Home

NXC2500 User's Guide

1. Exceptional This table allows you to configure exceptions to the captive portal interception of network Services traffic Add Click to add a service that is allowed to by pass the captive portal This allows certain networking features such as being able to connect to a DNS server one of the pre configured default exceptions to remain unhindered Remove Select an exception from the table then click this button to remove it Once removed all traffic from the specified protocol goes back to being intercepted by the captive portal This is the index number of the Exceptional Services list entry Exceptional This column lists the services that you have flagged as exceptions to captive portal Services interception Authentication Policy Summary This table defines how captive portal interception is implemented using the source IPs and destination IPs that you specify Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Activate To turn on an entry select it and click Activate NXC2500 User s Guide Chapter 14 Captive Portal Table 75 Configuration gt Captive Portal continued LABEL DESCRIPTION Inactivate To turn off an entry select it and click Inactiv
2. TELNE changed to default perk port has been An administrator changed the port number for TELNET back to the default 23 NXC2500 User s Guide Appendix A Log Descriptions Table 175 Built in Services Logs continued LOG MESSAGE DESCRIPTION FTP certificate s does not exist An administrator assigned a nonexistent certificate to FTP s is certificate name assigned by user FTP port has been changed to port s An administrator changed the port number for FTP s is port number assigned by user P port has been hanged to default An administrator changed the port number for FTP back to the default 21 P port has been Ba c port S changed to port s An administrator changed the port number for SNMP s is port number assigned by user P port has been hanged to default An administrator changed the port number for SNMP back to the default 161 onsole baud has been hanged to s S e port e el An administrator changed the console port baud rate s is baud rate assigned by user Console baud has been reset to d An administrator changed the console port baud rate back to the default 115200 d is default baud rate DHCP Server on Interface s will not work due to Device HA status is Stand By If interface is stand by mode for device HA DHCP server can t be run Otherwise it has conflict
3. The Address Group summary screen Section 18 3 on page 211 and the Address Group Add Edit screen maintain address groups in the NXC 18 1 2 What You Need To Know The following terms and concepts may help as you read this chapter Addresses Address objects and address groups are used in dynamic routes Please see the respective sections for more information about how address objects and address groups are used in each one Address groups are composed of address objects and address groups The sequence of members in the address group is not important 18 2 Address Summary The address screens are used to create maintain and remove addresses There are the types of address objects HOST a host address is defined by an IP Address e RANGE a range address is defined by a Starting I P Address and an Ending IP Address SUBNET a network address is defined by a Network IP address and Netmask subnet mask NXC2500 User s Guide Chapter 18 Addresses The Address screen provides a summary of all addresses in the NXC To access this screen click Configuration gt Object gt Address gt Address Click a column s heading cell to sort the table entries by that column s criteria Click the heading cell again to reverse the sort order Figure 116 Configuration gt Object gt Address gt Address Summary Address Group IPv4 Address Configuration Qadd est i Name 1 LAN_SUBNET Page 1 Type IPv4 Addr
4. Chapter 6 Registration 88 license key in this screen Click Configuration gt Licensing gt Registration gt Service to open the screen as shown next Figure 41 I License Status Service 1 MAPS Page 1 Jof License Activation License Key Service License Refresh Note Update device license information from myZyXEL com server Configuration gt Licensing gt Registration gt Service v Status Registration Type Expiration Date Count Not Licensed 8 Show 50 v items Displaying 1 2 of 2 The following table describes the labels in this screen Table 42 Configuration gt Licensing gt Registration gt Service LABEL DESCRIPTION License Status This is the entry s position in the list Service This lists the services that are available on the NXC Status This field displays whether a service is activated Licensed or not Not Licensed or expired Expired Registration Type This field displays whether you applied for a trial application Trial or registered a service with your iCard s PIN number Standard This field is blank when a service is not activated Expiration date Count License Upgrade This field displays the date your service expires This field displays how many managed APs the NXC can support with your current license This field does not apply to the other services License Key Enter your iCard s PIN number and click
5. LABEL DESCRIPTION Radio 1 2 Profile Create new Object menu Select a profile from the list If no profile exists you can create a new one through the Force Overwrite Select this to have the NXC change the AP s management VLAN to match the VLAN Config configuration in this screen Management VLAN Enter a VLAN ID for this AP ID As Native VLAN assigned to it from outside the network Select this option to treat this VLAN ID as a VLAN created on the NXC and not one OK Click OK to save your changes back to the NXC Cancel Click Cancel to close the window with changes unsaved 7 4 MON Mode Use this screen to assign APs either to the rogue AP list or the friendly AP list A rogue AP is a wireless access point operating in a network s coverage area that is not under the control of the network administrator and which can potentially open up holes in a network s security Click Configuration gt Wireless gt MON Mode to access this screen Figure 45 Configuration gt Wireless gt MON Mode Rogue Friendly AP List Rogue Friendly AP List add Lj Role MAC Address Description 1 friendly ap 00 A0 C5 01 23 45 test Page 1 of 1 Show 50 v items Rogue AP List Importing Exporting File Path Select a file path for Rogue AP List Browse Exporting Friendly AP List Importing Exporting File Path Select a file path for Friendly AP List Browse Exporting Eac
6. LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Service Control table to access the NXC CLI using this service Server Port You may change the server port number for a service if needed however you must use the same port number in order to use that service for remote management Service Control This specifies from which computers you can access which NXC zones Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This the index number of the service control rule The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy Zone This is t
7. Table 51 Configuration gt Network gt Interface gt Ethernet gt Edit continued LABEL DESCRIPTION DHCP Select what type of DHCP service the NXC provides to the network Choices are None the NXC does not provide any DHCP services There is already a DHCP server on the network DHCP Relay the NXC routes DHCP requests to one or more DHCP servers you specify The DHCP server s may be on another network DHCP Server the NXC assigns IP addresses and provides subnet mask gateway and DNS server information to the network The NXC is the DHCP server for the network These fields appear if the NXC is a DHCP Relay Relay Server 1 Enter the IP address of a DHCP server for the network Relay Server 2 This field is optional Enter the IP address of another DHCP server for the network These fields appear if the NXC is a DHCP Server IP Pool Start Enter the IP address from which the NXC begins allocating IP addresses If you want to Address assign a static IP address to a specific computer use the Static DHCP Table If this field is blank the Pool Size must also be blank In this case the NXC can assign every IP address allowed by the interface s IP address and subnet mask except for the first address network address last address broadcast address and the interface s IP address Pool Size Enter the number of IP addresses to allocate This number must be at least one and is lim
8. Enable X 509v3 CRL Distribution Points and OCSP checking Select this check box to have the NXC check incoming certificates that are signed by this certificate against a Certificate Revocation List CRL or an OCSP server You also need to configure the OSCP or LDAP server details OCSP Server Select this check box if the directory server uses OCSP Online Certificate Status Protocol URL Type the protocol IP address and pathname of the OCSP server ID The NXC may need to authenticate itself in order to assess the OCSP server Type the login name up to 31 ASCII characters from the entity maintaining the server usually a certification authority Password Type the password up to 31 ASCII characters from the entity maintaining the OCSP server usually a certification authority LDAP Server Select this check box if the directory server uses LDAP Lightweight Directory Access Protocol LDAP is a protocol over TCP that specifies how clients access directories of certificates and lists of revoked certificates Address Type the IP address in dotted decimal notation of the directory server Port Use this field to specify the LDAP server port number You must use the same server port number that the directory server uses 389 is the default server port number for LDAP ID The NXC may need to authenticate itself in order to assess the CRL directory server Type the login name up to 31 ASCII characte
9. Note Both the Active Directory and LDAP screens while on separate tabs are identical in configuration This section applies to both equally Click Configuration gt Object gt AAA Server gt Active Directory LDAP to display the Active Directory LDAP screen Figure 130 Configuration gt Object gt AAA Server gt Active Directory LDAP AD Server Summary Q Add Est i Name Server Address Base DN 1 ad Page 1 of i Show 50 items Displaying 1 1 of 1 The following table describes the labels in this screen Table 116 Configuration gt Object gt AAA Server gt Active Directory LDAP LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Select an entry and click Object Reference to open a screen that shows which settings Reference use the entry This field displays the index number Name This is the name that you specified to identify the server 230 NXC2500 User s Guide Chapter 21 AAA Server Table 116 Configuration gt Object gt AAA Server gt Active Directory LDAP continued LABEL DESCRIPTION Server Address This is the address of the AD or LDAP server Base DN This specifies a directory For example
10. Speed This field displays the connection speed the USB storage device supports Status Ready you can have the NXC use the USB storage device Click Remove Now to stop the NXC from using the USB storage device so you can remove it Unused the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the NXC cannot mount it Click Use It to have the NXC mount a connected USB storage device This button is grayed out if the file system is not supported unknown by the NXC none no USB storage device is connected Detail This field displays any other information the NXC retrieves from the USB storage device Deactivated the use of a USB storage device is disabled turned off on the NXC OutofSpace the available disk space is less than the disk space full threshold see Section 24 3 on page 260 for how to configure this threshold Mounting the NXC is mounting the USB storage device Removing the NXC is unmounting the USB storage device none the USB device is operating normally or not connected 72 NXC2500 User s Guide Chapter 5 Monitor 5 11 AP List Use this screen to view which APs are currently connected to the NXC To access this screen click Monitor gt Wireless gt AP Information gt AP List Figure 31 Monitor gt Wireless gt AP Information gt AP List Radio List Status Registration IP Address MAC Address Model Mgnt VLAN
11. d the policy route rule number The policy route Sd Use an empty object group uses E servic d the policy route rule number group Policy route rule d Rules is inserted into system yas inserted d the policy route rule number Policy route rule d Rules is appended into system vas appended d the policy route rule number Policy route rule d Rule is modified AS d the policy route rule number Policy route rule d Rule is moved was moved to d 1st d the original policy route rule number 2nd d the new policy route rule number NXC2500 User s Guide 367 Appendix A Log Descriptions Table 174 Policy Route Logs continued LOG MESSAGE DESCRIPTION Policy route rule d was deleted Rule is deleted d the policy route rule number Policy route rules were flushed Policy routing rules are cleared BWM has been activated The global setting for bandwidth management on the NXC has been turned on BWM has been deactivated The global setting for bandwidth management on the NXC has been turned off Table 175 Built in Services Logs LOG MESSAGE DESCRIPTION User on Su u Su Su has been denied access from s HTTP HTTPS TELNET SSH FTP SNMP access to the device was denied u u u u is IP address s is HTTP HTTPS SSH SNMP FTP TELNET HTTPS certificate s does not exist HTTPS s
12. A wireless client cannot be authenticated through the Captive Portal If the Captive Portal redirects a wireless client to a failed login page or an internal server error page then the authentication server may not be reachable Make sure that the NXC can reach it if is external to the LAN by opening the Console Window and pinging the server s IP address If Captive Portal is using the external web portal e Make sure the Captive Portal configuration pointing to it is correct You must configure the Login URL field e Check that the external Web server is configured properly NXC2500 User s Guide 355 Chapter 31 Troubleshooting Itis recommended to have the external web server on the same subnet as the login users The NXC sends wireless clients the default logout page instead of a login page Make sure you have configured the Captive Portal external web portal s Login URL field correctly Wireless clients are not being load balanced among my APs e Make sure that all the APs used by the wireless clients in question share the same SSID security and radio settings e Make sure that all the APs are in the same broadcast domain Make sure that the wireless clients are in range of the other APs if they are only in range of a single AP then load balancing may not be as effective In the Monitor gt Wireless gt AP Info gt AP List screen there is no load balancing indicator associated wi
13. Chapter 31 Troubleshooting NXC2500 User s Guide Log Descriptions This appendix provides descriptions of example log messages The ZySH logs deal with internal system errors Table 170 ZySH Logs LOG MESSAGE DESCRIPTION Invalid message queue Maybe someone starts another zysh daemon ZySH daemon is 1st pid num instructed to reset by Sd System integrity error Group OPS cannot close property group cannot close group Ss cannot get size of 1st zysh group name group s cannot specify 1st zysh group name 2st zysh entry name properties for entry s s cannot join group 1st zysh group name 2st zysh group name Ss loop detected cannot create too many 1st max group num groups gt d s cannot find entry 1st zysh group name 2st zysh entry name Ss de ol s Cannot remove entry 1st zysh group name 2st zysh entry name Ss oe ol List OPS can t alloc entry bs 1st zysh entry name can t retrieve entry 1st zysh entry name ss can t get entry s 1st zysh entry name can t print entry 5 s 1st zysh entry name s cannot retrieve 1st zysh list name entries from list Can t get name for 1st zysh entry index entry d NXC2500 User s Guide Appendix A Log Descriptions Table 170 ZySH Logs continued LOG MESSAGE DESCRIPTION can t get reference count s 1st zysh list name
14. Enable Logs Select this option to have the NXC generate a log if a device connected to this interface for IP MAC attempts to use an IP address not assigned by the NXC Binding Violation Static DHCP This table lists the bound IP and MAC addresses The NXC checks this table when it assigns Bindings IP addresses If the computer s MAC address is in the table the NXC assigns the corresponding IP address You can also access this table from the interface s edit screen Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so This is the index number of the static DHCP entry NXC2500 User s Guide Chapter 13 IP MAC Binding Table 71 Configuration gt Network gt P MAC Binding gt Edit continued LABEL DESCRIPTION IP Address This is the IP address that the NXC assigns to a device with the entry s MAC address MAC Address This is the MAC address of the device to which the NXC assigns the entry s IP address Description This helps identify the entry OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving 13 2 2 Add Edit Static DHCP Rule Click Configuration gt Network gt P MAC Binding
15. General Details Certification Path Certificate Information This CA Root certificate is not trusted To enable trust install this certificate in the Trusted Root Certification Authorities store Issued to nsa2401 Issued by nsa2401 Valid from 5 20 2008 to 5 20 2011 5 Welcome to the Certificate Import Wizard This wizard helps you copy certificates certificate trust lists and certificate revocation lists from your disk to a certificate store A certificate which is issued by a certification authority is a confirmation of your identity and contains information used to protect data or to establish secure network connections A certificate store is the system area where certificates are kept To continue dick Next NXC2500 User s Guide Appendix C Importing Certificates 6 7 8 If you want Internet Explorer to Automatically select certificate store based on the type of certificate click Next again and then go to step 9 Certificate Import Wizard Certificate Store Certificate stores are system areas where certificates are kept Windows can automatically select a certificate store or you can specify a location for 2 Automatically select the certificate store based on the type of certificate Place all certificates in the following store Otherwise select Place all certificates in the following store and then click Browse Place all certific
16. The disassociation priority is determined automatically by the NXC and is as follows e Idle Timeout Devices that have been idle the longest will be disassociated first If none of the connected devices are idle then the priority shifts to Signal Strength Signal Strength Devices with the weakest signal strength will be disassociated first Note If you enable this function you should ensure that there are multiple APs within the broadcast radius that can accept any rejected or kicked wireless clients otherwise a wireless client attempting to connect to an overloaded AP will be kicked continuously and never be allowed to connect NXC2500 User s Guide Chapter 7 Wireless Table 48 Configuration gt Wireless gt Load Balancing continued LABEL DESCRIPTION Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 7 5 1 Disassociating and Delaying Connections When your AP becomes overloaded there are two basic responses it can take The first one is to delay a client connection This means that the AP withholds the connection until the data transfer throughput is lowered or the client connection is picked up by another AP If the client is picked up by another AP then the original AP cannot resume the connection For example here the AP has a balanced bandwidth allotment of 6 Mbps If laptop R connects and it pushes the
17. a g pa lt The following table describes the labels in this screen Table 90 Guest Manager Login LABEL DESCRIPTION Create account Enter the number up to 32 of dynamic guest accounts you want to create Guest Name This field is available only when you want to create one account Enter the name for the guest account Phone This field is available only when you want to create one account Enter the telephone number for the guest account E mail This field is available only when you want to create one account Enter the E mail address for the guest account Company Enter the company name up to 64 characters for the guest account s Address Enter the geographic address up to 64 characters for the guest account s Other Enter the additional information up to 60 characters for the guest account s Account Select the date when the account s becomes invalid Expiration Date Account Select the time when the account s becomes invalid Expiration Time Dynamic Guest Select the dynamic guest group with which the dynamic guest account s is associated User Group Apply Click this icon to create the account s Logout Click this icon to exit and go back to the Web Configurator login screen NXC2500 User s Guide Chapter 15 User Group 15 4 4 1 Guest Account List After you click Apply to create dynamic guest accounts the following guest account list screen ap
18. 1 Tim wants to send a message to Jenny He needs her to be sure that it comes from him and that the message content has not been altered by anyone else along the way Tim generates a public key pair one public key and one private key 2 Tim keeps the private key and makes the public key openly available This means that anyone who receives a message seeming to come from Tim can read it and verify whether it is really from him or not 3 Tim uses his private key to sign the message and sends it to Jenny 4 Jenny receives the message and uses Tim s public key to verify it Jenny knows that the message is from Tim and that although other people may have been able to read the message no one can have altered it because they cannot re sign the message with Tim s private key NXC2500 User s Guide Chapter 23 Certificates Additionally Jenny uses her own private key to sign a message and Tim uses Jenny s public key to verify the message The NXC uses certificates based on public key cryptology to authenticate users attempting to establish a connection not to encrypt the data that you send after establishing a connection The method used to secure the data that you send through an established connection depends on the type of connection The certification authority uses its private key to sign certificates Anyone can then use the certification authority s public key to verify the certificates A certification path is the hierarch
19. Chapter 24 System 3 A window displays prompting you to store the host key in you computer Click Yes to continue Figure 163 SSH Example 1 Store Host Key Host Identification 3 xj The host has provided you its identification a host public key The fingerprint of the host public key is gevac bycor kubyz dipah ravut fyduz kazuk goler cavom hifot sexox You can save the host key to the local database by clicking Yes You can continue without saving the host key by clicking No You can also cancel the connection by clicking Cancel Do you want to save the new host key to the local database Enter the password to log in to the NXC The CLI screen displays next 24 8 5 2 Example 2 Linux This section describes how to access the NXC using the OpenSSH client program that comes with most Linux distributions 1 Test whether the SSH service is available on the NXC Enter telnet 192 168 1 1 22 at a terminal prompt and press ENTER The computer attempts to connect to port 22 on the NXC using the default IP address of 192 168 1 1 A message displays indicating the SSH protocol version supported by the NXC Figure 164 SSH Example 2 Test telnet 192 168 1 1 22 Trying 192 168 1 1 Connected to 192 168 1 1 Escape character is SSH 1 5 1 0 0 2 Enter ssh 1 192 168 1 1 This command forces your computer to connect to the NXC using SSH version 1 If this is the first time you
20. Click Configuration gt Network gt Routing to open this screen Use this screen to see the configured policy routes and turn policy routing based bandwidth management on or off A policy route defines the matching criteria and the action to take when a packet meets the criteria The action is taken only when all the criteria are met The criteria can include the user name source address and incoming interface destination address schedule IP protocol ICMP UDP TCP etc and port The actions that can be taken include e Routing the packet to a different gateway or outgoing interface e Limiting the amount of bandwidth available and setting a priority for traffic NXC2500 User s Guide Chapter 9 Policy and Static Routes IPPR follows the existing packet filtering facility of RAS in style and in implementation Figure 62 Configuration gt Network gt Routing gt Policy Route Static Route E Hide Advanced Settings IPv4 Configuration E Use Policy Route to Override Direct Route Add Y y aN es Sta User Schedule Incoming Source Destina DSCP C Service Source Next Hop DSCP M SNAT Page 1 of 1 Show 50 items No data to display Apply Reset The following table describes the labels in this screen Table 59 Configuration gt Network gt Routing gt Policy Route LABEL DESCRIPTION Show Hide Click this button to display a greater or lesser number of configur
21. Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action NXC2500 User s Guide Chapter 24 System Table 134 Configuration gt System gt DNS continued LABEL DESCRIPTION Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This is the index number of the domain zone forwarder record The ordering of your rules is important as rules are applied in sequence A hyphen displays for the default domain zone forwarder record The default record is not configurable The NXC uses this default record if the domain zone that needs to be resolved does not match any of the other domain zone forwarder records Domain Zone A domain zone is a fully qualified domain name without the host For example zyxel com tw is the domain zone for the www zyxel com tw fully qualified domain name A means all domain zones MX Record for My FQDN Type This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or configured manually User Defined DNS Server This is
22. Figure 34 Monitor gt Wireless gt AP Information gt Radio List gt AP Mode Radio Information 4 AP Mode Radio Information MBSSID Detail SSID Name 1 ZyXEL Page 1 of 1 Traffic Statistics 28 Kbps 1k RX BSSID B0 B2 DC 6E 7F 25 Show 50 v items Security Mode NONE 1 VLAN Last Update 2013 03 27 17 19 20 x Displaying 1 10f 1 25 2 22 4 19 6 16 8 14 0 11 2 8 4 5 6 2 8 Station Count 100 Stations Hol 21 19 01 19 oo 05 19 Gist 09 19 13 19 Last Update 2013 03 27 17 19 20 17 19 90 80 70 60 50 40 30 20 10 21 19 01 19 05 19 09 19 13 19 17 19 NXC2500 User s Guide 77 Chapter 5 Monitor The following table describes the labels in this screen Table 36 Monitor gt Wireless gt AP Info gt Radio List gt AP Mode Radio Information LABEL DESCRIPTION MBSSID Detail This list shows information about the SSID s that is associated with the radio over the preceding 24 hours This is the items sequential number in the list It has no bearing on the actual data in this list SSID Name This displays an SSID associated with this radio There can be up to eight maximum BSSID This displays the MAC address associated with the SSID Security This displays the security mode in which the SSID is operating Mode VLAN This displays the VLAN ID associated with th
23. Object Name Service Page 1 Priority Name Description of 1 Show 50 v items No data to display Refresh Cancel The following table describes labels that can appear in this screen Table 52 Object References LABEL DESCRIPTION Object Name This identifies the object for which the configuration settings that use it are displayed Click the object s name to display the object s configuration screen in the main window This field is a sequential value and it is not associated with any entry Service This is the type of setting that references the selected object Click a service s name to display the service s configuration screen in the main window Priority If it is applicable this field lists the referencing configuration item s position in its list otherwise N A displays Name This field identifies the configuration item that references the object Description If the referencing configuration item has a description configured it displays here Refresh Click this to update the information in this screen Cancel Click Cancel to close the screen 8 2 3 Add Edit DHCP Extended Options When you configure an interface as a DHCPv4 server you can additionally add DHCP extended options which have the NXC to add more information in the DHCP packets The available fields vary depending on the DHCP option you select in this screen To open the screen click Configuration gt Netw
24. Table 40 Monitor gt Log gt View AP Log LABEL DESCRIPTION Show Hide Filter Click this to show or hide the AP log filter Select an AP Select an AP from the list and click Query to view its log messages Log Query This indicates the current log query status Status init Indicates the query has not been initialized querying Indicates the query is in process fail Indicates the query failed success Indicates the query succeeded AP Information This displays the MAC address for the selected AP Log File Status This indicates the status of the AP s log messages Last Log Query This indicates the last time the AP was queried for its log messages Time Display Select the log file from the specified AP that you want displayed Note This criterion only appears when you Show Filter NXC2500 User s Guide Chapter 5 Monitor Table 40 Monitor gt Log gt View AP Log LABEL DESCRIPTION Priority Select a priority level to use for filtering displayed log messages Note This criterion only appears when you Show Filter Source Address Enter a source IP address to display only the log messages that include it Note This criterion only appears when you Show Filter Destination Address Enter a destination IP address to display only the log messages that include it Note This criterion only appears when you Show Filter Source Interface Enter a so
25. do not log any information from this category enable normal logs green check mark log regular information and alerts from this category enable normal logs and debug logs yellow check mark log regular information alerts and debugging information from this category OK Click this to save your changes and return to the previous screen Cancel Click this to return to the previous screen without saving your changes 25 3 5 Log Category Settings This screen allows you to view and to edit what information is included in the system log USB storage e mail profiles and remote servers at the same time It does not let you change other log settings for example where and how often log information is e mailed or remote server names NXC2500 User s Guide Chapter 25 Log and Report To access this screen go to the Log Settings Summary screen and click the Log Category Settings button Figure 178 Configuration gt Log amp Report gt Log Settings gt Log Category Settings Log Category Settings 21x Log Category Settings AC D System Log y D USB Storage y MJ E mail Server 1y E mail Server 2v ff Remote Server 1 ff Remote Server 2 jij Remote Server 3 f Remote Server 4v System Log USB Storage E mail Serve E mail Serve Remote Serv Remote Serv Remote Serv Remote Serv E Mail E Mail Syslog Syslog Syslog Syslog
26. 5 Select a server object from the Method List drop down list box 6 You can add up to four server objects to the table The ordering of the Method List column is important The NXC authenticates the users using the databases in the local user database or the external authentication server in the order they appear in this screen If two accounts with the same username exist on two authentication servers you specify the NXC does not continue the search on the second authentication server when you enter the username and password that doesn t match the one on the first authentication server NXC2500 User s Guide 239 Chapter 22 Authentication Method 7 Click OK to save the settings or click Cancel to discard all changes and return to the previous screen Add Authentication Method x General Settings Name Add 32 Edit J Remove MN Move Method List r 1 local pa The following table describes the labels in this screen Table 121 Configuration gt Object gt Auth Method gt Add LABEL DESCRIPTION Name Specify a descriptive name for identification purposes You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive For example My_ Device Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Remove Dou
27. AAA Telnet 24 7 1 Service Access Limitations A service cannot be used to access the NXC when 1 You have disabled that service in the corresponding screen 2 The allowed IP address address object in the Service Control table does not match the client IP address the NXC disallows the session 3 The IP address address object in the Service Control table is not in the allowed zone or the action is set to Deny NXC2500 User s Guide 271 Chapter 24 System 24 7 2 System Timeout There is a lease timeout for administrators The NXC automatically logs you out if the management session remains idle for longer than this timeout period The management session does not time out when a statistics screen is polling Each user is also forced to log in the NXC for authentication again when the reauthentication time expires You can change the timeout settings in the User Group screens 24 7 3 HTTPS You can set the NXC to use HTTP or HTTPS HTTPS adds security for Web Configurator sessions Specify which zones allow Web Configurator access and from which IP address the access can come HTTPS HyperText Transfer Protocol over Secure Socket Layer or HTTP over SSL is a web protocol that encrypts and decrypts web pages Secure Socket Layer SSL is an application level protocol that enables secure transactions of data by ensuring confidentiality an unauthorized party cannot read the transferred data authentication one party
28. AP 40 Page 1 of AP 40 Model MAC A Radio OP Mo Pr Freque Chann Station RxPKT TxPKT RxFC Tx Retr NWAS 40 44 2 AP de 5GHz 36 40 0 0 0 1101 4343 NWAS 40 44 1 AP NX 24GHz 6 1 6347 101659 69787 24751 1 Show 50 v items Displaying 1 2 of 2 The following table describes the labels in this screen Table 34 Monitor gt Wireless gt AP Information gt Radio List LABEL DESCRIPTION More Click this to view additional information about the selected radio s SSID s wireless traffic Information and wireless clients Information spans a 24 hour period This is the radio s index number in this list Loading This indicates the AP s load balance status UnderLoad or OverLoad when load balancing is enabled on the AP Otherwise it shows when load balancing is disabled or the radio is in monitor mode AP Description This displays the description of the AP to which the radio belongs Model This displays the model of the AP to which the radio belongs MAC Address This displays the MAC address of the radio Radio This indicates the radio number on the AP to which it belongs OP Mode This indicates the radio s operating mode Operating modes are AP access point or MON monitor Profile This indicates the profile name to which the radio belongs NXC2500 User s Guide 75 Chapter 5 Monitor 76 Table 34 Monitor g
29. Authentication Timeout Settings LABEL DESCRIPTION User Default Settings Default These authentication timeout settings are used by default when you create a new user account They also control the settings for any existing user accounts that are set to use the default settings You can still manually configure any user account s authentication timeout settings Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings This field is a sequential value and it is not associated with a specific entry User Type These are the kinds of user account the NXC supports e admin this user can look at and change the configuration of the NXC limited admin this user can look at the configuration of the NXC but not to change it e user this user has access to the NXC s services but cannot look at the configuration e guest this user has access to the NXC s services but cannot look at the configuration e ext user this user account is maintained in a remote server such as RADIUS or LDAP e ext group user this user account is maintained in a remote server such as RADIUS or LDAP guest manager this user can log in via the web configurator login screen and create dynamic guest accounts using the Master Manager screen that pops up dynamic guest this user has access to the NXC s services within a given period of time but cannot look at the configuration
30. Chapter 8 Interfaces The following table lists the available DHCP extended options defined in RFCs on the NXC See RFCs for more information Table 54 DHCP Extended Options OPTION NAME CODE DESCRIPTION Time Offset 2 This option specifies the offset of the client s subnet in seconds from Coordinated Universal Time UTC Time Server 4 This option specifies a list of Time servers available to the client NTP Server 42 This option specifies a list of the NTP servers available to the client by IP address TFTP Server Name 66 This option is used to identify a TFTP server when the sname field in the DHCP header has been used for DHCP options The minimum length of the value is 1 Bootfile 67 This option is used to identify a bootfile when the file field in the DHCP header has been used for DHCP options The minimum length of the value is 1 SIP Server 120 This option carries either an IPv4 address or a DNS domain name to be used by the SIP client to locate a SIP server VIVC 124 Vendor Identifying Vendor Class option A DHCP client may use this option to unambiguously identify the vendor that manufactured the hardware on which the client is running the software in use or an industry consortium to which the vendor belongs VIVS 125 Vendor Identifying Vendor Specific option DHCP clients and servers may use this option to exchange vendor specific information CAPWAP AC 138 CAPWAP Access Co
31. Click OK to save your changes back to the NXC You can only change the name Cancel Click Cancel to quit and return to the Trusted Certificates screen 23 3 2 Import Trusted Certificates Click Configuration gt Object gt Certificate gt Trusted Certificates gt Import to open the Trusted Certificates mport screen Follow the instructions in this screen to save a trusted certificate to the NXC NXC2500 User s Guide Chapter 23 Certificates Note You must remove any spaces from the certificate s filename before you can import the certificate Figure 142 Configuration gt Object gt Certificate gt Trusted Certificates gt Import Import Trusted Certificates 21x Please specify the location of the certificate file to be imported The certificate file must be in one of the Following formats Binary X 509 e PEM Base 64 encoded X 509 Binary PKCS 7 e PEM Base 64 encoded PKCS 7 File Path elect a file path OK Cancel The following table describes the labels in this screen Table 128 Configuration gt Object gt Certificate gt Trusted Certificates gt Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it You cannot import a certificate with the same name as a certificate that is already in the NXC Browse Click Browse to find the certificate file you want to upload OK Click OK
32. IP address and subnet mask are 0 0 0 0 the interface is disabled or did not receive an IP address and subnet mask via DHCP IP Assignment This field displays how the interface gets its IP address Static This interface has a static IP address DHCP Client This interface gets its IP address from a DHCP server Services This field lists which services the interface provides to the network Examples include DHCP relay and DHCP server This field displays n a if the interface does not provide any services to the network Action Use this field to get or to update the IP address for the interface Click Renew to send a new DHCP request to a DHCP server Click Connect to try to connect the interface If the interface cannot use one of these ways to get or to update its IP address this field displays n a Interface This table provides packet statistics for each interface Statistics Refresh Click this button to update the information in the screen Name This field displays the name of each interface Status This field displays the current status of each interface The possible values depend on what type of interface it is For Ethernet interfaces Inactive The Ethernet interface is disabled Down The Ethernet interface is enabled but not connected Speed Duplex The Ethernet interface is enabled and connected This field displays the port speed and duplex setting Full or Half For VLAN interfaces Up
33. LEAP LEAP Lightweight Extensible Authentication Protocol is a Cisco implementation of IEEE 802 1x Dynamic WEP Key Exchange The AP maps a unique key that is generated with the RADIUS server This key expires when the wireless connection times out disconnects or reauthentication times out A new WEP key is generated each time reauthentication is performed NXC2500 User s Guide Appendix D Wireless LANs If this feature is enabled it is not necessary to configure a default encryption key in the wireless security configuration screen You may still configure and store keys but they will not be used while dynamic WEP is enabled Note EAP MD5 cannot be used with Dynamic WEP Key Exchange For added security certificate based authentications EAP TLS EAP TTLS and PEAP use dynamic keys for data encryption They are often deployed in corporate environments but for public deployment a simple user name and password pair is more practical The following table is a comparison of the features of authentication types Table 198 Comparison of EAP Authentication Types EAP MD5 EAP TLS EAP TTLS PEAP LEAP Mutual Authentication No Yes Yes Yes Yes Certificate Client No Yes Optional Optional No Certificate Server No Yes Yes Yes No Dynamic Key Exchange No Yes Yes Yes Yes Credential Integrity None Strong Strong Strong Moderate Deployment Difficulty Easy Hard Moderate Moderate Moderate Clien
34. O 59 224 NXC2500 User s Guide Chapter 20 Schedules Table 114 Configuration gt Object gt Schedule gt Add Edit Recurring continued LABEL DESCRIPTION Weekly Week Days Select each day of the week the recurring schedule is effective OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide Chapter 20 Schedules NXC2500 User s Guide AAA Server 21 1 Overview You can use a AAA Authentication Authorization Accounting server to provide access control to your network The AAA server can be a Active Directory LDAP or RADIUS server Use the AAA Server screens to create and manage objects that contain settings for using AAA servers You use AAA server objects in configuring ext group user user objects and authentication method objects 21 1 1 What You Can Do in this Chapter The Active Directory LDAP screens Section 21 2 on page 230 configure Active Directory or LDAP server objects e The RADIUS screen Section 21 3 on page 235 configures the default external RADIUS server to use for user authentication 21 1 2 What You Need To Know The following terms and concepts may help as you read this chapter Directory Service AD LDAP LDAP AD allows a client the NXC to connect to a server to retrieve information from a directory A network example is shown next Figu
35. O means there is no time limit File Suffix Specify text to add to the end of the file name before the dot and filename extension to help you identify the packet capture files Modifying the file suffix also avoids making new capture files that overwrite existing files of the same name The file name format is interface name file suffix cap for example vlan2 packet capture cap Number Of Bytes To Capture Per Packet Specify the maximum number of bytes to capture per packet The NXC automatically truncates packets that exceed this size As a result when you view the packet capture files in a packet analyzer the actual size of the packets may be larger than the size of captured packets NXC2500 User s Guide Chapter 27 Diagnostics Table 161 Maintenance gt Diagnostics gt Packet Capture continued LABEL DESCRIPTION Capture Click this button to have the NXC capture packets according to the settings configured in this screen You can configure the NXC while a packet capture is in progress although you cannot modify the packet capture settings The NXC s throughput or performance may be affected while a packet capture is in progress After the NXC finishes the capture it saves a separate capture file for each selected interface The total number of packet capture files that you can save depends on the file sizes and the available flash storage space Once the flash storage sp
36. Select an AP and click the Edit button in the Configuration gt Wireless gt MON Mode table to display this screen Figure 46 Configuration gt Wireless gt MON Mode gt Add Edit Rogue Friendly MAC Address Description Role Edit Rogue Friendly AP List Vix DOMAMABADACA CAOBA Optional 9 Rogue AP Friendly AP aa Each field is described in the following table Table 47 Configuration gt Wireless gt MON Mode gt Add Edit Rogue Friendly LABEL DESCRIPTION MAC Address Enter the MAC address of the AP you want to add to the list A MAC address is a unique hardware identifier in the following hexadecimal format xx xXx XX XX XX XX where xx is a hexadecimal number separated by colons Description Enter up to 60 characters for the AP s description Spaces and underscores are allowed Role Select either Rogue AP or Friendly AP for the AP s role Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 7 Wireless 7 5 Load Balancing Use this screen to configure wireless network traffic load balancing between the APs on your network Click Configuration gt Wireless gt Load Balancing to access this screen Figure 47 Configuration gt Wireless gt Load Balancing Load Balancing Configuration Y Enable Load Balancing Mode By Station Number Max Station Numb
37. The wmm entries are for QoS For more information on QoS and WMM categories see page 134 User Defined Use this field to specify a custom DSCP value DSCP Code Address Use this section to configure NAT for the policy route Translation Source Network Select none to not use NAT for the route Address a Translation Select outgoing interface to use the IP address of the outgoing interface as the source IP address of the packets that matches this route If you select outgoing interface you can also configure port trigger settings for this interface Otherwise select a pre defined address group to use as the source IP address es of the packets that match this route Use Create new Object if you need to configure a new address group to use as the source IP address es of the packets that match this route OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving 9 3 Static Route Click Configuration gt Network gt Routing gt Static Route to open the Static Route screen This screen displays the configured static routes Figure 64 Configuration gt Network gt Routing gt Static Route Policy Route IPv4 Configuration DO Add E Destination Page 1 of 1 Show 50 Subnet Mask Metric items No data to display The following table describes the labels in this screen Table 61 Configuration gt Network gt Routing g
38. The NXC s security features include certificates It also provides captive portal configuration NAT port forwarding policy routing DHCP server extensive wireless AP control options and many other powerful features Flexible configuration helps you set up the network and enforce security policies efficiently The front panel physical Gigabit Ethernet ports labeled P1 P2 P3 and so on are mapped to Gigabit Ethernet ge interfaces By default P1 is mapped to gel P2 is mapped to ge2 and so on e The default LAN IP address is 192 168 1 1 e The default administrator login user name and password are admin and 1234 respectively 1 2 Zones Interfaces and Physical Ports Here is an overview of zones interfaces and physical ports in the NXC Table 1 Zones Interfaces and Physical Ethernet Ports Zones A zone is a group of interfaces LAN Interfaces Interfaces are logical entities that layer 3 packets pass through Use interfaces in configuring zones policy routes static routes and NAT Ethernet VLAN Port combine physical ports into interfaces Physical Ethernet The physical port is where you connect a cable Ports P1 P2 P3 and so on 1 2 1 Interface Types There are two types of interfaces in the NXC In addition to being used in various features interfaces also describe the network that is directly connected to it Ethernet interfaces are the foundation for defining ot
39. The NXC successfully applied the system default configuration This occurs when the NXC starts for the first time or you intentionally reset the NXC to the system default settings Fallback to lastgood configuration The NXC was unable to apply the startup config conf configuration file and fell back to the lastgood conf configuration file Fallback to system default configuration The NXC was unable to apply the lastgood conf configuration file and fell back to the system default configuration file system default conf Booting in progress The NXC is still applying the system configuration NXC2500 User s Guide Chapter 4 Dashboard Table 15 Dashboard continued Management AP LABEL DESCRIPTION AP Information This shows a summary of connected wireless Access Points APs All AP This section displays a summary for all connected wireless APs Click the link to go to the AP information gt AP List screen Online This displays the number of currently connected management APs Management AP Offline This displays the number of currently offline managed APs Un Management This displays the number of non managed APs Un Classified AP All Station This section displays a summary of connected stations Click the link to go to the Station I nfo gt Station List screen Station This displays the number of stations currently connected to the network All Sensed Device This sections displays a
40. The VLAN interface is enabled and one of its member Ethernet interfaces is connected Down The VLAN interface is enabled but none of its member Ethernet interfaces is connected Inactive The VLAN interface is disabled TxPkts This field displays the number of packets transmitted from the NXC on the interface since it was last connected RxPkts This field displays the number of packets received by the NXC on the interface since it was last connected Tx B s This field displays the transmission speed in bytes per second on the interface in the one second interval before the screen updated Rx B s This field displays the reception speed in bytes per second on the interface in the one second interval before the screen updated 5 5 Traffic Statistics Click Monitor gt System Status gt Traffic Statistics to display this screen This screen provides basic information about the different kinds of data traffic moving through the NXC For example NXC2500 User s Guide Chapter 5 Monitor e Most visited Web sites and the number of times each one was visited This count may not be accurate in some cases because the NXC counts HTTP GET packets e Most used protocols or service ports and the amount of traffic on each one e LAN IP with heaviest traffic and how much traffic has been sent to and from each one You use the Traffic Statistics screen to tell the NXC when to start and when to stop collecti
41. This is an ITU T recommendation that defines the formats for X 509 certificates e PEM Base 64 encoded X 509 This Privacy Enhanced Mail format uses lowercase letters uppercase letters and numerals to convert a binary X 509 certificate into a printable form Binary PKCS 7 This is a standard that defines the general syntax for data including digital signatures that may be encrypted A PKCS 7 file is used to transfer a public key certificate The private key is not included The NXC currently allows the importation of a PKS 7 file that contains a single certificate e PEM Base 64 encoded PKCS 7 This Privacy Enhanced Mail PEM format uses lowercase letters uppercase letters and numerals to convert a binary PKCS 7 certificate into a printable form e Binary PKCS 12 This is a format for transferring public key and private key certificates The private key in a PKCS 12 file is within a password encrypted envelope The file s password is not connected to your certificate s public or private passwords Exporting a PKCS 12 file creates this and you must provide it to decrypt the contents when you import the file into the NXC 352 NXC2500 User s Guide Chapter 31 Troubleshooting Note Be careful not to convert a binary file to text during the transfer process It is easy for this to occur since many programs use text files by default cannot access the NXC from a computer connected to the Internet Check th
42. You can have a maximum of 32 SSID profiles on the NXC Figure 107 Config SSID List SSID Summary Q Add x i Profile Name default 2 Page 1 Security List of 1 uration gt Object gt AP Profile gt SSID List MAC Filter List E SSID ZyXEL Show 50 QoS WMM Security Profile default MAC Filtering Profile VLAN ID disable 1 Displaying 1 1 of 1 v items The following table describes the labels in this screen Table 96 Configuration gt Object gt AP Profile gt SSID List LABEL DESCRIPTION Add Click this to add a new SSID profile Edit Click this to edit the selected SSID profile Remove Click this to remove the selected SSID profile Object Reference Click this to view which other objects are linked to the selected SSID profile for example radio profile H This field is a sequential value and it is not associated with a specific profile Profile Name This field indicates the name assigned to the SSID profile SSID This field indicates the SSID name as it appears to wireless clients Security Profile This field indicates which if any security profile is associated with the SSID profile Qos This field indicates the QoS type associated with the SSID profile MAC Filtering Profile VLAN ID This field indicates which if any MAC Filter Profile is associated with the SSID profile This field indicates the VLAN ID ass
43. example if your region has 11 channels and an adjacent AP is using channel 1 then you need to select a channel between 6 or 11 NXC2500 User s Guide 407 Appendix D Wireless LANs RTS CTS A hidden node occurs when two stations are within range of the same access point but are not within range of each other The following figure illustrates a hidden node Both stations STA are within range of the access point AP or wireless gateway but out of range of each other so they cannot hear each other that is they do not know if the channel is currently being used Therefore they are considered hidden from each other Figure 209 RTS CTS RTS Range CTS Range Station AP RTS a ORs When station A sends data to the AP it might not know that the station B is already using the channel If these two stations send data at the same time collisions may occur when both sets of data arrive at the AP at the same time resulting in a loss of messages for both stations Stations A and B do not hear each other They can hear the AP Station A Station B RTS CTS is designed to prevent collisions due to hidden nodes An RTS CTS defines the biggest size data frame you can send before an RTS Request To Send CTS Clear to Send handshake is invoked When a data frame exceeds the RTS CTS value you set between 0 to 2432 bytes the station that wants to transmit this frame must first send an RTS Request To Send message to th
44. gt Session Usage 166 Sessions Last Update 2013 01 05 12 46 26 149 133 116 100 83 66 50 33 17 PIE SRA ANO NA 16 46 20 46 00 46 04 46 08 46 Refresh Interval 5 minutes 12 46 The following table describes the labels in this screen Table 18 Dashboard gt Session Usage LABEL DESCRIPTION Sessions The y axis represents the number of session The x axis shows the time period over which the session usage occurred Refresh Interval Enter how often you want this window to be automatically updated Refresh Now Click this to update the information in the window right away NXC2500 User s Guide Chapter 4 Dashboard 4 2 4 DHCP Table Use this screen to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses To access this screen click the icon beside DHCP Table in the dashboard Figure 20 Dashboard gt DHCP Table DHCP Table Interface IP Address Host Name MAC Address Description Reserve 1 vlan0 192 168 1 50 nwa5260 00 13 49 00 00 01 Refresh Interval 5 minutes y The following table describes the labels in this screen Table 19 Dashboard gt DHCP Table LABEL DESCRIPTION This field is a sequential value and it is not associated with a specific entry Interface This field identifies the interface that assigned an IP address to a DHCP client IP Address This field d
45. have the NXC get the date and time from a time server Figure 145 Configuration gt System gt Date Time Date Time Current Time and Date Current Time 11 36 31 GMT 00 00 Current Date 2013 04 09 Time and Date Setup 9 Manual New Time hh mm ss 11 36 New Date yyyy mm dd 2013 04 09 4 D Get from Time Server Time Server Address Optional There is a pre defined NTP time server list Time Zone Setup Time Zone GMT 00 00 Greenwich Mean Time Dublin Edinburgh Li Y Enable Daylight Savings Start Date Y Monday Y of January End Date Monday of January Offset Hours NXC2500 User s Guide Chapter 24 System The following table describes the labels in this screen Table 131 Configuration gt System gt Date Time LABEL DESCRIPTION Current Time and Date Current Time This field displays the present time of your NXC Current Date This field displays the present date of your NXC Time and Date Setup Manual Select this radio button to enter the time and date manually If you configure a new time and date time zone and daylight saving at the same time the time zone and daylight saving will affect the new time and date you entered When you enter the time settings manually the NXC uses the new setting once you click Apply New Time hh mm ss This field displays the last updated time from the time server or the last time configur
46. o ZyXEL c US NXC2500 User s Guide Chapter 21 AAA Server 21 2 1 Add Edit Active Directory LDAP Server Click Object gt AAA Server gt Active Directory LDAP to display the Active Directory or LDAP screen Click the Add icon or an Edit icon to display the following screen Use this screen to create a new entry or edit an existing one Note The Active Directory and LDAP server setup screens are almost identical so the features for both screens are described in this section Figure 131 Configuration gt Object gt AAA Server gt Active Directory gt Add Edit General Settings Name New Description Optional Server Settings Server Address or Fann Port 389 1 65535 Base DN O Fl Use SSL Search time limit 5 1 300 seconds Y Case sensitive User Names E Server Authentication Bind DN Password Retype to Confirm User Login Settings Login Name Attribute sAMAccountName Alternative Login Name Attribute Optional Group Membership Attribute memberOf Domain Authentication for MSChap Enable User Password Retype to Confirm Realm NetBIOS Name Optional Configuration Validation Please enter an existing user account in this server to validate the above settings Username User Name Must be a user who has rights to add a machine to the domain TG NXC2500 User s Guide Chapter 21 AAA Server Figure 132 Configuration gt Obje
47. persistent location APs can also be configured to monitor for rogue APs Figure 2 AP Management Example Here the NXC A connects to a number of Power over Ethernet PoE devices B They connect to the managed Access Points C such as NWA5160N NWA5550 N NWA5560 N NWA5121 NI or NWA5123 NI which in turn provide access to the network for the wireless clients D within their broadcast radius 1 3 2 Wireless Security Keep the connections between wireless clients and your APs secure with the NXC s comprehensive wireless security tools APs can be configured to require WEP and WPA encryption from all wireless clients attempting to associate with them Furthermore you can protect your network by monitoring for rogue APs Rogue APs are wireless access points operating in a network s coverage area that are not under the control of the network s administrators and can potentially open up critical holes in a network s security policy Note Monitoring for rogue APs is not supported by the NWA5121 N NWA5121 NI and NWA5123 NI when they are in managed AP mode NXC2500 User s Guide Chapter 1 Introduction 1 3 3 Captive Portal The NXC can be configured with a captive portal which intercepts all network traffic regardless of address or port until a connecting user authenticates his or her session through a designated login Web page Figure 3 Applications Captive Portal WLAN Captive Portal Page The capt
