Page 188: ...s 192 168 1 255 Highest Host ID 192 168 1 254 Table 64 Subnet 4 continued IP SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE Table 65 Eight Subnets SUBNET SUBNET ADDRESS FIRST ADDRESS LAST ADDRESS BROADCAST ADDRESS 1 0 1 30 31 2 32 33 62 63 3 64 65 94 95 4 96 97 126 127 5 128 129 158 159 6 160 161 190 191 7 192 193 222 223 8 224 225 254 255 Table 66 24 bit Network Number Subnet Planning NO BORROWE...

Page 189: ...e please do not use any other number unless you are told otherwise You must also enable Network Address Translation NAT on the ZyXEL Device Once you have decided on the network number pick an IP address for your ZyXEL Device that is easy to remember for instance 192 168 1 1 but make sure that no other device on your network is using that IP address The subnet mask specifies the network number port...

Page 190: ...rivate networks 10 0 0 0 10 255 255 255 172 16 0 0 172 31 255 255 192 168 0 0 192 168 255 255 You can obtain your IP address from the IANA from an ISP or it can be assigned from a private network If you belong to a small organization and your Internet access is through an ISP the ISP can provide you with the Internet addresses for your local networks On the other hand if you are part of a much lar...

Page 191: ...w You can use plain text configuration files to configure the wireless LAN settings on multiple APs The AP can automatically get a configuration file from a TFTP server at startup or after renewing DHCP client information Figure 103 Text File Based Auto Configuration Use one of the following methods to give the AP the IP address of the TFTP server where you store the configuration files and the na...

Page 192: ...ver IP address and a filename the AP will try to download the file from the specified TFTP server The AP then uses the file to configure wireless LAN settings Note Not all DHCP servers allow you to specify options 66 and 67 Configuration Via SNMP You can configure and trigger the auto configuration remotely via SNMP Use the following procedure to have the AP download the configuration file Table 6...

Page 193: ...ile version The AP compares the file version with the version of the last configuration file that it downloaded If the version of the downloaded file is the same or smaller older the AP ignores the file If the version of the downloaded file is larger newer the AP uses the file Configuration File Rules You can only use the wlan and wcfg commands in the configuration file The AP ignores other ZyNOS ...

Page 194: ...hem You can zip each configuration file You must use the store compression method and a zip file extension When zipping a configuration file you can also add password protection using the same password that you use to log into the AP Wcfg Command Configuration File Examples These example configuration files use the wcfg command to configure security and SSID profiles Figure 105 WEP Configuration F...

Page 195: ...adius 2 primary 172 23 3 4 1812 1234 enable wcfg radius 2 backup 172 23 3 5 1812 1234 enable wcfg radius save wcfg ssid 2 name ssid 8021x wcfg ssid 2 security Test 8021x wcfg ssid 2 radius radius rd wcfg ssid 2 qos 4 wcfg ssid 2 l2isolation disable wcfg ssid 2 macfilter disable wcfg ssid save ZYXEL PROWLAN VERSION 13 wcfg security 3 name Test wpapsk wcfg security 3 mode wpapsk wcfg security 3 pass...

Page 196: ...e applied in order So for example you would place the commands that create security and SSID profiles before the commands that tell the AP to use those profiles Figure 109 Wlan Configuration File Example ZYXEL PROWLAN VERSION 14 wcfg security 4 name Test wpa wcfg security 4 mode wpa wcfg security 4 reauthtime 1800 wcfg security 4 idletime 3600 wcfg security 4 groupkeytime 1800 wcfg security save w...

Page 197: ...ssid 3 security Test wpapsk wcfg ssid 4 name ssid wpa2psk wcfg ssid 4 security Test wpa2psk wcfg ssid save line starting with is comment change to channel 8 wlan chid 8 change operating mode AP mode then select ssid wep as running WLAN profile wlan opmode 0 wlan ssidprofile ssid wep change operating mode MBSSID mode then select ssid wpapsk ssid wpa2psk as running WLAN profiles wlan opmode 3 wlan s...

Page 198: ...Appendix H Text File Based Auto Configuration ZyXEL NWA 1100 User s Guide 198 ...