48. select an appropriate type for the value that you will enter in the next field Only advanced users should configure User Defined Misconfiguration could result in interface lockout Value Enter the value for the selected DHCP option For example if you selected TFTP Server Name 66 and the type is TEXT enter the DNS domain name of a TFTP server here This field is mandatory First IP Address Second IP Address Third IP Address If you selected Time Server 4 NTP Server 42 SIP Server 120 CAPWAP AC 138 or TFTP Server 150 you have to enter at least one IP address of the corresponding servers in these fields The servers should be listed in order of your preference First Enterprise ID Second Enterprise ID If you selected VIVC 124 or VIVS 125 you have to enter at least one vendor s 32 bit enterprise number in these fields An enterprise number is a unique number that identifies a company First Class Second Class If you selected VIVC 124 enter the details of the hardware configuration of the host on which the client is running or of industry consortium compliance First If you selected VIVS 125 enter additional information for the corresponding enterprise Information number in these fields Second Information OK Click this to close this screen and update the settings to the previous Edit screen Cancel Click Cancel to close the screen NXC2500 User s Guide
49. the only way you can connect to the SSID is by manually entering the SSID name in your wireless connection setup screen s these vary by client client connectivity software and operating system Enable Intra BSS Traffic Blocking Select this option to prevent crossover traffic from within the same SSID OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 16 3 2 Security List This screen allows you to manage wireless security configurations that can be used by your SSIDs Wireless security is implemented strictly between the AP broadcasting the SSID and the stations that are connected to it To access this screen click Configuration gt Object gt AP Profile gt SSID gt Security List NXC2500 User s Guide Chapter 16 AP Profile Note You can have a maximum of 32 security profiles on the NXC Figure 109 Configuration gt Object gt AP Profile gt SSID gt Security List Radio SSID SSID List Security List MAC Filter List Security Summary Add 2 ni Profile Name Security Mode 1 default none Page i of1 Show 50 v litems Displaying 1 1of 1 The following table describes the labels in this screen Table 98 Configuration gt Object gt AP Profile gt SSID gt Security List LABEL DESCRIPTION Add Click this to add a new security profile Edit Click this to edit the selected security
50. this user has access to the NXC s services within a given period of time but cannot look at the configuration Lease Time Enter the number of minutes this type of user account has to renew the current session before the user is logged out You can specify 1 to 1440 minutes You can enter 0 to make the number of minutes unlimited Admin users renew the session every time the main screen refreshes in the Web Configurator Access users can renew the session by clicking the Renew button on their screen If you allow access users to renew time automatically the users can select this check box on their screen as well In this case the session is automatically renewed before the lease time expires NXC2500 User s Guide Chapter 15 User Group Table 87 User Group gt Setting gt Edit User Authentication Timeout Settings continued LABEL DESCRIPTION Reauthentication Type the number of minutes this type of user account can be logged into the NXC in one Time session before the user has to log in again You can specify 1 to 1440 minutes You can enter O to make the number of minutes unlimited Unlike Lease Time the user has no opportunity to renew the session without logging out OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 15 4 2 Add Edit Dynamic Guest Group This screen allows you to create a dynamic guest group or edit
51. types of 221 screen resolution 29 Secure Socket Layer see SSL serial number 51 service control and users 272 limitations 271 timeouts 272 service groups 216 service objects 215 Service Set 187 service subscription status 88 services 215 216 387 and policy routes 216 sessions 67 sessions usage 51 56 shell scripts 313 downloading 322 editing 321 how applied 314 managing 321 syntax 314 uploading 323 shutdown 22 Simple Certificate Enrollment Protocol SCEP 248 Simple Network Management Protocol see SNMP SNAT 133 SNMP 290 agents 290 and address groups 292 and address objects 292 and zones 292 Get 290 GetNext 290 Manager 290 managers 290 MIB 290 291 network components 290 Set 290 Trap 290 traps 291 versions 290 Source Network Address Translation see SNAT SSH 282 and address groups 285 and address objects 285 and certificates 285 and zones 285 client requirements 284 encryption methods 284 for secure Telnet 285 how connection is established 283 versions 284 with Linux 286 with Microsoft Windows 285 SSL 272 and AAA 233 and AD 233 and LDAP 233 NXC2500 User s Guide 427 Index starting the device 22 startup config conf 318 if errors 316 missing at restart 316 present at restart 316 startup config bad conf 316 static DHCP 152 static routes 125 and interfaces 132 metric 132 statistics daily e mail report 298 traffic 64 status 50 status bar 41 warning message popup 41
52. you effectively remove the restrictions The NXC also restricts the size of each data packet The maximum number of bytes in each packet is called the maximum transmission unit MTU If a packet is larger than the MTU the NXC divides 1 At the time of writing the NXC does not support ingress bandwidth management NXC2500 User s Guide 121 Chapter 8 Interfaces it into smaller fragments Each fragment is sent separately and the original packet is re assembled later The smaller the MTU the more fragments sent and the more work required to re assemble packets correctly On the other hand some communication channels such as Ethernet over ATM might not be able to handle large data packets DHCP Settings Dynamic Host Configuration Protocol DHCP RFC 2131 RFC 2132 provides a way to automatically set up and maintain IP addresses subnet masks gateways and some network information such as the IP addresses of DNS servers on computers in the network This reduces the amount of manual configuration you have to do and usually uses available IP addresses more efficiently In DHCP every network has at least one DHCP server When a computer a DHCP client joins the network it submits a DHCP request The DHCP servers get the request assign an IP address and provide the IP address subnet mask gateway and available network information to the DHCP client When the DHCP client leaves the network the DHCP servers can assign i
53. 0 23 Minute 0 59 OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 20 2 2 Add Edit Schedule Recurring Rule The Add Edit Schedule Recurring Rule screen allows you to define a recurring schedule or edit an existing one To access this screen go to the Schedule screen and click either the Add icon or an Edit icon in the Recurring section Figure 126 Configuration gt Object gt Schedule gt Add Edit Recurring 3 Add Schedule Recurring Rule 2 X Configuration Name Y Day Time StartTime 2 9 StopTime Weekly Week Days v Monday v Tuesday J Wednesday Y Thursday v Friday v Saturday Y Sunday The Year Month and Day columns are not used in recurring schedules and are disabled in this screen The following table describes the remaining labels in this screen Table 114 Configuration gt Object gt Schedule gt Add Edit Recurring LABEL DESCRIPTION Configuration Name Type the name used to refer to the recurring schedule You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Date Time StartTime Specify the hour and minute when the schedule begins each day Hour 0 23 Minute 0 59 StopTime Specify the hour and minute when the schedule ends each day Hour 0 23 Minute
54. 1 7 As Native VLAN 40 4A4 03 05 82 1E NWAS160N AP 404A0305821E O AP Mode MON Mode default v O AP Mode MON Mode default2 v 1 4094 Each field is described in the following table Table 45 Configuration gt Wireless gt AP Management gt Edit AP List LABEL DESCRIPTION Create new Object Use this menu to create a new Radio Profile or MON Profile object to associate with this AP MAC This displays the MAC address of the selected AP Model This field displays the AP s hardware model information It displays N A not applicable only when the AP disconnects from the NXC and the information is unavailable as a result Description Enter a description for this AP You can use up to 31 characters spaces and underscores allowed Radio 1 2 OP Mode Select the operating mode for radio 1 or radio 2 AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the NXC to be managed or subsequently passed on to an upstream gateway for managing MON Mode means the AP monitors the broadcast area for other APs then passes their information on to the NXC where it can be determined if those APs are friendly or rogue If an AP is set to this mode it cannot receive connections from wireless clients NXC2500 User s Guide Chapter 7 Wireless Table 45 Configuration gt Wireless gt AP Management gt Edit AP List continued
55. 1521 Structured Query Language is an interface to access data on many different types of database systems including mainframes midrange systems UNIX systems and network servers SSH TCP UDP 22 Secure Shell Remote Login Program STRM WORKS UDP 1558 Stream Works Protocol SYSLOG UDP 514 Syslog allows you to send system logs to a UNIX server TACACS UDP 49 Login Host Protocol used for Terminal Access Controller Access Control System TELNET TCP 23 Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments It operates over TCP IP networks Its primary function is to allow users to log into remote host systems TFTP UDP 69 Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP but uses the UDP User Datagram Protocol rather than TCP Transmission Control Protocol VDOLIVE TCP 7000 Another videoconferencing solution NXC2500 User s Guide Appendix B Common Services NXC2500 User s Guide C Importing Certificates This appendix shows you how to import public key certificates into your web browser Public key certificates are used by web browsers to ensure that a secure web site is legitimate When a certificate authority such as VeriSign Comodo or Network Solutions to name a few receives a certificate request from a website oper
56. 2016 04 08 10 44 04 GMT Page 1 of 1 Show 50 items Displaying 1 1 of 1 The CA sends you a package containing the CA s trusted certificate s your personal certificate s and a password to install the personal certificate s 24 7 6 5 Installing the CA s Certificate 1 Double click the CA s trusted certificate to produce a screen similar to the one shown next General Details Certification Path Certificate Information This certificate is intended to Proves your identity to a remote computer Ensures software came from software publisher eProtects software From alteration after publication eProtects e mail messages Allows data to be signed with the current time hdl Ensures the identity of a remote computer 4 Issued to CSO CA Issued by C50 CA Yalid from 8 30 2003 to 8 30 2005 Install Certificate ay ssuer Statement 2 Click Install Certificate and follow the wizard as shown earlier in this appendix 278 NXC2500 User s Guide Chapter 24 System 24 7 6 6 Installing a Personal Certificate You need a password in advance The CA may issue the password or you may have to specify it during the enrollment Double click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to begin the wizard Certificate Import Wizard x xi Welcome to the Certificate Import Wizard This wizard helps you
57. 229 Distinguished Name see DN DN 229 231 233 password 234 port 233 236 search time limit 233 SSL 233 AAA server 227 AD 229 and users 170 directory service 227 LDAP 227 229 local user database 228 RADIUS 228 229 RADIUS default 235 RADIUS group 236 see also RADIUS access 29 access users 169 171 idle timeout 178 multiple logins 179 see also users 169 Web Configurator 182 account myZyXEL com 86 user 169 accounting server 227 Active Directory see AD active sessions 51 56 67 AD 227 229 230 231 233 234 directory structure 229 Distinguished Name see DN password 234 port 233 236 search time limit 233 SSL 233 address groups 209 Index and FTP 289 and SNMP 292 and SSH 285 and Telnet 287 and WWW 276 address objects 209 and FTP 289 and NAT 131 142 and policy routes 130 and SNMP 292 and SSH 285 and Telnet 287 and WWW 276 HOST 209 RANGE 209 SUBNET 209 types of 209 address record 268 admin users 169 multiple logins 179 see also users 169 Advanced Encryption Standard see AES AES 413 alerts 299 303 304 305 308 309 310 ALG 147 and NAT 147 FTP 147 AP Access Point 407 Application Layer Gateway see ALG applications 19 authentication LDAP AD 229 server 227 authentication method objects 238 and users 170 and WWW 275 create 239 Authentication server RADIUS client 294 authentication server 292 Authentication Authorization Accounting servers NXC2500 User s Guide see AAA server I
58. 59 A TO 59 21 1 What Yan Gan Dolls ADS er 59 Pe Mal von Need TO O at 60 BUS FeO can A o O 60 Bal PONE US ISA susnianas tl o pal 62 E AA o O 63 A MAA e PU POC II NaRn ARR ads 64 E SSN NOMIC ura ia 67 D PNAC Binding MISMO ride 69 oS LUES aaa rae cee ayaa die eae loa terre iedia hie Rerauiatl a Rabie teas ead ae tis Garnet aa heaedes laren duet dureaanieg 70 E DEPARTS QUES A 70 T10 USB AUTOS ni is 71 SALE cal A ar rr A is o roda 73 Bad Say COMUNE CT APF anni a 74 3 12 RAS is AA 75 5 12 1 AP Mode Radi CAMADA cia TT A O as 78 DA Dele DOES aiaa ar di 79 o A iesewansladdidenti betas N SO 80 D10 VSW AP LG AAPP e accarGhine dieuniechentaineats 83 Chapter 6 AAPP cst ng mak ea eddie A o Ae 85 KN NXC2500 User s Guide Table of Contents AA PPC PEE505 a a 85 La NDA ou Can Do A MS Chapter rasca duns bidoiedienesatadusenicus 85 8 1 2 What you Negd 10 KNOW cits cccccnsissccccetnrtyctedenomdacdentiod ia 85 A A a SA aA quate aE A a Aaa 86 DI Aa 87 Chapter 7 ud PE AP e 89 EVA aaa ii 89 AAA You Can Do AS Chapter o led 89 Dolce VENUE VOR NEEG TO KION tia 89 Pie VOM oaea AR ReA RAeAeateR OE 90 ade MARIA ad 90 TL OU LISI in cate 92 EI Ne unir id 93 Fh FC OSMA ara dina 94 To LOS BECA aaa 95 725 1 Digassaciating and Delaying Connections cesi n ir 96 TO DCS aa n dS eaece itn case auty E alee ta al nde detec E ee aes 97 Te VC FO eS a A a 100 21 Dinamie Channel Selecion suscritas i
59. 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name NXC2500 User s Guide Appendix A Log Descriptions Table 188 CAPWAP Server Logs LOG MESSAGE DESCRIPTION Sucess Send Updating Configuration to AP MAC 502x 02x 02x 502x 02x 02x Name Ss Model s Receiving Send Updating Configuration Response from an AP in the Managed List 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Model Name 8th s Managed AP Description Send Retransmit Configuration to AP MAC 502x 02x 02x3502x 02x 02x Name s Retry Count d Model s Retransmit Configuration to an AP in the Managed List 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name 9th d Retry count AP SSID Stop MAC 02x 02x 02x 02x 02x 02x Radio d SSID s Stop A Managed AP s stops broadcasting the SSID due to DTLS Datagram Transport Layer Security is disabled 1st 02x 6th 02x Managed AP MAC Address 7th d Managed AP s Radio Number 8th s Managed AP Stop SSID Name VLAN setting is conflict MAC 02x 02x 02x 02 02x 502x Model s Mgnt VID AC 3d VID AP 3d s o SS Mgnt The VLAN ID of the AC is not the same as the VLAN ID of the AP 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th d VID 9th s tag or untag 10th d VID 11th s
60. 89 A snie E a 103 EOS a e ROUES saosa co sia 125 FONOS AAA aladeee asa neutucwanetelolaietis 135 AT A G 139 O 147 do AE po PP o A ieusaantets 149 CAPI POMAN ASA AA ba 155 A faa vasa tac iudes tesla lect te aiaces acide adovana2 R A a 169 MP td da 187 el A PP O 203 POTES cases crc nesunsidaansnesiduanronnedtdanctinedduante a n aN 209 PRUNES rain ro 215 E eUI o EET A A E A A IE A E AET AE EN E SE A O NEET E A O AE A A 221 PFE E A E EAE E A EE E NEA EE E ta E EE EEEE E a A 227 Authentication NEIND A Aa 238 A ri A A ONE 241 SUSISIM dies 259 Lan RODA ura sr o ri O oa 297 A oles aceuncuieeniauccicnest lose sate nacaledtueniasmdecasaeuta aan edaesneamaniaeies 313 BUR a loa e PA eee nee ern PRET NE Terre re tre errr re Tre tre errr er ree rr reer ere 325 PORTONE TOE AA oo Ry O oor ls AA o PA y E 345 OM ars 347 TONI ni nee rece pee Re N 349 NXC2500 User s Guide 3 Contents Overview EN NXC2500 User s Guide Table of Contents Table of Contents ile AAA ocedasateseaccbuadseuceeSecpiecartetzasaas 3 TAS DEDOS a seve cds vac oe a a a a e a a aE a 5 Pan k USS GUIO cri ne rey eer ee eee oD rT 15 Chapter 1 il AAA y 17 A A nn ede eaaseen a 17 1 2 Zones IMs aces and Physical PGMS ua Ad awl 17 PaM e e o nadia 17 1 2 2 Example Interface and Zone Configuration ooooccccncconnncccconcccnnncncnnnnannnnnn nono innr idni annin Es 18 Es AA A A baa T I E ds denies E A naan 19 TS 1AF Management iris 19 Tas W
61. A O A AAE E A A T 295 Chapter 25 Log and RO sii iasadssaeeniaseasaauniaassbiaiacisesauniaatouiorensin 297 erna ii 297 Eo al Whai Yon Can Do Wi INS CREAR reso RR 297 S EA DEA EDO sido 297 250 LOG SEINGE san da 299 O el AAA esas aaa a Sub uniruleea 300 230 2 OIL Were LG OTIS rara na la 302 29 03 ER USB Sloane Log SEMOS qna np cari 304 25 3 4 Edit Remote Server Log SEIS ses 307 29 30 Log CAES GENS is 308 Chapter 26 File WAG GD iia nc A A bA TNO NAETOAAA KONANTA RATASE RADA AA 313 EEE E o E E E o EN 313 281 1 Whal rou Can Doin Mis Chaptal acacia 313 1 Ree Vn ee OO a A E E E A ane tantuad patuutiaas 313 Elo wee IIA PU sta eer eT enn a nnn meer creer tre eoretr treet rontt tts 315 20 0 FINTINARO PACKAGE lt cccccsssstccteconncdacesemnnct n ER 319 12 NXC2500 User s Guide Table of Contents A 5 AE Uae 321 Chapter 27 A O Do 325 oP e OT nana 325 2711 Wal Vow Gan De inie Chaplet si 325 AA A E A ye Salata cue ni A A A 325 rl MIE ASUS WS iia 326 210 Pace ua DIN us A daa 327 eee er a o A Te reat tenner een Torte near rrr er ee Tonner mere Tree tte 329 27 32 Example or Viewing a Packet Capture Filg src 330 AGO A E OS 330 Be ead ORS DUME PU T E 331 ETS SILO ui E E S kedehiiees 332 LO Wies Fane CGaAPUTE ai rl OE aa aa 333 27 6 1 Wireless Frame Capture Pile and 334 Chapter 28 Packet Flow EXPIOPS sscirscionasianasarriii a A RAS 337 RS q i PO LEA O 337 26 1 Whal ro Can Doin e Chapter sis rita 337 20 2 THE
62. AP over its allotment say to 7 Mbps then the AP delays the red laptop s connection until it can afford the bandwidth or the laptop is picked up by a different AP with bandwidth to spare Figure 48 Delaying a Connection NXC2500 User s Guide Chapter 7 Wireless The second response your AP can take is to kick the connections that are pushing it over its balanced bandwidth allotment Figure 49 Kicking a Connection 1 Mbps G 6 Mbps 7 Mbps 8 A c amp AS Connections are kicked based on either idle timeout or signal strength The NXC first looks to see which devices have been idle the longest then starts kicking them in order of highest idle time If no connections are idle the next criteria the NXC analyzes is signal strength Devices with the weakest signal strength are kicked first 7 6 DCS Use DCS Dynamic Channel Selection in an environment where are many APs and there may be interference DCS allows APs to automatically find a less used channel in such an environment Use NXC2500 User s Guide Chapter 7 Wireless this screen to configure dynamic radio channel selection on managed APs Click Configuration gt Wireless gt DCS to access this screen Figure 50 Configuration gt Wireless gt DCS General Settings E Enable Dynamic Channel Selection DCS Time Interval DCS Sensitivity Level 10 1440 minutes v 7 Enable DCS Client Aware 2 4 GHz Settings 2 4 GHz C
63. Activation to activate or extend a standard service subscription If a standard service subscription runs out you need to buy a new iCard specific to your NXC and enter the new PIN number to extend the service Service License Refresh Click this button to renew service license information such as the registration status and expiration day NXC2500 User s Guide 7 Wireless 7 1 Overview Use the Wireless screens to configure how the NXC manages the Access Point that are connected to it 7 1 1 What You Can Do in this Chapter e The Controller screen Section 7 2 on page 90 sets how the NXC allows new APs to connect to the network The AP Management screen Section 7 3 on page 90 manages all of the APs connected to the NXC The MON Mode screen Section 7 4 on page 93 allows you to assign APs either to the rogue AP list or the friendly AP list The Load Balancing screen Section 7 5 on page 95 configures network traffic load balancing between the APs and the NXC e The DCS screen Section 7 6 on page 97 configures dynamic radio channel selection on managed APs 7 1 2 What You Need to Know The following terms and concepts may help as you read this chapter Station Wireless Client A station or wireless client is any wireless capable device that can connect to an AP using a wireless signal Dynamic Channel Selection DCS Dynamic Channel Selection DCS is a feature that allows an AP
64. Add Domain Zone Forwarder LABEL DESCRIPTION Domain Zone A domain zone is a fully qualified domain name without the host For example zyxel com tw is the domain zone for the www zyxel com tw fully qualified domain name For example whenever the NXC receives needs to resolve a zyxel com tw domain name it can send a query to the recorded name server IP address Enter if all domain zones are served by the specified DNS server s DNS Server Select DNS Server s from ISP if your ISP dynamically assigns DNS server information You also need to select an interface through which the ISP provides the DNS server IP address es The interface should be activated and set to be a DHCP client The fields below display the read only DNS server IP address es that the ISP assigns N A displays for any DNS server IP address fields for which the ISP does not assign an IP address Note If all interfaces are static then this field is hidden Select Public DNS Server if you have the IP address of a DNS server Enter the DNS server s IP address in the field to the right The NXC must be able to connect to the DNS server The DNS server could be on the Internet or one of the NXC s local networks You cannot use 0 0 0 0 Use the Query via field to select the interface through which the NXC sends DNS queries to a DNS server OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit
65. Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 24 System 24 12 1 Add Edit RADIUS Client Click Configuration gt System gt Auth Server to display the Auth Server screen Click the Add icon or an Edit icon to display the following screen Use this screen to create a new entry or edit an existing one Figure 171 Configuration gt System gt Auth Server gt Add Edit Q Add Trusted Client v Activate Profile Name IP Address Netmask Secret Description 2X a The following table describes the labels in this screen Table 147 Configuration gt System gt Auth Server gt Add Edit LABEL DESCRIPTION Activate Select this check box to make this profile active Profile Name Enter a descriptive name up to 31 alphanumerical characters for identification purposes IP Address Enter the IP address of the RADIUS client that is allowed to exchange messages with the NXC Netmask Enter the subnet mask of the RADIUS client Secret Enter a password up to 64 alphanumeric characters as the key to be shared between the NXC and the RADIUS client The key is not sent over the network This key must be the same on the external authentication server and the NXC Description Enter the description of each server if any You can use up to 60 printable ASCI
66. Authentication Method Configuration Add edt Y Method Name Method List 1 default local Page 1 of 1 Show 50 items Displaying 1 1o0f 1 NXC2500 User s Guide Chapter 22 Authentication Method The following table describes the labels in this screen Table 120 Configuration gt Object gt Auth Method LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Reference Select an entry and click Object Reference to open a screen that shows which settings use the entry This field displays the index number Method Name This field displays a descriptive name for identification purposes Method List This field displays the authentication method s for this entry 22 2 1 Add Authentication Method Follow the steps below to create an authentication method object 1 Click Configuration gt Object gt Auth Method 2 Click Add 3 Specify a descriptive name for identification purposes in the Name field You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive For example My_ Device 4 Click Add to insert an authentication method in the table
67. Bytes 100 Bytes 140 Bytes 52 808 KBytes Duration 4514 87 7166 6028 Displaying 1 4 of 4 NXC2500 User s Guide 67 Chapter 5 Monitor The following table describes the labels in this screen Table 26 Monitor gt System Status gt Session Monitor LABEL DESCRIPTION View Select how you want the information to be displayed Choices are sessions by users display all active sessions grouped by user sessions by services display all active sessions grouped by service or protocol sessions by source IP display all active sessions grouped by source IP address sessions by destination IP display all active sessions grouped by destination IP address all sessions filter the active sessions by the User Service Source Address and Destination Address and display each session individually sorted by user Refresh Click this button to update the information on the screen The screen also refreshes automatically when you open and close the screen The User Service Source Address and Destination Address fields display if you view all sessions Select your desired filter criteria and click the Search button to filter the list of sessions User This field displays when View s set to all sessions Type the user whose sessions you want to view It is not possible to type part of the user name or use wildcards in this field you must enter the whole user name Servic
68. CLI WWW TELNET SSH FTP Console limited admin Access Users Look at NXC configuration web CLI Perform basic diagnostics CLI WWW TELNET SSH Console NXC2500 User s Guide Chapter 15 User Group 170 Table 81 Types of User Accounts continued TYPE ABILITIES LOGIN METHOD S user Access network services Captive Portal TELNET SSH Browse user mode commands CLI guest Access network services Captive Portal ext user External user account Captive Portal ext group user External group user account Captive Portal guest manager Create dynamic guest accounts WWW dynamic guest Access network services Captive Portal mac address As permitted by the user aware feature MAC Authentication configuration Note The default admin account is always authenticated locally regardless of the authentication method setting Ext User Accounts Set up an ext user account if the user is authenticated by an external server and you want to set up specific policies for this user in the NXC If you do not want to set up policies for this user you do not have to set up an ext user account All ext user users should be authenticated by an external server such as AD LDAP or RADIUS If the NXC tries to use the local database to authenticate an ext user the authentication attempt always fails Note If the NXC tries to authenticate an ext user using the local databa
69. Capture gt Files LABEL DESCRIPTION Remove Select files and click Remove to delete them from the NXC Use the Shift and or Ctrl key to select multiple files A pop up window asks you to confirm that you want to delete Download Click a file to select it and click Download to save it to your computer This column displays the number for each packet capture file entry The total number of packet capture files that you can save depends on the file sizes and the available flash storage space File Name This column displays the label that identifies the file The file name format is interface name file suffix cap Size This column displays the size in bytes of a configuration file Last Modified This column displays the date and time that the individual files were saved NXC2500 User s Guide Chapter 27 Diagnostics NXC2500 User s Guide Packet Flow Explore 28 1 Overview Use this to get a clear picture on how the NXC determines where to forward a packet and how to change the source IP address of the packet according to your current settings This function provides you a summary of all your routing and SNAT settings and helps troubleshoot any related problems 28 1 1 What You Can Do in this Chapter e The Routing Status screen Section 28 2 on page 337 displays the overall routing flow and each routing function s settings e Use the SNAT Status screen Section 28 3 on pa
70. Client and DNS as exceptional services Figure 82 Configuration gt Captive Portal gt Add Exceptional Services Available Member Object A Object AH BOOTP_CLIENT AIM Group AUTH DNS Any_TCP Any_UDP BGP BOOTP_SERVER CU_SEEME_TCP1 CU_SEEME_TCP2 Y NXC2500 User s Guide Chapter 14 Captive Portal The following table describes the labels in this screen Table 76 Configuration gt Captive Portal gt Add Exceptional Services LABEL DESCRIPTION Available This lists all available network services eligible for being excepted from captive portal interception Member This lists all networks services currently assigned to the Exceptional Services table OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving 14 2 2 Auth Policy Add Edit This screen allows you to add authentication policies to captive portal interception Click the Add or Edit button for an existing policy in the Authentication Policy Summary table on the Captive Portal screen to access this screen Figure 83 Configuration gt Captive Portal gt Auth Policy Add Edit Q Auth Policy Add 2x U5 Create new Object y General Settings Y Enable Policy Description Optional User Authentication Policy Source Address any y Destination Address any v Schedule none y Authentication required M Y Force User Authentic
71. DNS server fail because the device already has the maximum number of DNS records configured s is IP address of the DNS server Access control rules of s have reached the maximum number of Su The maximum number of allowable rules has been reached s is HTTP HTTPS SSH SNMP FTP TELNET u is the maximum number of access control rules NXC2500 User s Guide Appendix A Log Descriptions Table 175 Built in Services Logs continued LOG MESSAGE DESCRIPTION Access control rule u A new built in service access control rule was appended BE ae Wes se Ci u is the index of the access control rule s is HTTP HTTPS SSH SNMP FTP TELNET Access control rule u An access control rule was inserted successfully CHS Bee eS ASEOS u is the index of the access control rule s is HTTP HTTPS SSH SNMP FTP TELNET Access control rule u An access control rule was modified successfully LEA MOSS u is the index of the access control rule s iS HTTP HTTPS SSH SNMP FTP TELNET Access control rule u An access control rule was removed successfully Oe ES de TEESE u is the index of the access control rule s is HTTP HTTPS SSH SNMP FTP TELNET Access control rule d An access control rule was moved successfully of s was moved to Sd 1st d is the previous index s is HTTP HTTPS SSH SNMP FTP TELNET 2nd d is current previous index SNMP trap can not be sent successfully
72. Direction This field indicates whether the IP address or user is sending or receiving traffic Rx From traffic is coming from the IP address or user to the NXC Tx To traffic is going from the NXC to the IP address or user IP Address User This field displays the IP address or user in this record The maximum number of IP addresses or users in this report is indicated in Table 25 on page 67 Amount This field displays how much traffic was sent or received from the indicated IP address or user If the Direction is Rx From a red bar is displayed if the Direction is Tx To a blue bar is displayed The unit of measure is bytes Kbytes Mbytes or Gbytes depending on the amount of traffic for the particular IP address or user The count starts over at zero if the number of bytes passes the byte count limit See Table 25 on page 67 These fields are available when the report type is Service Port This field is the rank of each record The protocols and service ports are sorted by the amount of traffic Service Port This field displays the service and port in this record The maximum number of services and service ports in this report is indicated in Table 25 on page 67 Protocol This field indicates what protocol the service was using Direction This field indicates whether the indicated protocol or service port is sending or receiving traffic Ingress traffic is coming into the N
73. Each VLAN also has a unique identification number 1D The ID is a 12 bit value that is stored in the MAC header The VLANs are connected to switches and the switches are connected to the router If one switch has enough connections for the entire network the network does not need switches A and B Traffic inside each VLAN is layer 2 communication data link layer MAC addresses It is handled by the switches As a result the new switch is required to handle traffic inside VLAN 2 Traffic is only broadcast inside each VLAN not each physical network Traffic between VLANs or between a VLAN and another type of network is layer 3 communication network layer IP addresses It is handled by the router This approach provides a few advantages e Increased performance In VLAN 2 the extra switch should route traffic inside the sales department faster than the router does In addition broadcasts are limited to smaller more logical groups of users NXC2500 User s Guide Chapter 8 Interfaces e Higher security If each computer has a separate physical connection to the switch then broadcast traffic in each VLAN is never sent to computers in another VLAN e Better manageability You can align network policies more appropriately for users For example you can create different policy route rules for each VLAN each department in the example above and you can set different bandwidth limits for each VLAN These rules are also
74. Edit Trusted Certificates Click Configuration gt Object gt Certificate gt Trusted Certificates and then a certificate s Edit icon to open the Trusted Certificates Edit screen Use this screen to view in depth information about the certificate change the certificate s name and set whether or not you want the NXC to check a certification authority s list of revoked certificates before trusting a certificate issued by the certification authority x Figure 141 Configuration gt Object gt Certificate gt Trusted Certificates gt Edit 7 Edit Trusted Certificates Configuration Name MyCertificate Certification Path CN Mydevice example com Validation Result self signed Certificate Validation E Enable X 509v3 CRL Distribution Points and OCSP checking El ocsP Serve Certificate Information Type Self signed X 509 Certificate Version v3 Serial Number 1365504244 Subject CN Mydevice example com Issuer CN Mydevice example com Signature Algorithm rsa pkcs 1 sha1 Valid From 2013 04 09 10 44 04 GMT Valid To 2016 04 08 10 44 04 GMT Key Algorithm rsaEncryption 1024 bits Subject Alternative Name Mydevice example com Key Usage DigitalSignature KeyEncipherment KeyCertSign Basic Constraint Subject Type CA Path Length Constraint 1 MDS5 Fingerprint 72 11 d9 0b 6c 8b 52 51 9c 2f 34 7b ff ee 51 0f SHA1 Fingerprint Of ff 48 56 70 ba 36 c4 4e 41 3a b4 76 96 6b 16 76 1c 17 99 Certificate EWRU
75. Figure 21 Dashboard gt Number of Login Users Number of Login Users UserID Reauth Lease T Type IP Address User Info Force Logout 1 admin unlimited 00 30 00 http https 192 168 1 33 admin admin Bio a The following table describes the labels in this screen Table 20 Dashboard gt Number of Login Users LABEL DESCRIPTION This field is a sequential value and is not associated with any entry User ID This field displays the user name of each user who is currently logged in to the NXC Reauth Lease T This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user Type This field displays the way the user logged in to the NXC IP address This field displays the IP address of the computer used to log in to the NXC User Info This field displays the types and user names of user accounts the NXC uses If the user type is ext user external user this field will show its external group information when you move your mouse over it If the external user matches two external group objects both external group object names will be shown Force Logout Click this icon to end a user s session NXC2500 User s Guide Monitor 5 1 Overview Use the Monitor screens to check status and statistics information 5 1 1 What You Can Do in this Chapter The Port Statistics screen Section 5 3 on page 60 displays packet statis
76. Group Figure 96 Configuration gt Object gt User Group gt Setting User Default Setting Default Authentication Timeout Settings A Edit UserType Lease Time Reauthentication Time user 1440 guest 1440 ext user 1440 limited admin 1440 ext group user 1440 guest manager dynamic guest mac address Page 1 ofi Pi Show 50 v 00 DO amp WD Miscellaneous Settings Allow renewing lease time automatically Enable user idle detection User idle timeout User Logon Settings Maximum number per administration account 1 Maximum number per access account 1 User Lockout Settings Enable logon retry limit Maximum retry count Lockout period Dynamic Guest Settings Dynamic Guest Group Add 7 Group Name 1 Cafe Pageli of1 bi Show 50 items Miscellaneous Settings Y Account Deleted After Expiration Dynamic Guest Note E Limit the number of simultaneous logons for administration account E Limit the number of simultaneous logons for access account 1 60 minutes 1 1024 1 1024 1 99 1 65535 minutes Description 1440 1440 1440 1440 1440 1440 1440 Displaying 1 9 of 9 Displaying 1 1of 1 NXC2500 User s Guide 177 Chapter 15 User Group 178 The following table describes the labels in this screen Table 86 Configuration gt Object gt User Group gt Setting
77. Group gt Group Object Reference LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Removing a group does not remove the user accounts in the group Select an entry and click Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with a specific user group Group Name This field displays the name of each user group Description This field displays the description for each user group Member This field lists the members in the user group Each member is separated by a comma NXC2500 User s Guide 175 Chapter 15 User Group 15 3 1 Add Edit Group This screen allows you to add a new user group or edit an existing one To access this screen go to the Group screen and click either the Add icon or an Edit icon Figure 95 Configuration gt User Group gt Group gt Add Edit Group Add Group Configuration Name Description Member List Available ad users Idap users mac test mac users radius users Object 21Xx O Optional Member E Cancel The following table describes the labels in this screen Table 85 Configuration gt U
78. I Description Station Recent O Last Off ii a Mgnt AP 172 16 13 32 B0 B2 DC 6E 7F NWAS12 1 1 AP BOB2DC6E7 2 13 44 13 N A Page 1 of 1 Show 50 v items Displaying 1 1of 1 The following table describes the labels in this screen Table 31 Monitor gt Wireless gt AP Information gt AP List LABEL DESCRIPTION Add to Mgnt AP Click this to add the selected AP to the managed AP list List More Click this to view a daily station count about the selected AP The count records station Information activity on the AP over a consecutive 24 hour period This is the AP s index number in this list Status This visually displays the AP s connection status with icons For details on the different Status states see the next table Registration This indicates whether the AP is registered with the managed AP list IP Address This displays the AP s IP address MAC Address This displays the AP s MAC address Model This displays the AP s model number Mgnt VLAN This displays the Access Controller the NXC management VLAN ID setting for the AP and ID AC AP the runtime management VLAN ID setting on the AP VLAN Conflict displays if the AP s management VLAN ID does not match the NXC s management VLAN ID setting for the AP This field displays n a if the NXC cannot get VLAN information from the AP Description This displays the AP s associated description The d
79. Interface s MAC Ss A wireless client used an incorrect WPA key and thus failed to connect to the specified WLAN interface first s The MAC address of the wireless client is listed second s Incorrect password for WPA or WPA2 enterprise internal authentication Interface s MAC Ss A wireless client used an incorrect WPA or WPA2 user password and failed authentication by the NXC s local user database while trying to connect to the specified WLAN interface first s The MAC address of the wireless client is listed second s Incorrect username or password for WPA or WPA2 enterprise internal authentication Interface s MAC SS A wireless client used an incorrect WPA or WPA2 user name or user password and failed authentication by the NXC s local user database while trying to connect to the specified WLAN interface first s The MAC address of the wireless client is listed second s System internal error Ss STA s could not extract EAP Message from RADIUS message There was an error when attempting to extract the EAP Message from a RADIUS message The first s is the WLAN interface The second s is the MAC address of the wireless client Table 182 Account Logs LOG MESSAGE DESCRIPTION o Account s s has been deleted A user deleted an ISP account profile 1st s profile type 2nd se profile name o Account s s has been changed A use
80. Login Page LABEL DESCRIPTION Restore Click Restore to set the NXC back to use the default built in login page customization file to default Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 14 3 1 Custom Login and Access Pages The following identify the parts you can customize in the login and access pages Figure 85 Login Page Customization Logo Title Message Color color of all text Background Note 1 Turn on Javascript and Cookie setting in your web browser 2 Turn off Popup Window Blocking in your web browser 3 Turn on Java Runtime Environment JRE in your web browser This is the note you can configure Note Message last line of text NXC2500 User s Guide Chapter 14 Captive Portal Figure 86 Access Page Customization Logo Title Message Color color of all text Background Note Message last line of text You can specify colors in one of the following ways e Click Color to display a screen of web safe colors from which to choose Enter the name of the desired color e Enter a pound sign followed by the six digit hexadecimal number that represents the desired color For example use 000000 for black Enter rgb followed by red green and blue values in parenthesis and separate by commas For example use rgb 0 0 0 for black Your desir
81. MAC address to identify itself Overwrite Select this option to have the interface use a different MAC address Either enter the Default MAG MAC address in the fields or click Clone by host and enter the IP address of the device or computer whose MAC you are cloning Once it is successfully configured the address will be copied to the configuration file It will not change unless you change the setting or upload a different configuration file Related Setting Configure Policy Route Click Policy Route to go to the policy route summary screen where you can manually associate traffic with this interface You must manually configure a policy route to add routing and SNAT settings for an interface with the I nterface Type set to General You can also configure a policy route to override the default routing and SNAT behavior for an interface with the I nterface Type set to Internal or External OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide Chapter 8 Interfaces 8 2 2 Object References When a configuration screen includes an Object Reference icon select a configuration object and click Object Reference to open the Object References screen This screen displays which configuration settings reference the selected object The fields shown vary with the type of object Figure 56 Object References E3 Object References
82. Mapped IP Select to which translated destination IP address this NAT rule forwards packets User Defined this NAT rule supports a specific IP address specified in the User Defined field HOST address the drop down box lists all the HOST address objects in the NXC If you select one of them this NAT rule supports the IP address specified by the address object User Defined This field is available if Mapped IP is User Defined Type the translated destination IP Original IP address that this NAT rule supports Mapped IP This field displays for Many 1 1 NAT Select to which translated destination IP address Subnet Range subnet or IP address range this NAT rule forwards packets The original and mapped IP address subnets or ranges must have the same number of IP addresses NXC2500 User s Guide Chapter 11 NAT Table 68 Configuration gt Network gt NAT gt Add Edit continued LABEL DESCRIPTION Port Mapping Type Use the drop down list box to select how many original destination ports this NAT rule supports for the selected destination IP address Original IP Choices are Any this NAT rule supports all the destination ports Service this NAT rule supports the destination port s used by the specified service s Port this NAT rule supports one destination port Ports this NAT rule supports a range of destination ports You might use a range of destination ports for unknown servic
83. Root Certificate Store dialog box click Yes Root Certificate Store A Do you want to DELETE the following certificate from the Root Store Subject 172 20 37 202 ZyXEL Issuer Self Issued Time Validity Wednesday May 21 2008 through Saturday May 21 2011 Serial Number 00846BC7 48BF7C2E CB Thumbprint sha1 DC44635D 10FE2D0D E76A72ED 002B9AF7 677EB0E9 Thumbprint md5 65 5E948 FOBC9598 50803387 C6A 18384 Yes J no 6 The next time you go to the web site that issued the public key certificate you just removed a certification error appears NXC2500 User s Guide Appendix C Importing Certificates Firefox The following example uses Mozilla Firefox 2 on Windows XP Professional however the screens can also apply to Firefox 2 on all platforms 1 If your device s Web Configurator is set to use SSL certification then the first time you browse to it you are presented with a certification error 2 Select Accept this certificate permanently and click OK Website Certified by an Unknown Authority Unable to verify the identity of 172 20 37 202 as a trusted site Possible reasons for this error Your browser does not recognize the Certificate Authority that issued the site s certificate The site s certificate is incomplete due to a server misconfiguration You are connected to a site pretending to be 172 20 37 202 possibly to obtain your confidential information Please notify the site s webma
84. SMTP server User Name This box is effective when you select the SMTP Authentication check box Type the user name to provide to the SMTP server when the log is e mailed Password This box is effective when you select the SMTP Authentication check box Type the password to provide to the SMTP server when the log is e mailed Retype to Confirm Retype your new password for confirmation Active Log and Alert System log Use the System Log drop down list to change the log settings for all of the log categories disable all logs red X do not log any information for any category for the system log or e mail any logs to e mail server 1 or 2 enable normal logs green check mark create log messages and alerts for all categories for the system log If e mail server 1 or 2 also has normal logs enabled the NXC will e mail logs to them enable normal logs and debug logs yellow check mark create log messages alerts and debugging information for all categories The NXC does not e mail debugging information even if this setting is selected E mail Server 1 Use the E Mail Server 1 drop down list to change the settings for e mailing logs to e mail server 1 for all log categories Using the System Log drop down list to disable all logs overrides your e mail server 1 settings enable normal logs green check mark e mail log messages for all categories to e mail server 1 enable alert logs red ex
85. Setting E mail Server 1 E SMTP Authentication Jser Name etype to Confirm E mail Server 2 Active Log and Alert AC System Logy E mail Server 1 EY E mail Server 2v System Log E mail Server 1 Log Category 9900 YO 1 Account 2 Captive Portal 3 Authentication Server 4 Built in Service CAPWAP 6 Connectivity Check 7 Daily Report Default 30 ZySH Page 1 Jof1 Show so witems Active Log and Alert AP gt System Logy EJ E mail Server 1 E mail Server 2v System Log E mail Server 1 Log Category 1 Account 2 Built in Service CAPWAP 4 Daily Report Default 6 DHCP 7 File Manager 8 Force Authentication 20 ZySH Page 1 Jof1 Show 50 x items Log Consolidation E Active Log Consolidation Interval seconds 10 10 600 IF Active Mail Server Outgoing SMTP Server Name or IP Address Mail Subject Send From E Mail Address Send Log to E Mail Address Send Alerts to E Mail Address Sending Log When Full X ending Log Time for Sending Log A e ae Pix E mail Server 2 99 Displaying 1 30 of 30 E mail Server 2 Displaying 1 20 of 20 5 NXC2500 User s Guide Chapt
86. Statistics Status Down Down Down 1000M Full Down 100M Full Up Each field is described in the following table Table 23 Monitor gt System Status gt Interface Status LABEL DESCRIPTION Interface Status If an Ethernet interface does not have any physical ports associated with it its entry is displayed in light gray text Name This field displays the name of each interface Port This field displays the physical port number Status This field displays the current status of each interface The possible values depend on what type of interface it is For Ethernet interfaces Inactive The Ethernet interface is disabled Down The Ethernet interface is enabled but not connected Speed Duplex The Ethernet interface is enabled and connected This field displays the port speed and duplex setting Full or Half For VLAN interfaces Up The VLAN interface is enabled and one of its member Ethernet interfaces is connected Down The VLAN interface is enabled but none of its member Ethernet interfaces is connected Inactive The VLAN interface is disabled NXC2500 User s Guide Chapter 5 Monitor Table 23 Monitor gt System Status gt Interface Status continued LABEL DESCRIPTION Zone This field displays the zone to which the interface is assigned IP Addr Netmask This field displays the current IP address and subnet mask assigned to the interface If the
87. Trusted Certificates gt Edit continued LABEL DESCRIPTION Signature Algorithm This field displays the type of algorithm that was used to sign the certificate Some certification authorities use rsa pkcs1 shal RSA public private key encryption algorithm and the SHA1 hash algorithm Other certification authorities may use rsa pkcs1 md5 RSA public private key encryption algorithm and the MD5 hash algorithm Valid From This field displays the date that the certificate becomes applicable The text displays in red and includes a Not Yet Valid message if the certificate has not yet become applicable Valid To This field displays the date that the certificate expires The text displays in red and includes an Expiring or Expired message if the certificate is about to expire or has already expired Key Algorithm Subject Alternative Name This field displays the type of algorithm that was used to generate the certificate s key pair the NXC uses RSA encryption and the length of the key set in bits 1024 bits for example This field displays the certificate s owner s IP address IP domain name DNS or e mail address EMAIL Key Usage Basic Constraint This field displays for what functions the certificate s key can be used For example DigitalSignature means that the key can be used to sign certificates and KeyEncipherment means that the key can be used to encrypt text This fiel
88. WPA 2 with RADIUS Application Example A WPA 2 PSK Application Example A WPA 2 PSK application looks as follows 1 First enter identical passwords into the AP and all wireless clients The Pre Shared Key PSK must consist of between 8 and 63 ASCII characters or 64 hexadecimal characters including spaces and symbols 2 The AP checks each wireless client s password and allows it to join the network only if the password matches 3 The AP and wireless clients generate a common PMK Pairwise Master Key The key itself is not sent over the network but is derived from the PSK and the SSID NXC2500 User s Guide Appendix D Wireless LANs The AP and wireless clients use the TKIP or AES encryption process the PMK and information exchanged in a handshake to create temporal encryption keys They use these keys to encrypt data exchanged between them Figure 211 WPA 2 PSK Authentication INTERNE Security Parameters Summary Refer to this table to see what other security parameters you should configure for each authentication method or key management protocol type MAC address filters are not dependent on how you configure these security features Table 199 Wireless Security Relational Matrix AUTHENTICATION METHOD KEY ENCRYPTION ENTER IEEE 802 1X MANAGEMENT METHOD MANUAL KEY PROTOCOL Open None No Disable Enable without Dynamic WEP Key Open WEP No Enable with Dynamic WEP
89. a a 0 Filter Action deny v Add li MAC Address Description Page 1 of 1 Show 50 v items No data to display Co ce The following table describes the labels in this screen Table 101 SSID gt MAC Filter List gt Add Edit MAC Filter Profile LABEL DESCRIPTION Profile Name Enter up to 31 alphanumeric characters for the profile name This name is only visible in the Web Configurator and is only for management purposes Spaces and underscores are allowed Filter Action Select allow to permit the wireless client with the MAC addresses in this profile to connect to the network through the associated SSID select deny to block the wireless clients with the specified MAC addresses Add Click this to add a MAC address to the profile s list Edit Click this to edit the selected MAC address in the profile s list Remove Click this to remove the selected MAC address from the profile s list This field is a sequential value and it is not associated with a specific profile NXC2500 User s Guide Chapter 16 AP Profile Table 101 SSID gt MAC Filter List gt Add Edit MAC Filter Profile continued LABEL DESCRIPTION MAC Address This field specifies a MAC address associated with this profile Description This field displays a description for the MAC address associated with this profile You can click the description to make it editable En
90. a secure connection to the AD or LDAP server s Search time limit Specify the timeout period between 1 and 300 seconds before the NXC disconnects from the AD server In this case user authentication fails Search timeout occurs when either the user information is not in the AD or LDAP server or the AD or LDAP server is down NXC2500 User s Guide Chapter 21 AAA Server Table 117 Configuration gt Object gt AAA Server gt Active Directory or LDAP gt Add Edit LABEL DESCRIPTION Case sensitive Select this if the server checks the case of the usernames User Names Bind DN Specify the bind DN for logging into the AD or LDAP server Enter up to 127 alphanumerical characters For example cn zyAdmin specifies zyAdmin as the user name Password If required enter the password up to 15 alphanumerical characters for the NXC to bind or log in to the AD or LDAP server Retype to Confirm Retype your new password for confirmation Login Name Enter the type of identifier the users are to use to log in For example name or e mail Attribute address Alternative Login If there is a second type of identifier that the users can use to log in enter it here For Name Attribute example name or e mail address Group Enter the name of the attribute that the NXC is to check to determine to which group a Membership user belongs The value for this attribute is calle
91. access this screen go to the Schedule screen and click either the Add icon or an Edit icon in the One Time section Figure 125 Configuration gt Object gt Schedule gt Add Edit One Time Configuration Name Day Time StartDate StartTime StopDate StopTime Add Schedule One Time Rule 2 x O ON Cancel The following table describes the labels in this screen Table 113 Configuration gt Object gt Schedule gt Add Edit One Time LABEL DESCRIPTION Configuration Name Type the name used to refer to the one time schedule You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Date Time StartDate Specify the year month and day when the schedule begins Year 1900 2999 Month 1 12 Day 1 31 it is not possible to specify illegal dates such as February 31 StartTime Specify the hour and minute when the schedule begins Hour 0 23 Minute 0 59 StopDate Specify the year month and day when the schedule ends Year 1900 2999 Month 1 12 Day 1 31 it is not possible to specify illegal dates such as February 31 NXC2500 User s Guide Chapter 20 Schedules Table 113 Configuration gt Object gt Schedule gt Add Edit One Time continued LABEL DESCRIPTION StopTime Specify the hour and minute when the schedule ends Hour
92. allowed 802 11 Band Mode Select the wireless band which this radio profile should use 2 4 GHz is the frequency used by IEEE 802 11b g n wireless clients 5 GHz is the frequency used by IEEE 802 11a n wireless clients Select how to let wireless clients connect to the AP When using the 2 4 GHz band select b g to let IEEE 802 11b and IEEE 802 11g compliant WLAN devices associate with the AP When using the 2 4 GHz band select b g n to let IEEE 802 11b IEEE 802 11g and IEEE 802 11n compliant WLAN devices associate with the AP When using the 5 GHz band select a to let only IEEE 802 11a compliant WLAN devices associate with the AP When using the 5 GHz band select a n to let IEEE 802 11a and IEEE 802 11n compliant WLAN devices associate with the AP Channel Select the wireless channel which this radio profile should use It is recommended that you choose the channel least in use by other APs in the region where this profile will be implemented This will reduce the amount of interference between wireless clients and the AP to which this profile is assigned Some 5 GHz channels include the label indoor use only These are for use with an indoor AP only Do not use them with an outdoor AP Advanced Settings Channel Width Select the channel bandwidth you want to use for your wireless network Select Auto to allow the NXC to adjust the channel bandwidth to 40 MHz or 20 MHz depending on network conditio
93. amount of time remaining before the NXC automatically logs them out The NXC sets this amount of time according to the e User defined lease time field in this screen Lease time field in the User Add Edit screen Lease time field in the Setting gt Edit screen Updating lease time automatically This box appears if you checked the Allow renewing lease time automatically box in the Setting screen Access users can select this check box to reset the lease time automatically 30 seconds before it expires Otherwise access users have to click the Renew button to reset the lease time Remaining time before lease timeout This field displays the amount of lease time that remains though the user might be able to reset it Remaining time before auth timeout This field displays the amount of time that remains before the NXC automatically logs the access user out regardless of the lease time Remaining time before session timeout This field displays how much longer the user can use the session before the NXC automatically logs the access user out NXC2500 User s Guide Chapter 15 User Group 15 4 4 Guest Manager Login Example To create dynamic guest accounts enter the guest manager account information in the Web Configurator login screen After you log in successfully the following guest manager screen appears Figure 100 Guest Manager Login 2011 05 04 08 21 16 2011 05 04 3
94. an existing one To access this screen go to the Configuration gt Object gt User Group gt Setting screen and click either the Add icon or an Edit icon in the Dynamic Guest Group section Figure 98 User Group gt Setting gt Add Edit Dynamic Guest Group Add Group Configuration Name Description Penni Optional a The following table describes the labels in this screen Table 88 User Group gt Setting gt Add Edit Dynamic Guest Group LABEL DESCRIPTION Name Specify the name used to identify the dynamic guest group Description Enter a description for the dynamic guest group OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide Chapter 15 User Group 15 4 3 User Aware Login Example Access users cannot use the Web Configurator to browse the configuration of the NXC Instead after access users log into the NXC the following user aware login screen appears Figure 99 User Aware Login The following table describes the labels in this screen Table 89 User Aware Login LABEL DESCRIPTION User defined lease time max minutes Access users can specify a lease time shorter than or equal to the one that you specified The default value is the lease time that you specified Renew Access users can click this button to reset the lease time the
95. and click Download to save it to your computer This column displays the number for each packet capture file entry The total number of packet capture files that you can save depends on the file sizes and the available flash storage space NXC2500 User s Guide Chapter 27 Diagnostics Table 162 Maintenance gt Diagnostics gt Packet Capture gt Files continued LABEL DESCRIPTION File Name This column displays the label that identifies the file The file name format is interface name file suffix cap Size This column displays the size in bytes of a configuration file Last Modified This column displays the date and time that the individual files were saved 27 3 2 Example of Viewing a Packet Capture File Here is an example of a packet capture file viewed in the Wireshark packet analyzer Notice that the size of frame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes The NXC truncated the frame because the capture screen s Number Of Bytes To Capture Per Packet field was set to 1500 bytes Figure 190 Packet Capture File Example 7 lant packet capture cap Wireshark File Edit View Go Capture Analyze Statistics Telephony Tools Help AYNA SAXSS AQe F2 Ba Raan BURK B Filter Y Expression Clear Apply No Time Source Destination Protocol Info 000000 DIALES 172 16 1 33 TLSV1 Application De 000744 172 16 1 AUGE Encrypted Aler
96. are connecting to the NXC using SSH a message displays prompting you to save the host information of the NXC Type yes and press ENTER Then enter the password to log in to the NXC Figure 165 SSH Example 2 Log in ssh 1 192 168 1 1 The authenticity of host 192 168 1 1 192 168 1 1 can t be established RSAl key fingerprint is 21 6c 07 25 7e f4 75 80 ec af bd d4 3d 80 53 dl Are you sure you want to continue connecting yes no yes Warning Permanently added 192 168 1 1 RSA1 to the list of known hosts Administrator 192 168 1 1 s password 3 The CLI screen displays next 286 NXC2500 User s Guide Chapter 24 System 24 9 Telnet You can use Telnet to access the NXC s command line interface Specify which zones allow Telnet access and from which IP address the access can come Click Configuration gt System gt TELNET to configure your NXC for remote Telnet access Use this screen to specify from which zones Telnet can be used to manage the NXC You can also specify from which IP addresses the access can come Figure 166 Configuration gt System gt TELNET General Settings Enable Server Port Service Control Add ko Page 1 of 1 Show 50 items Displaying 1 1 of 1 TELNET 23 Zone Address Action ALL ALL Accept The following table describes the labels in this screen Table 142 Configuration gt System gt TELNET
97. before doing so Note that subsequent entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This the index number of the service control rule Zone This is the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 8 5 Examples of Secure Telnet Using SSH This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the NXC The configuration and connection steps are similar for most SSH client programs Refer to your SSH client program user s guide 24 8 5 1 Example 1 Microsoft Windows This section describes how to access the NXC using the Secure Shell Client program 1 Launch the SSH client and specify the connection information IP address port number for the NXC 2 Configure the SSH client to accept connection using SSH version 1 NXC2500 User s Guide
98. can t parse the HTTP header in a response returned by a server Maybe some HTTP headers are missing NXC2500 User s Guide Appendix A Log Descriptions Table 173 Sessions Limit Logs LOG MESSAGE DESCRIPTION Maximum sessions per host Sd was exceeded d is maximum sessions per host Table 174 Policy Route Logs LOG MESSAGE DESCRIPTION Can t open bwm_entries Policy routing can t activate BWM feature Can t open link_down Policy routing can t detect link up down status Cannot get handle from UAM user aware PR is disabled User aware policy routing is disabled due to some reason mblock allocate memory failed Allocating policy routing rule fails insufficient memory pt allocate memory failed Allocating policy routing rule fails insufficient memory Po send message to policy route daemon failed Failed to send control message to policy routing manager The policy route Sd allocates memory fail Allocating policy routing rule fails insufficient memory d the policy route rule number route d user group The policy uses empty Use an empty object group d the policy route rule number The policy route Sd uses empty source address group Use an empty object group d the policy route rule number The policy route Sd uses empty destination address group Use an empty object group
99. can t print entry name Ss 1st zysh entry name Can t append entry s 1st zysh entry name Can t set entry s 1st zysh entry name o Can t define entry s 1st zysh entry name s list is full 1st zysh list name Can t undefine s 1st zysh list name Can t remove s Table OPS 1st zysh list name s cannot retrieve entries from table 1st zysh table name Ss index is out of range 1st zysh table name Ss cannot set entry 50 1st zysh table name 2st zysh entry num s table is full 1st zysh table name s invalid old new index 1st zysh table name Unable to move entry Sa 1st zysh entry num s invalid index 1st zysh table name Unable to delete entry Sa Unable to change entry Sa 1st zysh entry num 1st zysh entry num s Cannot retrieve entries from table 1st zysh table name s invalid old new index 1st zysh table name Unable to move entry Sa 1st zysh entry num Ss apply failed at initial stage 1st zysh table name Ss apply failed at main stage 1st zysh table name Ss apply failed at closing stage 1st zysh table name NXC2500 User s Guide Appendix A Log Descriptions Table 171 User Logs LOG MESSAGE DESCRIPTION s s from s has A user logged into the NXC e e 1st s The type of user account Enterprisew
100. certificates 172 20 37 202 5 The next time you go to the web site that issued the public key certificate you just removed a certification error appears NXC2500 User s Guide 403 Appendix C Importing Certificates NXC2500 User s Guide Wireless LANs Wireless LAN Topologies This section discusses ad hoc and infrastructure wireless LAN topologies Ad hoc Wireless LAN Configuration The simplest WLAN configuration is an independent Ad hoc WLAN that connects a set of computers with wireless adapters A B C Any time two or more wireless adapters are within range of each other they can set up an independent network which is commonly referred to as an ad hoc network or Independent Basic Service Set IBSS The following diagram shows an example of notebook computers using wireless adapters to form an ad hoc wireless LAN Figure 206 Peer to Peer Communication in an Ad hoc Network BSS A Basic Service Set BSS exists when all communications between wireless clients or between a wireless client and a wired network client go through one access point AP Intra BSS traffic is traffic between wireless clients in the BSS When Intra BSS is enabled wireless client A and B can access the wired network and communicate with each other When Intra BSS is NXC2500 User s Guide Appendix D Wireless LANs disabled wireless client A and B can still access the wired network but cannot communicate with each othe
101. entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed Zone This the index number of the service control rule The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy This is the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 24 System 24 11 SNMP Simple Network Management Protocol is a protocol used for exchanging management information between network devices Your NXC supports SNMP agent functionality which allows a manager station to manage and monitor the NXC through the netw
102. entry Edit Select an entry and click this to be able to modify it Remove Select an entry and click this to delete it This field is a sequential value and it is not associated with a specific entry IP Address Enter the IP address to assign to a device with this entry s MAC address MAC Address Enter the MAC address to which to assign this entry s IP address Description Enter a description to help identify this static DHCP entry You can use alphanumeric and _ characters and it can be up to 60 characters long Connectivity Check The NXC can regularly check the connection to the gateway you specified to make sure it is still available You specify how often to check the connection how long to wait for a response before the attempt is a failure and how many consecutive failures are required before the NXC stops routing to the gateway The NXC resumes routing to the gateway the first time the gateway passes the connectivity check Enable Connectivity Check Select this to turn on the connection check Check Method Select the method that the gateway allows Select icmp to have the NXC regularly ping the gateway you specify to make sure it is still available Select tcp to have the NXC regularly perform a TCP handshake with the gateway you specify to make sure it is still available Check Period Enter the number of seconds between connection check attempts Check Timeout Enter the
103. example 415 WPA PSK 413 414 application example 415 WWW 273 and address groups 276 and address objects 276 and authentication method objects 275 and certificates 274 and zones 276 see also HTTP HTTPS 273 Z zones 17 135 and FTP 289 and interfaces 17 135 and SNMP 292 and SSH 285 and Telnet 287 and VPN 17 135 and WWW 276 NXC2500 User s Guide Index default 18 extra zone traffic 135 inter zone traffic 135 intra zone traffic 135 types of traffic 135 NXC2500 User s Guide
104. field cannot be blank Enter Address the end of the range of IP address that this address object represents Network This field is only available if the Address Type is SUBNET in which case this field cannot be blank Enter the IP address of the network that this address object represents Netmask This field is only available if the Address Type is SUBNET in which case this field cannot be blank Enter the subnet mask of the network that this address object represents Use dotted decimal format Interface If you selected INTERFACE IP INTERFACE SUBNET or INTERFACE GATEWAY as the Address Type use this field to select the interface of the network that this address object represents OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 18 3 Address Group Summary The Address Group screen provides a summary of all address groups To access this screen click Configuration gt Object gt Address gt Address Group Click a column s heading cell to sort the table entries by that column s criteria Click the heading cell again to reverse the sort order Figure 118 Configuration gt Object gt Address gt Address Group Address IPv4 Address Group Configuration add s Name Page 1 of 1 Description Show 50 v items No data to display NXC2500 User s Guide Chapter 18 Addresses The following table describes the labels in this s
105. for both the authentication of wireless stations and encryption key management Authentication is done using an external RADIUS server 16 2 Radio 188 This screen allows you to create radio profiles for the APs on your network A radio profile is a list of settings that a supported managed AP NWA5121 N for example can use to configure either one of its two radio transmitters To access this screen click Configuration gt Object gt AP Profile Note You can have a maximum of 32 radio profiles on the NXC Figure 105 Configuration gt Object gt AP Profile gt Radio Radio Summary Q Add 4 Edit Y Activate Inactivate ig Object Reference Status Profile Name Frequency Band Channel ID 2 9 default2 5G 36 Page 1 of1 Show 50 y items Displaying 1 2 of 2 Apply Reset The following table describes the labels in this screen Table 94 Configuration gt Object gt AP Profile gt Radio LABEL DESCRIPTION Add Click this to add a new radio profile Edit Click this to edit the selected radio profile Remove Click this to remove the selected radio profile NXC2500 User s Guide Chapter 16 AP Profile Table 94 Configuration gt Object gt AP Profile gt Radio continued Object Reference LABEL DESCRIPTION Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate Click this to view which other obje
106. have the NXC use the USB storage device The available storage capacity also displays service deactivated the USB storage feature is disabled and the NXC cannot use a connected USB device to store the system log and other diagnostic information Note The NXC reserves some USB storage space as a buffer Captured Packet Files When saving packet captures only to the NXC s onboard storage specify a maximum limit in megabytes for the total combined size of all the capture files on the NXC When saving packet captures to a connected USB storage device specify a maximum limit in megabytes for each capture file Note If you have existing capture files and have not selected the Continuously capture and overwrite old ones option you may need to set this size larger or delete existing capture files The valid range depends on the available onboard USB storage size The NXC stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires Split threshold Specify a maximum size limit in megabytes for individual packet capture files After a packet capture file reaches this size the NXC starts another packet capture file Duration Set a time limit in seconds for the capture The NXC stops the capture and generates the capture file when either this period of time has passed or the file reaches the size specified in the Captured Packet Files field
107. however even if this setting is selected E mail Server 1 Select whether each category of events should be included in the log messages when it is e mailed green check mark and or in alerts red exclamation point for the e mail settings specified in E Mail Server 1 The NXC does not e mail debugging information even if it is recorded in the System log E mail Server 2 Select whether each category of events should be included in log messages when it is e mailed green check mark and or in alerts red exclamation point for the e mail settings specified in E Mail Server 2 The NXC does not e mail debugging information even if it is recorded in the System log Log Consolidation Active Select this to activate log consolidation Log consolidation aggregates multiple log messages that arrive within the specified Log Consolidation I nterval n the View Log tab the text count x where x is the number of original log messages is appended at the end of the Message field when multiple log messages were aggregated Log Consolidation Type how often in seconds to consolidate log information If the same log message Interval appears multiple times it is aggregated into one log message with the text count x where x is the number of original log messages appended at the end of the Message field OK Click this to save your changes and return to the previous screen Cancel Click this to re
108. in the group Object Reference Select an entry and click Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with a specific user group Group Name This field displays the name of each dynamic guest group Description This field displays the description for each dynamic guest group Account Deleted Select this check box to remove the dynamic guest accounts from the Monitor gt After Expiration System Status gt Dynamic Guest screen when they expire Dynamic Guest Enter the notes such as the SSID and security key the dynamic guests can use to Note access the network services you wan to display in the paper along with the account information you print out for dynamic guest users You can enter up to 1024 ASCII characters NXC2500 User s Guide 179 Chapter 15 User Group Table 86 Configuration gt Object gt User Group gt Setting continued LABEL DESCRIPTION Apply Click Apply to save the changes Reset Click Reset to return the screen to its last saved settings 15 4 1 Edit User Authentication Timeout Settings This screen allows you to set the default authentication timeout settings for the selected type of user account These default authentication timeout settings also control the settings for any existing user accounts that are set to use the default settings You can still manually configure any user account s a
109. in this screen Table 143 Configuration gt System gt FTP LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Service Control table to access the NXC using this service TLS required Select the check box to use FTP over TLS Transport Layer Security to encrypt communication This implements TLS as a security mechanism to secure FTP clients and or servers Server Port You may change the server port number for a service if needed however you must use the same port number in order to use that service for remote management Server Certificate Service Control Select the certificate whose corresponding private key is to be used to identify the NXC for FTP connections You must have certificates already configured in the My Certificates screen This specifies from which computers you can access which NXC zones NXC2500 User s Guide Chapter 24 System Table 143 Configuration gt System gt FTP continued LABEL DESCRIPTION Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent
110. independent of the physical network so you can change the physical network without changing policies In this example the new switch handles the following types of traffic e Inside VLAN 2 e Between the router and VLAN 1 e Between the router and VLAN 2 e Between the router and VLAN 3 8 3 1 VLAN Summary This screen lists every VLAN interface To access this screen click Configuration gt Network gt Interface gt VLAN Figure 60 Configuration gt Network gt Interface gt VLAN Ethernet Configuration SH Add w y Status Name IP Address VID Member 1 Q vlan0 STATIC 192 168 1 1 1 ge1 ge2 ge3 ge4 ge5 ge6 Page 1 of 1 Show 50 v items Displaying 1 2 of 2 Apply Reset Each field is explained in the following table Table 55 Configuration gt Network gt Interface gt VLAN LABEL DESCRIPTION Add Click this to create a new VLAN Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate Object Select an entry and click Object Reference to open a screen that shows which settings use Reference the entry This field is a sequential value and it is not associated with any i
111. indicates the current data transmission rate of the station Rx Rate This indicates the current data receiving rate of the station Association Time This displays the time a wireless station first associated with the AP Refresh Click this to refresh the items displayed on this page 5 14 Detected Device Use this screen to view information about wireless devices detected by the AP Click Monitor gt Wireless gt Rogue AP gt Detected Device to access this screen Note At least one radio of the APs connected to the NXC must be set to monitor mode in the Wireless gt AP Management screen in order to detect other wireless devices in its vicinity Figure 36 Monitor gt Wireless gt Rogue AP gt Detected Device Detected Device Detected Device Mark as Friendly AP Status Device Roer MAC Address SSID Name ChanneliD 802 1 Security Description Last Seen AAA A AEREA E T 2 Q infras friendly ap 52 4A 03 79 ED 97 Test 6 WEP Fri Apr 29 3 Q infras 00 17 9A 50 24 9F Lab IEEE 8 WEP Fri Apr 29 Q infras 52 67 F0 F7 71 04 ZyXEL_7104 gt IEEE 8 WEP Fri Apr 29 Page 1 of 1 Show 50 items Displaying 1 28 of 28 NXC2500 User s Guide 79 Chapter 5 Monitor The following table describes the labels in this screen Table 38 Monitor gt Wireless gt Rogue AP gt Detected Device LABEL DESCRIPTION Mark as Rogu
112. is the NXC s summary list of certificates and certification requests Figure 136 Configuration gt Object gt Certificate gt My Certificates Trusted Certificates PKI Storage Space in Use 0 035 used My Certificates Setting S Add Name Type Subject Issuer Valid From Valid To 1 default SELF CN nxc2500_B0B2D CN nxc2500_B0B2D 2012 12 07 10 49 31 2032 12 02 10 49 31 Page 1 of 1 Show 50 v items Displaying 1 1of 1 Import Refresh The following table describes the labels in this screen Table 122 Configuration gt Object gt Certificate gt My Certificates LABEL DESCRIPTION PKI Storage This bar displays the percentage of the NXC s PKI storage space that is currently in use Space in Use When the storage space is almost full you should consider deleting expired or unnecessary certificates before adding more certificates Add Click this to go to the screen where you can have the NXC generate a certificate or a certification request Edit Double click an entry or select it and click Edit to open a screen with an in depth list of information about the certificate Remove The NXC keeps all of your certificates unless you specifically delete them Uploading a new firmware or default configuration file does not delete your certificates To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Subsequent certificates move u
113. it looking for the channel with the least amount of interference In the 2 4 GHz spectrum each channel from 1 to 13 is broken up into discrete 22 MHz segments that are spaced 5 MHz apart Channel 1 is centered on 2 412 GHz while channel 13 is centered on 2 472 GHz Figure 51 An ses Three Channel gt O TOb7 TI bz STbz Tevz tbr Sbbz 8bbz TSvz esvz T9bz ELbz BLvz s6b7 TvZ gvz E v7 DET Totz 100 NXC2500 User s Guide Chapter 7 Wireless Three channels are situated in such a way as to create almost no interference with one another if used exclusively 1 6 and 11 When an AP broadcasts on any of these three channels it should not interfere with neighboring APs as long as they are also limited to same trio Figure 52 An Example Four Channel Deployment N N N N N N N NN N N NN NN N N NN N NN NN N ON ON SREPRBBBRBRBEBRSBBERBEESERRBEBRBHHS B PRERRBRRBRBRE HBSS B0882208338 However some regions require the use of other channels and often use a safety scheme with the following four channels 1 4 7 and 11 While they are situated sufficiently close to both each other and the three so called safe channels 1 6 and 11 that interference becomes inevitable the severity of it is dependent upon other factors proximity to the affected AP signal strength activity and so on Finally there is an alternative four channel scheme for ETSI consisting of channels 1 5 9 13 This offers significantly less
114. it randomly selects one server and tries to synchronize with it If the synchronization fails then the NXC goes through the rest of the list in order from the first one tried until either it is successful or all the pre defined NTP time servers have been tried 24 4 2 Time Server Synchronization Click the Synchronize Now button to get the time and date from the time server you specified in the Time Server Address field NXC2500 User s Guide 263 Chapter 24 System When the Loading message appears you may have to wait up to one minute Figure 146 Loading The Current Time and Current Date fields will display the appropriate settings if the synchronization is successful If the synchronization was not successful a log displays in the View Log screen Try re configuring the Date Time screen To manually set the NXC date and time 1 Click System gt Date Time 2 Select Manual under Time and Date Setup 3 Enter the NXC s time in the New Time field 4 Enter the NXC s date in the New Date field 5 Under Time Zone Setup select your Time Zone from the list 6 Asan option you can select the Enable Daylight Saving check box to adjust the NXC clock for daylight savings 7 Click Apply To get the NXC date and time from a time server 1 Click System gt Date Time 2 Select Get from Time Server under Time and Date Setup 3 Under Time Zone Setup select your Time Zone from the list 4 Under Time and Date Se
115. level to Medium The AP s tolerance for interference is relatively narrow On the other hand if you know there are numerous other devices in the region you should set the level to High to keep the interference to a minimum In this case the NXC s tolerance for interference is quite strict Note Generally speaking the higher the sensitivity level the more frequently the AP switches channels As a consequence anyone connected to the AP will experience more frequent disconnects and reconnects unless you select Enable DCS Client Aware Enable DCS Client Aware Select this to have the AP wait until all connected clients have disconnected before switching channels If you disable this then the AP switches channels immediately regardless of any client connections In this instance clients that are connected to the AP when it switches channels are dropped 2 4 GHz Channel Selection Method Select auto to have the AP search for available channels automatically in the 2 4 GHz band The available channels vary depending on what you select in the 2 4 GHz Channel Deployment field Select manual and specify the channels the AP uses in the 2 4 GHz band Available This text box lists the channels that are available in the 2 4 GHz band Select the channels channels that you want the AP to use and click the right arrow button to add them Channels This text box lists the channels that you allow the AP to use Select any channels th
116. max_file_size d when the wireless frame capture has been completed 1st d total files size of directory 2nd d max files size Can not initial monitor mode signal handler n While an AP is in Monitor mode the handler functions as a daemon if it fails to initialize the handler then this message is returned Table 193 DCS Logs LOG MESSAGE DESCRIPTION des init failed n Indicates that the NXC failed to initialize the dcs daemon init zylog fail n channel changed s d gt d n Indicates that the NXC failed to initialize zylog DCS has changed the wireless interface s channel from d to channel d lst s interface name 1st d current channel 2nd d new channel dcs is terminated DCS was terminated for an unknown reason Table 194 WLAN Station Info LOG MESSAGE DESCRIPTION STA Association Addr 02x 02x 02x S02x 02x 02x AP s A wireless client is connected to the AP 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP s description STA Disassociation Addr 02x 02x 02x S02x O2x 02x AP s A wireless client is disconnected from the AP 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP s description STA Roaming MAC 02x 02x 02x 02 x 02x 02x From s To s A wireless client roams from one AP to another 1st 02x 6th 02x Station MAC Address 7th s Source WTP s description 8th
117. may be incorrect or there may be a problem with the NXC s or the server s network connection NXC2500 User s Guide Appendix A Log Descriptions Table 187 P MAC Binding Logs LOG MESSAGE DESCRIPTION Drop packet Ss Su Su Su Su 02X 502X 02X 502X 0 2X 502X The IP MAC binding feature dropped an Ethernet packet The interface the packet came in through and the sender s IP address and MAC address are also shown Cannot bind ip mac from dhcpd Ss su Su Su Su S02X 0 2X 302X 02X 502K 02X The IP MAC binding feature could not create an IP MAC binding hash table entry The interface the packet came in through the sender s IP address and MAC address are also shown along with the binding type s for static or d for dynamic Cannot remove ip mac binding from dhcpd Ss ou Su Su Su S02X 0 2X 02X 02X 502X 02X The IP MAC binding feature could not delete an IP MAC binding hash table entry The interface the packet came in through the sender s IP address and MAC address are also shown along with the binding type s for static or d for dynamic Table 188 CAPWAP Server Logs LOG MESSAGE DESCRIPTION WLAN Controller Start Registration Type s Start the AP management service 1st s Registration Type Always Accept Manual WLAN Controller Reset Registration Type s Reset the AP management service 1st s Registratio
118. may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Description This field displays the description of each address group if any You can use up to 60 characters punctuation marks and spaces NXC2500 User s Guide Chapter 18 Addresses Table 107 Configuration gt Object gt Address gt Address Group gt Add Edit continued LABEL DESCRIPTION Member List The Member list displays the names of the address and address group objects that have been added to the address group The order of members is not important Select items from the Available list that you want to be members and move them to the Member list You can double click a single entry to move it or use the Shift or Ctrl key to select multiple entries and use the arrow button to move them Move any members you do not want included to the Available list OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide Chapter 18 Addresses NXC2500 User s Guide Services 19 1 Overview Use service objects to define TCP applications UDP applications and ICMP messages You can also create service groups to refer to multiple service objects in other features 19 1 1 What You Can Do in this Chapter e The Service screens Section 19 2 on p
119. menu to create one Note It is highly recommended that you create security profiles for all of your SSIDs to enhance your network security MAC Filtering Profile Select a MAC filtering profile from the list to associate with this SSID If none exist you can sue the Create new Object menu to create one MAC filtering allows you to limit the wireless clients connecting to your network through a particular SSID by wireless client MAC addresses Any clients that have MAC addresses not in the MAC filtering profile of allowed addresses are denied connections The disable setting means no MAC filtering is used NXC2500 User s Guide Chapter 16 AP Profile Table 97 Configuration gt Object gt AP Profile gt Add Edit SSID Profile continued LABEL DESCRIPTION QoS Select a Quality of Service QoS access category to associate with this SSID Access categories minimize the delay of data packets across a wireless network Certain categories such as video or voice are given a higher priority due to the time sensitive nature of their data packets QoS access categories are as follows disable Turns off QoS for this SSID All data packets are treated equally and not tagged with access categories WMM Enables automatic tagging of data packets The NXC assigns access categories to the SSID by examining data as it passes through it and making a best guess effort If something looks like video traffic f
120. nmsigport gt ht Encrypted Aler nms1gport it Att ps nms1q o o 2448 72 16 1 33 72 l gport gt ht o 0 rmlnk gt htt Client Hello https gt rmink server Hello a f 5 Y 5a change Cipher 072077 RESTE A Ignored Unknow 072944 SiGe 16 1 httos gt rmlnk gt 4 erfa e0 Dst ZyxelCcom_00 30 59 00 13 49 00 30 59 Internet sr spe 172 T6 T 33 o E yo K p RE E D PE a a oe K To e R G72 16521 Transmission Control Protocol src Port rmlnk 2818 Dst Port https 443 Seq 173 Ack 139 Len Secure Socket Layer E O Frame a 1500 bytes Pae 1794 Displayed 1794 Marked 0 E Profile Default 27 4 Core Dump Use the Core Dump screen to have the NXC save a process s core dump to an attached USB storage device if the process terminates abnormally crashes You may need to send this file to customer support for troubleshooting NXC2500 User s Guide Chapter 27 Diagnostics Click Maintenance gt Diagnostics gt Core Dump to open the following screen Figure 191 Maintenance gt Diagnostics gt Core Dump Packet Capture Wireless Frame Capture Settings Core Dump Y Save core dump to USB storage if ready The following table describes the labels in this screen Table 163 Maintenance gt Diagnostics gt Core Dump LABEL DESCRIPTION Save core dump to USB Select this to have the NXC save a process s core dump to an attached USB storage storage if ready d
121. of trusted certification authorities Request Authentication When you select Create a certification request and enroll for a certificate immediately online the certification authority may want you to include a reference number and key to identify you when you send a certification request Fill in both the Reference Number and the Key fields if your certification authority uses the CMP enrollment protocol Just the Key field displays if your certification authority uses the SCEP enrollment protocol For the reference number use O to 99999999 For the key use up to 31 of the following characters a zA ZO 91 7 8 _HUJP lt gt OK Click OK to begin certificate or certification request generation Cancel Click Cancel to quit and return to the My Certificates screen If you configured the My Certificate Create screen to have the NXC enroll a certificate and the certificate enrollment is not successful you see a screen with a Return button that takes you back to the My Certificate Create screen Click Return and check your information in the My Certificate Create screen Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the NXC to enroll a certificate online NXC2500 User s Guide Chapter 23 Certificates 23 2 2 Edit My Certificates Click Configuration gt Object gt Certificate gt My Certificates and t
122. on the interface cannot get the RADIUS server to authenticate the NXC s default admin account The default admin account is always authenticated locally regardless of the authentication method setting The NXC fails to authentication the ext user user accounts configured NXC2500 User s Guide 351 Chapter 31 Troubleshooting An external server such as AD LDAP or RADIUS must authenticate the ext user accounts If the NXC tries to use the local database to authenticate an ext user the authentication attempt will always fail cannot add the admin users to a user group with access users You cannot put access users and admin users in the same user group cannot add the default admin account to a user group You cannot put the default admin account into any user group The schedule configured is not being applied at the configured times Make sure the NXC s current date and time are correct cannot get a certificate to import into the NXC 1 For My Certificates you can import a certificate that matches a corresponding certification request that was generated by the NXC You can also import a certificate in PKCS 12 format including the certificate s public and private keys 2 You must remove any spaces from the certificate s filename before you can import the certificate 3 Any certificate that you want to import has to be in one of these file formats e Binary X 509
123. or run a shell script without the NXC restarting You can store multiple configuration files and shell script files on the NXC You can edit configuration files or shell scripts in a text editor and upload them to the NXC Configuration files use a conf extension and shell scripts use a zysh extension 26 1 1 What You Can Do in this Chapter The Configuration File screen Section 26 2 on page 315 stores and names configuration files You can also download and upload configuration files The Firmware Package screen Section 26 3 on page 319 checks your current firmware version and uploads firmware to the NXC The Shell Script screen Section 26 4 on page 321 stores names downloads uploads and runs shell script files 26 1 2 What you Need to Know The following terms and concepts may help as you read this chapter Configuration Files and Shell Scripts When you apply a configuration file the NXC uses the factory default settings for any features that the configuration file does not include When you run a shell script the NXC only applies the commands that it contains Other settings do not change NXC2500 User s Guide 313 Chapter 26 File Manager These files have the same syntax which is also identical to the way you run CLl commands manually An example is shown below Figure 179 Configuration File Shell Script Example enter configuration mode configure terminal change administrator passw
124. port has it s link down Table 177 Connectivity Check Logs LOG MESSAGE DESCRIPTION Can t open link_up2 Cannot recover routing status which is link down Can not open s pid Cannot open connectivity check process ID file s interface name Can not open s arg Cannot open configuration file for connectivity check process s interface name The connectivity The link status of interface is still activate after check of connectivity check check is activate for Process s interface s interface name The connectivity The link status of interface is fail after check of connectivity check process check is fail for s s interface name interface Can t get gateway IP The connectivity check process can t get the gateway IP address for the of s interface specified interface s interface name Can t alloc memory The connectivity check process can t get memory from OS Can t load s module The connectivity check process can t load module for check link status s the connectivity module currently only ICMP available isalive Ss module Can t handle function of The connectivity check process can t execute isalive function from module for check link status s the connectivity module currently only ICMP available NXC2500 User s Guide 373 Appendix A Log Descriptions 374 Table 177 Connectivity Check Logs continued LOG MES
125. port s of packets for the NAT entry This field is blank if there is no restriction on the original destination port Mapped Port This field displays the new destination port s for the packet This field is blank if there is no restriction on the original destination port Apply Click this button to save your changes to the NXC Reset Click this button to return the screen to its last saved settings NXC2500 User s Guide Chapter 11 NAT 11 2 1 Add Edit NAT This screen lets you create new NAT rules and edit existing ones To open this window open the NAT summary screen Then click on an Add icon or Edit icon to open the following screen Figure 70 Configuration gt Network gt NAT gt Add Edit 4 Add NAT 2x 5 Create new Object y General Settings Y Enable Rule Rule Name oO Benen et ies Port Mapping Type Classification O Virtual Server 1 1NAT Many 1 1NAT Mapping Rule Incoming Interface gel vi Original IP User Defined y User Defined Original IP A FAA gt Address Mapped IP User Defined gt User Defined Mapped IP i Or Address Port Mapping Type Ports Me Protocol Type any v Original Start Port Q Original End Port Q Mapped Start Port Mapped End Port Related Settings W Enable NAT Loopback E Configure Firewall EJ Cancel The following table describes the labels in this screen Table 68 Configuration g
126. profile Remove Click this to remove the selected security profile Object Reference Click this to view which other objects are linked to the selected security profile for example SSID profile This field is a sequential value and it is not associated with a specific profile Profile Name This field indicates the name assigned to the security profile Security Mode This field indicates this profile s security mode if any NXC2500 User s Guide 197 Chapter 16 AP Profile 16 3 2 1 Add Edit Security Profile This screen allows you to create a new security profile or edit an existing one To access this screen click the Add button or select a security profile from the list and click the Edit button Note This screen s options change based on the Security Mode selected Only the default screen is displayed here Figure 110 Configuration gt Object gt AP Profile gt SSID gt Security Profile gt Add Edit Security Profile Add Security Profile General Settings Profile Name Security Mode Radius Settings Radius Server Type Radius Server IP Address Radius Server Port Radius Server Secret Radius Server IP Address Radius Server Port Radius Server Secret MAC Authentication Setting Y MAC Authentication Delimiter Account Case Account Delimiter Calling Station ID Case Calling Station ID Authentication Settings 9 802 1X ReAuthentication Timer
127. remove zones To access this screen click Configuration gt Network gt Zone Figure 66 Configuration gt Network gt Zone User Configuration Q Add i Show 50 v items Displaying 1 1of 1 The following table describes the labels in this screen Table 65 Configuration gt Network gt Zone LABEL DESCRIPTION Add Click this to create a new user configured zone Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove a user configured zone select it and click Remove The NXC confirms you want to remove it before doing so Object Reference Select an entry and click Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with any interface Name This field displays the name of the zone Member This field displays the names of the interfaces that belong to each zone NXC2500 User s Guide Chapter 10 Zones 10 2 1 Add Edit Zone This screen allows you to add or edit a zone To access this screen go to the Zone screen and click the Add icon or an Figure 67 Network Edit Zone Group Members Name Member List Available gel ge2 ge3 ge4 ge5 ge6 vlan123 Interface Interface Edit icon gt Zone gt Add Edit LAN Member vlan0 HE OK Cancel The following ta
128. return the screen to its last saved settings 7 3 AP Management Use this screen to manage all of the APs connected to the NXC Click Configuration gt Wireless gt AP Management to access this screen Figure 43 Configuration gt Wireless gt AP Management Mgnt AP List Mgnt AP List i a IP Address MAC Address Model R1 Mode Profile R2Mode Profile Mgnt VL Mant VL Description 1 172 16 30 106 B0 B2 DC 6E 7F NWAS512 AP default AP default2 1 1 AP B0B2DC6E7 Page 1 of 1 Show 50 v items Displaying 1 10f 1 EN NXC2500 User s Guide Chapter 7 Wireless Each field is described in the following table Table 44 Configuration gt Wireless gt AP Management LABEL DESCRIPTION Edit Select an AP and click this button to edit its properties Remove Select an AP and click this button to remove it from the list Note If in the Configuration gt Wireless gt Controller screen you set the Registration Type to Always Accept then as soon as you remove an AP from this list it reconnects Reboot Select an AP and click this button to force it to restart This field is a sequential value and it is not associated with any interface IP Address This field displays the IP address of the AP MAC Address This field displays the MAC address of the AP Model This field displays the AP s hardware model information It displays N A not applicable only when the AP
129. s Destination WTP s description STA List Full List of AP s Full STA is The number of wireless clients connected to the AP has reached the maximium limit lst s Managed AP s description NXC2500 User s Guide Appendix A Log Descriptions Table 194 WLAN Station Info LOG MESSAGE DESCRIPTION STA Disassociation s MAC 502x 02x 502x 02x 5 02x 502x AP S Indicates the reason why a wireless client is disassociated from an AP 1st s Disassociation reason 2nd 02x 7th 02x Wireless client s MAC Address 8th s Managed AP Description AP Radio x 02x 3 02x Station dBm MAC SO02x 02x 502x 02x RSSI d MAC 02x 02x 02x 02 Reject 02x 02x An AP rejected a wireless client s association request 1st 02x 6th 02x AP s MAC Address 7th 02x 12th 02x Wireless client s MAC Address 13th d RSSI value NXC2500 User s Guide Common Services The following table lists some commonly used services and their associated protocols and port numbers For a comprehensive list of port numbers ICMP type code numbers and services visit the IANA Internet Assigned Number Authority web site e Name This is a short descriptive name for the service You can use this one or create a different one if you like e Protocol This is the type of IP protocol used by the service If this is TCP UDP then the service uses the sa
130. settings for each log in the remote server syslog Go to the Log Settings Summary screen and click a remote server Edit icon Figure 177 Configuration gt Log amp Report gt Log Settings gt Edit Remote Server Edit Remote Server 1 Log Settings for Remote Server E Active Log Format VRPT Syslog v Server Address Log Facility Local 1 y Active Log AC D Selection v Log Category 1 Account 2 Captive Portal 3 Authentication Server 4 Builtin Service 5 CAPWAP 6 Connectivity Check 7 Daily Report 8 Default 9 DHCP 33 ZySH Page 1 of 1 Show 50 v items Active Log AP gt Selection y Log Category 1 Account 2 Built in Service 3 CAPWAP 4 Daily Report 5 Default 6 DHCP 7 File Manager 8 Force Authentication 9 Interface 10 Interface Statistics 11 PKI Page 1 of 1 Show 50 items 2x Server Name or IP Address Selection Displaying 1 33 of 33 Selection Displaying 1 23 of 23 NXC2500 User s Guide 307 Chapter 25 Log and Report The following table describes the labels in this screen Table 153 Configuration gt Log Report gt Log Settings gt Edit Remote Server LABEL DESCRIPTION Log Settings for Remote Server Active Select this check box to send log information according to the information in this section You specify what kinds of messages are included in log information in the Acti
131. siara aa 185 TA I AV Edi MAC ARES A hardents tahini 186 Chapter 16 a AAA e a aa ee 187 TAI adi 187 161 1 What You Gan Do in this Chaplet ca eee omen ee areas 187 101 2 Wna You TN eed Ta RAW ar sare vte ars sateceaiantnteands sorevtusiestty aamiolateaad sent tana auc 187 ARA raid 188 Tea A lo e e ES 190 RAS er a oa 193 TEST BG nia 193 18 3 NIE St ni ia 196 TS BA Fiar CSE adi 201 Chapter 17 MON Profile ii 203 EAT N E i ART 203 1211 What You Cari Do inthis Chapter cr 203 1712 Wihal You Need TO KION sora 203 NXC2500 User s Guide 9 Table of Contents recae POE IO o isa A 204 121 o e EIN PI noia nit ei 205 149 Tecnica PUG OROTICS e 206 Chapter 18 PODIO ci A A A AN AA RARA 209 e o A deanna edad EEA OA E A E A 209 12441 What You Can Do dls Chaptal ali 209 CAPA a e e canada 209 sola E AA TO 209 18 21 AWE AOS e 210 1 Se es A dae eet eaaa ba eden 211 18 3 1 Add Edit Address Group RUIS ar ici 212 Chapter 19 e AA 215 TETOVO ON ri ANA AAA AA 215 19 11 What SUSTO IS Chapter ri ceehnusdssnadasthehasnintaesdaiWideadinduciudasaed passaese 215 191 2 What You Neod to ROW iii 215 e e A E O 216 1121 ARRE dE Seraca Rule caidas iia 217 153 GCE GRUP SUMMAI sue 218 1831 Add Edit Serice Group NES ssc sas id 219 Chapter 20 SONAS ii a is 221 BOT AI oir ea 221 201 1 What Yon Cam Do ih tis HAIER sar pea een 221 SU NAL POU Sado NOA dai diras 221 20 2 SCM SUMAR 222 20 2 1 Add Edit Schedule One Time Rule ococoooccccnncccccacoccncncccnonncco
132. stopping the device 22 subscription services status 88 upgrading 88 supported browsers 29 syslog 300 308 syslog servers see also logs system log see logs system name 51 260 system reports see reports system uptime 52 system default conf 318 T target market 17 TCP 215 connections 215 port numbers 215 Telnet 287 and address groups 287 and address objects 287 and zones 287 with SSH 285 Temporal Key Integrity Protocol TKIP 413 time 261 time servers default 263 trademarks 417 traffic statistics 64 Transmission Control Protocol see TCP Transport Layer Security TLS 288 troubleshooting 325 330 349 Trusted Certificates see also certificates 252 U UDP 215 messages 215 port numbers 215 upgrading firmware 319 licenses 88 uploading configuration files 319 firmware 319 shell scripts 321 usage CPU 51 54 flash 51 memory 51 55 onboard flash 51 sessions 51 56 user authentication 169 external 170 local user database 228 user awareness 171 User Datagram Protocol see UDP user group objects 169 user groups 169 171 and policy routes 129 130 user name rules 173 user objects 169 user sessions see sessions users 169 access see also access users admin type 169 admin see also admin users and AAA servers 170 and authentication method objects 170 and LDAP 170 and policy routes 129 130 and RADIUS 170 NXC2500 User s Guide Index and service control 272 attributes for Ext User 170 curre
133. summary of all wireless devices detected by the network Click the link to go to the Rogue AP gt Detected Device screen This displays the number of detected unclassified APs Rogue AP Friendly AP This displays the number of detected rogue APs This displays the number of detected friendly APs Licensed Service Status This shows how many licensed services there are Status This is the current status of the license Name This identifies the licensed service Version This is the version number of the service Expiration If the service license is valid this shows when it will expire N A displays if the service license does not have a limited period of validity The Latest Alert Logs This section of the screen displays recent logs generated by the NXC This is the entry s rank in the list of alert logs Time This field displays the date and time the log was created Priority This field displays the severity of the log Category This field displays the type of log generated Message This field displays the actual log message Source This field displays the source address if any in the packet that generated the log Destination This field displays the destination address if any in the packet that generated the log Extension Slot This section of the screen displays the status of the USB ports This field displays how many USB ports there are Exte
134. table icons Table 14 Common Table Icons LABEL DESCRIPTION Add Click this to create a new entry For features where the entry s position in the numbered list is important features where the NXC applies the table s entries in order you can select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings In some tables you can just click a table entry and edit it directly in the table For those types of tables small red triangles display for table entries with changes that you have not yet applied Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate NXC2500 User s Guide Chapter 3 The Web Configurator Table 14 Common Table Icons continued LABEL DESCRIPTION Object Reference Select an entry and click Object Reference to open a screen that shows which settings use the entry Move To change an entry s position in a numbered list select it and click Move to display a field to type a number for where you want to put that entry and press ENTER to move the entry to the number that you typed For example if you type 6 the entry you are moving becomes number 6 and the pr
135. that handles the booting process of the NXC Current Version This shows the firmware version of the NXC Released Date This shows the date yyyy mm dd and time hh mm ss when the firmware is released OK Click this to close the screen NXC2500 User s Guide Chapter 3 The Web Configurator Site Map Click Site MAP to see an overview of links to the Web Configurator screens Click a screen s link to go to that screen Figure 9 Site Map oF Site Map 2x Monitor System Status Wireless Log O Port Statistics O AP Information O Interface Status O Station Info Traffic Statistics O Roque AP sion Monitor IP MAC Binding Login Users Dynamic Guest USB Storage ooooc amp Configuration 3 Maintenance Es Object Reference Click Object Reference to open the Object Reference screen Select the type of object and the individual object and click Refresh to show which configuration settings reference the object Figure 10 Object Reference 3 Object References ax Object Type Please select one v Object Name Please select one v Service Priority Name Description Page 1 ofi Show 50 v items No data to display NXC2500 User s Guide Chapter 3 The Web Configurator The fields vary with the type of object The following table describes labels that can appear in this screen Table 8 Object References LABEL DESCRIPTION Object
136. the NXC on the physical port since it was last connected Collisions This field displays the number of collisions on the physical port since it was last connected Tx B s This field displays the transmission speed in bytes per second on the physical port in the one second interval before the screen updated Rx B s This field displays the reception speed in bytes per second on the physical port in the one second interval before the screen updated Up Time This field displays how long the physical port has been connected System Up Time This field displays how long the NXC has been running since it last restarted or was turned on NXC2500 User s Guide Chapter 5 Monitor 5 3 1 Port Statistics Graph Use the port statistics graph to look at a line graph of packet statistics for each physical port To view click Monitor gt System Status gt Port Statistics and then the Switch to Graphic View Button Figure 23 Monitor gt System Status gt Port Statistics gt Switch to Graphic View General Settings Refresh Interval 5 minutes Mi Refresh Now Port Usage Port Selection v Switch To Grid View 1 bps Last Update 2013 01 05 15 41 19 0 9 ee a ec 19 44 23 41 03 41 07 41 11 41 15 41 The following table describes the labels in this screen Table 22 Monitor gt System Status gt Port Statistics gt Switch to Graphic View LABEL DESCRIPTION Refresh Interval Enter how oft
137. the password for the default user account this screen does not appear anymore NXC2500 User s Guide Chapter 3 The Web Configurator 3 3 The Main Screen The Web Configurator s main screen is divided into these parts Figure 6 The Web Configurator s Main Screen ZyXEL nxc2500 D SHBOARD de WT Device Information System Name Model Name Serial Number MAC Address Range Firmware Version E System Status System Uptime Current Date Time DHCP Table Current Login User Number of Login Users Boot Status NXC2500 NXC2500 132L06160030 B0 B2 DC 6E A8 97 B0 B2 DC 6E A8 9C V4 OO AAIG 0 V0 9 1 2013 03 11 00 45 23 01 40 35 2013 04 02 18 21 39 GMT 00 00 o admin unlimited 00 29 59 4 Firmware update OK f Licensed Service Status Status Name 1 O notLice MAPS A The Latest Alert Logs Time Priority 2013 04 02 alert 2013 04 02 alert 2013 04 02 alert 2013 04 02 alert 2013 04 02 alert WI Extension Slot Extension Slot Device Version Expiration N A 9 2 x Category Message Source Destination AP doesn policy route Interface policy route Interface capwap AP doesn policy route Interface capwap USB 1 none Os R USB 2 CPU Usage A Title Bar e B Navigation Panel e C Main Window 3 3 1 Title Bar The title bar provides some useful links that always appear over the screens below regardless of
138. the same number of IP addresses One many 1 1 NAT rule works like multiple 1 1 NAT rules but it eases configuration effort since you only create one rule Incoming Select the interface on which packets for the NAT rule must be received It can be an Interface Ethernet or VLAN interface Original IP Specify the destination IP address of the packets received by this NAT rule s specified incoming interface any Select this to use all of the incoming interface s IP addresses including dynamic addresses or those of any virtual interfaces built upon the selected incoming interface User Defined Select this to manually enter an IP address in the User Defined field For example you could enter a static public IP assigned by the ISP without having to create a virtual interface for it Host address select a host address object to use the IP address it specifies The list also includes address objects based on interface IPs So for example you could select an address object based on a WAN interface even if it has a dynamic IP address User Defined This field is available if Original IP is User Defined Type the destination IP address that Original IP this NAT rule supports Original IP This field displays for Many 1 1 NAT Select the destination IP address subnet or IP address Subnet Range range that this NAT rule supports The original and mapped IP address subnets or ranges must have the same number of IP addresses
139. this screen without saving NXC2500 User s Guide Chapter 24 System 24 6 8 MX Record A MX Mail eXchange record indicates which host is responsible for the mail for a particular domain that is controls where mail is sent for that domain If you do not configure proper MX records for your domain or other domain external e mail from other mail servers will not be able to be delivered to your mail server and vice versa Each host or domain can have only one MX record that is one domain is mapping to one host 24 6 9 Add MX Record 24 6 10 Click the Add icon in the MX Record table to add a MX record Figure 151 Configuration gt System gt DNS gt Add MX Record Q Add MX Record DE Domain Name DAAA IP Address FQDN Deseret crite a Jl The following table describes the labels in this screen Table 137 Configuration gt System gt DNS gt Add MX Record LABEL DESCRIPTION Domain Name Enter the domain name where the mail is destined for IP Address FQDN Enter the IP address or Fully Qualified Domain Name FQDN of a mail server that handles the mail for the domain specified in the field above OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit this screen without saving Add Service Control Click the Add icon in the Service Control table to add a service control rule Figure 152 Configuration gt Sys
140. thus you do not need to import any certificate that is signed by one of these certificates Figure 140 Configuration gt Object gt Certificate gt Trusted Certificates My Certificates Trusted Certificates PKI Storage Space in Use Trusted Certificates Setting w Name 1 MyCertificate Page 1 Subject CN Mydevice example of 1 Show 50 Issuer Valid From Valid To CN Mydevice example 2013 04 09 10 44 04 GMT 2016 04 08 10 44 04 GMT v items Displaying 1 1of 1 Import Refresh The following table describes the labels in this screen Table 126 Configuration gt Object gt Certificate gt Trusted Certificates LABEL DESCRIPTION PKI Storage Space in Use This bar displays the percentage of the NXC s PKI storage space that is currently in use When the storage space is almost full you should consider deleting expired or unnecessary certificates before adding more certificates Edit Double click an entry or select it and click Edit to open a screen with an in depth list of information about the certificate Remove The NXC keeps all of your certificates unless you specifically delete them Uploading a new firmware or default configuration file does not delete your certificates To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Subsequent certificates move up by one when you take this action Object Reference You cannot dele
141. to create a new service or edit an existing one To access this screen go to the Service screen and click either the Add icon or an Edit icon Figure 121 Configuration gt Object gt Service gt Service gt Add Edit 3 Add Service Rule Name IP Protocol Starting Port Ending Port 21 LAANA DADEA Y TCP y 1 65535 1 65535 Cancel The following table describes the labels in this screen Table 109 Configuration gt Object gt Service gt Service gt Add Edit LABEL DESCRIPTION Name Type the name used to refer to the service You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive IP Protocol Select the protocol the service uses Choices are TCP UDP ICMP and User Defined Starting Port This field appears if the IP Protocol is TCP or UDP Specify the port number s used by this service If you fill in one of these fields the service uses that port If you fill in both fields the Ending Port service uses the range of ports ICMP Type This field appears if the IP Protocol is I CMP Type Select the ICMP message used by this service This field displays the message text not the message number IP Protocol This field appears if the IP Protocol is User Defined calla Enter the number of the next level protocol IP protocol Allowed values are O 255 OK Click OK to sa
142. type 2 in the at field Daylight Saving Time ends in the European Union on the last Sunday of October All of the time zones in the European Union stop using Daylight Saving Time at the same moment 1 A M GMT or UTC So in the European Union you would select Last Sunday October The time you type in the at field depends on your time zone In Germany for instance you would type 2 because Germany s time zone is one hour ahead of GMT or UTC GMT 1 Offset Specify how much the clock changes when daylight saving begins and ends Enter a number from 1 to 5 5 by 0 5 increments For example if you set this field to 3 5 a log occurred at 6 P M in local official time will appear as if it had occurred at 10 30 P M Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 4 1 Pre defined NTP Time Servers List When you turn on the NXC for the first time the date and time start at 2003 01 01 00 00 00 The NXC then attempts to synchronize with one of the following pre defined list of Network Time Protocol NTP time servers The NXC continues to use the following pre defined list of NTP time servers if you do not specify a time server or it cannot synchronize with the time server you specified Table 132 Default Time Servers 0 pool ntp org 1 pool ntp org 2 pool ntp org When the NXC uses the pre defined list of NTP time servers
143. value of incoming packets to which this policy route applies or select User Defined to specify another DSCP code point The lower the number the higher the priority with the exception of O which is usually given only best effort treatment any means all DSCP value or no DSCP marker default means traffic with a DSCP value of 0 This is usually best effort traffic The af choices stand for Assured Forwarding The number following the af identifies one of four classes and one of three drop preferences The wmm entries are for QoS For more information on QoS and WMM categories see page 134 User Defined Use this field to specify a custom DSCP code point DSCP Code Schedule Select a schedule to control when the policy route is active none means the route is active at all times if enabled Service Select a service or service group to identify the type of traffic to which this policy route applies Source Port Select a service or service group to identify the source port of packets to which the policy route applies Next Hop Type Select Auto to have the NXC use the routing table to find a next hop and forward the matched packets automatically Select Gateway to route the matched packets to the next hop router or switch you specified in the Gateway field You have to set up the next hop router or switch as a HOST address object first Select Interface to route the matched packets through the speci