Page 199: ... one or more routers In the latter case make sure remote management of the ZyXEL Device is allowed via Telnet Logging in Use the administrator username and password If this is your first login use the default values in some ZyXEL Device models you may not need to enter the user name The ZyXEL Device automatically logs you out of the management interface after five minutes of inactivity If this hap...

Page 200: ... in sys datetime date year month date year month date can be replaced by the actual year month and date that you want to set for example 2007 08 15 A key stroke is denoted by square brackets and uppercase text for example ENTER means the Enter or Return key on your keyboard cr means press the ENTER key An arrow indicates that this line is a continuation of the previous line A long list of pre defi...

Page 201: ...d Getting Help This table identifies some shortcuts in the CLI as well as how to get help Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable Use the help command to view the executable commands on the ZyXEL Device Follow these steps to create a list of supported commands 1 Log into the CLI Table 76 CLI Shortcuts and Help COMMAND KEY S DESCRIPTION y...

Page 202: ...figuration In the ZyXEL Device some commands are saved as you run them and others require you to run a save command See the related section of this guide to see if a save command is required Note Unsaved configuration changes are lost once you restart the ZyXEL Device Logging Out Use the exit command to log out of the CLI ras help alarm chsh config exit ip statistics switch sys voip ras ...

Page 203: ...m copies of this license document but changing it is not allowed Preamble The licenses for most software are designed to take away your freedom to share and change it By contrast the GNU General Public License is intended to guarantee your freedom to share and change free software to make sure the software is free for all its users This General Public License applies to most of the Free Software F...

Page 204: ...gram will individually obtain patent licenses in effect making the program proprietary To prevent this we have made it clear that any patent must be licensed for everyone s free use or not licensed at all The precise terms and conditions for copying distribution and modification follow TERMS AND CONDITIONS FOR COPYING DISTRIBUTION AND MODIFICATION This License applies to any program or other work ...

Page 205: ...stribute the program under these conditions and telling the user how to view a copy of this License Exception if the Program itself is interactive but does not normally print such an announcement your work based on the Program is not required to print an announcement These requirements apply to the modified work as a whole If identifiable sections of that work are not derived from the Program and ...

Page 206: ... unless that component itself accompanies the executable If distribution of executable or object code is made by offering access to copy from a designated place then offering equivalent access to copy the source code from the same place counts as distribution of the source code even though third parties are not compelled to copy the source along with the object code You may not copy modify sublice...

Page 207: ...te software through any other system and a licensee cannot impose that choice This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License If the distribution and or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces the original copyright holder who places the Program under this License may add...

Page 208: ...NCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES END OF TERMS AND CONDITIONS All other tr...

Page 209: ...software under BSD license BSD Copyright c dates as appropriate to package The Regents of the University of California All rights reserved Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaime...

Page 210: ...TALLED SOFTWARE AND PACKAGING TO THE PLACE FROM WHICH IT WAS ACQUIRED AND YOUR MONEY WILL BE REFUNDED 1 1 Grant of License for Personal Use ZyXEL Communications Corp ZyXEL grants you a non exclusive non sublicense non transferable license to use the program with which this license is distributed the Software including any documentation files accompanying the Software Documentation for internal bus...

Page 211: ...t code for the Software Except as and only to the extent expressly permitted in this License by applicable licensing terms governing use of the Open Sourced Components or by applicable law you may not market co brand private label or otherwise permit third parties to link to the Software or any part thereof You may not use the Software or any part thereof in the operation of a service bureau or fo...

Page 212: ...A COURT OF COMPETENT JURISDICTION THEN ALL EXPRESS AND IMPLIED WARRANTIES SHALL BE LIMITED IN DURATION TO A PERIOD OF THIRTY 30 DAYS FROM THE DATE OF PURCHASE OF THE SOFTWARE AND NO WARRANTIES SHALL APPLY AFTER THAT PERIOD 7 Limitation of Liability IN NO EVENT WILL ZyXEL BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES INCLUDING WITHOUT LIMITATION INDIRECT SPECIAL PU...

Page 213: ...t Upon notification of termination you agree to destroy or return to ZyXEL all copies of the Software and Documentation and to certify in writing that all known copies including backup copies have been destroyed All provisions relating to confidentiality proprietary rights and non disclosure shall survive the termination of this Software License Agreement 10 General This License Agreement shall be...

Page 214: ...Appendix J Open Software Announcements ZyWALL USG 300 User s Guide 214 ...