144. web page s security information NXC2500 User s Guide Appendix C Importing Certificates Removing a Certificate in Firefox This section shows you how to remove a public key certificate in Firefox 2 1 Open Firefox and click Tools gt Options Tools Web Search Ctrl K Downloads Ctrl J Add ons Java Console Error Console Page Info Clear Private Data Ctrl Shift Del X Options 2 In the Options dialog box click Advanced gt Encryption gt View Certificates w DY Y a 8 9 Main Tabs Content Feeds Privacy Security Advanced gon General Network Updale Encryption Protocols Use SSL 3 0 Use TLS 1 0 Certificates When a web site requires a certificate Select one automatically 2 Ask me every time View Certificates Revocation Lists 402 NXC2500 User s Guide Appendix C Importing Certificates 3 Inthe Certificate Manager dialog box select the Web Sites tab select the certificate that you want to remove and then click Delete Certificate Manager DER Your Certificates Other Peoplk s Web Sites A thorities You have certificates on file that identify these web sites Certificate Name Purposes ZyXEL 3 172 20 37 202 Client Server Status Responder 4 Inthe Delete Web Site Certificates dialog box click OK Delete Web Site Certificates Are you sure you want to delete these web site
145. with the interface in master mode s is interface name DHCP Server on Interface s will be reapplied due to Device HA status is Active When an interface has become the HA master the DHCP server needs to start operating s is interface name DHCP s DNS option s has changed DHCP pool s DNS option support from WAN interface If this interface is unlink disconnect or link connect this log will be shown s is interface name The DNS option of DHCP pool has retrieved from it SS Set timezone to An administrator changed the time zone s is time zone value Set timezone to default An administrator changed the time zone back to the default 0 Enable daylight saving An administrator turned on daylight saving Disable daylight saving An administrator turned off daylight saving DNS access control rules have been reached the maximum number An administrator tried to add more than the maximum number of DNS access control rules 64 DNS access control rule Su of DNS has been appended An administrator added a new rule u is rule number NXC2500 User s Guide Appendix A Log Descriptions Table 175 Built in Services Logs continued LOG MESSAGE DESCRIPTION DNS access control An administrator inserted a new rule rule u has been Entes u is rule number inserted DNS access control An administrator appended a ne
146. your computer to your NXC File Path Type in the location of the file you want to upload in this field or click Browse to find it NXC2500 User s Guide Chapter 26 File Manager Table 158 Maintenance gt File Manager gt Shell Script continued LABEL DESCRIPTION Browse Click Browse to find the zysh file you want to upload Upload Click Upload to begin the upload process This process may take up to several minutes NXC2500 User s Guide Chapter 26 File Manager NXC2500 User s Guide 27 Diagnostics 27 1 Overview Use the diagnostics screens for troubleshooting 27 1 1 What You Can Do in this Chapter The Diagnostics screen Section 27 2 on page 325 generates a file containing the NXC s configuration and diagnostic information if you need to provide it to customer support during troubleshooting e The Packet Capture screen Section 27 3 on page 327 captures data packets going through the NXC The Core Dump screens Section 27 4 on page 330 save a process s core dump to an attached USB storage device if the process terminates abnormally crashes so you can send the file to customer support for troubleshooting e The System Log screens Section 27 5 on page 332 download files of system logs from a connected USB storage device to your computer e The Wireless Frame Capture screens Section 27 6 on page 333 capture network traffic going through the A
147. 0 Down 0 0 00 00 00 Down 0 0 00 00 00 1000M Full 783824 299731 05 07 52 Down 0 0 00 00 00 100M Full 280592 749337 29 02 28 Page 1 of 1 Show 50 wv items Displaying 1 6 of 6 System Up Time 1 days 05 02 48 The following table describes the labels in this screen Table 21 Monitor gt System Status gt Port Statistics LABEL DESCRIPTION Poll Interval Enter how often you want this window to be updated automatically and click Set Interval Set Interval Click this to set the Poll Interval the screen uses Stop Click this to stop the window from updating automatically You can start it again by setting the Poll Interval and clicking Set I nterval Switch to Click this to display the port statistics as a line graph Graphic View KN NXC2500 User s Guide Chapter 5 Monitor Table 21 Monitor gt System Status gt Port Statistics continued LABEL DESCRIPTION This field displays the port s number in the list Port This field displays the physical port number Status This field displays the current status of the physical port Down The physical port is not connected Speed Duplex The physical port is connected This field displays the port speed and duplex setting Full or Half TxPkts This field displays the number of packets transmitted from the NXC on the physical port since it was last connected RxPkts This field displays the number of packets received by
148. 00 5200 TUN24G OU NONE 100 alll 192 168 1 1 80M 34M 10 07 55 2012 06 19 AP kelly 5200 TUN24G 0U NONE 83 alll 192 168 10 98M 64M 10 59 14 2012 06 19 5200 TUN24G 0U NONE 169 254 139 52M 104M 10 06 38 2012 06 19 100 ail Station List NXC2500 User s Guide Chapter 5 Monitor The following table describes the labels in this screen Table 37 Monitor gt Wireless gt Station List LABEL DESCRIPTION SSID Name This field displays the SSID name with which at least one station is associated Click or to display or hide details about wireless stations that connected to the SSID This is the station s index number in this list MAC Address This is the station s MAC address Associated AP This indicates the AP through which the station is connected to the network SSID Name This indicates the name of the wireless network to which the station is connected A single AP can have multiple SSIDs or networks Security Mode This indicates which secure encryption methods is being used by the station to connect to the network Signal Strength This indicates the strength of the signal The signal strength mainly depends on the antenna output power and the distance between the station and the AP IP Address This is the station s IP address An 169 x x x IP address is a private IP address that means the station didn t get the IP address from a DHCP server Tx Rate This
149. 04 NXC2500 User s Guide Chapter 8 Interfaces Each field is described in the following table Table 50 Configuration gt Network gt Interface gt Ethernet LABEL DESCRIPTION Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Activate To turn on an interface select it and click Activate Inactivate To turn off an interface select it and click Inactivate Object Reference Select an entry and click Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with any interface Status This icon is lit when the entry is active and dimmed when the entry is inactive Name This field displays the name of the interface IP Address This field displays the current IP address of the interface If the IP address is 0 0 0 0 the interface does not have an IP address yet This screen also shows whether the IP address is a static IP address STATIC or dynamically assigned DHCP IP addresses are always static in virtual interfaces Mask This field displays the interface s subnet mask in dot decimal notation PVID This field indicates the interface s PVID Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 8 2 1 Edit Ethernet This screen lets you configure IP address assi
150. 1 Configure the external server to authenticate the notebook s wireless client MAC address 2 Click Configuration gt Object gt AP Profile gt SSID gt Security List gt Add Edit Security Profile and configure an SSID security profile s MAC authentication settings to have the AP use the external server to authenticate wireless clients by MAC address see Section 16 3 2 1 on page 198 3 Click Configuration gt Object gt User Group gt User gt Add and create a MAC address user account see Section 15 2 1 on page 173 4 Click Configuration gt Object gt User Group gt MAC Address gt Add and map the notebook s MAC address to the MAC address user account also called a MAC role See Section 15 5 on page 185 User Groups User groups may consist of user accounts or other user groups Use user groups when you want to create the same rule for several user accounts instead of creating separate rules for each one Note You cannot put access users and admin users in the same user group Note You cannot put the default admin account into any user group User Awareness By default users do not have to log into the NXC to use the network services it provides The NXC automatically routes packets for everyone If you want to restrict network services that certain users can use via the NXC you can require them to log in to the NXC first The NXC is then aware of the user who is logged in and you can create user aware
151. 1 Introduction 1 6 Starting and Stopping the NXC Here are some of the ways to start and stop the NXC Always use Maintenance gt Shutdown or the shutdown command before you turn off the NXC or remove the power Not doing so can cause the firmware to become corrupt Table 4 Starting and Stopping the NXC METHOD DESCRIPTION Turning on the power A cold start occurs when you turn on the power to the NXC The NXC powers up checks the hardware and starts the system processes Rebooting the NXC A warm start without powering down and powering up again occurs when you use the Reboot button in the Reboot screen or when you use the reboot command The NXC writes all cached data to the local storage stops the system processes and then does a warm start Using the RESET button If you press the RESET button the NXC sets the configuration to its default values and then reboots Clicking Maintenance gt Shutdown gt Shutdown or using the shutdown command Clicking Maintenance gt Shutdown gt Shutdown or using the shutdown command writes all cached data to the local storage and stops the system processes Wait for the device to shut down and then manually turn off or remove the power It does not turn off the power Disconnecting the power Power off occurs when you turn off the power to the NXC The NXC simply turns off It does not stop the system processes or write cached data to local st
152. 13 03 22 15 55 Add dynamic guest account URVPXUUS Dynamic G 2013 03 22 15 54 Dynamic guest internal error Error link 15 Account 2013 03 22 15 54 2013 03 22 15 54 2013 03 22 15 54 2013 03 22 15 54 2013 03 22 15 54 2013 03 22 15 54 2013 01 07 17 14 2013 01 07 17 09 2013 01 07 17 09 2013 01 07 17 09 Delete the expire dynamic guest account VAPBESMC Account Dynamic guest account VAPBESMC has expire Expire Account Delete the expire dynamic guest account CWYWSWGY Account Dynamic guest account CWYWSWGY has expire Expir Account Delete the expire dynamic guest account AA465F8E Account Dynamic guest account AA465F8E has expire Expire ti Account Add dynamic guest account HMSZACPL Dynamic G Add dynamic guest account AA465F8E Dynamic G Add dynamic guest account CWYWSWGY Dynamic G cs99505959D50599595959555959 9 Add dynamic guest account VAPBESMC Dynamic G Page E of1 Show 50 vw items Displaying 1 16 of 16 The following table describes the labels in this screen Table 39 Monitor gt View Log LABEL DESCRIPTION Show Filter Click this button to show or hide the filter settings Hide Filter If the filter settings are hidden the Display Email Log Now Refresh and Clear Log fields are available If the filter settings are shown the Display Priority Source Address Destination Address Source Interface Destination I nterface Service
153. 27 2 1 Diagnostics Files Click Maintenance gt Diagnostics gt Files to open the diagnostic files screen This screen lists the files of diagnostic information the NXC has collected and stored in a connected USB storage device You may need to send these files to customer support for troubleshooting Figure 187 Maintenance gt Diagnostics gt Files Diagnostics Packet Capture Core Dump System Log Wireless Frame Capture Collect Files Old archives in USB storage y File Name Last Modified Page 1 of 1 Show 50 v items No data to display The following table describes the labels in this screen Table 160 Maintenance gt Diagnostics gt Files LABEL DESCRIPTION Remove Select files and click Remove to delete them from the NXC Use the Shift and or Ctrl key to select multiple files A pop up window asks you to confirm that you want to delete Download Click a file to select it and click Download to save it to your computer This column displays the number for each file entry The total number of files that you can save depends on the file sizes and the available storage space File Name This column displays the label that identifies the file Size This column displays the size in bytes of a file Last Modified This column displays the date and time that the individual files were saved NXC2500 User s Guide Chapter 27 Diagnostics 27 3 Packet Capture Use this scre
154. 30 and interfaces 130 and schedules 130 and user groups 129 130 and users 129 130 benefits 125 criteria 126 pop up windows 29 port mapping 17 ports 17 power off 22 power on 22 PPP interfaces subnet mask 121 preamble mode 409 product overview 17 product registration 418 PSK 414 PTR record 268 Public Key Infrastructure PKI 242 public private key pairs 241 Q QoS 126 Quick Start Guide 2 R RADIUS 228 229 410 advantages 228 and users 170 message types 411 messages 411 shared secret key 411 RADIUS server 292 reboot 22 345 347 vs reset 345 347 Reference Guide CLI 2 registration 85 product 418 related documentation 2 Relative Distinguished Name RDN 229 231 233 Remote Authentication Dial In User Service see RADIUS remote management FTP see FTP NXC2500 User s Guide Index Telnet 287 WWW see WWW reports collecting data 65 daily 298 daily e mail 298 specifications 67 traffic statistics 64 reset 356 vs reboot 345 347 RESET button 22 356 RFC 1631 NAT 133 2131 DHCP 122 2132 DHCP 122 2510 Certificate Management Protocol or CMP 248 Rivest Shamir and Adleman public key algorithm RSA 247 routing protocols and Ethernet interfaces 104 RSA 247 250 256 RSSI threshold 192 RTS Request To Send 408 threshold 408 S SCEP Simple Certificate Enrollment Protocol 248 schedules 221 and current date time 221 and policy routes 130 one time 221 recurring 221
155. 50 255 255 Otherwise it can assign every IP address in the range except the interface s IP address If you do not specify the starting address or the pool size the interface the maximum range of IP addresses allowed by the interface s IP address and subnet mask For example if the interface s IP address is 9 9 9 1 and subnet mask is 255 255 255 0 the starting IP address in the pool is 9 9 9 2 and the pool size is 253 e Subnet mask The interface provides the same subnet mask you specify for the interface e Gateway The interface provides the same gateway you specify for the interface E NXC2500 User s Guide Chapter 8 Interfaces DNS servers The interface provides IP addresses for up to three DNS servers that provide DNS services for DHCP clients You can specify each IP address manually for example a company s own DNS server or you can refer to DNS servers that other interfaces received from DHCP servers for example a DNS server at an ISP These other interfaces have to be DHCP clients It is not possible for an interface to be the DHCP server and a DHCP client simultaneously WINS WINS Windows Internet Naming Service is a Windows implementation of NetBIOS Name Server NBNS on Windows It keeps track of NetBIOS computer names It stores a mapping table of your network s computer names and IP addresses The table is dynamically updated for IP addresses assigned by DHCP This helps reduce broadcast traf
156. ADIUS Click Configuration gt Object gt AAA Server gt RADIUS to display the RADIUS screen Click the Add icon or an Edit icon to display the following screen Use this screen to create a new entry or edit an existing one Figure 134 Configuration gt Object gt AAA Server gt RADIUS gt Add Edit Add RADIUS General Settings Name Description Server Settings Server Address Authentication Port Backup Server Address Backup Authentication Port 1 65535 Optional Timeout 5 1 300 seconds NAS IP Address Address Y Case sensitive User Names E Server Authentication Key o haran User Login Settings Group Membership Attribute User Defined v 26 1 255 New Optional a UP or FaDN BAAI 1812 1 65535 Cancel The following table describes the labels in this screen Table 119 Configuration gt Object gt AAA Server gt RADIUS gt Add Edit LABEL Name Description DESCRIPTION Enter a descriptive name up to 63 alphanumerical characters for identification purposes Enter the description of each server if any You can use up to 60 printable ASCII characters Server Address Enter the address of the RADIUS authentication server Authentication Specify the port number on the RADIUS server to which the NXC sends authentication Port requests Enter a number between 1 and 65535 Backup Server If the RADIUS server has a backup authenti
157. AN 114 Ethernet interface 107 range 51 MAC authentication 199 Calling Station ID 200 case 199 200 delimiter 199 200 mac role 185 Management Information Base MIB 290 291 mapping ports 17 memory usage 51 55 message bar 41 Message Integrity Check MIC 413 messages CLI 37 warning 41 metrics see reports model name 51 multicast 193 multicast rate 193 My Certificates see also certificates 244 myZyXEL com 85 accounts creating 85 N NAT 133 139 ALG see ALG and address objects 131 and address objects HOST 142 and ALG 147 and interfaces 142 and policy routes 131 NAT example 139 NBNS 109 119 123 NetBIOS Name Server see NBNS NXC2500 User s Guide Index NetBIOS name 234 Netscape Navigator 29 Network Address Translation see NAT Network Time Protocol NTP 263 O object based configuration 21 objects 21 AAA server 227 addresses and address groups 209 authentication method 238 certificates 241 for configuration 21 introduction to 21 schedules 221 services and service groups 215 users user groups 169 Online Certificate Status Protocol OCSP 257 vs CRL 257 other documentation 2 OUI 186 P P1 17 packet statistics 60 62 packet capture files 326 331 332 packet captures downloading files 326 332 Pairwise Master Key PMK 414 415 physical ports 17 and interfaces 17 packet statistics 60 62 pointer record 268 policy routes 125 actions 126 and address objects 1
158. AP Example In the example above a corporate network s security is compromised by a rogue AP RG set up by an employee at his workstation in order to allow him to connect his notebook computer wirelessly A The company s legitimate wireless network the dashed ellipse B is well secured but the rogue AP uses inferior security that is easily broken by an attacker X running readily available NXC2500 User s Guide Chapter 17 MON Profile encryption cracking software In this example the attacker now has access to the company network including sensitive data stored on the file server C Friendly APs If you have more than one AP in your wireless network you should also configure a list of friendly APs Friendly APs are other wireless access points that are detected in your network as well as any others that you know are not a threat those from recognized networks for example It is recommended that you export save your list of friendly APs often especially if you have a network with a large number of access points NXC2500 User s Guide 207 Chapter 17 MON Profile NXC2500 User s Guide Addresses 18 1 Overview Address objects can represent a single IP address or a range of IP addresses Address groups are composed of address objects and other address groups 18 1 1 What You Can Do in this Chapter The Address screen Section 18 2 on page 209 provides a summary of all addresses in the NXC
159. AP and the NXC and so on See Section 5 11 on page 73 for how to check if the AP s runtime management VLAN ID setting matches the NXC s management VLAN ID setting for the AP See Section 5 11 1 on page 74 for how to check if the AP s configuration is in conflict with the NXC s settings for the AP The wireless client s MAC address may be on the MAC filtering list See Section 16 3 3 on page 201 for details on managing the NXC MAC Filter NXC2500 User s Guide Chapter 31 Troubleshooting e The wireless client may not be able to get an IP If the NXC is operating in bridge mode check the settings on the DHCP server associated with the network Check the wireless client s own network configuration settings to ensure that it is set up to receive its IP address automatically If the NXC or a connected Internet access device are managing the network with static IPs make sure that the server settings for issuing those IPs are properly configured Check the wireless client s own network settings to ensure it is already set up with its static IP address e Authentication of the wireless client with the authentication server may have failed Ensure the AP profile assigned to the AP uses a security profile that is properly configured and which matches the security settings in use by the NXC For example if the security mode on the AP is set to WPA WPA2 then make sure the authentication server is running and able to complete t
160. C This screen displays even if you only have a single certificate as in the example Client Authentication Identification Web site you want to view requests identification sh 24 8 SSH You can use SSH Secure SHell to securely access the NXC s command line interface Specify which zones allow SSH access and from which IP address the access can come SSH is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network In the NXC2500 User s Guide Chapter 24 System following figure computer A on the Internet uses SSH to securely connect to the WAN port of the NXC for a management session Figure 160 SSH Communication Over the WAN Example 24 8 1 How SSH Works The following figure is an example of how a secure connection is established between two remote hosts using SSH v1 Figure 161 How SSH v1 Works Example Encryption method to use E Password User name aeae OA 1 Host Identification The SSH client sends a connection request to the SSH server The server identifies itself with a host key The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server The client automatically saves any new server public keys In subsequent connections the server public key is checked against the saved version on the client comput
161. CA Installing a certificate with an unconfirmed thumbprint is a security risk If you dick Yes you acknowledge this risk Do you want to install this certificate 11 Finally click OK when presented with the successful certificate installation message Certificate Import Wizard A The import was successful Lox NXC2500 User s Guide Appendix C Importing Certificates 12 The next time you start Internet Explorer and go to a ZyXEL Web Configurator page a sealed padlock icon appears in the address bar Click it to view the page s Website Identification information E 2 Website Identification 172 20 37 202 has identified this sit 172 20 37 202 This connection to the server is encrypted Should trust this site View certificates Installing a Stand Alone Certificate File in Internet Explorer Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted you can install a stand alone certificate file if one has been issued to you 1 Double click the public key certificate file au 2 In the security warning dialog box click Open Open File Security Warning Do you want to open this file Name CA cer Publisher Unknown Publisher Type Security Certificate From D Documents and Settings 13435 Desktop Always ask before opening this file potentially harm your computer If you do not trust the source do not Y While files from the Inte
162. Cannot send a SNMP trap to a remote host due to network error Table 176 System Logs LOG MESSAGE DESCRIPTION Port d is up When LINK is up d is the port number Port d is down When LINK is down d is the port number Ss is dead at s A daemon process is gone was killed by the operating system lst s Daemon Name 2nd s date and time s process count is incorrect at s The count of the listed process is incorrect lst s Daemon Name 2nd s date and time Ss becomes Zombie at SS A process is present but not functioning lst s Daemon Name 2nd s date and time When memory usage exceed threshold max memory usage reaches d mem threshold max When local storage usage exceeds threshold max s Partition name file system usage reaches d disk threshold max When memory usage drops below threshold min System Memory usage drops below the threshold of d mem threshold min When local storage usage drops below threshold min s partition_name file system drops below the threshold of d disk threshold min DHCP Server executed with cautious mode enabled DHCP Server executed with cautious mode enabled NXC2500 User s Guide 371 Appendix A Log Descriptions 372 Table 176 System Logs continued LOG MESSAGE DESCRIPTION DHCP Server executed with cautious mode disabled DHCP Server executed with cautiou
163. DEEE d chets d quipements lectriques et lectroniques 2003 108 CE 2008 34 CE Capan Huan Signature de la d claration Nom Titre Raymond Huang Quality amp Customer Service Division Assistant VP Date aaaa mm jj 2013 02 01 ITALIANO NEDERLANDS SVENSKA Prodotto dichiarazione di verde Direttiva RoHS 2011 65 UE Direttiva RAEE 2002 96 CE RAEE Rifiuti di Apparecchiature Elettriche ed Elettroniche 2003 108 CE 2008 34 CE Firma dichiarazione Nomef titolo Raymond Huang Quality 8 Customer Service Division Assistant VP Data aaaa mm gg 2013 02 01 Productmilieuverklaring RoHS Richtlijn 2011 65 EU AEEA Richtlijn 2002 96 EG AEEA Afgedankte Elektrische en Elektronische apparatuur 2003 108 EG 2008 34 EG den Hoag Verklaringshandtekening Naam titel Raymond Huang Quality amp Customer Service Division Assistant VP Datum jjjmm dd 2013 02 01 Milj deklaration RoHS Direktiv 2011 65 EU WEEE Direktiv 2002 96 EG WEEE om avfall som utg rs av eller inneh ller elektriska eller elektroniska produkter 2003 108 EG 2008 34 EG O ayuno Huan Deklaration undertecknad av Namn Titel Raymond Huang Quality amp Customer Service Division Assistant VP Datum aaaa mm dd 2013 02 01 NXC2500 User s Guide Appendix E Legal Information NXC2500 User s Guide Index AAA Base DN 230 Bind DN 230 234 directory structure
164. EDs The following table describes the front panel LEDs Table 5 Front Panel LEDs LED COLOR STATUS DESCRIPTION PWR Off The NXC is turned off Green On The NXC is turned on Red On There is a hardware component failure Shut down the device wait for a few minutes and then restart the device see Section 1 6 on page 22 If the LED turns red again then please contact your vendor SYS Green Off The NXC is not ready or has failed On The NXC is ready and running Blinking The NXC is booting Red On The NXC had an error or has failed P1 P6 Green On This port has a successful link to a 10 100 Mbps Ethernet network Blinking The NXC is sending or receiving packets to from a 10 100 Mbps Ethernet network on this port Orange On This port has a successful link to a 1000 Mbps Ethernet network Blinking The NXC is sending or receiving packets to from a 1000 Mbps Ethernet network on this port Off There is no connection on this port 26 NXC2500 User s Guide Chapter 2 Hardware Installation and Connection 2 3 Rear Panel The rear panel contains a console port a power switch and a connector for the power receptacle Figure 5 NXC Rear Panel CONSOLE oC jo Console Port Connect this port to your computer using an RS 232 cable if you want to configure the NXC using the command line interface CLI via the console port For local management you ca
165. EL DESCRIPTION Maximum Number of Records 20 Byte Count Limit 264 bytes this is just less than 17 million terabytes Hit Count Limit 24 hits this is over 1 8 x 1029 hits 5 6 Session Monitor This screen displays information about active sessions for debugging or statistical analysis It is not possible to manage sessions in this screen The following information is displayed e User who started the session e Protocol or service port used e Source IP address e Destination IP address Number of bytes received so far e Number of bytes transmitted so far e Duration so far You can look at all the active sessions by user service source IP address or destination IP address You can also filter the information by user protocol service or service group source address and or destination address and view it by user Click Monitor gt System Status gt Session Monitor to display the following screen Figure 26 Monitor gt System Status gt Session Monitor Session View all sessions User Source Address User i Source y een Service Destination Address Destination unknown SIP 172 16 30 3 2048 224 0 1 75 5060 unknown Any_UDP 172 16 30 217 51 224 0 0 252 5355 unknown SNMP TRAPS_UDP 192 168 0 10 162 192 168 0 10 162 unknown SSDP 172 16 30 6 53979 239 255 255 250 Page 1 Show 50 v items Rx 0 Bytes 0 Bytes 198 940 KBytes 0 Bytes Tx 934
166. Edit screen allows you to create a new user account or edit an existing one 15 2 1 1 Rules for User Names Enter a user name from 1 to 31 characters The user name can only contain the following characters e Alphanumeric A z 0 9 there is no unicode support e _ underscores e dashes The first character must be alphabetical A Z a z an underscore _ or a dash Other limitations on user names are e User names are case sensitive If you enter a user bob but use BOB when connecting via CIFS or FTP it will use the account settings used for BOB not bob e User names have to be different than user group names e Here are the reserved user names e adm e admin e any e bin e debug e devicehaecived ftp games e Idap users e Ip mail e news e operator e radius users e root e shutdown e sync e uucp e zyxel To access this screen go to the User screen and click Add or Edit Figure 93 Configuration gt User Group gt User gt Add Edit A User 3 Add A User User Configuration User Name User Type Password Retype Description Authentication Timeout Settings Lease Time Reauthentication Time Deets ACCES user v O O Use Default Settings Use Manual Settings 1440 minutes 1440 minutes paran e daemon e halt e nobody e sshd NXC2500 User s Guide 173 Chapter 15 User Group 174 The following table describes the labels in this scree
167. Enter the password again for confirmation NXC2500 User s Guide Chapter 6 Registration Table 41 Configuration gt Licensing gt Registration continued LABEL DESCRIPTION E Mail Address Enter your e mail address You can use up to 80 alphanumeric characters periods and the underscore are also allowed without spaces Country Select your country from the drop down box list Seller Details Use this section to enter your seller information Seller s Name Enter your seller s name Seller s E mail Enter your seller s e mail address Seller s Contact Number Enter your seller s phone number VAT Number Enter your seller s Value Added Tax number if you bought your NXC from Europe accept the terms in the Privacy Policy Apply If you accept the privacy policy statement shown above this field select this check box Click Apply to save your changes back to the NXC Note If the NXC is registered already this screen is read only Use the Service screen to update your service subscription status Figure 40 Configuration gt Licensing gt Registration Registered Device Service General Settings 6 3 Service Use this screen to display the status of your service registrations and upgrade licenses To activate or extend a standard service subscription purchase an iCard and enter the iCard s PIN number NXC2500 User s Guide 87
168. I best effort BE and background BK These categories known as a access categories AC are mapped to 802 1D priority values which can then be mapped to their corresponding DSCP hex values Table 64 WMM to DiffServ Conversion on the NXC Priority WMM AC 802 1D Priority DSCP Hex Value Lowest BK 1 0x08 BK 2 0x10 BE 0 0x00 BE 3 0x18 VI 4 0x20 vwo B n o S VO 6 0x30 Highest Wvo o o h loas SY The WMM ACs as implemented on the NXC have the following functions VOICE All wireless traffic to the SSID is tagged as voice data This is recommended if an SSID is used for activities like placing and receiving VolP phone calls VI DEO All wireless traffic to the SSID is tagged as video data This is recommended for activities like video conferencing BEST EFFORT All wireless traffic to the SSID is tagged as best effort meaning the data travels the best route it can without displacing higher priority traffic This is good for activities that do not require the best bandwidth throughput such as surfing the Internet BACKGROUND All wireless traffic to the SSID is tagged as low priority or background traffic meaning all other access categories take precedence over this one If traffic from an SSID does not have strict throughput requirements then this access category is recommended For example an SSID that only has network printers connected to it NXC2500 User s Guide Z
169. I characters OK Click OK to save the changes Cancel Click Cancel to discard the changes NXC2500 User s Guide Chapter 24 System 24 13 Language Click Configuration gt System gt Language to open this screen Use this screen to select a display language for the NXC s Web Configurator screens Figure 172 Configuration gt System gt Language Language Setting Language Setting English The following table describes the labels in this screen Table 148 Configuration gt System gt Language LABEL DESCRIPTION Language Setting Select a display language for the NXC s Web Configurator screens You also need to open a new browser session to display the screens in the new language Apply Reset Click Apply to save your changes back to the NXC Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 24 System NXC2500 User s Guide Log and Report 25 1 Overview Use the system screens to configure daily reporting and log settings 25 1 1 What You Can Do In this Chapter The Email Daily Report screen Section 25 2 on page 297 configures how and where to send daily reports and what reports to send The Log Settings screens Section 25 3 on page 299 specify which logs are e mailed where they are e mailed and how often they are e mailed 25 2 Email Daily Report Use this screen to start or stop data coll
170. K to delete the shell script file or click Cancel to close the screen without deleting the shell script file Download Click a shell script file s row to select it and click Download to save the configuration to your computer Copy Use this button to save a duplicate of a shell script file on the NXC Click a shell script file s row to select it and click Copy to open the Copy File screen Copy File 2 x Source file wiz PN 2 zysh Target file OK Cancel Specify a name for the duplicate file Use up to 25 characters including a zA Z0 9 amp L F 5 Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file Apply Use this button to have the NXC use a specific shell script file Click a shell script file s row to select it and click Apply to have the NXC use that shell script file You may need to wait awhile for the NXC to finish applying the commands This column displays the number for each shell script file entry File Name This column displays the label that identifies a shell script file Size This column displays the size in KB of a shell script file Last This column displays the date and time that the individual shell script files were last changed or Modified saved Upload The bottom part of the screen allows you to upload a new or previously saved shell script file Shell Script from
171. Key Yes Enable without Dynamic WEP Key Yes Disable Shared WEP No Enable with Dynamic WEP Key Yes Enable without Dynamic WEP Key Yes Disable WPA TKIP AES No Enable WPA PSK TKIP AES Yes Disable WPA2 TKIP AES No Enable WPA2 PSK TKIP AES Yes Disable NXC2500 User s Guide Copyright Legal Information Copyright O 2013 by ZyXEL Communications Corporation The contents of this publication may not be reproduced in any part or as a whole transcribed stored in a retrieval system translated into any language or transmitted in any form or by any means electronic mechanical magnetic optical chemical photocopying manual or otherwise without the prior written permission of ZyXEL Communications Corporation Published by ZyXEL Communications Corporation All rights reserved Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products or software described herein Neither does it convey any license under ts patent rights nor the patent rights of others ZyXEL further reserves the right to make changes in any products described herein without notice This publication is subject to change without notice Your use of the NXC is subject to the terms and conditions of any related service providers Trademarks ZyNOS ZyXEL Network Operating System is a registered trademark of ZyXEL Communications Inc Other trademarks mentioned in this publication are used for identi
172. Keyword Protocol and Search fields are available Display Select the category of log message s you want to view You can also view All Logs at one time or you can view the Debug Log Priority This displays when you show the filter Select the priority of log messages to display The log displays the log messages with this priority or higher Choices are any emerg alert crit error warn notice and info from highest priority to lowest priority This field is read only if the category is Debug Log Source Address This displays when you show the filter Type the source IP address of the incoming packet that generated the log message Do not include the port in this filter NXC2500 User s Guide Chapter 5 Monitor Table 39 Monitor gt View Log continued LABEL DESCRIPTION Destination Address This displays when you show the filter Type the IP address of the destination of the incoming packet when the log message was generated Do not include the port in this filter Source Interface This displays when you show the filter Select the source interface of the packet that generated the log message Destination This displays when you show the filter Select the destination interface of the packet that Interface generated the log message Service This displays when you show the filter Select the service whose log messages you would like to see The Web Configurator us
173. L Accept Show 50 v items Displaying 1 1 of 1 The following table describes the labels in this screen Table 134 Configuration gt System gt DNS LABEL DESCRIPTION Address PTR This record specifies the mapping of a Fully Qualified Domain Name FQDN to an IP Record address An FQDN consists of a host and domain name For example www zyxel com tw is a fully qualified domain name where www is the host zyxel is the third level domain com is the second level domain and tw is the top level domain Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action This is the index number of the address PTR record FQDN This is a host s fully qualified domain name IP Address This is the IP address of a host Domain Zone This specifies a DNS server s IP address The NXC can query the DNS server to resolve Forwarder domain zones for features like the time server When the NXC needs to resolve a domain zone it checks it against the domain zone forwarder entries in the order that they appear in this list Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry
174. LAN 2nd s The user s user name 3rd s The name of the service the user is using HTTP HTTPS FTP Telnet SSH or console s s from s has A user logged out of the NXC Le99eS out 1st s The type of user account EnterprisewLAN 2nd s The user s user name 3rd s The name of the service the user is using HTTP HTTPS FTP Telnet SSH or console Ss Ss from s has been logged out EnterpriseWLAN re auth timeout The NXC is signing the specified user out due to a re authentication timeout 1st s The type of user account 2nd s The user s user name 3rd s The name of the service the user is using HTTP HTTPS FTP Telnet SSH or console Ss Ss from s has been logged out EnterpriseWLAN lease timeout The NXC is signing the specified user out due to a lease timeout 1st s The type of user account 2nd s The user s user name 3rd s The name of the service the user is using HTTP HTTPS FTP Telnet SSH or console Ss Ss from s has been logged out EnterpriseWLAN idle timeout The NXC is signing the specified user out due to an idle timeout 1st s The type of user account 2nd s The user s user name 3rd s The name of the service the user is using HTTP HTTPS FTP Telnet SSH or console Console has been put into lockout state Too many failed login attempts were made on the console port so the NXC is blocking login attempts on the c
175. LL Page 1 of 1 Show 50 Address ALL v items Action Accept Displaying 1 1 of 1 NXC2500 User s Guide Chapter 24 System The following table describes the labels in this screen Table 141 Configuration gt System gt SSH LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Service Control table to access the NXC CLI using this service Version 1 Select the check box to have the NXC use both SSH version 1 and version 2 protocols If you clear the check box the NXC uses only SSH version 2 protocol Server Port You may change the server port number for a service if needed however you must use the same port number in order to use that service for remote management Server Certificate Select the certificate whose corresponding private key is to be used to identify the NXC for SSH connections You must have certificates already configured in the My Certificates screen Service Control This specifies from which computers you can access which NXC zones Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it
176. LogCategoy YYUL YU 90 20 99 99 99 899 1 Account 000 000 000000 000 00 2 CapivaPortall 0 00 000 000 000 000 3 Autheniicalo 900 000 000 0OC 4 BulinSoM 0 00 000000 000 00 9 CAEWAP 0o00 000 000000 000 00 6 Coney 0 00 000000 000 000 7 Dayrit 000000 000 000 8 mein 000 000 000 000 000 00 37 PRES 000 000 000 000 000 0 000 000 00060 00 00 OOO Page fi of i Show 50 v items Displaying 1 33 of 33 Log Category Settings AP D SystemLogv E mail Server 1 E mail Server 2 fE Remote Server 1 ff Remote Server 2v fi Remote Server 3v ff Remote Server 4v System Log E mail Server 1 E mail Server2 Remote Server Remote Server Remote Server Remote Server E Mail E Mail Syslog Syslog Syslog Syslog Log Category EXORO ORO ORO EAU Yu YO EJE 1 MOm 000 000 000 000 800 2 BulifiSenice 0 0 6060 6060 08860 00O 3 CARWAP OOO oo 000 000 00 4 DallyReport OOO 0066 00 000 000 S baan 00 ooo 000 000 000 6 DHCP 000 ooo 000 000 000 T Ele Manager 00600 00 000_000O0 000 AA A A S Page 1 of 1 Show 50 v items Displaying 1 23 of 23 a This screen provides a different view and a different way of indicating which messages are included in each log and each alert The Default category includes debugging messages genera
177. MAC Address 7th s Managed AP Model Name Update AP Configure Fail Wrong Send configuration to an AP in the managed list but AP sent back IAC 502x 02x 02xS02x 02x 02x ame s Model s Configure an apply fail response Apply MAC 02x 02x 02x 02x 02x 1 02x 6th 02x Managed AP MAC Address 02x Model s 7th s Managed AP Model Name AP Reboot Reboot the specified AP in the managed list 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name Upgrade AP Firmware MAC 02x 02x 02x 02x 02x 02x Name s Model s Update AP Firmware in the managed list 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name Start Send Configuration to AP MAC 02x 02x S02x 02x 02x 02x Name s Model s Start Send Configuration to an AP in the Managed List 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name Sucess Send Configuration to AP s MAC 02x 02x 02x 02x 02x 02x Name s Model s Receiving Send Configuration Respons from an AP in the Managed List 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name Start Send Updating Configuration to AP MAC 02x 02x 02x 02x 02x 02x Name s Model s Start Send Updating Configuration to an AP in the Managed List 1st 02x
178. MJZUDEGF LOGXICITINVD Y ARPWUXIMZA DIME XID QUIMIDRar WU XIWADIMIDY Ar MDRaMB8xHTAbBgNVBAMMFE 15ZGV2aWNIQGV4YW IwbGUuY 29tMIG MAOGCSqGSIb3 DQEBAQUAA4GNADCBIQKBgQC KA 9NKuD9diRfbl6edotirCRONIRWYryQrlYiXal OqAgyhRYGEo0StDJOhgpFOUVO0QfqeP JX40q 13 02KT8eM06Z7emgXkkyo Y 1aDkdk LOA OWN TiEddRo O ihez EOE SK Sef 5 24ank can ES 7hbaiNRO dun DIV ZA Export Certificate NXC2500 User s Guide Chapter 23 Certificates The following table describes the labels in this screen Table 127 Configuration gt Object gt Certificate gt Trusted Certificates gt Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate You can change the name You can use up to 31 alphanumeric and amp _ characters Certification Path Click the Refresh button to have this read only text box display the end entity s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity s certificate If the issuing certification authority is one that you have imported as a trusted certificate it may be the only certification authority in the list along with the end entity s own certificate The NXC does not trust the end entity s certificate and displays Not trusted in this field if any certificate on the path has expired or been revoked Refresh Click Refresh to display the certification path
179. Message This field displays the reason the log message was generated The text count x where x is a number appears at the end of the Message field if log consolidation is turned on and multiple entries were aggregated to generate into this one Source This field displays the source IP address and the port number in the event that generated the log message Destination This field displays the destination IP address and the port number of the event that generated the log message Note This field displays any additional information about the log message The Web Configurator saves the filter settings if you leave the View Log screen and return to it later NXC2500 User s Guide Chapter 5 Monitor 5 16 View AP Log Use this screen to view the NXC s current wireless AP log messages Click Monitor gt Log gt View AP Log to access this screen Figure 38 Monitor gt Log gt View AP Log View AP ios S hide Filter AP Selection Select an AP A Log Query Status init Log Query Information AP Information N A Log File Status Empty Last Log Query Time N A Logs Display All Logs 5 Priority any y Source Address Destination Address Source Interface any v Destination Interface any v Service any v Keyword Protocol any y Time Pri Cat Message Source Destination Note Page 1 of i Show 50 v items No data to display The following table describes the labels in this screen
180. N interfaces and virtual VLAN interfaces Routing Policy Route Create and manage routing policies Static Route Create and manage IP static routing information Zone Configure zones used to define various policies NAT Set up and manage port forwarding rules ALG Configure SIP H 323 and FTP pass through settings IP MAC Binding Summary Configure IP to MAC address bindings for devices connected to each supported interface Exempt List Configure ranges of IP addresses to which the NXC does not apply IP MAC binding Captive Portal Captive Portal Assign the captive portal web page to various network services Login Page Assign and customize the login page user s see when they hit the captive portal Object NXC2500 User s Guide Chapter 3 The Web Configurator Table 11 Configuration Menu Screens Summary continued FOLDER OR LINK TAB FUNCTION User Group User Create and manage users Group Create and manage groups of users Setting Manage default settings for all users general settings for user sessions and rules to force user authentication MAC Address Map wireless client MAC addresses to MAC roles MAC address user accounts AP Profile Radio Create and manage wireless radio settings files that can be associated with different APs SSID Create and manage wireless SSID security and MAC filtering settings files that can be associated with di
181. NXC2500 User s Guide 353 Chapter 31 Troubleshooting cannot get the firmware uploaded using the commands The Web Configurator is the recommended method for uploading firmware You only need to use the command line interface if you need to recover the firmware See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it My packet capture captured less than wanted or failed The packet capture screen s File Size sets a maximum size limit for the total combined size of all the capture files on the NXC including any existing capture files and any new capture files you generate If you have existing capture files you may need to set this size larger or delete existing capture files The NXC stops the capture and generates the capture file when either the capture files reach the File Size or the time period specified in the Duration field expires My earlier packet capture files are missing New capture files overwrite existing files of the same name Change the File Suffix field s setting to avoid this 31 1 2 Wireless This section provides troubleshooting for wireless devices connected the NXC Wireless clients cannot connect to an AP e There may be a configuration mismatch between the AP and the NXC This could be the result of a number of things such as incorrect VLAN topology incorrect AP profiles incorrect security settings between the
182. Name This identifies the object for which the configuration settings that use it are displayed Click the object s name to display the object s configuration screen in the main window This field is a sequential value and it is not associated with any entry Service This is the type of setting that references the selected object Click a service s name to display the service s configuration screen in the main window Priority If it is applicable this field lists the referencing configuration item s position in its list otherwise N A displays Name This field identifies the configuration item that references the object Description If the referencing configuration item has a description configured it displays here Refresh Click this to update the information in this screen Cancel Click Cancel to close the screen Console The Console allows you to use CLI commands from directly within the Web Configurator rather than having to use a separate terminal program In addition to logging in directly to the NXC s CLI you can also log into other devices on the network through this Console It uses SSH to establish a connection Note To view the functions in the Web Configurator user interface that correspond directly to specific NXC CLI commands use the CLI Messages window see Section on page 37 in tandem with this one Figure 11 Console re terminal 192 168 1 1 22 Done NXC2500 User s Guide Ch
183. O Station Count of AP 21x AP Information Configuration Status Config Setting OK Non Support n a Station Count 100 Stations Last Update 2013 03 27 17 13 50 90 80 70 60 50 40 30 20 10 Hear O HH 21 13 01 13 05 13 09 13 13 13 17 13 74 NXC2500 User s Guide Chapter 5 Monitor The following table describes the labels in this screen Table 33 Monitor gt Wireless gt AP Information gt AP List gt Station Count of AP LABEL DESCRIPTION Configuration This displays whether or not any of the AP s configuration is in conflict with the NXC s Status settings for the AP Non Support If any of the AP s configuration conflicts with the NXC s settings for the AP this field displays which configuration conflicts It displays n a if none of the AP s configuration conflicts with the NXC s settings for the AP Station Count The y axis represents the number of connected stations Time The x axis shows the time over which a station was connected Last Update This field displays the date and time the information in the window was last updated 5 12 Radio List Use this screen to view statistics about the wireless radio transmitters in each of the APs connected to the NXC To access this screen click Monitor gt Wireless gt AP Information gt Radio List Figure 33 Monitor gt Wireless gt AP Information gt Radio List Radio List Loading AP De
184. P Settings Y Enable FTP ALG Y Enable FTP Transformations FTP Signaling Port 1 65535 Additional FTP Signaling Port for Transformations 1 65535 Optional The following table describes the labels in this screen Table 69 Configuration gt Network gt ALG LABEL DESCRIPTION Enable FTP ALG Turn on the FTP ALG to detect FTP File Transfer Program traffic and help build FTP sessions through the NXC s NAT Enable FTP Transformations FTP Signaling Port Select this option to have the NXC modify IP addresses and port numbers embedded in the FTP data payload to match the NXC s NAT environment Clear this option if you have an FTP device or server that will modify IP addresses and port numbers embedded in the FTP data payload to match the NXC s NAT environment If you are using a custom TCP port number not 21 for FTP traffic enter it here Additional FTP Signaling Port for Transformations If you are also using FTP on an additional TCP port number enter it here Apply Reset Click Apply to save your changes back to the NXC Click Reset to return the screen to its last saved settings 12 3 Technical Reference The following section contains additional technical information about the features described in this chapter FTP File Transfer Protocol FTP is an Internet file transfer service that operates on the Internet and over TCP IP networks A system runnin
185. P interfaces connected to your NXC 27 2 Diagnostics This screen provides an easy way for you to generate a file containing the NXC s configuration and diagnostic information You may need to generate this file and send it to customer support during troubleshooting Click Maintenance gt Diagnostics to open the Diagnostic screen Figure 186 Maintenance gt Diagnostics Diagnostics Packet Capture Core Dump System Log Wireless Frame Capture Collect Files Diagnostic Information Collector Filename none Last Modified none Size none V Copy the diagnostic file to USB storage if ready Apply Collect Now NXC2500 User s Guide 325 Chapter 27 Diagnostics The following table describes the labels in this screen Table 159 Maintenance gt Diagnostics LABEL DESCRIPTION Filename This is the name of the most recently created diagnostic file Last modified This is the date and time that the last diagnostic file was created The format is yyyy mm dd hh mm ss Size This is the size of the most recently created diagnostic file Copy the Select this to have the NXC create an extra copy of the diagnostic file to a connected USB diagnostic file storage device to USB storage if ready Apply Click Apply to save your changes Collect Now Click this to have the NXC create a new diagnostic file Download Click this to save the most recent diagnostic file to a computer
186. PSK Pre Shared Key Cipher Type Idle timeout Group Key Update Timer Pre Authentication E Primary Radius Server Activate Secondary Radius Server Activate wpa2 mix External colon upper colon upper tkip 300 1800 Enable 2 X m 30 30000 seconds 0 is unlimited v 30 30000 seconds 30 30000 seconds NXC2500 User s Guide Chapter 16 AP Profile The following table describes the labels in this screen Table 99 Configuration gt Object gt AP Profile gt SSID gt Security Profile gt Add Edit Security Profile LABEL DESCRIPTION Profile Name Enter up to 31 alphanumeric characters for the profile name This name is only visible in the Web Configurator and is only for management purposes Spaces and underscores are allowed Security Mode Select a security mode from the list wep wpa wpa2 or wpa2 mix Radius Server Type Select Internal to use the NXC s internal authentication database or External to use an external RADIUS server for authentication Primary Secondary Radius Server Activate Select this to have the NXC use the specified RADIUS server Radius Server IP Address Enter the IP address of the RADIUS server to be used for authentication Radius Server Port Enter the port number of the RADIUS server to be used for authentication Radius Server Secret Enter the shared secret password of the
187. RADIUS server Authentication Server Certificate Select the certificate whose corresponding private key is to be used to identify the NXC to the RADIUS client You must have certificates already configured in the My Certificates screen Authentication Method Select an authentication method if you have created any in the Configuration gt Object gt Auth Method screen Service Control Add This specifies from which computers you can access which NXC zones Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate This is the index number of the entry Status This icon is lit when the entry is active and dimmed when the entry is inactive Profile Name This field indicates the name assigned to the profile IP Address This is the IP address of the RADIUS client that is allowed to exchange messages with the NXC Mask This is the subnet mask of the RADIUS client Description This is the description of the RADIUS client
188. RADIUS server to be used for authentication Auth Method This field is available only when you set the RADIUS server type to Internal Select an authentication method if you have created any in the Configuration gt Object gt Auth Method screen Idle Timeout Enter the idle interval in seconds that a client can be idle before authentication is discontinued Authentication Type Select a WEP authentication method Choices are Open or Share key Key Length Select the bit length of the encryption key to be used in WEP connections If you select WEP 64 e Enter 10 hexadecimal digits in the range of A F a f and 0 9 for example 0x11AA22BB33 for each Key used or e Enter 5 ASCII characters case sensitive ranging from a z A Z and 0 9 for example MyKey for each Key used If you select WEP 128 e Enter 26 hexadecimal digits in the range of A F a f and 0 9 for example 0x00112233445566778899AABBCC for each Key used or e Enter 13 ASCII characters case sensitive ranging from a z A Z and 0 9 for example MyKey12345678 for each Key used Key 1 4 Based on your Key Length selection enter the appropriate length hexadecimal or ASCII key MAC Authentication Select this to use an external server to authenticate wireless clients by their MAC addresses Users cannot get an IP address if the MAC authentication fails See page 171 for inf
189. Rate Configuration This section controls the data rates permitted for clients For each Rate select a rate option from its list The rates are e Basic Rate Mbps Set the basic rate configuration in Mbps Support Rate Mbps Set the support rate configuration in Mbps MCS Rate Set the MCS rate configuration IEEE 802 11n supports many different data rates which are called MCS rates MCS stands for Modulation and Coding Scheme This is an 802 11n feature that increases the wireless network performance in terms of throughput Multicast Settings Use this section to set a transmission mode and maximum rate for multicast traffic Transmission Set how the AP handles multicast traffic Mode Select Multicast to Unicast to broadcast wireless multicast traffic to all of the wireless clients as unicast traffic Unicast traffic dynamically changes the data rate based on the application s bandwidth requirements The retransmit mechanism of unicast traffic provides more reliable transmission of the multicast traffic although it also produces duplicate packets Select Fixed Multicast Rate to send wireless multicast traffic at a single data rate You must know the multicast application s bandwidth requirements and set it in the following field Multicast Rate If you set the multicast transmission mode to fixed multicast rate set the data rate for Mbps multicast traffic here For example to deploy 4 Mbps video select
190. Routing SNS RIND case casertccccassetessaqenaed sateadutepadavonne aO EEO a a A laasunieeiadaraeedscacsaagens 337 28 TNA TS OCA rs o ENN EE 340 Chapter 29 o sisiesisisaseiasiciscstnsereetnisisiesediainersacensateniaasnd dasnaiaastrsassaiasiabsaseniaiiGiaasiesadeauedeaniaamiiasdeadsaiuebaaieninnindin 345 PODIO con 345 a O AA aed aera rat ann aaeaieeaio 345 A Creer ee eee er er Per rT ee fer re ere rer er eae erry ree terre rere Terre ee errr ee 345 Chapter 30 A A 347 E A RP O 347 E fededuasuaas 347 02 MI o 347 Chapter 31 TIOUDISS COI rica A A AAA 349 A A ene eer reser ee entree E eenrn rene ert enn tr rs 349 e AI A ORNETA OA o A O aeiedwie ee eat eatciecnee 349 LA IE Aa 354 SL ASSIM NENAU a E 356 313 Betting More Troubleshooting Help soria 357 NXC2500 User s Guide EM Table of Contents Appendix A A o do 359 Appendix eo ae ee Eee deana rere ees ee n EE R naani 387 Appendix C Importing Certificates esc cance cetacean cece cect eect tarce hence nceieeicacaccnctahanbeniecs 391 poe occ A A A 405 Appendix E Legal A ee ee es iy 417 ee re 421 NXC2500 User s Guide PART User s Guide Introduction 1 1 Overview The NXC is a comprehensive wireless LAN controller Its flexible configuration helps network administrators set up wireless LAN networks and efficiently enforce security policies over them In addition the NXC provides excellent throughput making it an ideal solution for reliable secure service
191. S color code Q Note 1 Turn on Javascript and Cookie setting in your web browser 2 Turn off Popup Window Blocking in your web browser 3 Turn on Java Runtime Environment JRE in your web browser 4 Allow Gears if you are using Google Chrome Customized Access Page Title You now have logged in Message Color black CSS color code Note Message none Background support format gif pna jpa maximum size 100K O Picture 9 Color CSS color code The following table describes the labels in this screen Table 78 Configuration gt Captive Portal gt Login Page LABEL DESCRIPTION Select Type Use Default Login Select this to use the default login page built into the device If you later create a custom Page login page you can still return to the NXC s default page as it is saved indefinitely Use Customized Select this to use a custom login page instead of the default one built into the NXC Once Login Page this option is selected the custom login page controls below become active NXC2500 User s Guide Chapter 14 Captive Portal Table 78 Configuration gt Captive Portal gt Login Page LABEL DESCRIPTION Use uploaded file Select this to upload a web portal file with custom html pages to the NXC and use it Once this option is selected the screen changes Logo File This section allows you to choose and upload a custom logo image for t
192. S server addresses in the following ways e The ISP tells you the DNS server addresses usually in the form of an information sheet when you sign up If your ISP gives you DNS server addresses manually enter them in the DNS server fields If your ISP dynamically assigns the DNS server IP addresses along with the NXC s WAN IP address set the DNS server fields to get the DNS server address from the ISP e You can manually enter the IP addresses of other DNS servers 24 6 2 Configuring the DNS Screen Click Configuration gt System gt DNS to change your NXC s DNS settings Use the DNS screen to configure the NXC to use a DNS server to resolve domain names for NXC system features like the time server You can also configure the NXC to accept or discard DNS queries Use the Network gt NXC2500 User s Guide Chapter 24 System Interface screens to configure the DNS server information that the NXC sends to the specified DHCP client devices Figure 148 Configuration gt System gt DNS DNS O add a FQDN Page 1 add a Domain Zone Page 1 add Page 1 Service Control O add a Zone ALL Page 1 Address PTR Record Domain Zone Forwarder Default MX Record for My FQDN Ro Domain Name IP Address Show 50 items No data to display DNS Server Query via 105 51 wan2 Show 50 v items Displaying 1 1 of 1 IPFQDN Show 50 v items No data to display Ni Address Action AL
193. SAGE DESCRIPTION Create socket error The connectivity check process can t get socket to send packet Can t get IP address of s interface The connectivity check process can t get IP address of interface s interface name Can t get flags of s interface The connectivity check process can t get interface configuration s interface name Can t get NETMASK address of s interface The connectivity check process can t get netmask address of interface s interface name Can t get BROADCAST address of s interface The connectivity check process can t get broadcast address of interface s interface name Can t use MULTICAST IP for destination The connectivity check process can t use multicast address to check link status The destination is invalid because destination IP is broadcast IP The connectivity check process can t use broadcast address to check link status Can t get MAC address of s interface The connectivity check process can t get MAC address of interface s interface name To send ARP REQUEST error The connectivity check process can t send ARP request packet The s routing status seted to DEAD by connectivity check The interface routing can t forward packet s interface name The s routing status seted ACTIVATE by connectivity check The interface routing can forward packet s interface nam
194. SCRIPTION 15 CRL is too old 16 CRL is not valid 17 CRL signature was not verified correctly 18 CRL was not found anywhere 19 CRL was not added to the cache 20 CRL decoding failed 21 CRL is not currently valid but in the future 22 CRL contains duplicate serial numbers 23 Time interval is not continuous 24 Time information not available 25 Database method failed due to timeout 26 Database method failed 27 Path was not verified 28 Maximum path length reached LOG MESSAGE DESCRIPTION interface down Default route will not apply until s links up Interface s has been An administrator deleted an interface s is the interface name deleted Interface s has been An administrator changed an interface s configuration s interface name changed Interface s has been An administrator added a new interface s interface name added Interface s is An administrator enabled an interface s interface name enabled Interface s is An administrator disabled an interface s interface name disabled Interface s links An administrator set a static gateway in interface but this interface is link down At this time the configuration will be saved but route will not take effect until the link becomes up 1st s interface name 2nd s interface name kts Su xB s u RxPkts u name s status s TxP Colli u T RxB s u UpTime s Port statistics log Thi
195. SID Profile disable disable disable disable disable disable oy om FON disable A MPDU Subframe 7 Enable RSSI Threshold Hide Advanced Settings 5 Create new Object Le Y Enable A MPDU Aggregation Y Enable A MSDU Aggregation 2 46 y b g n y 6 v Auto 20 MHz 3 Short A Long 1 50000 10065535 32 2 64 4096 2290 4096 2347 0 2347 100 40ms 1000ms S 1 1 255 100 y 76 dBm 20 76 1 2 Y 5 5 M 11 6 9 12 18 E 24 36 El 48 o 54 9 1 wl 2 Mss Wai WI 6 7 9 vi 12 v 18 7 24 Y 36 7 48 F 54 mio M1 m2 E 3 F 4 Y 5 76 77 ws Mo F 10 F 11 Y 12 Y 13 Y 14 W 15 Multicast to Unicast Fixed Multicast Rate o 1 O 2 5 5 11 16 9 12 18 24 36 48 54 m m NXC2500 User s Guide Chapter 16 AP Profile The following table describes the labels in this screen Table 95 Configuration gt Object gt AP Profile gt Add Edit Radio Profile LABEL DESCRIPTION Hide Show Advanced Settings Click this to hide or show the Advanced Settings in this window Create New Object Select an item from this menu to create a new object of that type Any objects created in this way are automatically linked to this radio profile General Settings Activate Select this option to make this profile active Profile Name Enter up to 31 alphanumeric characters to be used as this profile s name Spaces and underscores are
196. SSID for a specified time unit Use this screen to look at a list of dynamic guest user accounts on the NXC s local database To access this screen click Monitor gt System Status gt Dynamic Guest Figure 29 Monitor gt System Status gt Dynamic Guest Dynamic Guest List User ID URVPXU XFAXHP TISYTCXR Page 1 of 1 Show 50 Reauth L Expiratio Guest Na Phone Email Address Other 2013 03 IP Address Group Company Cafe 2013 03 Cafe 2013 03 Cafe Displaying 1 3 of 3 v items The following table describes the labels in this screen Table 29 Monitor gt System Status gt Dynamic Guest LABEL DESCRIPTION Remove Select an entry and click this button to remove it from the list Note If you delete a valid user account which is in use the NXC ends the user session Status This field displays whether an account expires or not User ID This field displays the user name of the user account Reauth Lease T This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user See Chapter 15 on page 1609 Expiration Time This field displays the date and time the user account becomes invalid IP address This field displays the IP address of the computer used to log in to the NXC Group This field displays the name of the dynamic guest group to which the account belongs Guest N
197. Sent by an access point requesting authentication e Access Reject Sent by a RADIUS server rejecting access e Access Accept Sent by a RADIUS server allowing access e Access Challenge Sent by a RADIUS server requesting more information in order to allow access The access point sends a proper response from the user and then sends another Access Request message The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting Accounting Request Sent by the access point requesting accounting e Accounting Response Sent by the RADIUS server to indicate that it has started or stopped accounting In order to ensure network security the access point and the RADIUS server use a shared secret key which is a password they both know The key is not sent over the network In addition to the shared key password information exchanged is also encrypted to protect the network from unauthorized access Types of EAP Authentication This section discusses some popular authentication types EAP MD5 EAP TLS EAP TTLS PEAP and LEAP Your wireless LAN device may not support all authentication types EAP Extensible Authentication Protocol is an authentication protocol that runs on top of the IEEE 802 1x transport mechanism in order to support multiple types of user authentication By using EAP to interact with an EAP compatible RADIUS server an access point helps a wireless station and a RADIUS s
198. Source This is the original source IP address es any means any IP address Destination This is the original destination IP address es any means any IP address Outgoing This is the name of an interface which transmits packets out of the NXC Gateway This is the IP address of the gateway in the same network of the outgoing interface 28 3 The SNAT Status Screen The SNAT Status screen allows you to view and quickly link to specific source NAT SNAT settings Click a function box in the SNAT Flow section the related SNAT rules activated will display in the SNAT Table section To access this screen click Maintenance gt Packet Flow Explore gt SNAT Status The order of the SNAT flow may vary depending on whether you e use policy routes to control 1 1 NAT by using the policy control virtual server rules activate command Note Once a packet matches the criteria of an SNAT rule the NXC takes the corresponding action and does not perform any further flow checking NXC2500 User s Guide Chapter 28 Packet Flow Explore Figure 200 Maintenance gt Packet Flow Explore gt SNAT Status Policy Route SNAT Routing Status SNAT Status SNAT Flow SNAT Table Q Note If you want to configure Policy Route SNAT please go to Policy Route PR Outgoing SNAT ld 4 Page 1 of1 gt bl Show 50 gt items No data to display Figure 201 Maintenance gt Packet Flow Explore gt SNAT Status 1 1 SNAT Ro
199. US server The Language screen Section 24 13 on page 295 sets the user interface language for the NXC s Web Configurator screens NXC2500 User s Guide Chapter 24 System 24 2 Host Name A host name is the unique name by which a device is known on a network Click Configuration gt System gt Host Name to open this screen Figure 143 Configuration gt System gt Host Name General Settings System Name Optional Domain Name Optional Apply Reset The following table describes the labels in this screen Table 129 Configuration gt System gt Host Name LABEL DESCRIPTION System Name Choose a descriptive name to identify your NXC device This name can be up to 64 alphanumeric characters long Spaces are not allowed but dashes underscores _ and periods are accepted Domain Name Enter the domain name if you know it here This name is propagated to DHCP clients connected to interfaces with the DHCP server enabled This name can be up to 254 alphanumeric characters long Spaces are not allowed but dashes are accepted Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 3 USB Storage The NXC can use a connected USB device to store the system log and other diagnostic information Use this screen to turn on this feature and set a disk full warning limit Note Only connect one USB device It m
200. XC Figure 111 Configuration gt Object gt AP Profile gt SSID gt MAC Filter List SSID List MAC Filter List Summary Q Add mm Profile Name Page 1 of 1 Security List MAC Filter List Filter Action Show 50 v items No data to display NXC2500 User s Guide Chapter 16 AP Profile The following table describes the labels in this screen Table 100 Configuration gt Object gt AP Profile gt SSID gt MAC Filter List LABEL DESCRIPTION Add Click this to add a new MAC filtering profile Edit Click this to edit the selected MAC filtering profile Remove Click this to remove the selected MAC filtering profile Object Reference Click this to view which other objects are linked to the selected MAC filtering profile for example SSID profile This field is a sequential value and it is not associated with a specific profile Profile Name This field indicates the name assigned to the MAC filtering profile Filter Action This field indicates this profile s filter action if any 16 3 3 1 Add Edit MAC Filter Profile This screen allows you to create a new MAC filtering profile or edit an existing one To access this screen click the Add button or select a MAC filter profile from the list and click the Edit button Figure 112 SSID gt MAC Filter List gt Add Edit MAC Filter Profile Q Add MAC Filter Profile 21x Profile Name e
201. XC through the interface Egress traffic is going out from the NXC through the interface Amount This field displays how much traffic was sent or received from the indicated service port If the Direction is Ingress a red bar is displayed if the Direction is Egress a blue bar is displayed The unit of measure is bytes Kbytes Mbytes Gbytes or Tbytes depending on the amount of traffic for the particular protocol or service port The count starts over at zero if the number of bytes passes the byte count limit See Table 25 on page 67 These fields are available when the report type is Web Site Hits This field is the rank of each record The domain names are sorted by the number of hits Web Site This field displays the domain names most often visited The NXC counts each page viewed on a Web site as another hit The maximum number of domain names in this report is indicated in Table 25 on page 67 Hits This field displays how many hits the Web site received The NXC counts hits by counting HTTP GET packets Many Web sites have HTTP GET references to other Web sites and the NXC counts these as hits too The count starts over at zero if the number of hits passes the hit count limit See Table 25 on page 67 NXC2500 User s Guide Chapter 5 Monitor The following table displays the maximum number of records shown in the report the byte count limit and the hit count limit Table 25 Maximum Values for Reports LAB
202. ZyXEL NXC2500 Wireless LAN Controller Version 4 00 Edition 1 05 2013 User s Guide Default Login Details IP Address https 192 168 1 1 User Name admin Password 1234 Copyright 2013 ZyXEL Communications Corporation IMPORTANT READ CAREFULLY BEFORE USE KEEP THIS GUIDE FOR FUTURE REFERENCE Screenshots and graphics in this book may differ slightly from your product due to differences in your product firmware or your computer operating system Every effort has been made to ensure that the information in this manual is accurate Related Documentation e Quick Start Guide The Quick Start Guide is designed to show you how to make the NXC hardware connections and access the Web Configurator CLI Reference Guide The CLI Reference Guide explains how to use the Command Line Interface CLI and CLI commands to configure the NXC Note It is recommended you use the Web Configurator to configure the NXC e Web Configurator Online Help Click the help icon in any screen for help in configuring that screen and supplementary information NXC2500 User s Guide Contents Overview Contents Overview Me cae 15 TEPC FIONN ista cias 17 Hardware Installation and Carnie GION sucinta 23 TOO Nep COMITAT cc 29 Technical RETErENCE siisii aiaia ia 47 BEE 116 EPEA EEE E A E EEI A E AE T tr TAE ter AIA TE tes EE T E A E 49 ala caen a a lave Gut eciceertpenscniees aes 59 AREA 85 PP PE
203. a fixed multicast rate higher than 4 Mbps MBSSID Settings This section allows you to associate an SSID profile with the radio profile Edit Select and SSID and click this button to reassign it The selected SSID becomes editable immediately upon clicking SSID Profile Indicates which SSID profile is associated with this radio profile OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 16 3 SSID The SSID screens allow you to configure three different types of profiles for your networked APs an SSID list which can assign specific SSID configurations to your APs a security list which can assign specific encryption methods to the APs when allowing wireless clients to connect to them and a MAC filter list which can limit connections to an AP based on wireless clients MAC addresses 16 3 1 SSID List This screen allows you to create and manage SSID configurations that can be used by the APs An SSID or Service Set Dentifier is basically the name of the wireless network to which a wireless client can connect The SSID appears as readable text to any device capable of scanning for wireless frequencies Such as the WiFi adapter in a laptop and is displayed as the wireless network name when a person makes a connection to it To access this screen click Configuration gt Object gt AP Profile gt SSID NXC2500 User s Guide Chapter 16 AP Profile Note
204. a service on a NXC you need to have access to myZyXEL com via that NXC Maximum Number of Managed APs The NXC is initially configured to support up to 8 managed APs such as the NWA5123 NI You can increase this by subscribing to additional licenses As of this writing each license upgrade allows an additional 8 managed APs while the maximum number of APs a single NXC can support is 24 NXC2500 User s Guide Chapter 6 Registration 6 2 Registration Use this screen to register your NXC with myZyXEL com Click Configuration gt Licensing gt Registration in the navigation panel to open the screen as shown next Figure 39 Configuration gt Licensing gt Registration General Settings This device is not registered to myZyXEL com Please enter information below to register your device If you don t have myZyXEL com account please select new myZyXEL com account below If you have a myZyXEL com account but you forget your User Name or Password please go to www myZyXEL com for help new myZyXEL com account F existing myZyXEL com account User Name K you can dick to check if username exists Password Confirm Password E Mail Address Country Seller Details Seller s Name Seller s E mail Seller s Contact Number VAT Number Please read the following Privacy Policy carefully ZyXEL only processes your personal information for the purposes described here We take appropriate security mea
205. aa 100 PAL Load ACM ici ARA 101 Chapter 8 o SP 103 31 MTS CASPE a a E 103 OLA MIL VO Can Do US Chaplin 103 BAe Nha OU Neod 10 KOW rn rias 103 S BM aia 104 Bel EO EEMOL et da 105 8 2 CIRCE SION NCS ar iad i nuns Giehuauetattra ei auelaatnaanieL 111 420 Add Boi DAOP Extended DUDAS nia 111 2 3 YLAM OCR siria ide 113 Gat ERNUS a o SARAR TS AA NERAN 115 De PROVEA VLAN is 116 aL Tehnica PrE E nn dis 121 Chapter 9 Polloy and Static Robles cisco diaso rissiiiiabeiniiaiiiasiernsaia 125 SA DEN dc 125 4 11 What Ya Cetra Do ii Ihe Chaplet aa accend ceca dupa ahaatea a 125 9 1 2 Wna VOU OCR tO KNOW ia A Rd 125 9 2 POY QUES rs 126 NXC2500 User s Guide Table of Contents a POU a riscnacioritcal aneratniestarranias innit tenant aati 129 o AAA O E N A A ETIEN EN A A A AEE 131 gai Stal Route SOI caia 132 OF Teenie RANEE raa a A ia 133 Chapter 10 POWGS A ii A ii 135 VOTO ii das 135 TO Tl What rou Can Do in tis Chapi aeeriranoipi ada a aaa eaed yaaa rater atl ts aa tiulbed 135 10 12 Whai rou Neod To KOON api reno ii 135 WO ADNE ici 136 WA E CGMS ai T a A eeteon nantes 137 Chapter 11 A A A 139 ARE A e o E OOO mom cao aca aan Wi da cnt aa bmn ahaha cae ai a aR a 139 TSA Whai You Gan Doin THIS NOD rss tada 139 Tha NAT MUI cua AATE tap hendasitn dan Sus S aE Ea 139 11 21 MTEL NAT aa A 141 HEO Tenita Pee Sh WS sn iia 144 Chapter 12 Ee E E E E A A E E E T 147 TEL DIE a das 147 121 1 Whal ru Gan Do in ws
206. able storage space File Name This column displays the label that identifies the file Size This column displays the size in bytes of a file Last Modified This column displays the date and time that the individual files were saved NXC2500 User s Guide Chapter 27 Diagnostics 27 6 Wireless Frame Capture Use this screen to capture wireless network traffic going through the AP interfaces connected to your NXC Studying these frame captures may help you identify network problems Click Maintenance gt Diagnostics gt Wireless Frame Capture to display this screen Note New capture files overwrite existing files of the same name Change the File Suffix field s setting to avoid this Figure 194 Maintenance gt Diagnostics gt Wireless Frame Capture gt Capture Diagnostics Packet Capture Core Dump Wireless Frame Capture Capture Files MON Mode APs Configure AP to MON Mode Available MON Mode APs Capture MON Mode APs Misc setting File Size 1000 File Prefix monitor Capture The following table describes the labels in this screen Table 166 Maintenance gt Diagnostics gt Wireless Frame Capture gt Capture LABEL DESCRIPTION MON Mode APs Configure AP to Click this to go the Configuration gt Wireless gt AP Management screen where MON Mode you can set one or more APs to monitor mode Available MON This column displays which APs on your wireless network are currently configu
207. ace is full adding more packet captures will fail Stop Click this button to stop a currently running packet capture and generate a separate capture file for each selected interface Reset Click this button to return the screen to its last saved settings 27 3 1 Packet Capture Files Click Maintenance gt Diagnostics gt Packet Capture gt Files to open the packet capture files screen This screen lists the files of packet captures stored on the NXC or a connected USB storage device You can download the files to your computer where you can study them using a packet analyzer also known as a network or protocol analyzer such as Wireshark Figure 189 Maintenance gt Diagnostics gt Packet Capture gt Files Capture Packet Capture Core Dump System Log Wireless Frame Capture Files Captured Packet Files w B File Name i Last Modified Page 1 of 1 Show 50 v items No data to display Captured Packet Files in USB storage Y B File Name Last Modified Page 1 of1 Show 50 v items No data to display The following table describes the labels in this screen Table 162 Maintenance gt Diagnostics gt Packet Capture gt Files LABEL DESCRIPTION Remove Download Select files and click Remove to delete them from the NXC Use the Shift and or Ctrl key to select multiple files A pop up window asks you to confirm that you want to delete Click a file to select it
208. aching both mounting brackets position the NXC in the rack by lining up the holes in the brackets with the appropriate holes on the rack Secure the NXC to the rack with the rack mounting screws 2 2 Front Panel This section gives you an overview of the front panel Figure 4 NXC Front Panel i AXEL 1 2 P3 Pa A eo SYS RESET NXC2500 0 Wireless LAN Contro er MUU 1000Base T Ports The 1000Base T auto negotiating auto crossover Ethernet ports support 100 1000 Mbps Gigabit Ethernet so the speed can be 100 Mbps or 1000 Mbps The duplex mode can be both half or full duplex at 100 Mbps and full duplex only at 1000 Mbps An auto negotiating port can detect and NXC2500 User s Guide 25 Chapter 2 Hardware Installation and Connection adjust to the optimum Ethernet speed 100 1000 Mbps and duplex mode full duplex or half duplex of the connected device An auto crossover auto MDI MDI X port automatically works with a straight through or crossover Ethernet cable Default Ethernet Settings The factory default negotiation settings for the Ethernet ports on the NXC are e Speed Auto e Duplex Auto e Flow control On you cannot configure the flow control setting but the NXC can negotiate with the peer and turn it off if needed USB 2 0 Ports Connect a USB storage device to a USB port on the NXC to archive the NXC system logs or save the NXC operating system core dump to it 2 2 1 Front Panel L
209. ackets to the gateway when it does not know how to route the packet to its destination The gateway should be on the same network as the interface Metric This field is enabled if you set the Interface Type to external or general and select Get Automatically Enter the priority of the gateway if any on this interface The NXC decides which gateway to use based on this priority The lower the number the higher the priority If two or more gateways have the same priority the NXC uses the one that was configured first Interface Parameters Egress Enter the maximum amount of traffic in kilobits per second the NXC can send through Bandwidth the interface to the network Allowed values are 0 1048576 Ingress This is reserved for future use Bandwidth Enter the maximum amount of traffic in kilobits per second the NXC can receive from the network through the interface Allowed values are 0 1048576 MTU Maximum Transmission Unit Type the maximum size of each data packet in bytes that can move through this interface If a larger packet arrives the NXC divides it into smaller fragments Allowed values are 576 1500 Usually this value is 1500 Connectivity Check These fields appear when you set the Interface Type to External or General The interface can regularly check the connection to the gateway you specified to make sure it is still available You specify how often the interface checks the connection how long to wait for a respo
210. address Log Category This field displays each category of messages It is the same value used in the Display and Category fields in the View Log tab The Default category includes debugging messages generated by open source software NXC2500 User s Guide Chapter 25 Log and Report Table 154 Configuration gt Log amp Report gt Log Settings gt Log Category Settings continued LABEL DESCRIPTION System log Select which events you want to log by Log Category There are three choices disable all logs red X do not log any information from this category enable normal logs green check mark create log messages and alerts from this category enable normal logs and debug logs yellow check mark create log messages alerts and debugging information from this category the NXC does not e mail debugging information however even if this setting is selected USB Storage E mail Server 1 E mail Select which event log categories to save to a connected USB storage device There are three choices disable all logs red X do not log any information from this category enable normal logs green check mark save log messages and alerts from this category enable normal logs and debug logs yellow check mark save log messages alerts and debugging information from this category Select whether each category of events should be included in the log messages when it is e mailed g
211. address as the default router select Custom Defined and enter the IP address Lease time Specify how long each computer can use the information especially the IP address before it has to request the information again Choices are infinite select this if IP addresses never expire days hours and minutes select this to enter how long IP addresses are valid Extended This table is available if you selected DHCP server Options Configure this table if you want to send more information to DHCP clients through DHCP packets Add Click this to create an entry in this table See Section 8 2 3 on page 111 NXC2500 User s Guide Chapter 8 Interfaces Table 51 Configuration gt Network gt Interface gt Ethernet gt Edit continued Enable Logs for IP MAC Binding LABEL DESCRIPTION Edit Select an entry in this table and click this to modify it Remove Select an entry in this table and click this to delete it This field is a sequential value and it is not associated with any entry Name This is the name of the DHCP option Code This is the code number of the DHCP option Type This is the type of the set value for the DHCP option Value This is the value set for the DHCP option Enable P MAC Select this option to have this interface enforce links between specific IP addresses and Binding specific MAC addresses This stops anyone else from manually using a bound IP address on anot
212. age 216 display and configure the NXC s list of services and their definitions e The Service Group screens Section 19 2 on page 216 display and configure the NXC s list of service groups 19 1 2 What You Need to Know The following terms and concepts may help as you read this chapter IP Protocols IP protocols are based on the eight bit protocol field in the IP header This field represents the next level protocol that is sent in this packet This section discusses three of the most common IP protocols Computers use Transmission Control Protocol TCP IP protocol 6 and User Datagram Protocol UDP IP protocol 17 to exchange data with each other TCP guarantees reliable delivery but is slower and more complex Some uses are FTP HTTP SMTP and TELNET UDP is simpler and faster but is less reliable Some uses are DHCP DNS RIP and SNMP TCP creates connections between computers to exchange data Once the connection is established the computers exchange data If data arrives out of sequence or is missing TCP puts it in sequence or waits for the data to be re transmitted Then the connection is terminated In contrast computers use UDP to send short messages to each other There is no guarantee that the messages arrive in sequence or that the messages arrive at all Both TCP and UDP use ports to identify the source and destination Each port is a 16 bit number Some port numbers have been standardized and are used by low level
213. ailable if Port Mapping Type is Ports Enter the end of the range of translated destination ports if this NAT rule forwards the packet The original port range and the mapped port range must be the same size Enable NAT Loopback Enable NAT loopback to allow users connected to any interface instead of just the specified Incoming Interface to use the NAT rule s specified Original IP address to access the Mapped IP device For users connected to the same interface as the Mapped IP device the NXC uses that interface s IP address as the source address for the traffic it sends from the users to the Mapped IP device For example if you configure a NAT rule to forward traffic from the WAN to a LAN server enabling NAT loopback allows users connected to other interfaces to also access the server For LAN users the NXC uses the LAN interface s IP address as the source address for the traffic it sends to the LAN server If you do not enable NAT loopback this NAT rule only applies to packets received on the rule s specified incoming interface OK Click OK to save your changes back to the NXC Cancel Click Cancel to return to the NAT summary screen without creating the NAT rule if it is new or saving any changes if it already exists NXC2500 User s Guide Chapter 11 NAT 11 3 Technical Reference The following section contains additional technical information about the features described in this cha
214. ame This field displays the name of the person that uses the account Phone This field displays the telephone number for the user account Email This field displays the E mail address for the user account Address This field displays the geographic address for the user account Company This field displays the company name for the user account Other This field displays the additional information for the user account Refresh Click this button to update the information in the screen 5 10 USB Storage This screen displays information about a connected USB storage device Click Monitor gt System Status gt USB Storage to display this screen NXC2500 User s Guide 71 Chapter 5 Monitor Figure 30 Monitor gt System Status gt USB Storage Storage Information Information Device Description Usage File System Speed Status Detail The following table describes the labels in this screen Table 30 Monitor gt System Status gt USB Storage LABEL DESCRIPTION Device description This is a basic description of the type of USB device Usage This field displays how much of the USB storage device s capacity is currently being used out of ts total capacity and what percentage that makes File System This field displays what file system the USB storage device is formatted with This field displays Unknown if the file system of the USB storage device is not supported by the NXC such as NTFS
215. any times as simultaneous logons for they want as long as they use different IP addresses access account Maximum This field is effective when Limit for access account is checked Type the number per maximum number of simultaneous logins by each access user access account User Lockout Settings Enable logon Select this check box to set a limit on the number of times each user can login retry limit unsuccessfully for example wrong password before the IP address is locked out for a specified amount of time Maximum retry This field is effective when Enable logon retry limit is checked Type the maximum count number of times each user can login unsuccessfully before the IP address is locked out for the specified lockout period The number must be between 1 and 99 Lockout period This field is effective when Enable logon retry limit is checked Type the number of minutes the user must wait to try to login again if logon retry limit is enabled and the maximum retry count is reached This number must be between 1 and 65 535 about 45 5 days Dynamic Guest Settings Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Removing a group does not remove the user accounts
216. api A A 147 12 12 Whai rou Need To KOW sis 147 12 13 Bebe VOU Bogi osrin EOE 147 AO rai E ea 148 123 VECRINCA Retenes a ca oadend ag lcaand gern iedian ieee as edad enn ees 148 Chapter 13 AA AAA 149 A NN 149 I2 i1 What VOU a Do IS Chapter rr O bisauvsls swine 149 13 12 Whal vou Necid To KION en 149 iae IRMA Bm SIMA arginina AT 150 al E A o betevaneunusadade pacau anne osearasentuealiceasheeaata aunt reuaeaiets 151 TS a Stane DHCP A ae a EEEa 152 o PENAC BI Exem LIET cir isai a coo 153 Chapter 14 Captive Portal iria ias 155 AA lauasesed iaaaaabednedananieds iauamanciasantrediaaheatents 155 NXC2500 User s Guide Table of Contents ET ere Panal TYPE rias pto 156 14 12 Wal OCASO AMARE scr ii 156 142 Caps PoR na 157 1221 Add Excepilonal SSP a 159 12 Uh POE AURA dE adi 160 TAS Logn PADO o en A E 162 143 1 C stom Login and AECRES Page o a e ii 164 14 3 2 External or Uploaded Web Portal Details ves 166 Chapter 15 A AAA 169 E A o P A e A A E 169 18 11 What You Lan Do nds hala 169 191 2 Wal vou Nesd TO KION sana 169 TASA co ic 172 el BRE una iii 173 le AA e og ee eR aD 175 1353 LARES RU us a 176 Hed SSA sorda 176 154 1 Edit User Authentication Timeout Settings siii aona 180 154 2 Agd eit Dynamo Guest aU aiii 181 154 3 User Aware Login Example sicssscccccatsnnresseaatnarseqsnineccaadinarcciaamantedachananrseiessnantedeasmanbaadhassntan 182 15 44 GUESS Wanager Login EXA cos aiaa iiaa kiada akanan aE 183 1 NAC PSS
217. apter 3 The Web Configurator The following table describes the elements in this screen Table 9 Console LABEL DESCRIPTION Command Line Device IP Address terminal Enter commands for the device that you are currently logged into here If you are logged into the NXC see the CLI Reference Guide for details on using the command line to configure it lO 192 168 1 1 22 This is the IP address of the device that you are currently logged into Logged In User fadmin This displays the username of the account currently logged into the NXC through the Console Window Note You can log into the Web Configurator with a different account than used to log into the NXC through the Console Connection Status This displays the connection status of the account currently logged in If you are logged in and connected then this displays Connected If you lose the connection get disconnected or logout then this displays Not Connected Tx RX Activity Monitor jee This displays the current upload download activity The faster and more frequently an LED flashes the faster the data connection Before you use the Console ensure that e Your web browser of choice allows pop up windows from the IP address assigned to your NXC e Your web browser allows Java programs e You are using the latest version of the Java program http www java com To login in through the Co
218. assign a static IP address to a specific computer click Add Static DHCP If this field is blank the Pool Size must also be blank In this case the NXC can assign every IP address allowed by the interface s IP address and subnet mask except for the first address network address last address broadcast address and the interface s IP address Pool Size Enter the number of IP addresses to allocate This number must be at least one and is limited by the interface s Subnet Mask For example if the Subnet Mask is 255 255 255 0 and IP Pool Start Address is 10 10 10 10 the NXC can allocate 10 10 10 10 to 10 10 10 254 or 245 IP addresses If this field is blank the IP Pool Start Address must also be blank In this case the NXC can assign every IP address allowed by the interface s IP address and subnet mask except for the first address network address last address broadcast address and the interface s IP address First DNS Server Specify the IP addresses up to three DNS servers for the DHCP clients to use Use one as DNS of the following ways to specify these IP addresses Third DNS Custom Defined enter a static IP address Server From ISP select the DNS server that another interface received from its DHCP server EnterpriseWLAN the DHCP clients use the IP address of this interface and the NXC works as a DNS relay First WINS Type the IP address of the WINS Windows Internet Naming Service server t
219. at selected you want to prevent the AP from using it and click the left arrow button to remove them 2 4 GHz Channel Deployment This field is available only when you set 2 4 GHz Channel Selection Method to auto Select Three Channel Deployment to limit channel switching to channels 1 6 and 11 the three channels that are sufficiently attenuated to have almost no impact on one another In other words this allows you to minimize channel interference by limiting channel hopping to these three safe channels Select Four Channel Deployment to limit channel switching to four channels Depending on the country domain if the only allowable channels are 1 11 then the NXC uses channels 1 4 7 11 in this configuration otherwise the NXC uses channels 1 5 9 13 in this configuration Four channel deployment expands your pool of possible channels while keeping the channel interference to a minimum Enable 5 GHz DFS Aware Select this if your APs are operating in an area known to have RADAR devices This allows the device to downgrade its frequency to below 5 GHz in the event a RADAR signal is detected thus preventing it from interfering with that signal Enabling this forces the AP to select a non DFS channel 5 GHz Channel Selection Method Select auto to have the AP search for available channels automatically in the 5 GHz band Select manual and specify the channels the AP uses in the 5 GHz band Available cha
220. ate Move Click this to assign the selected policy a new Priority press Enter When you click the button an entry box opens beside it Enter the priority value then All traffic from the source IP has the policy applied to it Status This indicates whether a policy is active or inactive Priority This indicates the priority of a policy Priority values are unique to each policy If you want to adjust the priority use the Move button Source This indicates the source IP address to be monitored by the policy allows you to configure which times the rule is in effect Destination This indicates the destination IP address to be monitored by the policy All traffic going to the destination IP has the policy applied to it Schedule This indicates which Schedule objects if any is applied to the policy A schedule object Authentication This indicates whether authentication is required for the policy Description This displays the description of the policy It has no intrinsic value to the system Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 14 2 1 Add Exceptional Services This screen allows you to manage exceptions to captive portal interception Click the Add button in the Exceptional Services table on the Captive Portal screen to access this screen Note If you want 802 1x to work properly you must set BOOTP_
221. ated with any entry PR This is the number of an activated policy route If you have configured a schedule for the route this screen only displays the route at the scheduled time Incoming This is the interface on which the packets are received NXC2500 User s Guide Chapter 28 Packet Flow Explore Table 168 Maintenance gt Packet Flow Explore gt Routing Status continued LABEL DESCRIPTION Source This is the source IP address es from which the packets are sent Destination This is the destination IP address es to which the packets are transmitted Service This is the name of the service object any means all services Source Port This is the name of a service object The NXC applies the policy route to the packets sent from the corresponding service port any means all service ports DSCP Code This is the DSCP value of incoming packets to which this policy route applies Next Hop Type This is the type of the next hop to which packets are directed Next Hop Info This is the main route if the next hop type is Auto e This is the interface name and gateway IP address if the next hop type is Interface GW The following fields are available if you click 1 1 SNAT in the Routing Flow section This field is a sequential value and it is not associated with any entry NAT Rule This is the name of an activated 1 1 or Many 1 1 NAT rule in the NAT table
222. ates in the following store Certificate store In the Select Certificate Store dialog box choose a location in which to save the certificate and then click OK z Select Certificate Store Select the certificate store you want to use a 4 9 Trusted Root Certification Authorities H Enterprise Trust Intermediate Certification Authorities H Active Directory User Object PA Trictad Piihlichers lt Show physical stores Cx Cana NXC2500 User s Guide Appendix C Importing Certificates 9 Inthe Completing the Certificate I mport Wizard screen click Finish Certificate Import Wizard Completing the Certificate Import Wizard You have successfully completed the Certificate Import wizard You have specified the following settings Certificate Store Selected Automatically determined by Content Certificate 10 If you are presented with another Security Warning click Yes Security Warning A You are about to install a certificate from a certification authority CA daiming to represent nsa2401 Windows cannot validate that the certificate is actually from nsa2401 You should confirm its origin by contacting nsa2401 The following number will assist you in this process Thumbprint sha 1 35D 1C9AC DBCOE654 FE327C71 464D 1548 242E5B93 Warning If you install this root certificate Windows will automatically trust any certificate issued by this
223. ation E The following table describes the labels in this screen Table 77 Configuration gt Captive Portal gt Auth Policy Add Edit LABEL DESCRIPTION Create New Select an object SSID Profile Address or Service from the list to create a new one You Object can then use the object with the authentication policy rule For example if you create a new SSID Profile called CoffeeBar then you can select it immediately from the SSID list in this screen Enable Policy Select this to enable the new authentication policy You can later edit the authentication policy and deselect it if you want to disable it NXC2500 User s Guide Chapter 14 Captive Portal Table 77 Configuration gt Captive Portal gt Auth Policy Add Edit LABEL DESCRIPTION Description Enter an optional description of the authentication policy You can enter up to 60 characters Source Address Select an address object from the list If none are available you can create a new one using the Create New Object button The source address is an IP address for which the captive portal intercepts all network traffic Destination Select an address object from the list If none are available you can create a new one Address using the Create New Object button The destination address is an IP address for which the captive portal intercepts all network traffic toward Schedule Select a schedule from the lis
224. ation fields Advanced Settings Use Policy Select this to have the NXC forward packets that match a policy route according to the Route to policy route instead of sending the packets directly to a connected network Override Direct Route Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate Move To change a rule s position in the numbered list select the rule and click Move to display a field to type a number for where you want to put that rule and press ENTER to move the rule to the number that you typed The ordering of your rules is important as they are applied in order of their numbering This is the number of an individual policy route Status This icon is lit when the entry is active and dimmed when the entry is inactive User This is the name of the user group object from which the packets are sent any means all users Schedule This is the name of the schedule object none means the route is active at all times if enabled Incoming This is the interface on which the packets are rec
225. ator they confirm that the web domain and contact information in the request match those on public record with a domain name registrar If they match then the certificate is issued to the website operator who then places it on the site to be issued to all visiting web browsers to let them know that the site is legitimate Many ZyXEL products such as the NXC issue their own public key certificates These can be used by web browsers on a LAN or WAN to verify that they are in fact connecting to the legitimate device and not one masquerading as it However because the certificates were not issued by one of the several organizations officially recognized by the most common web browsers you will need to import the ZyXEL created certificate into your web browser and flag that certificate as a trusted authority Note You can see if you are browsing on a secure website if the URL in your web browser s address bar begins with https or there is a sealed padlock icon a somewhere in the main browser window not all browsers show the padlock in the same location NXC2500 User s Guide EM Appendix C Importing Certificates Internet Explorer The following example uses Microsoft Internet Explorer 7 on Windows XP Professional however they can also apply to Internet Explorer on Windows Vista 1 If your device s Web Configurator is set to use SSL certification then the first time you browse to it you are presented with a certification
226. be used by the APs To access this screen login to the Web Configurator and click Configuration gt Object gt MON Profile Figure 113 Configuration gt Object gt MON Profile MON Profile MON Mode Profile Summary add X Edt MY Q Activate Inactivate 38 Object Reference Status Profile Name Page 1 of 1 Show 50 items Displaying 1 1 of 1 The following table describes the labels in this screen Table 102 Configuration gt Object gt MON Profile LABEL DESCRIPTION Add Click this to add a new monitor mode profile Edit Click this to edit the selected monitor mode profile Remove Click this to remove the selected monitor mode profile Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate Object Reference Click this to view which other objects are linked to the selected monitor mode profile for example an AP management profile This field is a sequential value and it is not associated with a specific user Status This icon is lit when the entry is active and dimmed when the entry is inactive Profile Name This field indicates the name assigned to the monitor profile Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 17 MON Profile 17 2 1 Add Edit MON Profile This screen a
227. before doing so Object Select an entry and click Object Reference to open a screen that shows which settings Reference use the entry This field is a sequential value and it is not associated with a specific schedule Name This field displays the name of the schedule which is used to refer to the schedule prat Day This field displays the date and time at which the schedule begins oe Day This field displays the date and time at which the schedule ends i Recurring Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Select an entry and click Object Reference to open a screen that shows which settings Reference use the entry This field is a sequential value and it is not associated with a specific schedule Name This field displays the name of the schedule which is used to refer to the schedule NXC2500 User s Guide Chapter 20 Schedules Table 112 Configuration gt Object gt Schedule continued LABEL DESCRIPTION Start Time This field displays the time at which the schedule begins Stop Time This field displays the time at which the schedule ends 20 2 1 Add Edit Schedule One Time Rule The Add Edit Schedule One Time Rule screen allows you to define a one time schedule or edit an existing one To
228. before the lease time expires Reauthentic ation Time Type the number of minutes this user can be logged into the NXC in one session before the user has to log in again You can specify 1 to 1440 minutes You can enter 0 to make the number of minutes unlimited Unlike Lease Time the user has no opportunity to renew the session without logging out Configuratio Use a user account from the group specified above to test if the configuration is correct Enter n Validation the account s user name in the User Name field and click Test OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide Chapter 15 User Group 15 3 Group Summary User groups consist of access users and other user groups You cannot put admin users in user groups The Group screen provides a summary of all user groups In addition this screen allows you to add edit and remove user groups To access this screen login to the Web Configurator and click Configuration gt Object gt User Group gt Group Figure 94 Configuration gt Object gt User Group gt Group coun Configuration QAdd nf Group Name fas guest qq HK 4 Page 1 wn a Description Member aaa aaaaa of1 b D Show 50 w items Displaying 1 3 of 3 ive The following table describes the labels in this screen Table 84 Configuration gt Object gt User
229. bels in this screen Table 124 Configuration gt Object gt Certificate gt My Certificates gt Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate You can use up to 31 alphanumeric and amp _ characters Certification Path This field displays for a certificate not a certification request Click the Refresh button to have this read only text box display the hierarchy of certification authorities that validate the certificate and the certificate itself If the issuing certification authority is one that you have imported as a trusted certification authority it may be the only certification authority in the list along with the certificate itself If the certificate is a self signed certificate the certificate itself is the only one in the list The NXC does not trust the certificate and displays Not trusted in this field if any certificate on the path has expired or been revoked Refresh Click Refresh to display the certification path Certificate These read only fields display detailed information about the certificate Information Type This field displays general information about the certificate CA signed means that a Certification Authority signed the certificate Self signed means that the certificate s owner signed the certificate not a certification authority X 509 means that this certificate was created and signed accor
230. bes the labels in this screen Table 62 Configuration gt Network gt Routing gt Static Route gt Add Edit LABEL DESCRIPTION Destination IP This parameter specifies the IP network address of the final destination Routing is always based on network number If you need to specify a route to a single host use a subnet mask of 255 255 255 255 in the subnet mask field to force the network number to be identical to the host ID Subnet Mask Enter the IP subnet mask here Gateway IP Select the radio button and enter the IP address of the next hop gateway The gateway is a router or switch on the same segment as your NXC s interface s The gateway helps forward packets to their destinations Interface Select the radio button and a predefined interface through which the traffic is sent Metric Metric represents the cost of transmission for routing purposes IP routing uses hop count as the measurement of cost with a minimum of 1 for directly connected networks Enter a number that approximates the cost for this link The number need not be precise but it must be 0 127 In practice 2 or 3 is usually a good number OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide Chapter 9 Policy and Static Routes 9 4 Technical Reference The following section contains additional technical information about the features describ
231. ble describes the labels in this screen Table 66 Network gt Zone gt Add Edit LABEL DESCRIPTION Name Type the name used to refer to the zone You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Member List Available lists the interfaces that do not belong to any zone Select the interfaces that you want to add to the zone you are editing and click the right arrow button to add them Member lists the interfaces that belong to the zone Select any interfaces that you want to remove from the zone and click the left arrow button to remove them OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide 137 Chapter 10 Zones NXC2500 User s Guide NAT 11 1 Overview NAT Network Address Translation NAT RFC 1631 is the translation of the IP address of a host in a packet For example the source address of an outgoing packet used within one network is changed to a different IP address known within another network Use Network Address Translation NAT to make computers on a private network behind the NXC available outside the private network If the NXC has only one public IP address you can make the computers in the private network available by using ports to forward packets to the appropriate private IP addres
232. ble click an entry or select it and click Edit to modify the entry s settings To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Move To change a method s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed The ordering of your methods is important as NXC authenticates the users using the authentication methods in the order they appear in this screen Method List This field displays the index number Select a server object from the drop down list box You can create a server object in the AAA Server screen The NXC authenticates the users using the databases in the local user database or the external authentication server in the order they appear in this screen If two accounts with the same username exist on two authentication servers you specify the NXC does not continue the search on the second authentication server when you enter the username and password that doesn t match the one on the first authentication server OK Click OK to save the changes Cancel Click Cancel to discard the changes NXC2500 User s Guide Certificates 23 1 Overview The NXC can use certificates also called digital IDs to authenticate users Certificates are based on public private key pairs A certifica
233. by both the server and the wireless clients for mutual authentication The server presents a certificate to the client After validating the identity of the server the client sends a different certificate to the server The exchange of certificates is done in the open before a secured tunnel is created This makes user identity vulnerable to passive attacks A digital certificate is an electronic 1D card that authenticates the sender s identity However to implement EAP TLS you need a Certificate Authority CA to handle certificates which imposes a management overhead EAP TTLS Tunneled Transport Layer Service EAP TTLS is an extension of the EAP TLS authentication that uses certificates for only the server side authentications to establish a secure connection Client authentication is then done by sending username and password through the secure connection thus client identity is protected For client authentication EAP TTLS supports EAP methods and legacy authentication methods such as PAP CHAP MS CHAP and MS CHAP v2 PEAP Protected EAP Like EAP TTLS server side certificate authentication is used to establish a secure connection then use simple username and password methods through the secured connection to authenticate the clients thus hiding client identity However PEAP only supports EAP methods such as EAP MD5 EAP MSCHAPv2 and EAP GTC EAP Generic Token Card for client authentication EAP GTC is implemented only by Cisco
234. can identify the other party and data integrity you know if data has been changea It relies upon certificates public keys and private keys see Chapter 23 on page 241 for more information HTTPS on the NXC is used so that you can securely access the NXC using the Web Configurator The SSL protocol specifies that the HTTPS server the NXC must always authenticate itself to the HTTPS client the computer which requests the HTTPS connection with the NXC whereas the HTTPS client only should authenticate itself when the HTTPS server requires it to do so select Authenticate Client Certificates in the WWW screen Authenticate Client Certificates is optional and if selected means the HTTPS client must send the NXC a certificate You must apply for a certificate for the browser from a CA that is a trusted CA on the NXC Please refer to the following figure 1 HTTPS connection requests from an SSL aware web browser go to port 443 by default on the NXC s web server 2 HTTP connection requests from a web browser go to port 80 by default on the NXC s web server Figure 154 HTTP HTTPS Implementation Web Server 443 80 HTTPS HTTP 272 NXC2500 User s Guide Chapter 24 System Note If you disable HTTP in the WWW screen then the NXC blocks all HTTP connection attempts 24 7 4 Configuring WWW Service Control Click Configuration gt System gt WWW to open the WWW screen Use this screen to specify from which zones you can acc
235. cation request and save it locally for later manual enrollment 9 Create a certification request and enroll for a certificate immediately online Enrollment Protocol Simple Certificate Enrollment protocol SCEP v CA Server Address 10 CA Certificate Please select one lv ee Trusted CAs Request Authentication Key KO NXC2500 User s Guide Chapter 23 Certificates The following table describes the labels in this screen Table 123 Configuration gt Object gt Certificate gt My Certificates gt Add LABEL DESCRIPTION Name Type a name to identify this certificate You can use up to 31 alphanumeric and IO H amp _ characters Subject Information Use these fields to record information that identifies the owner of the certificate You do not have to fill in every field although you must specify a Host IP Address Host Domain Name or E Mail The certification authority may add fields such as a serial number to the subject information when it issues a certificate It is recommended that each certificate have unique subject information Select a radio button to identify the certificate s owner by IP address domain name or e mail address Type the IP address in dotted decimal notation domain name or e mail address in the field provided The domain name or e mail address is for identification purposes only and can be any string A domain name can be up to 255 chara
236. cation server enter its address here Address Backup Specify the port number on the RADIUS server to which the NXC sends authentication Authentication requests Enter a number between 1 and 65535 Port Timeout Specify the timeout period between 1 and 300 seconds before the NXC disconnects from the RADIUS server In this case user authentication fails Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down NXC2500 User s Guide Chapter 21 AAA Server Table 119 Configuration gt Object gt AAA Server gt RADIUS gt Add Edit continued LABEL DESCRIPTION NAS IP Address If the RADIUS server requires the NXC to provide the Network Access Server IP address attribute with a specific value enter it here Case sensitive Select this if the server checks the case of the usernames User Names Key Enter a password up to 15 alphanumeric characters as the key to be shared between the external RADIUS server and the NXC The key is not sent over the network This key must be the same on the external RADIUS server and the NXC Group A RADIUS server defines attributes for its accounts Select the name and number of the Membership attribute that the NXC is to check to determine to which group a user belongs If it does Attribute not display select User Defined and specify the attribute s number This attribute s value is called a group ident