Page 215: ...arising out of the application or use of any products or software described herein Neither does it convey any license under its patent rights nor the patent rights of others ZyXEL further reserves the right to make changes in any products described herein without notice This publication is subject to change without notice Trademarks ZyNOS ZyXEL Network Operating System is a registered trademark of...

Page 216: ...vice off and on the user is encouraged to try to correct the interference by one or more of the following measures 1 Reorient or relocate the receiving antenna 2 Increase the separation between the equipment and the receiver 3 Connect the equipment into an outlet on a circuit different from that to which the receiver is connected 4 Consult the dealer or an experienced radio TV technician for help ...

Page 217: ...terials or workmanship for a period of up to two years from the date of purchase During the warranty period and upon proof of purchase should the product have indications of failure due to faulty workmanship and or materials ZyXEL will at its discretion repair or replace the defective products or components without charge for either parts or labor and to whatever extent it shall deem necessary to ...

Page 218: ...turned products without proof of purchase or those with an out dated warranty will be repaired or replaced at the discretion of ZyXEL and the customer will be billed for parts and labor All repaired or replaced products will be shipped by ZyXEL to the corresponding return address Postage Paid This warranty gives you specific legal rights and you may also have other rights that vary from country to...

Page 219: ...o Configuration Status 194 B Basic Service Set 56 see BSS beacon 57 Beacon Interval 59 BPDU 69 Bridge 21 Bridge loops 23 bridged APs security 21 BSS 56 157 C CA 165 Certificate authentication 111 file format 111 Certificate Authority See CA Certificate Screen 111 certificate based authentications 166 Certificates Fingerprint 114 MD5 114 public key 111 SHA1 114 Certification Authority 113 Certifica...

Page 220: ...ing 30 FCC interference statement 215 File Version 193 Firmware 123 Firmware uploading via web configurator 126 Fragmentation 60 63 66 Fragmentation threshold 70 161 FTP 103 restrictions 103 G Generic Token Card 76 GTC 76 H handshake 160 help in the CLI 201 Hidden node 160 Hide SSID 59 Humidity 139 I IANA 99 190 IBSS 157 IEEE 802 11g 162 IEEE 802 1x 57 Import Certificate 112 Independent Basic Serv...

Page 221: ...ss of messages 160 M MAC Address Clone 62 MAC Filter Allow Association 93 Deny Association 93 MAC Filter Screen 93 MAC filtering 140 Maintenance 123 Association List 124 Backup 128 Channel Usage 124 Configuration 127 F W Upload 126 Restart 130 Restore 128 Management Information Base MIB 109 managing the device using Telnet See command interface using the command interface See command interface Med...

Page 222: ... IP Address 91 Accounting Server Port 91 Backup 91 Primary 91 Server IP Address 91 Server Port 91 Share Secret 91 RADIUS server 74 Rates Configuration 60 63 66 registration product 218 Related documentation 3 Remote Authentication Dial In User Service 89 remote management 25 remote management limitations 102 Reset button 139 Rijndael 167 RJ 45 Port Pin Assignments 141 Roaming 71 root path cost 69 ...

Page 223: ...16 System Screens 47 General 49 Inactivity Timer 50 System DNS Servers 50 Password 50 Time 51 Daylight Savings 52 NTP client 52 Time and Date Setup 51 Time Server user defined 52 Time Zone 52 system timeout 104 T telnet 104 Telnet accessing the CLI 199 Temperature 139 Temporal Key Integrity Protocol 75 Temporal Key Integrity Protocol TKIP 167 Text file based auto configuration 140 191 TFTP restric...

Page 224: ...Screen 55 Access Point Mode 58 Antenna 71 AP Bridge Mode 67 Bridge Mode 63 BSS 56 Channel 57 ESS 56 Fragmentation Threshold 70 Intra BSS Traffic 70 Operating Mode 56 Preamble 70 Quality of Service 68 Roaming 71 RTS CTS Threshold 70 SSID 57 Wi Fi MultiMedia 68 Wireless Client Mode 61 Wireless Mode 57 WMM QoS 68 WLAN interference 159 security parameters 170 WMM 60 WMM QoS 60 68 WPA 75 166 key cachin...

Page 225: ...Index ZyXEL NWA 1100 User s Guide 225 ...