237. ccess by WLAN Controller 11 PRED ULES Geo ee wee 1st s Complete Update WLAN Controller IP Changed New Changed WTP s AC IP Discovery Type s WLAN 1st s controller Te e t s Discovery type Static DHCP DNS Broadcast 2nd s WLAN Controller IP Address AP Receiving Complete ZySH WTP receiving total configuration from WLAN Controller during Configuration from WLAN CAPWAP protocol handshaking Configuration Change State Controller AP Receiving Updating ZySH WTP receiving total configuration from WLAN Controller When Configuration from WLAN AC changed configuration RUN State Controller STA List Full STA List of AP s Number of stations connecting to the specified AP has reached is Full its upper limit 1st s WTP s description DNS Query result is NULL A DNS query failed Table 190 AP Load Balancing Logs LOG MESSAGE DESCRIPTION kick station Indicates that the specified station was removed from an AP s wireless 202x 202x 302x 302x 30 network because the AP became overloaded 2 S02 Table 191 Rogue AP Logs LOG MESSAGE DESCRIPTION rogue ap detection is Indicates that rogue AP detection is enabled enabled NXC2500 User s Guide Appendix A Log Descriptions Table 192 Wireless Frame Capture Logs LOG MESSAGE DESCRIPTION Capture done check_size d max_file_size d n This message displays check_size d and
238. ce I P means that the NXC uses the IP address of the outgoing interface as the source IP address for the matched packets it sends out through this rule The following fields are available if you click Default SNAT in the SNAT Flow section This field is a sequential value and it is not associated with any entry Incoming This indicates internal interface s on which the packets are received NXC2500 User s Guide Chapter 28 Packet Flow Explore Table 169 Maintenance gt Packet Flow Explore gt SNAT Status continued LABEL DESCRIPTION Outgoing This indicates external interface s from which the packets are transmitted SNAT This indicates which source IP address the SNAT rule uses finally For example Outgoing Interface I P means that the NXC uses the IP address of the outgoing interface as the source IP address for the matched packets it sends out through this rule NXC2500 User s Guide ES Chapter 28 Packet Flow Explore NXC2500 User s Guide Reboot 29 1 Overview Use this to restart the device 29 1 1 What You Need To Know If you applied changes in the Web configurator these were saved automatically and do not change when you reboot If you made changes in the CLI however you have to use the write command to save the configuration before you reboot Otherwise the changes are lost when you reboot Reboot is different to reset reset returns the
239. ce gets its IP address from a DHCP server Action Use this field to get or to update the IP address for the interface Click Renew to send a new DHCP request to a DHCP server System Status System Uptime This field displays how long the NXC has been running since it last restarted or was turned on Current Date This field displays the current date and time in the NXC The format is yyyy mm dd Time hh mm ss Click the icon to open the screen where you can configure the NXC s date and time DHCP Table This field displays the number of IP addresses the NXC has assigned via DHCP Click this to look at the IP addresses currently assigned to the NXC s DHCP clients and the IP addresses reserved for specific MAC addresses Current Login User This field displays the user name used to log in to the current session the amount of reauthentication time remaining and the amount of lease time remaining Number of Login Users This field displays the number of users currently logged in to the NXC Click the link to pop open a list of the users who are currently logged in to the NXC Boot Status This field displays details about the NXC s startup state OK The NXC started up successfully Firmware update OK A firmware update was successful Problematic configuration after firmware update The application of the configuration failed after a firmware upgrade System default configuration
240. ce still cannot download the system protect signature file after 3 retries Resolve server IP has failed The device could not resolve the myZyXEL com server s FQDN to an IP address through gethostbyname Connect to MyZyXEL com server has failed The device could not connect to the MyZyXEL com server Build query message has failed Some information was missing in the packets that the device sent to the server Verify server s certificate has failed The device could not process an HTTPS connection because it could not verify the server s certificate Get server respons has failed The device sent packets to the server but did not receive a response The root cause may be that the connection is abnormal Expiration daily check has failed s The daily check for service expiration failed an error message returned by the MyZyXEL com server will be appended to this log s error message returned by myZyXEL com server Do expiration daily check has failed Because of lack must fields The device received an incomplete response to the daily service expiration check and the packets caused a parsing error for the device Server setting error The device could not retrieve the server s IP address or FQDN from local Do expiration daily check has failed The daily check for service expiration failed Do expiration daily check has succeeded The daily check f
241. ces Table 56 Configuration gt Network gt Interface gt VLAN gt Add Edit continued LABEL DESCRIPTION Interface Properties Interface Name This field is read only if you are editing an existing VLAN interface Enter the number of the VLAN interface You can use a number from 0 4094 For example vlan0 vlan8 and so on VID Enter the VLAN ID This 12 bit number uniquely identifies each VLAN Allowed values are 1 4094 0 and 4095 are reserved Zone Select the zone to which the VLAN interface belongs Description Enter a description of this interface It is not used elsewhere You can use alphanumeric and S_ characters and it can be up to 60 characters long Member Use these settings to assign interfaces to this VLAN as members Configuration Edit Click this to edit the selected interface s membership values This is sequential indicator of the interface number Port Name This indicates the interface name Member This indicates whether the selected interface is a member or not of the VLAN which is currently being edited Click this field to edit the value Tx Tagging This indicates whether the selected interface tags outbound traffic with this VLAN s ID Click this field to edit the value IP Address Assignment Get Select this if this interface is a DHCP client In this case the DHCP server configures the Automatically IP address subnet mask and gateway au
242. ching from countries to organizations to organizational units to individuals Figure 129 Basic Directory Structure Countries c Organizations Organization Units Unique Common Name cn Distinguished Name DN A DN uniquely identifies an entry in a directory A DN consists of attribute value pairs separated by commas The leftmost attribute is the Relative Distinguished Name RDN This provides a unique name for entries that have the same parent DN cn domainl com ou Sales o MyCompany in the following examples cn domainl com ou Sales o MyCompany c US cn domainl com ou Sales o MyCompany c JP NXC2500 User s Guide Chapter 21 AAA Server Base DN A base DN specifies a directory A base DN usually contains information such as the name of an organization a domain name and or country For example o MyCompany c UK where o means organization and c means country Bind DN A bind DN is used to authenticate with an LDAP AD server For example a bind DN of cn zyAdmin allows the NXC to log into the LDAP AD server using the user name of zyAdmin The bind DN is used in conjunction with a bind password When a bind DN is not specified the NXC will try to log in as an anonymous user If the bind password is incorrect the login will fail 21 2 Active Directory LDAP Use the Active Directory or LDAP screen to manage the list of AD or LDAP servers the NXC can use in authenticating users
243. cient than A MPDU except in environments that are prone to high error rates A MSDU Limit Enter the maximum frame size to be aggregated Disable Channel Switch for DFS This field is available when you select 5G in the 802 11 Band field DFS dynamic frequency selection allows an AP to detect other devices in the same channel If there is another device using the same channel the AP changes to a different channel so that it can avoid interference with radar systems or other wireless networks Select this option to disable DFS on the AP RTS CTS Threshold Use RTS CTS to reduce data collisions on the wireless network if you have wireless clients that are associated with the same AP but out of range of one another When enabled a wireless client sends an RTS Request To Send and then waits for a CTS Clear To Send before it transmits This stops wireless clients from transmitting packets at the same time and causing data collisions A wireless client sends an RTS for all packets larger than the number of bytes that you enter here Set the RTS CTS equal to or higher than the fragmentation threshold to turn RTS CTS off Beacon Interval When a wirelessly networked device sends a beacon it includes with it a beacon interval This specifies the time period before the device sends the beacon again The interval tells receiving devices on the network how long they can wait in low power mode before waking up to handle
244. ck box on their screen Enable user idle detection This is applicable for access users Select this check box if you want the NXC to monitor how long each access user is logged in and idle in other words there is no traffic for this access user The NXC automatically logs out the access user once the User idle timeout has been reached NXC2500 User s Guide Chapter 15 User Group Table 86 Configuration gt Object gt User Group gt Setting continued LABEL DESCRIPTION User idle This is applicable for access users timeout This field is effective when Enable user idle detection is checked Type the number of minutes each access user can be logged in and idle before the NXC automatically logs out the access user User Logon Settings Limit the Select this check box if you want to set a limit on the number of simultaneous logins by number of admin users If you do not select this admin users can login as many times as they Baume want at the same time using the same or different IP addresses administration account Maximum This field is effective when Limit for administration account is checked Type the number per maximum number of simultaneous logins by each admin user administration account Limit the Select this check box if you want to set a limit on the number of simultaneous logins by number of non admin users If you do not select this access users can login as m
245. clamation point e mail alerts for all categories to e mail server 1 NXC2500 User s Guide Chapter 25 Log and Report Table 151 Configuration gt Log Report gt Log Settings gt Edit System Log continued LABEL DESCRIPTION E mail Server 2 Use the E Mail Server 2 drop down list to change the settings for e mailing logs to e mail server 2 for all log categories Using the System Log drop down list to disable all logs overrides your e mail server 2 settings enable normal logs green check mark e mail log messages for all categories to e mail server 2 enable alert logs red exclamation point e mail alerts for all categories to e mail server 2 This field is a sequential value and it is not associated with a specific address Log Category System log This field displays each category of messages It is the same value used in the Display and Category fields in the View Log tab The Default category includes debugging messages generated by open source software Select which events you want to log by Log Category There are three choices disable all logs red X do not log any information from this category enable normal logs green check mark create log messages and alerts from this category enable normal logs and debug logs yellow check mark create log messages alerts and debugging information from this category the NXC does not e mail debugging information
246. copy certificates certificate trust lists and certificate revocation ists from your disk to a certificate store A certificate which is issued by a certification authority is a confirmation of your identity and contains information used to protect data or to establish secure network connections A certificate store is the system area where certificates are kept To continue click Next 2 The file name and path of the certificate you double clicked should automatically appear in the File name text box Click Browse if you wish to import a different certificate Certificate Import Wizard E xj File to Import Specify the file you want to import Eile name Note More than one certificate can be stored in a single file in the Following Formats Personal Information Exchange PKCS 12 PFX P12 Cryptographic Message Syntax Standard PKCS 7 Certificates P7B Microsoft Serialized Certificate Store 55T NXC2500 User s Guide 279 Chapter 24 System 3 Enter the password given to you by the CA Certificate Import Wizard a xi Password To maintain security the private key veas protected with a password Type the password for the private key Password pe oo I Enable strong private key protection You will be prompted every time the private key is used by an application if you enable this option I Mark the private key as exportable 4 Have the wizard determine where t
247. creen Table 106 Configuration gt Object gt Address gt Address Group LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Select an entry and click Object Reference to open a screen that shows which settings use Reference the entry This field is a sequential value and it is not associated with a specific address group Name This field displays the name of each address group Description This field displays the description of each address group if any 18 3 1 Add Edit Address Group Rule The Add Edit Address Group Rule screen allows you to create a new address group or edit an existing one To access this screen go to the Address Group screen and click either the Add icon or an Edit icon Figure 119 Configuration gt Object gt Address gt Address Group gt Add Edit Add Address Group Rule 2 x Group Members Name bane nie SAAB nana Description Member List Available Member Object LAN_SUBNET test El Cancel The following table describes the labels in this screen Table 107 Configuration gt Object gt Address gt Address Group gt Add Edit LABEL DESCRIPTION Name Enter a name for the address group You
248. ct gt AAA Server gt LDAP gt Add Edit Add LDAP 21x General Settings Name New Description Optional Server Settings Server Address A i or FODN Port 389 1 65535 Base DN ee a Use SSL Search time limit 5 1 300 seconds Case sensitive User Names E Server Authentication Bind DN Password Retype to Confirm User Login Settings Login Name Attribute uid Alternative Login Name Attribute Optional Group Membership Attribute uniquemember Configuration Validation Please enter an existing user account in this server to validate the above settings Username Cancel The following table describes the labels in these screens Table 117 Configuration gt Object gt AAA Server gt Active Directory or LDAP gt Add Edit LABEL DESCRIPTION Name Enter a descriptive name up to 63 alphanumerical characters for identification purposes Description Enter the description of each server if any You can use up to 60 printable ASCII characters Server Address Enter the address of the AD or LDAP server Port Specify the port number on the AD or LDAP server to which the NXC sends authentication requests Enter a number between 1 and 65535 This port number should be the same on all AD or LDAP server s in this group Base DN Specify the directory up to 127 alphanumerical characters For example o ZyXEL c US Use SSL Select Use SSL to establish
249. cters You can use alphanumeric characters the hyphen and periods An e mail address can be up to 63 characters You can use alphanumeric characters the hyphen the symbol periods and the underscore Organizational Unit Identify the organizational unit or department to which the certificate owner belongs You can use up to 31 characters You can use alphanumeric characters the hyphen and the underscore Organization Identify the company or group to which the certificate owner belongs You can use up to 31 characters You can use alphanumeric characters the hyphen and the underscore Town City Identify the town or city where the certificate owner is located You can use up to 31 characters You can use alphanumeric characters the hyphen and the underscore State Province Identify the state or province where the certificate owner is located You can use up to 31 characters You can use alphanumeric characters the hyphen and the underscore Country Identify the nation where the certificate owner is located You can use up to 31 characters You can use alphanumeric characters the hyphen and the underscore Key Type Select RSA to use the Rivest Shamir and Adleman public key algorithm Select DSA to use the Digital Signature Algorithm public key algorithm Key Length Select a number from the drop down list box to determine how many bits the key should use The longer the key the more secure it is A long
250. cts are linked to the selected radio profile This field is a sequential value and it is not associated with a specific profile Status This icon is lit when the entry is active and dimmed when the entry is inactive Profile Name This field indicates the name assigned to the radio profile Frequency Band This field indicates the frequency band which this radio profile is configured to use Channel ID This field indicates the broadcast channel which this radio profile is configured to use Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 16 AP Profile 16 2 1 Add Edit Radio Profile This screen allows you to create a new radio profile or edit an existing one To access this screen click the Add button or select a radio profile from the list and click the Edit button Figure 106 Configuration gt Object gt AP Profile gt Add Edit Radio Profile Q Add Radio Profile General Settings Y Activate Profile Name 802 11 Band Mode Channel Advanced Settings Channel Width Guard Interval A MPDU Limit A MSDU Limit RTS CTS Threshold Beacon Interval DTIM Output Power RSSI Threshold Rate Configuration Basic Rate Mbps Support Rate Mbps MCS Rate Multicast Settings Transmission Mode Multicast Rate Mbps MBSSID Settings 2 Edit S
251. d X do not send the remote server logs for any log category enable normal logs green check mark send the remote server log messages and alerts for all log categories enable normal logs and debug logs yellow check mark send the remote server log messages alerts and debugging information for all log categories This field is a sequential value and it is not associated with a specific entry Log Category This field displays each category of messages The Default category includes debugging messages generated by open source software NXC2500 User s Guide Chapter 25 Log and Report Table 152 Configuration gt Log Report gt Log Settings gt Edit USB Storage continued LABEL DESCRIPTION Selection Select what information you want to log from each Log Category except All Logs see below Choices are disable all logs red X do not log any information from this category enable normal logs green check mark log regular information and alerts from this category enable normal logs and debug logs yellow check mark log regular information alerts and debugging information from this category OK Click this to save your changes and return to the previous screen Cancel Click this to return to the previous screen without saving your changes 306 NXC2500 User s Guide Chapter 25 Log and Report 25 3 4 Edit Remote Server Log Settings This screen controls the
252. d a group identifier it determines to Attribute which group a user belongs You can add ext group user user objects to identify groups based on these group identifier values For example you could have an attribute named memberOf with values like sales RD and management Then you could also create a ext group user user object for each group One with sales as the group identifier another for RD and a third for management Enable Select this to enable domain authentication for MSChap MS CHAP Microsoft CHAP Challenge Handshake Authentication Protocol uses a challenge response mechanism where the response is encrypted Note This is only for Active Directory User Name Enter the user name for the user who has rights to add a machine to the domain Note This is only for Active Directory User Password Enter the password for the associated user name Note This is only for Active Directory Retype to Confirm Retype your new password for confirmation Realm Enter the AD server s realm network domain Note This is only for Active Directory NetBIOS Name Enter the NetBIOS name of the AD or LDAP server If you enter this the NXC uses it with the user name in the format NetBIOS USERNAME to do authentication If you do not configure this the NXC uses the format USERNAME realm to do authentication Configuration Use a user account from the server specifi
253. d displays general information about the certificate For example Subject Type CA means that this is a certification authority s certificate and Path Length Constraint 1 means that there can only be one certification authority in the certificate s path MD5 Fingerprint This is the certificate s message digest that the NXC calculated using the MD5 algorithm You can use this value to verify with the certification authority over the phone for example that this is actually their certificate SHA1 Fingerprint This is the certificate s message digest that the NXC calculated using the SHA1 algorithm You can use this value to verify with the certification authority over the phone for example that this is actually their certificate Certificate in PEM Base 64 Encoded Format This read only text box displays the certificate or certification request in Privacy Enhanced Mail PEM format PEM uses lowercase letters uppercase letters and numerals to convert a binary certificate into a printable form You can copy and paste the certificate into an e mail to send to friends or colleagues or you can copy and paste the certificate into a text editor and save the file on a management computer for later distribution via floppy disk for example Export Certificate Click this button and then Save in the File Download screen The Save As screen opens browse to the location that you want to use and click Save OK
254. dd Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This is the index number of the service control rule The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy Zone This is the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny HTTP Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Servic
255. device to its default configuration 29 2 Reboot This screen allows remote users can restart the device To access this screen click Maintenance gt Reboot Figure 204 Maintenance gt Reboot Reboot Click the Reboot button to reboot the device Please wait a few minutes until the login screen appears If the login screen does not appear type the IP address of the device in your Web browser Click the Reboot button to restart the NXC Wait a few minutes until the login screen appears If the login screen does not appear type the IP address of the device in your Web browser You can also use the CLI command reboot to restart the NXC NXC2500 User s Guide 345 Chapter 29 Reboot NXC2500 User s Guide Shutdown 30 1 Overview Use this screen to shutdown the device Always use Maintenance gt Shutdown gt Shutdown or the shutdown command before you turn off the NXC or remove the power Not doing so can cause the firmware to become corrupt 30 1 1 What You Need To Know Shutdown writes all cached data to the local storage and stops the system processes Shutdown is different to reset reset returns the device to its default configuration 30 2 Shutdown To access this screen click Maintenance gt Shutdown Figure 205 Maintenance gt Shutdown Shutdown Shutdown Click the Shutdown button to shutdown the device Shutdown Click the Shutdown button to shut down the NXC Wait f
256. ding to the ITU T X 509 recommendation that defines the formats for public key certificates Version This field displays the X 509 version number Serial Number This field displays the certificate s identification number given by the certification authority or generated by the NXC Subject This field displays information that identifies the owner of the certificate such as Common Name CN Organizational Unit OU Organization O State ST and Country C Issuer This field displays identifying information about the certificate s issuing certification authority such as Common Name Organizational Unit Organization and Country With self signed certificates this is the same as the Subject Name field none displays for a certification request Signature Algorithm This field displays the type of algorithm that was used to sign the certificate The NXC uses rsa pkcs1 shal RSA public private key encryption algorithm and the SHA1 hash algorithm Some certification authorities may use rsa pkcs1 md5 RSA public private key encryption algorithm and the MD5 hash algorithm Valid From This field displays the date that the certificate becomes applicable none displays for a certification request Valid To This field displays the date that the certificate expires The text displays in red and includes an Expired message if the certificate has expired none displays for a certification reque
257. disconnects from the NXC and the information is unavailable as a result R1 Mode Profile This field displays the operating mode AP or MON and AP profile name for Radio 1 It displays n a for the profile for a radio not using an AP profile R2 Mode Profile This field displays the operating mode AP or MON and AP profile name for Radio 2 It displays n a for the profile for a radio not using an AP profile Mgnt VLAN ID AC This displays the Access Controller the NXC management VLAN ID setting for the AP Mgnt VLAN ID AP This displays the runtime management VLAN ID setting on the AP VLAN Conflict displays if the AP s management VLAN ID does not match the Mgnt VLAN I D AC This field displays n a if the NXC cannot get VLAN information from the AP Description This field displays the AP s description which you can configure by selecting the AP s entry and clicking the Edit button NXC2500 User s Guide Chapter 7 Wireless 7 3 1 Edit AP List Select an AP and click the Edit button in the Configuration gt Wireless gt AP Management table to display this screen Figure 44 Configuration gt Wireless gt AP Management gt Edit AP List Edit AP List 5 Create new Object Configuration MAC Model Description Radio 1 OP Mode Radio 1 Profile Radio 2 OP Mode Radio 2 Profile VLAN Settings V Force Overwrite VLAN Config Management VLAN ID
258. e The link status of s interface is inactive The specified interface failed a connectivity check Table 178 NAT Logs LOG MESSAGE DESCRIPTION The NAT range is full The NAT mapping table is full s FTP ALG has succeeded The FTP Application Layer Gateway ALG has been turned on or off s Enable or Disable Extra signal port of FTP ALG has been modified Extra FTP ALG port has been changed Signal port of FTP ALG has been modified Default FTP ALG port has been changed s H 323 ALG has succeeded The H 323 ALG has been turned on or off s Enable or Disable NXC2500 User s Guide Appendix A Log Descriptions Table 178 NAT Logs continued LOG MESSAGE DESCRIPTION Extra signal port of H 323 ALG has been modified Extra H 323 ALG port has been changed Signal port of H 323 ALG has been modified Default H 323 ALG port has been changed s SIP ALG has succeeded The SIP ALG has been turned on or off s Enable or Disable Extra signal port of SIP ALG has been modified Extra SIP ALG port has been changed Signal port of SIP ALG has been modified Default SIP ALG port has been changed Register SIP ALG extra port d failed SIP ALG apply additional signal port failed d Port number Register SIP ALG signal port d failed SIP ALG apply signal port failed d Port
259. e e To have the browser trust the certificates issued by a certificate authority import the certificate authority s certificate into your operating system as a trusted certificate Refer to Appendix C on page 391 for details 24 7 6 3 Login Screen After you accept the certificate the NXC login screen appears The lock displayed in the bottom of the browser status bar denotes a secure connection Figure 158 Login Screen Internet Explorer Note 1 Turn on Javascript and Cookie setting in your web browser 2 Turn off Popup Window Blocking in your web browser 3 Turn on Java Runtime Environment JRE in your web browser Internet 24 7 6 4 Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the NXC You must have imported at least one trusted CA to the NXC in order for the Authenticate Client Certificates to be active see the Certificates chapter for details NXC2500 User s Guide 277 Chapter 24 System Apply for a certificate from a Certification Authority CA that is trusted by the NXC see the NXC s Trusted Certificates Web Configurator screen Figure 159 Trusted Certificates My Certificates PKI Storage Space in Use 0 082 used Trusted Certificates Setting gta Y a Name Subject Issuer Valid From Valid To 1 MyCertificate CN Mydevice example CN Mydevice example 2013 04 09 10 44 04 GMT
260. e To turn on an entry select it and click Activate To turn off an entry select it and click Inactivate H Status This field is a sequential value and it is not associated with a specific log This icon is lit when the entry is active and dimmed when the entry is inactive Name Log Format Summary This field displays the name of the log system log or one of the remote servers This field displays the format of the log Internal system log you can view the log on the View Log tab VRPT Syslog ZyXEL s Vantage Report syslog compatible format CEF Syslog Common Event Format syslog compatible format This field is a summary of the settings for each log NXC2500 User s Guide Chapter 25 Log and Report Table 150 Configuration gt Log Report gt Log Settings continued LABEL DESCRIPTION Log Category Click this button to open the Log Category Settings screen Settings Click this button to save your changes activate and deactivate logs and make them take effect Apply NXC2500 User s Guide EM Chapter 25 Log and Report 25 3 2 Edit System Log Settings This screen controls the detailed settings for each log in the system log which includes the e mail profiles Go to the Log Settings Summary screen and click the system log Edit icon Figure 175 Configuration gt Log Report gt Log Settings gt Edit System Log J Edit Log
261. e device E mail Server 1 Use the E Mail Server 1 drop down list to change the settings for e mailing logs to e mail server 1 for all log categories Using the System Log drop down list to disable all logs overrides your e mail server 1 settings enable normal logs green check mark e mail log messages for all categories to e mail server 1 enable alert logs red exclamation point e mail alerts for all categories to e mail server 1 E mail Server 2 Use the E Mail Server 2 drop down list to change the settings for e mailing logs to e mail server 2 for all log categories Using the System Log drop down list to disable all logs overrides your e mail server 2 settings enable normal logs green check mark e mail log messages for all categories to e mail server 2 enable alert logs red exclamation point e mail alerts for all categories to e mail server 2 Remote Server For each remote server use the Selection drop down list to change the log settings for all 1 4 of the log categories disable all logs red X do not send the remote server logs for any log category enable normal logs green check mark send the remote server log messages and alerts for all log categories enable normal logs and debug logs yellow check mark send the remote server log messages alerts and debugging information for all log categories This field is a sequential value and it is not associated with a specific
262. e AP for permission to send it The AP then responds with a CTS Clear to Send message to all other stations within its range to notify them to defer their transmission It also reserves and confirms with the requesting station the time frame for the requested transmission Stations can send frames smaller than the specified RTS CTS directly to the AP without the RTS Request To Send CTS Clear to Send handshake You should only configure RTS CTS if the possibility of hidden nodes exists on your network and the cost of resending large frames is more than the extra network overhead involved in the RTS Request To Send CTS Clear to Send handshake If the RTS CTS value is greater than the Fragmentation Threshold value see next then the RTS Request To Send CTS Clear to Send handshake will never occur as data frames will be fragmented before they reach RTS CTS size Note Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy 408 NXC2500 User s Guide Appendix D Wireless LANs Fragmentation Threshold A Fragmentation Threshold is the maximum data fragment size between 256 and 2432 bytes that can be sent in the wireless network before the AP will fragment the packet into smaller data frames A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for bus
263. e Click this button to mark the selected AP as a rogue AP A rogue AP can be contained in the AP Configuration gt Wireless gt MON Mode screen Chapter 7 on page 89 Mark as Friendly Click this button to mark the selected AP as a friendly AP For more on managing friendly AP APs see the Configuration gt Wireless gt MON Mode screen Chapter 7 on page 89 This is the station s index number in this list Status This indicates the detected device s status Device This indicates the detected device s network type such as infrastructure or ad hoc Role This indicates the detected device s role such as friendly or rogue MAC Address This indicates the detected device s MAC address SSID Name This indicates the detected device s SSID Channel ID This indicates the detected device s channel ID 802 11 Mode This indicates the 802 11 mode a b g n transmitted by the detected device Security This indicates the encryption method if any used by the detected device Description This displays the detected device s description For more on managing friendly and rogue APs see the Configuration gt Wireless gt MON Mode screen Chapter 7 on page 89 Last Seen This indicates the last time the device was detected by the NXC Refresh Click this to refresh the items displayed on this page 5 15 View Log Log messages are stored in two separate logs one for regular log messages and one for debugging messages In the reg
264. e Control table to access the NXC Web Configurator using HTTP connections Server Port You may change the server port number for a service if needed however you must use the same port number in order to use that service to access the NXC NXC2500 User s Guide Chapter 24 System Table 139 Configuration gt System gt WWW gt Service Control continued LABEL DESCRIPTION Admin User Service Admin Service Control specifies from which zones an administrator can use HTTP to Control manage the NXC using the Web Configurator You can also specify the IP addresses from which the administrators can manage the NXC User Service Control specifies from which zones a user can use HTTP to log into the NXC You can also specify the IP addresses from which the users can access the NXC Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the numbe
265. e NXC It also appears every time you click the Dashboard icon in the navigation panel The Dashboard displays general device information system status system resource usage licensed service status and interface status in widgets that you can re arrange to suit your needs You can also collapse refresh and close individual widgets Figure 16 Dashboard DASHBOARD NXC2500 NXC2500 5132106160030 B0 B2 DC 6E A8 97 B0 B2 DC 6E A8 9C V4 00 AAIG 0 V0 9 1 2013 02 03 18 04 28 z ES A TER 2013 04 02 alert capwap AP doesn 2013 04 02 alert policy route Interface System Uptime eters 2013 04 02 alert policy route Interface Current Date Time 2012 12 31 12 57 34 GMT 00 00 2013 04 02 alert capwap AP doesn DHCP Table 0 2013 04 02 alert policy route Interface Current Login User admin unlimited 00 29 59 Number of Login Users 1 Boot Status Firmware update OK CPU Usage Memory Usage T Flash Usage USB Storage Usage 0 0 MB Active Sessions 56 100000 Alap Online Management AP Offline Management AP Un Management AP All Station Station All Sensed Device Un Classified AP Rogue AP 192 168 1 21 255 255 25 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000M Full 0 0 0 0 0 0 0 0 Down 0 0 0 0 0 0 0 0 100M Full 0 0 0 0 0 0 0 0 NXC2500 User s Guide Chapter 4 Dashboard The following table descr
266. e SSID Traffic Statistics This graph displays the overall traffic information about the radio over the preceding 24 hours y axis This axis represents the amount of data moved across this radio in megabytes per second x axis This axis represents the amount of time over which the data moved across this radio Station Count This graph displays information about all the wireless clients that have connected to the radio over the preceding 24 hours y axis The y axis represents the number of connected wireless clients x axis The x axis shows the time over which a wireless client was connected Last Update This field displays the date and time the information in the window was last updated OK Click this to close this window Cancel Click this to close this window 5 13 Station List Use this screen to view statistics pertaining to the associated stations or wireless clients Click Monitor gt Wireless gt Station Info to access this screen Figure 35 Monitor gt Wireless gt Station List Station List MAC Address J SSID Name 5200 TUN24G OUT OPEN 3 Stations 2 00 24 D6 70 44 86 3 C0 F8 DA 63 D5 96 PM 5G 24G SSID Name 5200 TUN24G OUT WPA2 2 Stations SSID Name 5200 TUNS5G OUT OPEN 2 Stations SSID Name ZyXEL 1 Station Associated AP SSID Name Security Mode Signal Stren IP Address TxRate RxRate Association time 1 00 19 CB F4 CF 13 AP 24G_52
267. e This field displays when View s set to all sessions Select the service or service group whose sessions you want to view The NXC identifies the service by comparing the protocol and destination port of each packet to the protocol and port of each services that is defined See Chapter 19 on page 215 for more information about services Source This field displays when View is set to all sessions Type the source IP address whose sessions you want to view You cannot include the source port Destination This field displays when View is set to all sessions Type the destination IP address whose sessions you want to view You cannot include the destination port Search This button displays when View is set to all sessions Click this button to update the information on the screen using the filter criteria in the User Service Source Address and Destination Address fields This field displays the index number of each active session User This field displays the user in each active session If you are looking at the sessions by users or all sessions report click or to display or hide details about a user s sessions Service This field displays the protocol used in each active session If you are looking at the sessions by services report click or to display or hide details about a protocol s sessions Source This field displays the source IP address and port in each active session If you are looking at the sessions by source IP re
268. e USB device connected to the NXC is in use Active Sessions This field displays how many traffic sessions are currently open on the NXC These are the sessions that are traversing the NXC Hover your cursor over this field to display icons Click the Detail icon to go to the Session Monitor screen to see details about the active sessions Click the Show Active Sessions icon to display a chart of NXC s recent session usage NXC2500 User s Guide Chapter 4 Dashboard Table 15 Dashboard continued LABEL DESCRIPTION Interface Status Summary Name This field displays the name of each interface Status This field displays the current status of each interface The possible values depend on what type of interface it is Inactive The Ethernet interface is disabled Down The Ethernet interface is enabled but not connected Speed Duplex The Ethernet interface is enabled and connected This field displays the port speed and duplex setting Full or Half Zone This field displays the zone to which the interface is currently assigned IP Addr This field displays the current IP address and subnet mask assigned to the interface If Netmask the IP address is 0 0 0 0 the interface is disabled or did not receive an IP address and subnet mask via DHCP IP Assignment This field displays how the interface gets its IP address Static This interface has a static IP address DHCP Client This interfa
269. e a of 1 Description t tO User Type MAG ruioruvauvn Cours External LDAP Users Local User Local User Administration account External AD Users Local User Show 50 v items User Type ext user mac address ext user guest guest manager admin ext user mac address Displaying 1 8 of 8 NXC2500 User s Guide Chapter 3 The Web Configurator 5 Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time Configuration Qad Zoo Y a User Name User Type Description 1 admin admin Administration account 2 Idap users ext user External LDAP Users 3 radius users extuser External RADIUS Users 4 ad users ext user External AD Users 5 mac users mac address MAC Authentication Users 6 guest guest Local User 7 boss guest manager Local User 8 Page 1 of1 Show 50 v items Displaying 1 8 of 8 Working with Table Entries The tables have icons for working with table entries A sample is shown next You can often use the Shift or Ctrl key to select multiple entries to remove activate or deactivate Table 13 Common Table Icons IPv4 Configuration Add X Edit MN Remove Activate Inactivate Move St Us Sched Incomi Source Destin DSCP Service Sourc Next H DSCP SNAT Page 1 of 1 Show 50 items Displaying 1 10f 1 Here are descriptions for the most common
270. e comes before any other routes that the traffic would also match can t enter the interface name want The format of interface names other than the Ethernet interface names is very strict Each name consists of 2 4 letters interface type followed by a number x limited by the maximum number of each type of interface For example VLAN interfaces are vianO vlan1 vlan2 and so on My rules and settings that apply to a particular interface no longer work The interface s IP address may have changed To avoid this create an IP address object based on the interface This way the NXC automatically updates every rule or setting that uses the object whenever the interface s IP address settings change For example if you change gel s IP address the NXC automatically updates the corresponding interface based gel subnet address object Hackers have accessed my WEP encrypted wireless LAN WEP is extremely insecure Its encryption can be broken by an attacker using widely available software It is strongly recommended that you use a more effective security mechanism Use the strongest security mechanism that all the wireless devices in your network support WPA2 or WPA2 PSK is recommended The wireless security is not following the re authentication timer setting specified NXC2500 User s Guide Chapter 31 Troubleshooting Ifa RADIUS server authenticates wireless stations the re authentication tim
271. e done Set manual time has succeeded Current time is s The device date and time was changed manually s is the date and time NTP update successful current time is s The device successfully synchronized with a NTP time server s is the date and time NTP update failed The device was not able to synchronize with the NTP time server successfully Device is rebooted by administrator An administrator restarted the device NXC2500 User s Guide Appendix A Log Descriptions Table 176 System Logs continued LOG MESSAGE DESCRIPTION Insufficient memory Cannot allocate system memory Update the profile s has failed because of strange server response Update profile failed because the response was strange s is the profile name Update the profile s has succeeded because the IP address of FODN Ss was not changed Update profile succeeded because the IP address of profile is unchanged s is the profile name Update the profile s has succeeded Update profile succeeded s is the profile name Collect Diagnostic Information has failed Server did not respond There was an error and the diagnostics were not completed Collect Diagnostic Infomation has succeeded The diagnostics scripts were executed successfully Port d is up The specified port has it s link up Port d is down The specified
272. e mac address an external server authenticates wireless clients based on their MAC addresses After authentication the NXC maps a wireless client to a MAC address user account MAC role User aware features control MAC address user access to specific resources You do not need to set the lease time and reauthentication time for this type of user account Lease Time This is the default lease time in minutes for each type of user account It defines the number of minutes the user has to renew the current session before the user is logged out Admin users renew the session every time the main screen refreshes in the Web Configurator Access users can renew the session by clicking the Renew button on their screen If you allow access users to renew time automatically the users can select this check box on their screen as well In this case the session is automatically renewed before the lease time expires Reauthenticatio n Time This is the default reauthentication time in minutes for each type of user account It defines the number of minutes the user can be logged into the NXC in one session before having to log in again Unlike Lease Time the user has no opportunity to renew the session without logging out Miscellaneous Settings Allow renewing lease time automatically Select this check box if access users can renew lease time automatically as well as manually simply by selecting the Updating lease time automatically che
273. e service control rules uploaded a logo to display on the upper left corner of the Web Configurator login screen and access page but it does not display properly Make sure the logo file is a GIF JPG or PNG of 100 kilobytes or less uploaded a logo to use as the screen or window background but it does not display properly Make sure the logo file is a GIF JPG or PNG of 100 kilobytes or less The NXC s traffic throughput rate decreased after started collecting traffic statistics Data collection may decrease the NXC s traffic throughput rate can only see newer logs Older logs are missing When a log reaches the maximum number of log messages new log messages automatically overwrite existing log messages starting with the oldest existing log message first The commands in my configuration file or shell script are not working properly e Ina configuration file or shell script use or as the first character of a command line to have the NXC treat the line as a comment e Your configuration files or shell scripts can use exit or a command line consisting of a single to have the NXC exit sub command mode e Include write commands in your scripts Otherwise the changes will be lost when the NXC restarts You could use multiple write commands in a long script Note exit or must follow sub commands if it is to make the NXC exit sub command mode
274. ect any to capture packets for traffic sent by either IP version Protocol Type Select the protocol type of traffic for which to capture packets Select any to capture packets for all types of traffic NXC2500 User s Guide 327 Chapter 27 Diagnostics Table 161 Maintenance gt Diagnostics gt Packet Capture continued LABEL DESCRIPTION Host IP Select a host IP address object for which to capture packets Select any to capture packets for all hosts Select User Defined to be able to enter an IP address Host Port This field is configurable when you set the Protocol Type to any tcp or udp Specify the port number of traffic to capture Continuously capture and overwrite old ones Select this to have the NXC keep capturing traffic and overwriting old packet capture entries when the available storage space runs out Save data to onboard storage only Select this to have the NXC only store packet capture entries on the NXC The available storage size is displayed as well Note The NXCL reserves some onboard storage space as a buffer Save data to USB storage Select this to have the NXC store packet capture entries only on a USB storage device connected to the NXC Status Unused the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the NXC cannot mount it none no USB storage device is connected available you can
275. ected Device screen Section 5 14 on page 79 displays the wireless devices passively detected by the NXC The View Log screen Section 5 15 on page 80 displays the NXC s current log messages You can change the way the log is displayed you can e mail the log and you can also clear the log in this screen The View AP Log screen Section 5 16 on page 83 displays the NXC s current wireless AP log messages NXC2500 User s Guide Chapter 5 Monitor 5 2 What You Need to Know The following terms and concepts may help as you read through the chapter Rogue AP Rogue APs are wireless access points operating in a network s coverage area that are not under the control of the network s administrators and can open up holes in a network s security See Chapter 17 on page 203 for details Friendly AP Friendly APs are other wireless access points that are detected in your network as well as any others that you know are not a threat those from neighboring networks for example See Chapter 17 on page 203 for details 5 3 Port Statistics Use this screen to look at packet statistics for each Gigabit Ethernet port To access this screen click Monitor gt System Status gt Port Statistics Figure 22 Monitor gt System Status gt Port Statistics Port Statistics General Settings Poll Interval 1 60 seconds Set Interval Stop Statistics Table Switch To Graphic View Port Status Collisions Up Time Down 0 0 00 00 0
276. ection and view various statistics about traffic passing through your NXC Note Data collection may decrease the NXC s traffic throughput rate NXC2500 User s Guide 297 Chapter 25 Log and Report Click Configuration gt Log amp Report gt Email Daily Report to display the following screen Configure this screen to have the NXC e mail you system statistics every day Figure 173 Configuration gt Log Report gt Email Daily Report General Settings E Enable Email Daily Report Email Settings Mail Server Qutgoing SMTP Server Name or IP Address Mail Subject E Append system name E Append date time Mail From mail Address AAA Mail To Qmail Address Email Address Email Address Email Address Email Address E SMTP Authentication User Name Password Retype to Confirm Schedule Time For Sending Report hours 0 minutes Report Items System Resource Usage CPU Usage Y Memory Usage Y Session Usage Port Usage Wireless Report E Station Count E TX Statistics RX Statistics Y Interface Traffic Statistics E Reset counters after sending report successfully Reset All Counters The following table describes the labels in this screen Table 149 Configuration gt Log Report gt Email Daily Report LABEL DESCRIPTION Enable Email Select this to send reports by e mail every day Daily Report Mail Server Type the name or IP address
277. ed manually When you set Time and Date Setup to Manual enter the new time in this field and then click Apply New Date yyyy mm dd This field displays the last updated date from the time server or the last date configured manually When you set Time and Date Setup to Manual enter the new date in this field and then click Apply Get from Time Server Select this radio button to have the NXC get the time and date from the time server you specify below The NXC requests time and date settings from the time server under the following circumstances When the NXC starts up When you click Apply or Synchronize Now in this screen e 24 hour intervals after starting up Time Server Address Enter the IP address or URL of your time server Check with your ISP network administrator if you are unsure of this information Sync Now Click this button to have the NXC get the time and date from a time server see the Time Server Address field This also saves your changes except the daylight saving settings Time Zone Setup Time Zone Choose the time zone of your location This will set the time difference between your time zone and Greenwich Mean Time GMT Enable Daylight Saving Daylight saving is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daytime light in the evening Select this option if you use Daylight Savin
278. ed above to test if the configuration is correct Validation Enter the account s user name in the Username field and click Test OK Click OK to save the changes Cancel Click Cancel to discard the changes NXC2500 User s Guide Chapter 21 AAA Server 21 3 RADIUS Use the RADI US screen to manage the list of RADIUS servers the NXC can use in authenticating users Click Configuration gt Object gt AAA Server gt RADI US to display the RADI US screen Figure 133 Configuration gt Object gt AAA Server gt RADIUS mos RADIUS Server Summary Add ect Name Server Address 1 radius Page 1 of i Show 50 v items Displaying 1 10f 1 The following table describes the labels in this screen Table 118 Configuration gt Object gt AAA Server gt RADIUS LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Select an entry and click Object Reference to open a screen that shows which settings Reference use the entry This field displays the index number Name This is the name of the RADIUS server entry Server Address This is the address of the AD or LDAP server NXC2500 User s Guide Chapter 21 AAA Server 21 3 1 Add Edit R
279. ed color should display in the preview screen on the right after you click in another field click Apply or press ENTER If your desired color does not display your browser may not support it Try selecting another color NXC2500 User s Guide Chapter 14 Captive Portal 14 3 2 External or Uploaded Web Portal Details You can also configure the look and feel of the web portal page if you use an external web portal or upload a web portal file to the NXC Here are some examples Figure 87 External Web Portal Login Page Example ZyXEL Enter user name Password and click to login Username Password Figure 88 External Web Portal Welcome Page Example ZyXEL Welcome Ce Your Internetis safer faster and smarter because you re using portal Think you NXC2500 User s Guide Chapter 14 Captive Portal Figure 89 External Web Portal Session Page Example ZyXEL radius3 You now have logged in Click the logout button to terminate the access session You could renew your lease time by clicking the Renew button For security reason you must login again after 24 hours O minutes O second Remaining time before lease timeout hh mm ss 23 59 43 Renew Remaining time before auth timeout hh mm ss 23 59 43 Remaining time before session timeout hh mm ss 00 09 43 Figure 90 External Web Portal Logout Page Example ZyXEL Thank you for choosing to use the portal Your Interne
280. ed in this chapter NAT and SNAT NAT Network Address Translation NAT RFC 1631 is the translation of the IP address in a packet in one network to a different IP address in another network Use SNAT Source NAT to change the source IP address in one network to a different IP address in another network Assured Forwarding AF PHB for DiffServ Assured Forwarding AF behavior is defined in RFC 2597 The AF behavior group defines four AF classes Inside each class packets are given a high medium or low drop precedence The drop precedence determines the probability that routers in the network will drop packets when congestion occurs If congestion occurs between classes the traffic in the higher class smaller numbered class is generally given priority Combining the classes and drop precedence produces the following twelve DSCP encodings from AF11 through AF43 The decimal equivalent is listed in brackets Table 63 Assured Forwarding AF Behavior Group Class 1 Class 2 Class 3 Class 4 Low Drop Precedence AF11 10 AF21 18 AF31 26 AF41 34 Medium Drop Precedence AF12 12 AF22 20 AF32 28 AF42 36 High Drop Precedence AF13 14 AF23 22 AF33 30 AF43 38 NXC2500 User s Guide Chapter 9 Policy and Static Routes WMM Wi Fi Multimedia WMM provides basic Quality of Service QoS features to wireless networks The four categories of QoS described by WMM are voice VO video V
281. edit what events is included in each log you can also use the Log Category Settings screen to edit this information for all logs at the same time NXC2500 User s Guide Chapter 25 Log and Report 25 3 1 Log Settings Summary To access this screen click Configuration gt Log amp Report gt Log Settings Figure 174 Configuration gt Log amp Report gt Log Settings Log Settings Log Settings Page 1 Name Log Format Summary E mail Server 1 Mail Server Mail Subject Send From Send Log to Send Alert to Schedule Send log when full System Log Internal E mail Server 2 Mail Server Mail Subject Send From Send Log to Send Alert to Schedule Send log when full USB Status none System Log Internal USB Storage Internal VRPT Syslog Server Address Log Facility Local 1 Remote Server 1 Server Address Log Facility Local 1 Server Address Log Facility Local 1 Remote Server 2 VRPT Syslog Remote Server3 VRPT Syslog Remote Server 4 VRPT Syslog Server Address Log Facility Local 1 Displaying 1 7 of 7 of 1 Show 50 items Log Category Settings Apply The following table describes the labels in this screen Table 150 Configuration gt Log amp Report gt Log Settings LABEL DESCRIPTION Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Activate Inactivat
282. efault description is AP the AP s MAC Address Station This displays the number of stations aka wireless clients associated with the AP Recent On line This displays the most recent time the AP came on line N A displays if the AP has not Time come on line since the NXC last started up Last Off line This displays the most recent time the AP went off line N A displays if the AP has either Time not come on line or gone off line since the NXC last started up NXC2500 User s Guide 73 Chapter 5 Monitor The following table describes the icons in this screen Table 32 Monitor gt Wireless gt AP Information gt AP List Icons LABEL DESCRIPTION be This AP is not on the management list This AP is on the management list and online Ll bed This AP is in the process of having its firmware updated 11 This AP is on the management list but offline E This indicates one of the following cases e This AP has a runtime management VLAN ID setting that conflicts with the VLAN ID setting on the Access Controller the NXC e A setting the NXC assigns to this AP does not match the AP s capability 5 11 1 Station Count of AP Use this screen to look at station statistics for the connected AP To access this screen select an entry and click the More Information button in the AP List screen Figure 32 Monitor gt Wireless gt AP Information gt AP List gt Station Count of AP
283. eived Source This is the name of the source IP address group object any means all IP addresses Destination This is the name of the destination IP address group object any means all IP addresses NXC2500 User s Guide 127 Chapter 9 Policy and Static Routes Table 59 Configuration gt Network gt Routing gt Policy Route continued LABEL DESCRIPTION DSCP Code This is the DSCP value of incoming packets to which this policy route applies any means all DSCP values or no DSCP marker default means traffic with a DSCP value of 0 This is usually best effort traffic The af entries stand for Assured Forwarding The number following the af identifies one of four classes and one of three drop preferences The wmm entries are for QoS For more information on QoS and WMM categories see page 134 Service This is the name of the service object any means all services Source Port This is the name of a service object The NXC applies the policy route to the packets sent from the corresponding service port any means all service ports Next Hop DSCP Marking This is the next hop to which packets are directed It helps forward packets to their destinations and can be a router or outgoing interface This is how the NXC handles the DSCP value of the outgoing packets that match this route If this field displays a DSCP value the NXC applies that DSCP value to the route s outgoing packets p
284. el that marks packets so that they receive specific per hop treatment at DiffServ compliant network devices along the route based on the application types and traffic flow Packets are marked with DiffServ Code Points DSCPs indicating the level of service desired This allows the intermediary DiffServ compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow In addition applications do not have to request a particular service or give advanced notice of where the traffic is going DSCP Marking and Per Hop Behavior DiffServ defines a new DS Differentiated Services field to replace the Type of Service TOS field in the IP header The DS field contains a 2 bit unused field and a 6 bit DSCP field which can define up to 64 service levels The following figure illustrates the DS field DSCP 6 bits Unused 2 bits DSCP is backward compatible with the three precedence bits in the ToS octet so that non DiffServ compliant ToS enabled network device will not conflict with the DSCP mapping The DSCP value determines the forwarding behavior the PHB Per Hop Behavior that each packet gets across the DiffServ network Based on the marking rule different kinds of traffic can be marked for different kinds of forwarding Resources can then be allocated according to the DSCP values and the configured policies 9 2 Policy Route
285. elp Notices Changes or modifications not expressly approved by the party responsible for compliance could void the user s authority to operate the equipment This Class B digital apparatus complies with Canadian I CES 003 Cet appareil num rique de la classe B est conforme a la norme NMB 003 du Canada Viewing Certifications Go to http www zyxel com to view this product s documentation and certifications ZyXEL Limited Warranty ZyXEL warrants to the original end user purchaser that this product is free from any defects in material or workmanship for a specific period the Warranty Period from the date of purchase The Warranty Period varies by region Check with your vendor and or the authorized ZyXEL local distributor for details about the Warranty Period of this product During the warranty period and upon proof of purchase should the product have indications of failure due to faulty workmanship and or materials ZyXEL will at its discretion repair or replace the defective products or components without charge for either parts or labor and to whatever extent it shall deem necessary to restore the product or components to proper operating condition Any replacement will consist of a new or re manufactured functionally equivalent product of equal or higher value and will be solely at the discretion of ZyXEL This warranty shall not apply if the product has been modified misused tampered with damaged by an act of God or subjec
286. ely indoors e This product is for indoor use only utilisation int rieure exclusivement Your product is marked with this symbol which is known as the WEEE mark WEEE stands for Waste Electronics and Electrical Equipment It means that used electrical and electronic products should not be mixed with general waste Used electrical and electronic equipment should be treated separately INFORMAZIONI AGLI UTENTI Ai sensi dell art 13 del Decreto Legislativo 25 luglio 2005 n 151 Attuazione delle Direttive 2002 95 CE 2002 96 CE e 2003 108 CE relative alla riduzione dell uso di sostanze pericolose nelle apparecchiature elettriche ed elettroniche nonche allo smaltimento dei rifiuti simbolo del cassonetto barrato riportato sull apparecchiatura o sulla sua confezione indica che il prodotto alla fine della propria vita utile deve essere raccolto separatamente dadli altri rifiuti La raccolta differenziata della presente apparecchiatura giunta a fine vita e organizzata e gestita dal produttore L utente che vorra disfarsi della presente apparecchiatura dovra quindi contattare il produttore e seguire il sistema che questo ha adottato per consentire la raccolta separata dell apparecchiatura giunta a fine vita L adeguata raccolta differenziata per l avvio successivo dell apparecchiatura dismessa al riciclaggio al trattamento e allo smaltimento ambientalmente compatibile contribuisce ad evitare possibili effetti negativi sull ambiente e sulla sal
287. en to capture network traffic going through the NXC s interfaces Studying these packet captures may help you identify network problems Click Maintenance gt Diagnostics gt Packet Capture to open the packet capture screen Note New capture files overwrite existing files of the same name Change the File Suffix field s setting to avoid this Figure 188 Maintenance gt Diagnostics gt Packet Capture gt Capture Packet Capture Core Dump System Log Wireless Frame Capture Capture Files Interfaces Available Interfaces Capture Interfaces gel ge2 ge3 ge4 ges Filter IP Version Protocol Type Host IP Host Port Misc setting I Continuously capture and overwrite old ones 9 Save data to onboard storage only available 470 MB Captured Packet Files Split threshold Duration File Suffix MB MB 0 unlimited packet capture Number Of Bytes To Capture Per Packet 1500 The following table describes the labels in this screen Table 161 Maintenance gt Diagnostics gt Packet Capture LABEL DESCRIPTION Interfaces Enabled interfaces appear under Available I nterfaces Select interfaces for which to capture packets and click the right arrow button to move them to the Capture Interfaces list Use the Shift and or Ctrl key to select multiple objects IP Version Select the version of the Internet Protocol IP by which traffic is routed across the networks and Internet Sel
288. en you want this window to be automatically updated Refresh Now Click this to update the information in the window right away Port Selection Select the number of the physical port for which you want to display graphics Switch to Grid Click this to display the port statistics as a table View Mbps The y axis represents the speed of transmission or reception time The x axis shows the time period over which the transmission or reception occurred TX This line represents traffic transmitted from the NXC on the physical port since it was last connected RX This line represents the traffic received by the NXC on the physical port since it was last connected Last Update This field displays the date and time the information in the window was last updated NXC2500 User s Guide Chapter 5 Monitor 5 4 Interface Status This screen lists all of the NXC s interfaces and gives packet statistics for them Click Monitor gt System Status gt I nterface Status to access this screen Figure 24 Monitor gt System Status gt Interface Status Interface Summary Interface Status Status IP Addr Netmask IP Assignment Down 0 0 0 0 0 0 0 0 Static Down 0 0 0 0 0 0 0 0 Static Down 0 0 0 0 0 0 0 0 Static 1000M Full 0 0 0 0 0 0 0 0 Static Down 0 0 0 0 0 0 0 0 Static 100M Full N 0 0 0 0 0 0 0 0 Static Up 192 168 1 1 255 255 255 0 Static Name gel ge2 e3 ge4 ges ges a I 5 Interface
289. end the features of IEEE 802 11 to support extended authentication as well as providing additional accounting and control features It is supported by Windows XP and a number of network devices Some advantages of IEEE 802 1x are e User based identification that allows for roaming e Support for RADIUS Remote Authentication Dial In User Service RFC 2138 2139 for centralized user profile and accounting management on a network RADIUS server e Support for EAP Extensible Authentication Protocol RFC 2486 that allows additional authentication methods to be deployed with no changes to the access point or the wireless clients RADIUS is based on a client server model that supports authentication authorization and accounting The access point is the client and the server is the RADIUS server The RADIUS server handles the following tasks e Authentication Determines the identity of the users e Authorization Determines the network services available to authenticated users once they are connected to the network e Accounting Keeps track of the client s network activity NXC2500 User s Guide Appendix D Wireless LANs RADIUS is a simple package exchange in which your AP acts as a message relay between the wireless client and the network RADIUS server Types of RADIUS Messages The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication e Access Request
290. er 2 Encryption Method Once the identification is verified both the client and server must agree on the type of encryption method to use NXC2500 User s Guide Chapter 24 System 3 Authentication and Data Transmission After the identification is verified and data encryption activated a secure tunnel is established between the client and the server The client then sends its authentication information user name and password to the server to log in to the server 24 8 2 SSH Implementation on the NXC Your NXC supports SSH versions 1 and 2 using RSA authentication and four encryption methods AES 3DES Archfour and Blowfish The SSH server is implemented on the NXC for management using port 22 by default 24 8 3 Requirements for Using SSH You must install an SSH client program on a client computer Windows or Linux operating system that is used to connect to the NXC over SSH 24 8 4 Configuring SSH Click Configuration gt System gt SSH to change your NXC s Secure Shell settings Use this screen to specify from which zones SSH can be used to manage the NXC You can also specify from which IP addresses the access can come Note It is recommended that you disable Telnet and FTP when you configure SSH for secure connections Figure 162 Configuration gt System gt SSH SSH General Settings F Enable E Version 1 Server Port 22 Server Certificate default Service Control QO Add Y N Ra Zone A
291. er 10 Disassociate station when overloaded Each field is described in the following table Table 48 Configuration gt Wireless gt Load Balancing LABEL DESCRIPTION Enable Load Select this to enable load balancing on the NXC Balancing Mode Select a mode by which load balancing is carried out Select By Station Number to balance network traffic based on the number of specified stations connect to an AP Select By Traffic Level to balance network traffic based on the volume generated by the stations connected to an AP Once the threshold is crossed either the maximum station numbers or with network traffic then the AP delays association request and authentication request packets from any new station that attempts to make a connection This allows the station to automatically attempt to connect to another less burdened AP if one is available Max Station Enter the threshold number of stations at which an AP begins load balancing its Number connections Traffic Level Select the threshold traffic level at which the AP begins load balancing its connections low medium high Disassociate Select this option to disassociate wireless clients connected to the AP when it becomes station when overloaded If you do not enable this option then the AP simply delays the connection overloaded until it can afford the bandwidth it requires or it transfers the connection to another AP within its broadcast radius
292. er 25 Log and Report The following table describes the labels in this screen Table 151 Configuration gt Log amp Report gt Log Settings gt Edit System Log LABEL DESCRIPTION E Mail Server 1 2 Active Select this to send log messages and alerts according to the information in this section You specify what kinds of log messages are included in log information and what kinds of log messages are included in alerts in the Active Log and Alert section Mail Server Type the name or IP address of the outgoing SMTP server Mail Subject Type the subject line for the outgoing e mail Send From Type the e mail address from which the outgoing e mail is delivered This address is used in replies Send Log To Type the e mail address to which the outgoing e mail is delivered Send Alerts To Type the e mail address to which alerts are delivered Sending Log Select how often log information is e mailed Choices are When Full Hourly and When Full Daily and When Full and Weekly and When Full Day for Sending Log This field is available if the log is e mailed weekly Select the day of the week the log is e mailed Time for Sending Log This field is available if the log is e mailed weekly or daily Select the time of day hours and minutes when the log is e mailed Use 24 hour notation SMTP Authentication Select this check box if it is necessary to provide a user name and password to the
293. er key also uses more PKI storage space These radio buttons deal with how and when the certificate is to be generated Create a self signed certificate Select this to have the NXC generate the certificate and act as the Certification Authority CA itself This way you do not need to apply to a certification authority for certificates Create a certification request and save it locally for later Manual enrollment Select this to have the NXC generate and store a request for a certificate Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority Copy the certification request from the My Certificate Details screen and then send it to the certification authority NXC2500 User s Guide 247 Chapter 23 Certificates Table 123 Configuration gt Object gt Certificate gt My Certificates gt Add continued LABEL DESCRIPTION Create a certification request and enroll for a certificate immediately online Select this to have the NXC generate a request for a certificate and apply to a certification authority for a certificate You must have the certification authority s certificate already imported in the Trusted Certificates screen When you select this option you must select the certification authority s enrollment protocol and the certification authority s certificate from the drop down list boxes and enter the certi
294. er on the RADIUS server has priority Change the RADIUS server s configuration if you need to use a different re authentication timer setting The NXC is not applying an interface s configured ingress bandwidth limit At the time of writing the NXC does not support ingress bandwidth management The NXC routes and applies SNAT for traffic from some interfaces but not from others The NXC automatically uses SNAT for traffic it routes from internal interfaces to external interfaces For example LAN to WAN traffic You must manually configure a policy route to add routing and SNAT settings for an interface with the Interface Type set to General You can also configure a policy route to override the default routing and SNAT behavior for an interface with the Interface Type set to Internal or External The NXC keeps resetting the connection If an alternate gateway on the LAN has an IP address in the same subnet as the NXC s LAN IP address return traffic may not go through the NXC This is called an asymmetrical or triangle route This causes the NXC to reset the connection as the connection has not been acknowledged changed the LAN IP address and can no longer access the Internet The NXC automatically updates address objects based on an interface s IP address subnet or gateway if the interface s IP address settings change However you need to manually edit any address objects for your LAN that are not based
295. er s Guide Chapter 8 Interfaces 8 2 Ethernet Summary This screen lists every Ethernet interface To access this screen click Configuration gt Network gt Interface Unlike other types of interfaces you cannot create new Ethernet interfaces nor can you delete any of them If an Ethernet interface does not have any physical ports assigned to it it is effectively removed from the NXC even though you can still configure it Ethernet interfaces are similar to other types of interfaces in many ways They have an IP address subnet mask and gateway used to make routing decisions They restrict the amount of bandwidth and packet size They can provide DHCP services and they can verify the gateway is available Use Ethernet interfaces to control which physical ports exchange routing information with other routers and how much information is exchanged through each one The more routing information is exchanged the more efficient the routers should be However the routers also generate more network traffic and some routing protocols require a significant amount of configuration and management Figure 54 Configuration gt Network gt Interface gt Ethernet Configuration Y IP Address Mask STATIC 192 168 1 21 255 255 255 0 STATIC 0 0 0 0 0 0 0 0 STATIC 0 0 0 0 0 0 0 0 STATIC 0 0 0 0 0 0 0 0 STATIC 0 0 0 0 0 0 0 0 STATIC 0 0 0 0 0 0 0 0 Show 50 vw items Displaying 1 6 of 6 Apply 1
296. er than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted you can install a stand alone certificate file if one has been issued to you Open Firefox and click Tools gt Options Web Search Ctrl K Downloads Ctrl J Add ons Java Console Error Console Page Info Clear Private Data Ctrl Shift Del X Options In the Options dialog box click Advanced gt Encryption gt View Certificates 00 sia Main Tabs Content Feeds Privacy Security Advanced General Network Updafe Encryption Protocols Use SSL 3 0 Use TLS 1 0 Certificates When a web site requires a certificate Select one automatically 2 Ask me every time Ce Cae 2 NXC2500 User s Guide Appendix C Importing Certificates 3 In the Certificate Manager dialog box click Web Sites gt Import Certificate Manager o Your Certificates Other Peoplels Web Sites A ities You have certificates on file that identify these web sites DAR Certificate Name Purposes 4 Use the Select File dialog box to locate the certificate and then click Open Select File containing Web Site certificate to import 7 My Computer S My Documents bo My Network Places Files of type 5 The next time you visit the web site click the padlock in the address bar to open the Page I nfo gt Security window to see the
297. error 7 Certificate Error Navigation Blocked Microsoft Internet Explorer provided by ZyXEL Oo go https 192 168 1 1 x r x P 2 iS L wee File Edit View Favorites Tools Help gt Ue Favorites Certificate Error Navigation Blocked fa A mm Pager Safety Tools gt Y There is a problem with this website s security certificate The security certificate presented by this website was not issued by a trusted certificate authority The security certificate presented by this website was issued for a different website s address Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server We recommend that you close this webpage and do not continue to this website Click here to close this webpage Continue to this website not recommended More information 2 Click Continue to this website not recommended 3 Inthe Address Bar click Certificate Error gt View certificates v IS Certificate Error Y Certificate Invalid The security certificate presented by this website has errors This problem may indicate an attempt to fool you or intercept any data you send to the server We recommend that you close this webpage About certificate errors View certificates W NXC2500 User s Guide Appendix C Importing Certificates 4 In the Certificate dialog box click Install Certificate Certificate E
298. erver perform authentication The type of authentication you use depends on the RADIUS server and an intermediary AP s that supports IEEE 802 1x For EAP TLS authentication type you must first have a wired connection to the network and obtain the certificate s from a certificate authority CA A certificate also called digital IDs can be used to authenticate users and a CA issues certificates and guarantees the identity of each certificate owner NXC2500 User s Guide Appendix D Wireless LANs EAP MD5 Message Digest Algorithm 5 MD5 authentication is the simplest one way authentication method The authentication server sends a challenge to the wireless client The wireless client proves that it knows the password by encrypting the password with the challenge and sends back the information Password is not sent in plain text However MD5 authentication has some weaknesses Since the authentication server needs to get the plaintext passwords the passwords must be stored Thus someone other than the authentication server may access the password file In addition it is possible to impersonate an authentication server as MD5 authentication method does not perform mutual authentication Finally MD5 authentication method does not support data encryption with dynamic session key You must configure WEP encryption keys for data encryption EAP TLS Transport Layer Security With EAP TLS digital certifications are needed
299. ervice and service group objects that have been added to the service group The order of members is not important Select items from the Available list that you want to be members and move them to the Member list You can double click a single entry to move it or use the Shift or Ctrl key to select multiple entries and use the arrow button to move them Move any members you do not want included to the Available list OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide Chapter 19 Services NXC2500 User s Guide Schedules 20 1 Overview Use schedules to set up one time and recurring schedules for policy routes The NXC supports one time and recurring schedules One time schedules are effective only once while recurring schedules usually repeat Both types of schedules are based on the current date and time in the NXC Note Schedules are based on the NXC s current date and time 20 1 1 What You Can Do in this Chapter The Schedule screen Section 20 2 on page 222 displays a list of all schedules in the NXC The One Time Schedule Add Edit screen Section 20 2 1 on page 223 creates or edits a one time schedule The Recurring Schedule Add Edit screen Section 20 2 2 on page 224 creates or edits a recurring schedule 20 1 2 What You Need to Know The following terms and concepts may help as y
300. ervice will not work An administrator assigned a nonexistent certificate to HTTPS s is certificate name assigned by user HTTPS port has been An administrator changed the port number for HTTPS changed to port s s is port number HTTPS port has been An administrator changed the port number for HTTPS back to the default changed to default 443 port HTTP port has changed to port SS An administrator changed the port number for HTTP s is port number assigned by user HTTP port has changed to default port An administrator changed the port number for HTTP back to the default 80 SSH port has been changed to port s An administrator changed the port number for SSH s is port number assigned by user SSH port has been changed to default Ports An administrator changed the port number for SSH back to the default 22 SSH certificate s does not exist SSH service will not work An administrator assigned a nonexistent certificate to SSH s is certificate name assigned by user SSH certificate s format is wrong SSH service will not work After an administrator assigns a certificate for SSH the device needs to convert it to a key used for SSH s is certificate name assigned by user TELNET port has been changed to port s An administrator changed the port number for TELNET s is port number assigned by user
301. es or when one server supports more than one service This field is read only and displays any for Many 1 1 NAT Original Service This field is available if Port Mapping Type is Service Select the original service whose destination port s is supported by this NAT rule Mapped Service Protocol Type This field is available if Port Mapping Type is Service Select the translated service whose destination port s is supported if this NAT rule forwards the packet This field is available if Port Mapping Type is Port or Ports Select the protocol TCP UDP or Any used by the service requesting the connection Original Port This field is available if Port Mapping Type is Port Enter the original destination port this NAT rule supports Mapped Port This field is available if Port Mapping Type is Port Enter the translated destination port if this NAT rule forwards the packet Original Start Port This field is available if Port Mapping Type is Ports Enter the beginning of the range of original destination ports this NAT rule supports Original End Port This field is available if Port Mapping Type is Ports Enter the end of the range of original destination ports this NAT rule supports Mapped Start Port This field is available if Port Mapping Type is Ports Enter the beginning of the range of translated destination ports if this NAT rule forwards the packet Mapped End Port This field is av
302. es the protocol and destination port number s of the service to select which log messages you see Keyword This displays when you show the filter Type a keyword to look for in the Message Source Destination and Note fields If a match is found in any field the log message is displayed You can use up to 63 alphanumeric characters and the underscore as well as punctuation marks 4 the period double quotes and brackets are not allowed Protocol This displays when you show the filter Select a service protocol whose log messages you would like to see Search This displays when you show the filter Click this button to update the log using the current filter settings Email Log Now Click this button to send log messages to the Active e mail addresses specified in the Send Log To field on the Log Settings page Refresh Click this button to update the log table Clear Log Click this button to clear the whole log regardless of what is currently displayed on the screen This field is a sequential value and it is not associated with a specific log message Time This field displays the time the log message was recorded Priority This field displays the priority of the log message It has the same range of values as the Priority field above Category This field displays the log that generated the log message It is the same value used in the Display and other Category fields
303. ess ENTER The NXC should reply If you ve forgotten the NXC s password use the RESET button Press the button in for about 5 seconds or until the PWR LED starts to blink then release it It returns the NXC to the factory defaults password is 1234 LAN IP address 192 168 1 1 etc see your User s Guide for details If you ve forgotten the NXC s IP address you can use the commands through the console port to check it Connect your computer to the CONSOLE port using a console cable Your computer should have a terminal emulation communications program such as HyperTerminal set to VT100 terminal emulation no parity 8 data bits 1 stop bit no flow control and 115200 bps port speed NXC2500 User s Guide Chapter 31 Troubleshooting cannot access the Internet e Check the NXC s connection to the Ethernet jack with Internet access Make sure the Internet gateway device such as a DSL modem is working properly e If the NXC is operating in its default bridge mode ensure that the DHCP server to which the NXC is connected is properly configured to assign IP addresses e Check the NXC s security settings and or interface and VLAN settings to ensure you have not inadvertently excluded your client device from accessing the network or the Internet The NXC is not applying the custom policy route configured The NXC checks the policy routes in the order that they are listed So make sure that your custom policy rout
304. ess INTERFACE SUBNET vlan0 192 168 1 0 24 of 1 Show 50 items Displaying 1 lof 1 The following table describes the labels in this screen Table 104 Configuration gt Object gt Address gt Address Summary Object Reference LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Select an entry and click Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with a specific address Name This field displays the configured name of each address object Type This field displays the type of each address object INTERFACE means the object uses the settings of one of the NXC s interfaces Address This field displays the IP addresses represented by each address object If the object s settings are based on one of the NXC s interfaces the name of the interface displays first followed by the object s current address settings 18 2 1 Add Edit Address The Add Edit Address screen allows you to create a new address or edit an existing one To access this screen go to the Address screen and click either the Add icon or an Edit icon Figure 117 Configuration gt Object gt Address gt Addres
305. ess the NXC using HTTP or HTTPS You can also specify which IP addresses the access can come from Note Admin Service Control deals with management access to the Web Configurator User Service Control deals with user access to the NXC Figure 155 Configuration gt System gt WWW gt Service Control Service Control HTTPS Y Enable Server Port 443 E Authenticate Client Certificates See Trusted CAs Server Certificate default v Y Redirect HTTP to HTTPS Admin Service Control O Add 2 w N Ea Zone Address Action ALL ALL accept Page 1 of 1 Show 50 v items Displaying 1 1 of 1 User Service Control Q Add 2 N Ro Zone Address Action ALL ALL accept Page 1 of 1 Show 50 v items Displaying 1 1 of 1 HTTP Y Enable Server Port 80 Admin Service Control Add 4 w oN Ro Zone Address Action ALL ALL accept Page 1 of 1 Show 50 v items Displaying 1 1 of 1 User Service Control add w A Ro Zone Address Action ALL ALL accept Page 1 of 1 Show 50 v items Displaying 1 1 of 1 Authentication Client Authentication Method default v NXC2500 User s Guide 273 Chapter 24 System 274 The following table describes the labels in this screen Table 139 Configuration gt System gt WWW gt Service Control LABEL DESCRIPTION HTTPS Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Service Con
306. essage Source This displays the source IP address of the selected log message Destination This displays the source IP address of the selected log message Note This displays any notes associated with the selected log message NXC2500 User s Guide Registration 6 1 Overview Use the Configuration gt Licensing gt Registration screens to register your NXC and manage its service subscriptions 6 1 1 What You Can Do in this Chapter e The Registration screen Section 6 2 on page 86 registers your NXC with myZyXEL com e The Service screen Section 6 3 on page 87 displays the status of your service registrations and upgrade licenses 6 1 2 What you Need to Know This section introduces the topics covered in this chapter myZyXEL com myZyXEL com is ZyXEL s online services center where you can register your NXC and manage subscription services available for the NXC To use a subscription service you have to register the NXC and activate the corresponding service at myZyXEL com through the NXC Note You need to create a myZyXEL com account before you can register your device and activate the services at myZyXEL com You can directly create a myZyXEL com account register your NXC and activate a service using the Registration screen Alternatively go to http www myZyXEL com with the NXC s serial number and LAN MAC address to register it Refer to the web site s on line help for details Note To activate
307. evice if the process terminates abnormally crashes If you clear this option the NXC only saves Apply Click Apply to save the changes Reset Click Reset to return the screen to its last saved settings 27 4 1 Core Dump Files Click Maintenance gt Diagnostics gt Core Dump gt Files to open the core dump files screen This screen lists the core dump files stored on the NXC or a connected USB storage device You may need to send these files to customer support for troubleshooting Figure 192 Maintenance gt Diagnostics gt Core Dump gt Files Packet Capture System Log Wireless Frame Capture Settings Files Core dump files in system space A File Name Last Modified Page 1 of 1 Show 50 items No data to display Core dump files in USB storage Y Al File Name Last Modified Page 1 of 1 Show 50 v items No data to display NXC2500 User s Guide Chapter 27 Diagnostics The following table describes the labels in this screen Table 164 Maintenance gt Diagnostics gt Core Dump gt Files LABEL DESCRIPTION Remove Select files and click Remove to delete them from the NXC Use the Shift and or Ctrl key to select multiple files A pop up window asks you to confirm that you want to delete Download Click a file to select it and click Download to save it to your computer This column displays the number for each packet capture file entry The total number of pac
308. evious entry 6 if there is one gets pushed up or down one Working with Lists When a list of available entries displays next to a list of selected entries you can often just double click an entry to move it from one list to the other In some lists you can also use the Shift or Ctrl key to select multiple entries and then use the arrow button to move them to the other list Figure 15 Working with Lists oon Dom bb QU ny p o Set Scan Channel List 2 4 G Available channels Channels selected E NXC2500 User s Guide Chapter 3 The Web Configurator NXC2500 User s Guide PART II echnical Refer Dashboard 4 1 Overview Use the Dashboard screens to check status information about the NXC 4 1 1 What You Can Do in this Chapter The main Dashboard screen Section 4 2 on page 50 displays the NXC s general device information system status system resource usage licensed service status and interface status You can also display other status screens for more information The DHCP Table screen Section 4 2 4 on page 57 displays the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses The Number of Login Users screen Section 4 2 5 on page 58 displays the users currently logged into the NXC NXC2500 User s Guide Chapter 4 Dashboard 4 2 Dashboard This screen is the first thing you see when you log into th
309. f configuration file If there isn t a lastgood conf configuration file or it also has an error the NXC applies the system default conf configuration file e You can change the way the startup config conf file is applied Include the setenv startup stop on error off command The NXC ignores any errors in the startup config conf file and applies all of the valid commands The NXC still generates a log for any errors Figure 180 Maintenance gt File Manager gt Configuration File Configuration File Shell Script Configuration Files Y Bl File Name Size Last Modified 1 system default conf 7545 2013 03 10 15 29 41 2 htm default conf 20 2013 03 10 15 29 41 3 startup config conf 12008 2013 04 10 09 08 02 4 lastgood conf 12008 2013 04 10 09 08 02 5 startup config bad conf 9951 2013 04 02 16 39 31 6 400AAIGOb2 conf 7545 2012 12 21 19 44 22 Page 1 of 1 Show 50 v items Displaying 1 6 of 6 Upload Configuration File To upload a configuration file browse to the location of the file conf and then click Upload File Path Do not turn off the NXC while configuration file upload is in progress 316 NXC2500 User s Guide Chapter 26 File Manager The following table describes the labels in this screen Table 156 Maintenance gt File Manager gt Configuration File LABEL DESCRIPTION Rename Use this button to change the label of a configuration file on the NXC You can only rename manually saved configura
310. fferent APs MON Profile Create and manage rogue AP monitoring files that can be associated with different APs Address Address Create and manage host range and network subnet addresses Address Group Create and manage groups of addresses Service Service Create and manage TCP and UDP services Service Group Create and manage groups of services Schedule Create one time and recurring schedules AAA Server Active Directory Configure the default Active Directory settings LDAP Configure the default LDAP settings RADIUS Configure the default RADIUS settings Auth Method Create and manage ways of authenticating users Certificate My Certificates Create and manage the NXC s certificates Trusted Certificates Import and manage certificates from trusted sources System Host Name Configure the system and domain name for the NXC USB Storage Settings Configure the settings for the connected USB devices Date Time Configure the current date time and time zone in the NXC Console Speed Set the console speed DNS Configure the DNS server and address records for the NXC WWW Configure HTTP HTTPS and general authentication SSH Configure SSH server and SSH service settings TELNET Configure telnet server settings for the NXC FTP Configure FTP server settings SNMP Configure SNMP communities and services Auth Server Configure the NXC to act as a RADIUS server La
311. ffic it routes from internal interfaces to external interfaces for example LAN to WAN traffic Select internal to connect to a local network Other corresponding configuration options DHCP server and DHCP relay The NXC automatically adds default SNAT settings for traffic flowing from this interface to an external interface Select external to connect to an external network like the Internet If you select general the rest of the screen s options do not automatically adjust and you must manually configure a policy route to add routing and SNAT settings for the interface Interface Name Specify a name for the interface It can use alphanumeric characters hyphens and underscores and it can be up to 11 characters long Port This indicates the port that you are currently editing PVID A PVID Port VLAN ID is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines Enter the PVID for this port 1 4094 Zone Select a zone with which to associate this port MAC Address This field is read only This is the MAC address that the Ethernet interface uses Description Enter a description of this interface It is not used elsewhere You can use alphanumeric and _ characters and it can be up to 60 characters long IP Address Assignment These IP address fields configure an IP address on the interface itself If you c
312. fic since computers can query the server instead of broadcasting a request for a computer name s IP address In this way WINS is similar to DNS although WINS does not use a hierarchy unlike DNS A network can have more than one WINS server Samba can also serve as a WINS server NXC2500 User s Guide 123 Chapter 8 Interfaces NXC2500 User s Guide Policy and Static Routes 9 1 Overview Use policy routes and static routes to override the NXC s default routing behavior in order to send packets through the appropriate interface 9 1 1 What You Can Do in this Chapter e The Policy Route screens Section 9 2 on page 126 list and configure policy routes e The Static Route screens Section 9 3 on page 131 list and configure static routes 9 1 2 What You Need to Know The following terms and concepts may help as you read this chapter Policy Routing Traditionally routing is based on the destination address only and the NXC takes the shortest path to forward a packet IP Policy Routing IPPR provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator Policy based routing is applied to incoming packets on a per interface basis prior to the normal routing How You Can Use Policy Routing e Source Based Routing Network administrators can use policy based routing to direct traffic from different users through different connec
313. fication authority s server address You also need to fill in the Reference Number and Key if the certification authority requires them Enrollment Protocol CA Server Address This field applies when you select Create a certification request and enroll for a certificate immediately online Select the certification authority s enrollment protocol from the drop down list box Simple Certificate Enrollment Protocol SCEP is a TCP based enrollment protocol that was developed by VeriSign and Cisco Certificate Management Protocol CMP is a TCP based enrollment protocol that was developed by the Public Key Infrastructure X 509 working group of the Internet Engineering Task Force IETF and is specified in RFC 2510 This field applies when you select Create a certification request and enroll for a certificate immediately online Enter the IP address or URL of the certification authority server For a URL you can use up to 511 of the following characters a zA Z0 9 7 _ CA Certificate This field applies when you select Create a certification request and enroll for a certificate immediately online Select the certification authority s certificate from the CA Certificate drop down list box You must have the certification authority s certificate already imported in the Trusted Certificates screen Click Trusted CAs to go to the Trusted Certificates screen where you can view and manage the NXC s list of certificates
314. fication purposes only and may be properties of their respective owners Certifications Bon Federal Communications Commission FCC Interference Statement The device complies with Part 15 of FCC rules Operation is subject to the following two conditions e This device may not cause harmful interference e This device must accept any interference received including interference that may cause undesired operations This device has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This device generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this device does cause harmful interference to radio television reception which can be determined by turning the device off and on the user is encouraged to try to correct the interference by one or more of the following measures Reorient or relocate the receiving antenna Increase the separation between the equipment and the receiver Connect the equipment into an outlet on a circuit different from that to which the receiver is connected Consult the dealer or an experienced radio TV technician for h
315. fication request in Privacy Enhanced Mail PEM format PEM uses lowercase letters uppercase letters and Export Certificate Format numerals to convert a binary certificate into a printable form You can copy and paste a certification request into a certification authority s web page an e mail that you send to the certification authority or a text editor and save the file on a management computer for later manual enrollment You can copy and paste a certificate into an e mail to send to friends or colleagues or you can copy and paste a certificate into a text editor and save the file on a management computer for later distribution via floppy disk for example Export This button displays for a certification request Use this button to save a copy of the request without its private key Click this button and then Save in the File Download screen The Save As screen opens browse to the location that you want to use and click Save Use this button to save a copy of the certificate without its private key Click this button Only and then Save in the File Download screen The Save As screen opens browse to the location that you want to use and click Save Password If you want to export the certificate with its private key create a password and type it here Make sure you keep this password in a safe place You will need to use it if you import the certificate to another device Export Certificate with Private Key Use this butto
316. fied outgoing interface to a gateway which is connected to the interface Gateway This field displays when you select Gateway in the Type field Select a HOST address object The gateway is an immediate neighbor of your NXC that will forward the packet to the destination The gateway must be a router or switch on the same segment as your NXC s interface s Interface This field displays when you select I nterface in the Type field Select an interface to have the NXC send traffic that matches the policy route through the specified interface Auto Disable This field displays when you select Interface in the Type field Select this to have the NXC automatically disable this policy route when the next hop s connection is down DSCP Marking NXC2500 User s Guide Chapter 9 Policy and Static Routes Table 60 Configuration gt Network gt Routing gt Policy Route gt Add Edit continued LABEL DESCRIPTION DSCP Marking Set how the NXC handles the DSCP value of the outgoing packets that match this route Select one of the pre defined DSCP values to apply or select User Defined to specify another DSCP value The af choices stand for Assured Forwarding The number following the af identifies one of four classes and one of three drop preferences Select preserve to have the NXC keep the packets original DSCP value Select default to have the NXC set the DSCP value of the packets to 0
317. following configuration files or change their file names The system default conf file contains the NXC s default settings Select this file and click Apply to reset all of the NXC settings to the factory defaults This configuration file is included when you upload a firmware package The startup config conf file is the configuration file that the NXC is currently using If you make and save changes during your management session the changes are applied to this configuration file The NXC applies configuration changes made in the Web Configurator to the configuration file when you click Apply or OK It applies configuration changes made via commands when you use the write command The lastgood conf is the most recently used valid configuration file that was saved when the device last restarted If you upload and apply a configuration file with an error you can apply lastgood conf to return to a valid configuration NXC2500 User s Guide Chapter 26 File Manager Table 156 Maintenance gt File Manager gt Configuration File continued LABEL DESCRIPTION Size This column displays the size in KB of a configuration file Last Modified This column displays the date and time that the individual configuration files were last changed or saved Upload The bottom part of the screen allows you to upload a new or previously saved Configuration configuration file from your computer to your NXC File You cannot u
318. for X 509 certificates e PEM Base 64 encoded X 509 This Privacy Enhanced Mail format uses lowercase letters uppercase letters and numerals to convert a binary X 509 certificate into a printable form e Binary PKCS 7 This is a standard that defines the general syntax for data including digital signatures that may be encrypted A PKCS 7 file is used to transfer a public key certificate The private key is not included The NXC currently allows the importation of a PKS 7 file that contains a single certificate e PEM Base 64 encoded PKCS 7 This Privacy Enhanced Mail PEM format uses lowercase letters uppercase letters and numerals to convert a binary PKCS 7 certificate into a printable form NXC2500 User s Guide Chapter 23 Certificates e Binary PKCS 12 This is a format for transferring public key and private key certificates The private key in a PKCS 12 file is within a password encrypted envelope The file s password is not connected to your certificate s public or private passwords Exporting a PKCS 12 file creates this and you must provide it to decrypt the contents when you import the file into the NXC Note Be careful not to convert a binary file to text during the transfer process It is easy for this to occur since many programs use text files by default 23 1 3 Verifying a Certificate Before you import a trusted certificate into the NXC you should verify that you have the correct certificate You can do
319. g Number of This field displays the interface s total number of IP MAC bindings and IP addresses that Binding the interface has assigned by DHCP Apply Click Apply to save your changes back to the NXC 150 NXC2500 User s Guide Chapter 13 IP MAC Binding 13 2 1 Edit IP MAC Binding Click Configuration gt Network gt P MAC Binding gt Edit to open this screen Use this screen to configure an interface s IP to MAC address binding settings Figure 77 Configuration gt Network gt IP MAC Binding gt Edit Edit IP MAC Binding 21x IP MAC Binding Settings Interface Name ge 1 0 0 0 0 0 0 0 0 Enable IP MAC Binding Enable Logs for IP MAC Binding Violation Static DHCP Bindings Add m IP Address MAC Address Description Page 1 of1 Show 50 v items No data to display The following table describes the labels in this screen Table 71 Configuration gt Network gt P MAC Binding gt Edit LABEL DESCRIPTION IP MAC Binding Settings Interface This field displays the name of the interface within the NXC and the interface s IP address Name and subnet mask Enable P Select this option to have this interface enforce links between specific IP addresses and MAC Binding specific MAC addresses This stops anyone else from manually using a bound IP address on another device connected to this interface Use this to make use only the intended users get to use specific IP addresses
320. g DSCP Marking preserve v Address Translation Source Network Address Translation none NA The following table describes the labels in this screen Table 60 Configuration gt Network gt Routing gt Policy Route gt Add Edit LABEL DESCRIPTION Show Hide Click this button to display a greater or lesser number of configuration fields Advanced Settings Create new Use this to configure any new settings objects that you need to use in this screen Object Configuration Enable Select this to activate the policy Description Enter a descriptive name of up to 60 printable ASCII characters for the policy Criteria User Select a user name or user group from which the packets are sent NXC2500 User s Guide Chapter 9 Policy and Static Routes Table 60 Configuration gt Network gt Routing gt Policy Route gt Add Edit continued LABEL DESCRIPTION Incoming Select where the packets are coming from any an interface or the NXC itself EnterpriseWLAN For an interface you also need to select the individual interface Please select one This field displays only when you set Incoming to Interface Select an interface from member which the packets are sent Source Address Select a source IP address object from which the packets are sent Destination Select a destination IP address object to which the traffic is being sent Address DSCP Code Select a DSCP code point
321. g Time Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving The at field uses the 24 hour format Here are a couple of examples Daylight Saving Time starts in most parts of the United States on the second Sunday of March Each time zone in the United States starts using Daylight Saving Time at 2 A M local time So in the United States you would select Second Sunday March and type 2 in the at field Daylight Saving Time starts in the European Union on the last Sunday of March All of the time zones in the European Union start using Daylight Saving Time at the same moment 1 A M GMT or UTC So in the European Union you would select Last Sunday March The time you type in the at field depends on your time zone In Germany for instance you would type 2 because Germany s time zone is one hour ahead of GMT or UTC GMT 1 NXC2500 User s Guide Chapter 24 System Table 131 Configuration gt System gt Date Time continued LABEL DESCRIPTION End Date Configure the day and time when Daylight Saving Time ends if you selected Enable Daylight Saving The at field uses the 24 hour format Here are a couple of examples Daylight Saving Time ends in the United States on the first Sunday of November Each time zone in the United States stops using Daylight Saving Time at 2 A M local time So in the United States you would select First Sunday November and
322. g table describes the labels in this screen Table 67 Configuration gt Network gt NAT LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate This field is a sequential value and it is not associated with a specific entry Status This icon is lit when the entry is active and dimmed when the entry is inactive Name This field displays the name of the entry Mapping Type This field displays what kind of NAT this entry performs Virtual Server 1 1 NAT or Many 1 1 NAT Interface This field displays the interface on which packets for the NAT entry are received Original IP This field displays the original destination IP address or address object of traffic that matches this NAT entry It displays any if there is no restriction on the original destination IP address Mapped IP This field displays the new destination IP address for the packet Protocol This field displays the service used by the packets for this NAT entry It displays any if there is no restriction on the services Original Port This field displays the original destination
323. g the FTP server accepts commands from a system running an FTP client The service allows users to send commands to the server for uploading and downloading files NXC2500 User s Guide IP MAC Binding 13 1 Overview IP address to MAC address binding helps ensure that only the intended devices get to use privileged IP addresses The NXC uses DHCP to assign IP addresses and records to MAC address it assigned each IP address The NXC then checks incoming connection attempts against this list A user cannot manually assign another IP to his computer and use it to connect to the NXC Suppose you configure access privileges for IP address 192 168 1 27 and use static DHCP to assign it to Tim s computer s MAC address of 12 34 56 78 90 AB IP MAC binding drops traffic from any computer trying to use IP address 192 168 1 27 with another MAC address Figure 75 P MAC Binding Example MAC 12 34 56 78 90 AB IP 192 168 1 27 MAC AB CD EF 12 34 56 IP 192 168 1 27 13 1 1 What You Can Do in this Chapter The Summary and Edit screens Section 13 2 on page 150 bind IP addresses to MAC addresses e The Exempt List screen Section 13 3 on page 153 configures ranges of IP addresses to which the NXC does not apply IP MAC binding 13 1 2 What You Need to Know The following terms and concepts may help as you read this chapter DHCP P MAC address bindings are based on the NXC s dynamic and static DHCP entries NXC2500 User
324. ge 340 displays the overall source IP address conversion SNAT flow and each SNAT function s settings 28 2 The Routing Status Screen The Routing Status screen allows you to view the current routing flow and quickly link to specific routing settings Click a function box in the Routing Flow section the related routes activated will display in the Routing Table section To access this screen click Maintenance gt Packet Flow Explore The order of the routing flow may vary depending on whether you select use policy route to override direct route in the CONFIGURATION gt Network gt Routing gt Policy Route screen e use policy routes to control 1 1 NAT by using the policy control virtual server rules activate command Note Once a packet matches the criteria of a routing rule the NXC takes the corresponding action and does not perform any further flow checking NXC2500 User s Guide 337 Chapter 28 Packet Flow Explore Figure 196 Maintenance gt Packet Flow Explore gt Routing Status Direct Route nooo tt Routing Flow Routing Table Note Flags A Activated route S Static route C directly Connected G selected Gateway reject B Black hole L Loop Destination Gateway Interface Metric Flags Persist 1 127 0 0 0 8 0 0 0 0 lo 0 ACG z 2 192 168 1 0 24 0 0 0 0 avianO 0 ACG ld 4d Page i oft gt Pi Show 50 vw items Displaying 1 2 of 2 Figure 197 Maintenance gt Pac
325. gnment and interface parameters To access this screen click an Edit icon in the Ethernet screen NXC2500 User s Guide Chapter 8 Interfaces Note If you create IP address objects based on an interface s IP address subnet or gateway the NXC automatically updates every rule or setting that uses the object whenever the interface s IP address settings change For example if you change LAN s IP address the NXC automatically updates the corresponding interface based LAN subnet address object Figure 55 Configuration gt Network gt Interface gt Ethernet gt Edit general Edit Ethernet E Hide Advanced Settings General Settings Y Enable Interface Interface Properties Interface Type Interface Name Port PVID Zone MAC Address Description IP Address Assignment Get Automatically Use Fixed IP Address IP Address Subnet Mask Gateway Metric Interface Parameters Egress Bandwidth Ingress Bandwidth MTU Connectivity Check T Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Check this address DHCP Setting DHCP IP Pool Start Address Optional First DNS Server Optional Second DNS Server Optional Third DNS Server Optional First WINS Server Optional Second WINS Server Optional Default Router Optional Lease Time Extended Options E Enable IP MAC Binding 7 Enable Logs f
326. group user type Enter the password of this user account It can consist of 4 31 alphanumeric characters Retype This field is not available if you select the ext user or ext group user type Group This field is available for a ext group user type user account Identifier Specify the value of the AD or LDAP server s Group Membership Attribute that identifies the group to which this user belongs Associated This field is available for a ext group user type user account Select the AAA server to use to AAA Server authenticate this account s users Object Description Enter the description of each user if any You can use up to 60 printable ASCII characters Default descriptions are provided Authenticati If you want to set authentication timeout to a value other than the default settings select Use on Timeout Manual Settings then fill your preferred values in the fields that follow Settings Lease Time Enter the number of minutes this user has to renew the current session before the user is logged out You can specify 1 to 1440 minutes You can enter 0 to make the number of minutes unlimited Admin users renew the session every time the main screen refreshes in the Web Configurator Access users can renew the session by clicking the Renew button on their screen If you allow access users to renew time automatically the users can select this check box on their screen as well In this case the session is automatically renewed
327. gt Edit to open this screen Click the Add or Edit icon to open the following screen Use this screen to configure an interface s IP to MAC address binding settings Figure 78 Configuration gt Network gt P MAC Binding gt Edit gt Add Edit IP Address MAC Address Description Add Static DHCP Rule Interface Name 21X ge1 0 0 0 0 0 0 0 0 Optional o Jae The following table describes the labels in this screen Table 72 Configuration gt Network gt P MAC Binding gt Edit gt Add Edit LABEL DESCRIPTION Interface Name This field displays the name of the interface within the NXC and the interface s IP address and subnet mask IP Address Enter the IP address that the NXC is to assign to a device with the entry s MAC address MAC Address Enter the MAC address of the device to which the NXC assigns the entry s IP address Description Enter up to 64 printable ASCII characters to help identify the entry For example you may want to list the computer s owner OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide Chapter 13 IP MAC Binding 13 3 IP MAC Binding Exempt List Click Configuration gt Network gt IP MAC Binding gt Exempt List to open the IP MAC Binding Exempt List screen Use this screen to configure ranges of IP addresses to which the NXC does not ap
328. gure 103 Configuration gt Object gt User Group gt MAC Address MAC Authentication add 2 w MAC Address OUI MAC Type MAC Role Description 1 00 A0 05 B 1 23 45 int mac address mac users test 2 00 A0 D4 ext oui MACexample Oultest Page 1 of 1 Show 50 items Displaying 1 2 of 2 The following table describes the labels in this screen Table 92 Configuration gt Object gt User Group gt MAC Address LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so NXC2500 User s Guide Chapter 15 User Group Table 92 Config uration gt Object gt User Group gt MAC Address continued LABEL DESCRIPTION This field is a sequential value and it is not associated with a specific entry MAC Address The wireless client MAC address or OUI Organizationally Unique Identifier The OUI is the OUI first three octets in a MAC address and uniquely identifies the manufacturer of a network device MAC Type This displays whether the entry is for a MAC address or an OUI ext mac address is a MAC address authenticated by an external server int mac address is a MAC address authenticated by the NXC s local user database ext oui is an OUI aut
329. h field is described in the following table Table 46 Configuration gt Wireless gt MON Mode Displaying 1 1 of 1 LABEL DESCRIPTION Rogue Friendly AP List Add Click this button to add an AP to the list and assign it either friendly or rogue status Edit Select an AP in the list to edit and reassign its status Remove Select an AP in the list to remove NXC2500 User s Guide Chapter 7 Wireless Table 46 Configuration gt Wireless gt MON Mode continued LABEL DESCRIPTION This field is a sequential value and it is not associated with any interface Role This field indicates whether the selected AP is a rogue ap or a friendly ap To change the AP s role click the Edit button MAC Address This field indicates the AP s radio MAC address Description This field displays the AP s description You can modify this by clicking the Edit button Rogue Friendly AP List I mporting Exporting These controls allow you to export the current list of rogue and friendly APs or import existing lists File Path Browse Enter the file name and path of the list you want to import or click the Browse Importing button to locate it Once the File Path field has been populated click I mporting to bring the list into the NXC Exporting Click this button to export the current list of either rogue APs or friendly APS 7 4 1 Add Edit Rogue Friendly List
330. hange this IP address on the interface you may also need to change a related address object for the network connected to the interface For example if you use this screen to change the IP address of your LAN interface you should also change the corresponding LAN subnet address object Get Automatically This option appears when you set the Interface Type to external or general Select this to make the interface a DHCP client and automatically get the IP address subnet mask and gateway address from a DHCP server Use Fixed IP This option appears when you set the Interface Type to external or general Select Address this if you want to specify the IP address subnet mask and gateway manually IP Address This field is enabled if you set the Interface Type to internal or you select Use Fixed IP Address Enter the IP address for this interface Subnet Mask This field is enabled if you set the Interface Type to internal or you select Use Fixed IP Address Enter the subnet mask of this interface in dot decimal notation The subnet mask indicates what part of the IP address is the same for all computers in the network NXC2500 User s Guide 107 Chapter 8 Interfaces Table 51 Configuration gt Network gt Interface gt Ethernet gt Edit continued LABEL DESCRIPTION Gateway This field is enabled if you select Use Fixed IP Address Enter the IP address of the gateway The NXC sends p
331. hannel Selection Method auto v 2 4 GHz Channel Deployment Four Channel Deployment Y FCC 1 4 7 11 ETSI 1 5 9 13 5 GHz Settings Y Enable 5 GHz DFS Aware 5 GHz Channel Selection Method Available channels 40 44 48 149 153 157 161 manual Channels selected 4 36 Apply Reset Each field is described in the following table Table 49 Configuration gt Wireless gt DCS LABEL DESCRIPTION Enable Dynamic Channel Selection DCS Time Interval Select this to turn on dynamic channel selection for the APs that the NXC manages Enter a number of minutes This regulates how often the NXC surveys the other APs within its broadcast radius If the channel on which it is currently broadcasting suddenly comes into use by another AP the NXC will then dynamically select the next available clean channel or a channel with lower interference NXC2500 User s Guide Chapter 7 Wireless Table 49 Configuration gt Wireless gt DCS continued LABEL DESCRIPTION DCS Sensitivity Level Select the AP s sensitivity level toward other channels Options are High Medium and Low Generally as long as the area in which your AP is located has minimal interference from other devices you can set the DCS Sensitivity Level to Low This means that the AP has a very broad tolerance If you are not sure about the number and location of any other devices in the region set the
332. hat you paer ccona want to send to the DHCP clients The WINS server keeps a mapping table of the FIVER computer names on your network and the IP addresses that they are currently using Lease time Specify how long each computer can use the information especially the IP address before it has to request the information again Choices are infinite select this if IP addresses never expire days hours and minutes select this to enter how long IP addresses are valid NXC2500 User s Guide Chapter 8 Interfaces Table 56 Configuration gt Network gt Interface gt VLAN gt Add Edit continued LABEL DESCRIPTION Enable IP MAC Select this option to have the NXC enforce links between specific IP addresses and Binding specific MAC addresses for this VLAN This stops anyone else from manually using a bound IP address on another device connected to this interface Use this to make use only the intended users get to use specific IP addresses Enable Logs for IP MAC Binding Select this option to have the NXC generate a log if a device connected to this VLAN attempts to use an IP address that is bound to another device s MAC address Violation Static DHCP Configure a list of static IP addresses the NXC assigns to computers connected to the Table interface Otherwise the NXC assigns an IP address dynamically using the interface s IP Pool Start Address and Pool Size Add Click this to create a new
333. hboard gt CPU Usage LABEL DESCRIPTION The y axis represents the percentage of CPU usage The x axis shows the time period over which the CPU usage occurred Refresh Interval Enter how often you want this window to be automatically updated Refresh Now Click this to update the information in the window right away NXC2500 User s Guide Chapter 4 Dashboard 4 2 2 Memory Usage Use this screen to look at a chart of the NXC s recent memory RAM usage To access this screen click Show Memory Usage in the dashboard Figure 18 Dashboard gt Memory Usage 100 Last Update 2013 01 05 12 43 43 90 80 70 60 50 40 ji 30 20 10 16 43 20 43 00 43 04 43 08 43 12 43 Refresh Interval 5 minutes Refresh Now The following table describes the labels in this screen Table 17 Dashboard gt Memory Usage LABEL DESCRIPTION The y axis represents the percentage of RAM usage The x axis shows the time period over which the RAM usage occurred Refresh Interval Enter how often you want this window to be automatically updated Refresh Now Click this to update the information in the window right away NXC2500 User s Guide Chapter 4 Dashboard 4 2 3 Session Usage Use this screen to look at a chart of the NXC s recent traffic session usage To access this screen click Show Active Sessions in the dashboard Figure 19 Dashboard
334. he 802 1x authentication sequence See Chapter 16 on page 187 and Chapter 7 on page 89 for more If the AP profile uses an SSID security profile that has the AP use an external server to authenticate wireless clients by MAC address check the SSID security profile s MAC authentication settings see Section 16 3 2 1 on page 198 Enable the AP Wireless LAN logs see Section 25 3 2 on page 302 e Check the AP log Wireless LAN logs Section 5 16 on page 83 for WTP logs WTP stands for Wireless Wireless Terminal Point and is equivalent to an AP e If you cannot solve the problem on your own before contacting Customer Support use the built in wireless frame capture tools Chapter 27 on page 325 to capture data that can be used for more granular troubleshooting procedures To use the built in wireless frame capture tool first set up a second NWA5160N nearby to act as a Monitor AP Chapter 7 on page 89 The AP status is registered as offline even though it is on e Check the network connections between the NXC and the AP to ensure they are still intact e The AP may be suffering from instability Disconnect it to turn its power off wait some time then reconnect it and see if that resolves the issue e The CAPWAP daemon may be down You can use the NXC s built in diagnostic tools and CLI console to get CAPWAP debug messages which can later be sent to customer service for analysis See Chapter 3 on page 29 for more information
335. he certificate should be saved on your computer or select Place all certificates in the following store and choose a different location Lic ii i x Certificate Store Certificate stores are system areas where certificates are kept Windows can automatically select a certificate store or you can specify a location for NXC2500 User s Guide Chapter 24 System 5 Click Finish to complete the wizard and begin the import process Certificate Import Wizard xj Completing the Certificate Import Wizard dedo successfully completed the Certificate Import wi h You have specified the Following settings Certificate Store Selected Automatically determined by t D Projects_2003 10 CPE2 cp 6 You should see the following screen when the certificate is correctly installed on your computer xi D The import was successful 24 7 6 7 Using a Certificate When Accessing the NXC To access the NXC via HTTPS 1 Enter https NXC IP Address in your browser s web address field A about blank Microsoft Internet Explorer File Edit view Favorites Tools Help l Back gt gt A A Qsearch Favorites AHistory Er S m El Ol lt Address htips 192 168 1 1 NXC2500 User s Guide Chapter 24 System 2 When Authenticate Client Certificates is selected on the NXC the following screen asks you to select a personal certificate to send to the NX
336. he connected APs ES NXC2500 User s Guide Chapter 3 The Web Configurator Table 10 Monitor Menu Screens Summary continued FOLDER OR LINK TAB FUNCTION Radio List Display information about the radios of the connected APs Station I nfo Display information about the connected stations Rogue AP Detected Display information about suspected rogue APs Device Log View Log List log entries for the NXC View AP Log Allow you to query connected APs and view log entries for them 3 3 2 3 Configuration Menu Use the configuration menu screens to configure the NXC s features Table 11 Configuration Menu Screens Summary FOLDER OR LINK TAB FUNCTION Licensing Registration Registration Register the device Service View the licensed service status and upgrade licensed services Wireless Controller Configuration Configure how the NXC handles APs that newly connect to the network AP Management Mgnt AP List Edit wireless AP information remove APs and reboot them MON Mode Rogue Friendly AP List Configure how the NXC monitors for rogue APs Load Balancing Configure load balancing for traffic moving to and from wireless clients DCS Configure dynamic wireless channel selection Network Interface Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces VLAN Create and manage VLA
337. he customized login page This corresponds to the ZyXEL logo image in the default page File Path Browse for the image file or enter the file path in the available input box then click the need Upload button to put it on the NXC Once uploaded this image file replaces the default ZyXEL logo on the login page You can use the following image file formats GIF PNG or JPG Customized Login Page This section allows you to customize the other elements on the captive portal login page Title Enter 1 64 characters for the page title Spaces are allowed This corresponds to the NXC2500 title in the default page Title Color Select a font color for the page title You can use the color palette chooser or enter a color value of your own Message Color Note Message Specify the color of the screen s text Enter a note to display below the title Use up to 1024 printable ASCII characters Spaces are allowed Background Set how the window s background looks To use a graphic select Picture and upload a graphic Specify the location and file name of the logo graphic or click Browse to locate it You can use the following image file formats GIF PNG or JPG To use a color select Color and specify the color Customized This section allows you to customize elements on the access page that appears upon Access Page successful login Title Enter 1 64 characters for the page title Spaces are al
338. he server must support CHAP and verify that the failed CHAP authentication failed this does not include cases where the server does not authentication support CHAP CHAP interface name failed Interface s connect The interface s connection will be terminated because the server did not send failed Peer not any LCP packets s interface name responding Interface s connect PAP authentication failed the server must support PAP and verify verify that failed PAP the authentication failed this does not include cases where the server does not authentication support PAP failed Interface s creat A bridge interface has no member s bridge interface name failed because has no Table 181 WLAN Logs LOG MESSAGE DESCRIPTION has failed Wlan device does not exist Wlan s is enabled The WLAN IEEE 802 11 b and or g feature has been turned on s is the slot number where the WLAN card is or can be installed Wlan s is disabled The WLAN IEEE 802 11 b and or g feature has been turned off s is the slot number where the WLAN card is or can be installed Wlan s has been The WLAN IEEE 802 11 b and or g feature s configuration has been configured changed s is the slot number where the WLAN card is or can be installed Interface s has been The configuration of the specified WLAN interface s has been changed configured Interface s has been The specified WLAN interface s has been rem
339. he zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny NXC2500 User s Guide 287 Chapter 24 System Table 142 Configuration gt System gt TELNET continued 24 10 FTP You can upload and download the NXC s firmware and configuration files using FTP To use this feature your computer must have an FTP client See Chapter 26 on page 313 for more information about firmware and configuration files 288 LABEL DESCRIPTION Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings To change your NXC s FTP settings click Configuration gt System gt FTP tab The screen appears as shown Use this screen to specify from which zones FTP can be used to access the NXC You can also specify from which IP addresses the access can come Figure 167 Configuration gt System gt FTP FTP General Settings Y Enable TLS required Server Port Server Certificate Service Control Ha Page 1 Q add 21 default y N Zone Address Action ALL ALL Accept Show 50 v items Displaying 1 1 of 1 Apply Reset The following table describes the labels
340. hen the Edit icon to open the My Certificate Edit screen You can use this screen to view in depth certificate information and change the certificate s name Figure 138 Configuration gt Object gt Certificate gt My Certificates gt Edit 2 Edit My Certificates Configuration Name Certification Path CN example example com Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm Subject Alternative Name Key Usage Basic Constraint MDS Fingerprint SHA1 Fingerprint example Self signed X 509 Certificate V3 1258090745 CN example example com CN example example com rsa pkes1 shal 2009 11 13 05 39 05 GMT 2012 11 12 05 39 05 GMT rsaEncryption 512 bits example example com DigitalSignature KeyEncipherment KeyCertSign Subject Type CA Path Length Constraint 1 77 cd 59 cd 35 22 9a 57 8e c4 b9 1b 1c b2 e8 3b a5 f3 d4 f0 b2 8d 53 b1 45 41 9e Ff 74 82 1e e7 37 a0 b0 e3 Certificate in PEM Base 64 Encoded Format BEGIN X509 CERTIFICATE A MIUBdICCASCaAWIBAGIESy2w TANBakghkiGowOBAQUFADAeMRwwGgYDVQQDDBNI eGFtcGxiQG4 YW wbGUuY29tMB4XD TASMTExMzA1 MzkwNVoXxDTEyMTEXMjA 1 Mzkw NVowHjEcMBoGA1UEAwwTZxhhbXBsZUBleGFtcGxlLmNvbTBcMA0GCS5qGSIb3DQEB y Export Certificate Only Password Export Certificate with Private Key NXC2500 User s Guide Chapter 23 Certificates The following table describes the la
341. henticated by an external server int oui is an OUI authenticated by the NXC s local user database MAC Role The MAC address user account to which the NXC maps the entry s MAC address or OUI Description This field displays the description for each mapping 15 5 1 Add Edit MAC Address Use the MAC Address Add Edit screen to map a wireless client s MAC address or OUI to a MAC role MAC address user account Figure 104 Configuration gt Object gt User Group gt MAC Address gt Add MAC Address OU MAC Role Save itinto Description Add MAC Auth Address 21x I Sere J mac users v local DataBase mmm The following table describes the labels in this screen Table 93 Config uration gt Object gt User Group gt MAC Address gt Add Edit LABEL DESCRIPTION MAC Address Specify the wireless client s MAC address or OUI Organizationally Unique Identifier The OUI OUI is the first three octets in a MAC address and uniquely identifies the manufacturer of a network device MAC Role Select one of the MAC address user accounts that you have configured to which to map this entry s MAC address or OUI Save it into Local Select this option to save the mapping settings into the NXC s local user database and to Database have the NXC authenticate the MAC address or OUI using the local user database Description Enter the description of the mapping if any OK Click OK
342. her device connected to this interface Use this to make use only the intended users get to use specific IP addresses Select this option to have the NXC generate a log if a device connected to this interface attempts to use an IP address that is bound to another device s MAC address Violation Static DHCP Configure a list of static IP addresses the NXC assigns to computers connected to the Table interface Otherwise the NXC assigns an IP address dynamically using the interface s IP Pool Start Address and Pool Size Add Click this to create a new entry Edit Select an entry and click this to be able to modify it Remove Select an entry and click this to delete it This field is a sequential value and it is not associated with a specific entry IP Address Enter the IP address to assign to a device with this entry s MAC address MAC Enter the MAC address to which to assign this entry s IP address Description Enter a description to help identify this static DHCP entry You can use alphanumeric and _ characters and it can be up to 60 characters long MAC Address Have the interface use either the factory assigned default MAC address a manually Setting specified MAC address or clone the MAC address of another device or computer Use Default MAC Select this option to have the interface use the factory assigned default MAC address Address By default the NXC uses the factory assigned
343. her interfaces and network policies NXC2500 User s Guide Chapter 1 Introduction e VLAN interfaces recognize tagged frames The NXC automatically adds or removes the tags as needed Each VLAN can only be associated with one Ethernet interface Note By default all Ethernet interfaces are placed into vlan0 allowing the NXC to function as a bridge device 1 2 2 Example Interface and Zone Configuration This section introduces the NXC s default zone member physical interfaces and the default configuration of those interfaces The following figure uses letters to denote public IP addresses or part of a private IP address Figure 1 Default Network Topology la a men ia roca a Table 2 NXC Sample Topology IP ADDRESS AND DHCP SUGGESTED USE WITH DEFAULT PORT INTERFACE ZONE SETTINGS SETTINGS P1 P6 gel ge6 LAN 192 168 1 1 DHCP server Dedicated LAN connections vlan0 enabled CONSOLE N A None None Local management e The LAN zone contains the gel ge6 interfaces physical ports P1 P6 By default all LAN interfaces are put in vlan0 The console port is not in a zone and can be directly accessed by a computer attached to it using a special console to Ethernet adapter NXC2500 User s Guide Chapter 1 Introduction 1 3 Applications These are some example applications for your NXC 1 3 1 AP Management Manage multiple separate Access Points APs from a single
344. how deep into the Web Configurator you navigate Figure 7 Title Bar PHelp ZaAbout SiteMap Object Reference GJ Console CLI The icons provide the following functions Table 6 Title Bar Web Configurator Icons LABEL DESCRIPTION Logout Click this to log out of the Web Configurator Help Click this to open the help page for the current screen NXC2500 User s Guide Chapter 3 The Web Configurator Table 6 Title Bar Web Configurator Icons continued LABEL DESCRIPTION About Click this to display basic information about the NXC Site Map Click this to see an overview of links to the Web Configurator screens Object Click this to open a screen where you can check which configuration items reference an object Reference Console Click this to open the console in which you can use the command line interface CLI See the NXC CLI Reference Guide for details CLI Click this to open a popup window that displays the CLI commands sent by the Web Configurator About Click About to display basic information about the NXC Figure 8 About Z About NXC2500 21x NXC2500 Did you check www zyxel com today Boot Module V0 9 1 Current Version V4 00 AAIG 0 Released Date 2013 02 03 18 04 28 The following table describes labels that can appear in this screen Table 7 About LABEL DESCRIPTION Boot Module This shows the version number of the software
345. iBlsss SUNN is an 19 kea A Portal aia iia 20 134 Load Balant M cra ia 20 Tag EA Channel SA ON escitas onda 20 1 36 User Aware Access DON dea 20 e UU SIM Gat aniso rere e nen rent Perret Tren rere metres at rrerree Tere Tree terre Trerer ere rrr re 21 15 SC Connoy ator IO 21 15 Sami and Stopping Me MAO cs 22 Chapter 2 Hardware Installation and Connection cccconnccccnnnnoncnanananoconananoconanananonananan cono nanarnna nana rnnnnanrrnnaananana 23 Zl Hackmeunted Instala 23 2 1 1 Rack Mounted Installation Procedure viii ARA 23 2a rron Pane scscuciciccanieicacacnus se baceunnme Lciednieeted heduepe Lancmnn enduad mavenanddeabebel Medntoer alec aeeacadoamvondia geoumiekdeubareneten 25 Fe aa LEDS i ass sntearunercsasansann E E E S a aE EAE 26 a OA INS ERE E EEE EEE 27 Chapter 3 The Web A A a iia 29 EE ct A IA ENAN II A A OEE A AIEEE A OE 29 AA iii 29 0 MEAN iaa 31 a E E a O tcananteeat hs 31 A A epeetpeeea tart etnias 38 NXC2500 User s Guide EN Table of Contents 1350 AON PND Mass ae aca aa 41 o A paar wyoes A N T N NE O E A A T 41 Part ll Technical Reterente siseses aa 47 Chapter 4 O E E E E E E E E E E E A E 49 AeA OOO AA AAA daa 49 21 hal You Camba linia arar A A 49 A eb coins isis A E TE A T E E E EE A A T E A T 50 Lal CPU USIOE narria e a a 54 12 Memo USOS A AAA 55 SES ONU daa innato it 56 tt DHCP Table sia 57 229 DS ALI USOS nod 58 Chapter 5 PROTON AP PP PEPA POE o PI RP POP O PU EA
346. ibes the labels in this screen Table 15 Dashboard LABEL DESCRIPTION Widget Settings A Use this link to re open closed widgets Widgets that are already open appear grayed out Arrow B Click this to collapse or expand a widget Refresh Time Setting C Set the interval for refreshing the information displayed in the widget Refresh Now D Click this to update the widget s information immediately Close Widget E Click this to close the widget Use Widget Settings to re open it Virtual Device Hover your cursor over a LED or connected Ethernet port to view details about the status of the NXC s LEDs and connections See Section 2 2 1 on page 26 for LED descriptions An unconnected interface appears grayed out The following labels display when you hover your cursor over a connected interface Name This field displays the name of the interface or slot Status This field displays the current status of each interface or device installed in a slot The possible values depend on what type of interface it is Inactive The Ethernet interface is disabled Down The Ethernet interface is enabled but not connected Speed Duplex The Ethernet interface is enabled and connected This field displays the port speed and duplex setting Full or Half Zone This field displays the zone to which the interface is currently assigned IP Address Mask This field displays
347. ich the web portal files are installed Logout URL Specify the logout page s URL for example http 11S server IP Address logout asp The Internet Information Server IIS is the web server on which the web portal files are installed Welcome Specify the welcome page s URL for example http 11S server IP Address welcome asp URL The Internet Information Server IIS is the web server on which the web portal files are installed Session URL Specify the session page s URL for example http IIS server IP Address session asp This page records the lease timeout reauth timeout and session timeout for a user The user can also click a logout button to log out The Internet Information Server IIS is the web server on which the web portal files are installed Error URL Specify the error page s URL for example http 11S server IP Address error asp The Internet Information Server IIS is the web server on which the web portal files are installed Download Click this to download an example web portal file for your reference Authentication Method Select an authentication method for the captive portal page You can configure the authentication method in the Configuration gt Object gt Auth Method screen Chapter 22 on page 238 This sets the default for all wireless clients interacting with the network through the captive portal page You can override this in the Auth Policy Edit screen Section 14 2 2 on page 160
348. ick Object Reference to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with a specific user User Name This field displays the user name of each user User Type This field displays the kind of account of each user These are the kinds of user account the NXC supports e admin this user can look at and change the configuration of the NXC e limited admin this user can look at the configuration of the NXC but not to change it e user this user has access to the NXC s services but cannot look at the configuration e guest this user has access to the NXC s services but cannot look at the configuration e ext user this user account is maintained in a remote server such as RADIUS or LDAP e ext group user this user account is maintained in a remote server such as RADIUS or LDAP guest manager this user can log in via the web configurator login screen and create dynamic guest accounts using the Master Manager screen that pops up e mac address an external server authenticates wireless clients based on their MAC addresses After authentication the NXC maps a wireless client to a MAC address user account MAC role User aware features control MAC address user access to specific resources Description This field displays the description for each user NXC2500 User s Guide Chapter 15 User Group 15 2 1 Add Edit User The User Add
349. ide 101 Chapter 7 Wireless Load balancing by traffic level limits the number of connections to the AP based on maximum bandwidth available If you are uncertain as to the exact number of wireless connections you will have then choose this option By setting a maximum bandwidth cap you allow any number of devices to connect as long as their total bandwidth usage does not exceed the configured bandwidth cap associated with this setting Once the cap is hit any new connections are rejected or delayed provided that there are other APs in range Imagine a coffee shop in a crowded business district that offers free wireless connectivity to its customers The coffee shop owner can t possibly know how many connections his AP will have at any given moment As such he decides to put a limit on the bandwidth that is available to his customers but not on the actual number of connections he allows This means anyone can connect to his wireless network as long as the AP has the bandwidth to spare If too many people connect and the AP hits its bandwidth cap then all new connections must basically wait for their turn or get shunted to the nearest identical AP 102 NXC2500 User s Guide Interfaces 8 1 Interface Overview Use these screens to configure the NXC s interfaces Ports are the physical ports to which you connect cables Interfaces are used within the system operationally You use them in configuring various features An inte
350. ifier it determines to which group a user belongs You can add ext group user user objects to identify groups based on these group identifier values For example you could have an attribute named memberOf with values like sales RD and management Then you could also create a ext group user user object for each group One with sales as the group identifier another for RD and a third for management OK Click OK to save the changes Cancel Click Cancel to discard the changes NXC2500 User s Guide 237 22 1 Overview Authentication Method Authentication method objects set how the NXC authenticates wireless HTTP HTTPS clients and captive portal clients Configure authentication method objects to have the NXC use the local user database and or the authentication servers and authentication server groups specified by AAA server objects By default user accounts created and stored on the NXC are authenticated locally 22 1 1 What You Can Do in this Chapter The Auth Method screens Section 22 2 on page 238 create and manage authentication method objects 22 1 2 Before You Begin Configure AAA server objects before you configure authentication method objects 22 2 Authentication Method Click Configuration gt Object gt Auth Method to display this screen Note You can create up to 16 authentication method objects Figure 135 Configuration gt Object gt Auth Method
351. iguration gt Network gt Interface gt VLAN gt Add Edit continued LABEL DESCRIPTION Ingress This is reserved for future use Bandwidth Enter the maximum amount of traffic in kilobits per second the NXC can receive from the network through the interface Allowed values are O 1048576 MTU Maximum Transmission Unit Type the maximum size of each data packet in bytes that can move through this interface If a larger packet arrives the NXC divides it into smaller fragments Allowed values are 576 1500 Usually this value is 1500 DHCP Setting DHCP Select what type of DHCP service the NXC provides to the network Choices are None the NXC does not provide any DHCP services There is already a DHCP server on the network DHCP Relay the NXC routes DHCP requests to one or more DHCP servers you specify The DHCP server s may be on another network DHCP Server the NXC assigns IP addresses and provides subnet mask gateway and DNS server information to the network The NXC is the DHCP server for the network These fields appear if the NXC is a DHCP Relay Relay Server 1 Enter the IP address of a DHCP server for the network Relay Server 2 This field is optional Enter the IP address of another DHCP server for the network These fields appear if the NXC is a DHCP Server IP Pool Start Address Enter the IP address from which the NXC begins allocating IP addresses If you want to
352. iguration Files o xecuted in Configuration mode r Shell Scripts In a configuration file or shell script use or as the first character of a command line to have the NXC treat the line as a comment Your configuration files or shell scripts can u have the NXC exit sub command mode Note exit or must follow sub com mode se exit or a command line consisting of a single to mands if it is to make the NXC exit sub command NXC2500 User s Guide Chapter 26 File Manager Line 3 in the following example exits sub command mode interface gel ip address dhcp I Lines 1 and 3 in the following example are comments and line 4 exits sub command mode 1 interface gel this interface is a DHCP client 1 Lines 1 and 2 are comments Line 5 exits sub command mode this is from Joe on 2008 04 05 interface gel ip address dhcp Errors in Configuration Files or Shell Scripts When you apply a configuration file or run a shell script the NXC processes the file line by line The NXC checks the first line and applies the line if no errors are detected Then it continues with the next line If the NXC finds an error it stops applying the configuration file or shell script and generates a log You can change the way a configuration file or shell script is applied Include setenv stop on error off in the configuration file or shell scrip
353. ing table describes the labels in this screen Table 140 Configuration gt System gt Service Control Rule gt Add Edit LABEL DESCRIPTION Create new Use this to configure any new settings objects that you need to use in this screen Object Address Object Select ALL to allow or deny any computer to communicate with the NXC using this service Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the NXC using this service Zone Select ALL to allow or prevent any NXC zones from being accessed using this service Select a predefined NXC zone on which a incoming service is allowed or denied Action Select Accept to allow the user to access the NXC from the specified computers Select Deny to block the user s access to the NXC from the specified computers OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit this screen without saving 24 7 6 HTTPS Example If you haven t changed the default HTTPS port on the NXC then in your browser enter https NXC IP Address as the web site address where NXC IP Address is the IP address or domain name of the NXC you wish to access 24 7 6 1 Internet Explorer Warning Messages When you attempt to access the NXC HTTPS server a Windows dialog box pops up asking if you trust the server certificate Click View Certificate if you want to verify that the ce
354. isplays the IP address currently assigned to a DHCP client or reserved for a specific MAC address Click the column s heading cell to sort the table entries by IP address Click the heading cell again to reverse the sort order Host Name This field displays the name used to identify this device on the network the computer name The NXC learns these from the DHCP client requests None shows here for a static DHCP entry MAC Address This field displays the MAC address to which the IP address is currently assigned or for which the IP address is reserved Click the column s heading cell to sort the table entries by MAC address Click the heading cell again to reverse the sort order Description For a static DHCP entry the host name or the description you configured shows here This field is blank for dynamic DHCP entries Reserve If this field is selected this entry is a static DHCP entry The IP address is reserved for the MAC address If this field is clear this entry is a dynamic DHCP entry The IP address is assigned to a DHCP client To create a static DHCP entry using an existing dynamic DHCP entry select this field To remove a static DHCP entry clear this field NXG2500 User s Guide 57 Chapter 4 Dashboard 4 2 5 Number of Login Users Use this screen to look at a list of the users currently logged into the NXC To access this screen click the dashboard s Number of Login Users icon
355. ited by the interface s Subnet Mask For example if the Subnet Mask is 255 255 255 0 and IP Pool Start Address is 10 10 10 10 the NXC can allocate 10 10 10 10 to 10 10 10 254 or 245 IP addresses If this field is blank the IP Pool Start Address must also be blank In this case the NXC can assign every IP address allowed by the interface s IP address and subnet mask except for the first address network address last address broadcast address and the interface s IP address First DNS Specify the IP addresses up to three DNS servers for the DHCP clients to use Use one DNS Server of the following ways to specify these IP addresses Thira DNS Custom Defined enter a static IP address erver From ISP select the DNS server that another interface received from its DHCP server EnterpriseWLAN the DHCP clients use the IP address of this interface and the NXC works as a DNS relay First WINS Type the IP address of the WINS Windows Internet Naming Service server that you o secona want to send to the DHCP clients The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using Default Router If you set this interface to DHCP Server you can either select gex IP where x is the interface number to use the interface s IP address or use another IP address as the default router This default router will become the DHCP clients default gateway To use another IP
356. ive portal page only appears once per authentication session Unless a session times out or a user closes the connection he or she generally will not see it again during the same session 1 3 4 Load Balancing With load balancing you can easily distribute wireless traffic across multiple APs to relieve strain on your network When a station becomes overloaded it can automatically delay a connection until the client associates with another network or it can alternatively disassociate idle clients or those clients with weak connections from the network 1 3 5 Dynamic Channel Selection The NXC can automatically select the radio channel upon which its APs broadcast by scanning the area around those APs and determining what channels are currently being used by other devices not connected to the network 1 3 6 User Aware Access Control Set up security policies that restrict access to sensitive information and shared resources based on the user who is trying to access it NXC2500 User s Guide Chapter 1 Introduction 1 4 Management Overview You can use the following ways to manage the NXC Web Configurator The Web Configurator allows easy NXC setup and management using an Internet browser This User s Guide provides information about the Web Configurator Command Line Interface CLI The CLI allows you to use text based commands to configure the NXC You can access it using remote management for example SSH or Telnet
357. ket Flow Explore gt Routing Status Policy Route SNAT Status Routing Flow Routing Table Q Note If you want to configure Policy Route please go to Policy Route PR Incoming Source Destination Service Source Port DSCP Code NextHopT Next Hop l 14 4 Page of1 bl Show 50 v items No data to display Figure 198 Maintenance gt Packet Flow Explore gt Routing Status 1 1 SNAT _ Routing Status Routing Flow Routing Table Note If you want to configure NAT please go to NAT NAT Rule Source Gateway ld 4 Page vi Show 50 No data to display NXC2500 User s Guide Chapter 28 Packet Flow Explore Figure 199 Maintenance gt Packet Flow Explore gt Routing Status Main Route Routing Status SNAT Status Routing Flow Routing Table q Note Flags A Activated route S Static route C directly Connected G selected Gateway reject B Black hole L Loop Destination Gateway Interface Metric Flags Persist 0 0 0 0 0 192 168 1 254 0 ASG 127 0 0 0 8 0 0 0 0 lo 0 ACG 192 168 1 0 24 0 0 0 0 aviand 0 ACG Page 1 of 1 Show 50 v items Displaying 1 3 of 3 The following table describes the labels in this screen Table 168 Maintenance gt Packet Flow Explore gt Routing Status LABEL DESCRIPTION Routing Flow This section shows you the flow of how the NXC determines where to route a packet Click a function box to display the related setti
358. ket capture files that you can save depends on the file sizes and the available flash storage space File Name This column displays the label that identifies the file Size This column displays the size in bytes of a file Last Modified This column displays the date and time that the individual files were saved 27 5 System Log Click Maintenance gt Diagnostics gt System Log to open the system log files screen This screen lists the files of system logs stored on a connected USB storage device The files are in comma separated value csv format You can download them to your computer and open them in a tool like Microsoft s Excel Figure 193 Maintenance gt Diagnostics gt System Log Diagnostics Packet Capture Core Dump System Log System Log Archives in USB Storage Y i File Name Page 1 Last Modified of 1 Show 50 vy Jjitems No data to display The following table describes the labels in this screen Table 165 Maintenance gt Diagnostics gt System Log LABEL DESCRIPTION Remove Select files and click Remove to delete them from the NXC Use the Shift and or Ctrl key to select multiple files A pop up window asks you to confirm that you want to delete Download Click a file to select it and click Download to save it to your computer This column displays the number for each file entry The total number of files that you can save depends on the file sizes and the avail
359. le Table 103 Configuration gt Object gt MON Profile gt Add Edit MON Profile continued LABEL DESCRIPTION Set Scan Channel List 2 4 GHz Move a channel from the Available channels column to the Channels selected column to have the APs using this profile scan that channel when Scan Channel Mode is set to manual These channels are limited to the 2 GHz range 802 11 b g n Set Scan Channel Move a channel from the Available channels column to the Channels selected List 5 GHz column to have the APs using this profile scan that channel when Scan Channel Mode is set to manual These channels are limited to the 5 GHz range 802 11 a n OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 17 3 Technical Reference The following section contains additional technical information about the features described in this chapter Rogue APs Rogue APs are wireless access points operating in a network s coverage area that are not under the control of the network s administrators and can open up holes in a network s security Attackers can take advantage of a rogue AP s weaker or non existent security to gain access to the network or set up their own rogue APs in order to capture information from wireless clients If a scan reveals a rogue AP you can use commercially available software to physically locate it Figure 115 Rogue
360. level domain mail myZyXEL com tw is also a FQDN where mail is the host myZyXEL is the third level domain com is the second level domain and tw is the top level domain The NXC allows you to configure address records about the NXC itself or another device This way you can keep a record of DNS names and addresses that people on your network may use frequently If the NXC receives a DNS query for an FQDN for which the NXC has an address record the NXC can send the IP address in a DNS response without having to query a DNS name server 24 6 4 PTR Record A PTR pointer record is also called a reverse record or a reverse lookup record It is a mapping of an IP address to a domain name 24 6 5 Adding an Address PTR Record Click the Add icon in the Address PTR Record table to add an address PTR record Figure 149 Configuration gt System gt DNS gt Add Address PTR Record Add Address PTR Record 21x FQDN lanssnnnnannnnrnnnnanannrnnnns IP Address 9 LABADARAAAAAAAAA AAA Note Use as a prefix in the FQDN for a wildcard domain name for example example com mm The following table describes the labels in this screen Table 135 Configuration gt System gt DNS gt Add Address PTR Record LABEL DESCRIPTION FQDN Type a Fully Qualified Domain Name FQDN of a server An FQDN starts with a host name and continues all the way up to the top level domain name For exam
361. llows you to create a new monitor mode profile or edit an existing one To access this screen click the Add button or select and existing monitor mode profile and click the Edit button Figure 114 Configuration gt Object gt MON Profile gt Add Edit MON Profile 3 Add MON Profile 21x a General Settings v Activate Profile Name Channel dwell time 100 100ms 1000ms Scan Channel Mode manual v Set Scan Channel List 2 4 GHz Available channels Channels selected t A 2 3 4 i 7 3 9 10 v Set Scan Channel List 5 GHz Available channels Channels selected 36 40 44 48 149 153 157 161 y 06 cos HE The following table describes the labels in this screen Table 103 Configuration gt Object gt MON Profile gt Add Edit MON Profile LABEL DESCRIPTION Activate Select this to activate this monitor mode profile Profile Name This field indicates the name assigned to the monitor mode profile Channel dwell time Enter the interval in milliseconds before the AP switches to another channel for monitoring Scan Channel Mode Select auto to have the AP switch to the next sequential channel once the Channel dwell time expires Select manual to set specific channels through which to cycle sequentially when the Channel dwell time expires Selecting this options makes the Scan Channel List options available NXC2500 User s Guide Chapter 17 MON Profi
362. low section The following fields are available if you click Policy Route SNAT in the SNAT Flow section This field is a sequential value and it is not associated with any entry PR This is the number of an activated policy route which uses SNAT Outgoing This is the outgoing interface that the route uses to transmit packets SNAT This is the source IP address es that the SNAT rule uses finally The following fields are available if you click 1 1 SNAT in the SNAT Flow section This field is a sequential value and it is not associated with any entry NAT Rule This is the name of an activated NAT rule which uses SNAT Source This is the original source IP address es Destination This is the original destination IP address es Outgoing This is the outgoing interface that the SNAT rule uses to transmit packets SNAT This is the source IP address es that the SNAT rule uses finally The following fields are available if you click Loopback SNAT in the SNAT Flow section This field is a sequential value and it is not associated with any entry NAT Rule This is the name of an activated NAT rule which uses SNAT and enables NAT loopback Source This is the original source IP address es any means any IP address Destination This is the original destination IP address es any means any IP address SNAT This indicates which source IP address the SNAT rule uses finally For example Outgoing Interfa
363. lowed This corresponds to the NXC2500 title in the default page Message Color Specify the color of the screen s text Note Message Enter a note to display below the title Use up to 1024 printable ASCII characters Spaces are allowed customized zip Window Set how the window s background looks Background To use a graphic select Picture and upload a graphic Specify the location and file name of the logo graphic or click Browse to locate it You can use the following image file formats GIF PNG or JPG To use a color select Color and specify the color Upload File This section appears when you select Use uploaded file It allows you to choose and upload a zipped web portal file to the NXC Download Click this to download an example web portal file for your reference File Path Browse for the web portal file or enter the file path in the available input box then click Browse the Upload button to put it on the NXC Upload Download Click Download to download the web portal file from the NXC to your computer This button is clickable only after you upload a zipped web port file to the NXC Preview Click a button to display the corresponding portal page you uploaded to the NXC The buttons are clickable only after you upload the corresponding portal pages to the NXC NXC2500 User s Guide Chapter 14 Captive Portal Table 78 Configuration gt Captive Portal gt
364. me port number with TCP and UDP If this is USER DEFINED the Port s is the IP protocol number not the port number Port s This value depends on the Protocol Please refer to RFC 1700 for further information about port numbers If the Protocol is TCP UDP or TCP UDP this is the IP port number If the Protocol is USER this is the IP protocol number e Description This is a brief explanation of the applications that use this service or the situations in which this service is used Table 195 Commonly Used Services NAME PROTOCOL PORT S DESCRIPTION AH User Defined 51 The IPSEC AH Authentication Header IPSEC_TUNNEL tunneling protocol uses this service Al M New 1CQ TCP 5190 AOL s Internet Messenger service It is also used as a listening port by ICQ AUTH TCP 113 Authentication protocol used by some servers BGP TCP 179 Border Gateway Protocol BOOTP_ CLIENT UDP 68 DHCP Client BOOTP_SERVER UDP 67 DHCP Server CU SEEME TCP 7648 A popular videoconferencing solution from White Pines Software UDP 24032 DNS TCP UDP 53 Domain Name Server a service that matches web names for example www zyxel com to IP numbers ESP User Defined 50 The IPSEC ESP Encapsulation Security IPSEC_TUNNEL Protocol tunneling protocol uses this service FINGER TCP 79 Finger is a UNIX or Internet related command that can be used to find out if a user is logged on FTP TCP 20 File Transfer Pr
365. measure the NXC contains captive portal functionality This means all web page requests can initially be redirected to a special web page that requires you to authenticate your session Once authentication is successful you can then connect to the rest of the network or Internet Typically you often find captive portal pages in public hotspots such as bookstores coffee shops and hotel rooms to name a few as soon as you attempt to open a web page the hotspot s AP reroutes your browser to a captive portal page that prompts you to log in Figure 80 Captive Portal Example WLAN KD Captive Portal Page The captive portal page only appears once per authentication session Unless a user idles out or closes the connection he or she generally will not see it again during the same session NXC2500 User s Guide 155 Chapter 14 Captive Portal 14 1 1 Captive Portal Type The NXC allows you to use either an internal captive web portal built into the NXC or external captive web portal on an external web server You can even customize the portal page s See Section 14 3 1 on page 164 and Section 14 3 2 on page 166 for portal pages details External Captive Portal http The following table shows you the differences between available web portal options Table 74 Captive Portal Options OPTION PORTAL TYPE USER DEFINED PORTAL PAGES WHERE TO CONFIGURE External Web Portal External Login L
366. met can be useful this file type can open this software What s the risk 3 Refer to steps 4 12 in the Internet Explorer procedure beginning on page 392 to complete the installation process NXC2500 User s Guide Appendix C Importing Certificates Removing a Certificate in Internet Explorer This section shows you how to remove a public key certificate in Internet Explorer 7 on Windows XP 1 Open Internet Explorer and click Tools gt Internet Options ES A e fa gt ah Page Delete Browsing History Pop up Blocker gt Phishing Filter Manage Add ons Work Offline Windows Update Full Screen F11 Menu Bar Toolbars gt Windows Messenger Diagnose Connection Problems Sun Java Console Internet Options X 2 Inthe Internet Options dialog box click Content gt Certificates Internet Options General Security Priva nections Programs Advanced Content Advisor Ratings help you control the Internet content that can be viewed on this computer Use certificates for encrypted connections and identification Certificates Clear SSL state Certificates Publishers AutoComplete AutoComplete stores previous entries on webpages and suggests matches for you Feeds provide updated content from websites that can be read in Internet Explorer and other programs NXC2500 User s Guide 397 Appendix C Importing Certificates 3 In
367. mpressed option The NXC classifies the firmware package as not being able to be decompressed and deletes it You can upload the firmware package to the NXC with the option enabled so you only need to clear the Destroy compressed files that could not be decompressed option while you download the firmware package NXC2500 User s Guide EN Chapter 26 File Manager The firmware update can take up to five minutes Do not turn off or reset the NXC while the firmware update is in progress Figure 181 Maintenance gt File Manager gt Firmware Package Configuration File Shell Script Version Boot Module v0 9 1 Current Version V4 00 AAIG 0 b3 Released Date 2013 03 11 00 45 23 Upload File To upload firmware browse to the location ofthe file bin and then click Upload The following table describes the labels in this screen Table 157 Maintenance gt File Manager gt Firmware Package LABEL DESCRIPTION Boot Module This is the version of the boot module that is currently on the NXC Current Version This is the firmware version and the date created Released Date This is the date that the version of the firmware was created File Path Type in the location of the file you want to upload in this field or click Browse to find it Browse Click Browse to find the bin file you want to upload Remember that you must decompress compressed zip files before you can upload them U
368. mpt to send a download message to the update server failed Get server respons has failed The device sent packets to the MyZyXEL com server but did not receive a response The root cause may be that the connection is abnormal Timeout for get server response zysh need to catch MyZyXEL com agent s return code this log will be shown when timeout Send update request to update server has failed The device could not send an update message to the update server Update has failed Because of lack must fields The device received an incomplete response from the update server and it caused a parsing error for the device Update server is busy now File download after Sd seconds The update server was busy so the device will wait for the specified number of seconds and send the download request to the update server again Device has latest file No need to update The device already has the latest version of the file so no update is needed Device has latest signature file no need to update The device already has the latest version of the signature file so no update is needed Connect to update server has failed The device cannot connect to the update server Wrong format for packets received The device cannot parse the response returned by the server Maybe some required fields are missing Server setting Update stop rror The device could not resolve the u
369. n Table 83 Configuration gt User Group gt User gt Add Edit A User LABEL DESCRIPTION User Name Type the user name for this user account You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive User names have to be different than user group names and some words are reserved User Type Select what type of user this is Choices are e admin this user can look at and change the configuration of the NXC e limited admin this user can look at the configuration of the NXC but not to change it e user this user has access to the NXC s services but cannot look at the configuration e guest this user has access to the NXC s services but cannot look at the configuration e ext user this user account is maintained in a remote server such as RADIUS or LDAP e ext group user this user account is maintained in a remote server such as RADIUS or LDAP e guest manager this user can log in via the web configurator login screen and create dynamic guest accounts using the Master Manager screen that pops up e mac address an external server authenticates wireless clients based on their MAC addresses After authentication the NXC maps a wireless client to a MAC address user account MAC role User aware features control MAC address user access to specific resources Password This field is not available if you select the ext user or ext
370. n Policy Summary Q Add A Y Status Priority Source Destination Schedule Authentication Description Defa any any none unnecessary n a Page 1 ofi Show 50 v items Displaying 1 10f 1 Apply Reset The following table describes the labels in this screen Table 75 Configuration gt Captive Portal LABEL DESCRIPTION Enable Captive Select this to turn on the captive portal feature Portal Once enabled all network traffic is blocked until a client authenticates with the NXC through the specifically designated captive portal page Internal Web Select this to use the login page built into the NXC Portal The login page appears whenever the web portal intercepts network traffic preventing unauthorized users from gaining access to the network NXC2500 User s Guide 157 Chapter 14 Captive Portal Table 75 Configuration gt Captive Portal continued LABEL DESCRIPTION External Web Portal Select this to use a custom login page from an external web portal instead of the one built into the NXC You can configure the look and feel of the web portal page Note lt is recommended to have the external web server on the same subnet as the login users Login URL Specify the login page s URL for example http IIS server IP Address login asp You must configure this field if you select External Web Portal The Internet Information Server IIS is the web server on wh
371. n Type Always Accept Manual WLAN Controller End AP Connect Name s Model s Model of AP is fake Model ID x MAC 02x 02x 02xS02xS02xS02x MAC 502x 02x 02x 02x302x302x Stop End the AP management service A Managed AP connected to the CAPWAP Server 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Model Name A Managed AP s model is not support by CAPWAP Server 1st 02x 6th 02x Managed AP MAC Address 7th x Managed AP s Model ID AP Disconnect Name s Reason s in State Model s MAC 02x 02x 02x 02x 02x 02x SS A Managed AP disconnected from the CAPWAP Server 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Description 8th s Managed AP Disconnect Reason 9th s Managed AP Model Name NXC2500 User s Guide Appendix A Log Descriptions Table 188 CAPWAP Server Logs LOG MESSAGE DESCRIPTION AP Add AC 502x502x 02x 02x502x 02x odel s Add an AP from un managed list to managed list 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Model Name AP Delete IAC S02x 02x 02xS02x 02x 02x odel s Delete an AP from managed list 1st 02x 6th 02x Managed AP MAC Address 7th s Managed AP Model Name Update AP Configure IAC S02x 02x S02x 02x 02x S02x odel s Send configuration to an AP in the managed list 1st 02x 6th 02x Managed AP
372. n to save a copy of the certificate with its private key Type the certificate s password and click this button Click Save in the File Download screen The Save As screen opens browse to the location that you want to use and click Save OK Click OK to save your changes back to the NXC You can only change the name Cancel Click Cancel to quit and return to the My Certificates screen 23 2 3 Import Certificates Click Configuration gt Object gt Certificate gt My Certificates gt Import to open the My Certificate I mport screen Follow the instructions in this screen to save an existing certificate to the NXC Note You can import a certificate that matches a corresponding certification request that was generated by the NXC You can also import a certificate in PKCS 12 format including the certificate s public and private keys The certificate you import replaces the corresponding request in the My Certificates screen NXC2500 User s Guide Chapter 23 Certificates You must remove any spaces in the certificate s filename before you can import it Figure 139 Configuration gt Object gt Certificate gt My Certificates gt Import lt a Import Certificates 21x Please specify the location of the certificate File to be imported The certificate file must be in one of the following formats Binary X 509 e PEM Base 64 encoded X 509 e Binary PKCS 7 e PEM Base 64 encoded PKCS 7 e Binar
373. n use a computer with terminal emulation software configured to the following parameters e VT100 terminal emulation e 115200 bps e No parity 8 data bits 1 stop bit No flow control Connect the male 9 pin end of the RS 232 console cable to the console port of the NXC Connect the female end to a serial port COM1 COM2 or other COM port of your computer NXC2500 User s Guide Chapter 2 Hardware Installation and Connection NXC2500 User s Guide The Web Configurator 3 1 Overview The NXC Web Configurator allows easy management using an Internet browser In order to use the Web Configurator you must Use Internet Explorer 7 0 and later or Firefox 1 5 and later e Allow pop up windows Enable JavaScript enabled by default Enable Java permissions enabled by default e Enable cookies The recommended screen resolution is 1024 x 768 pixels and higher 3 2 Access 1 Make sure your NXC hardware is properly connected See the Quick Start Guide 2 Browse to http 192 168 1 1 The Login screen appears 3 Enter the user name default admin and password default 1234 NXC2500 User s Guide Chapter 3 The Web Configurator 4 Click Login If you logged in using the default user name and password the Update Admin I nfo screen appears Otherwise the dashboard appears This screen appears every time you log in using the default user name and default password If you change
374. nanonnnno con nnnn cc nnnn cnn naar iaaa 223 20 22 Add Edi Schedule Recuting Rule ss 224 Chapter 21 A ASS 227 NAAA iaa 227 LL Wha rev Gan Do lila Chaplet sardina 227 21 1 2 Veet VOU Need TO KION serca tisdale iii rational gia dond 227 Cie AONO DEI DAR ais a a a 230 21 2 1 Add Edit Active Directory LDAP Server unn cia 232 LS RACIIS a Teeny entree rr yr ect rere a 235 Pko T AECI RABIA sur a a suitehan neath Sent Gute ts 236 NXC2500 User s Guide Table of Contents Chapter 22 SWEAT ATO MA a ai 238 A ao edit atinada ia 238 22 11 What vow Can Do Mihe Chaplet oi 238 Pe Ae o AP duces A T T E E E 238 222 Aulhenicanon METIDA nisinsin AEE 238 222 1 Add Auihenicaton Method aiii aaa 239 Chapter 23 a R E E E E E E ea E E E E 241 EERE E E E E A E AE nar Sata se EE AT ws E I O A EAE E OONA E TOEA ONN E es 241 231 1 Whal YOu Can Do in Mis Chas 241 231 2 What You Need To KNOWN As 241 ANEKERE AU E sad ns 243 e MN ESAS ET E N ES EA P E EEE A A AE ponlesad anda 244 232 l AGI MY RICAS cos pi A E 246 322 EU NY TENG ASS cod 249 ce MD im CECOT sin tere re rer en rrreetr err yr etree reerrrr trees frre tty 251 2d MISS NTIS sara 252 Pear Ed TUS CAMS todito 254 oe impon Tusted Cernis aca 256 23A Technical Referente is ccccolasic conic sic dadedarausurasi ahd AR O EAR SE aE 257 Chapter 24 A 259 EL IESO ed artis 259 241 1 What vou Can Do im tis Chaptal ca 259 2 FS NOME nada dl 260 ol A O 260 244 DAS RO TIME rd 261 24 4 1 Pre defined NTP Time Se
375. navigation panel to hide the navigation panel menus or drag it to resize them The following sections introduce the NXC s navigation panel menus and their screens Figure 13 Navigation Panel ZyXEL nxc2500 MONITOR Status Registration IP Address MAC Address Model Mgnt VLA Description Page E of1 P 71 Show 50 items 3 3 2 1 Dashboard The dashboard displays general device information system status system resource usage licensed service status and interface status in widgets that you can re arrange to suit your needs For details on the Dashboard s features see Chapter 4 on page 49 3 3 2 2 Monitor Menu The monitor menu screens display status and statistics information Table 10 Monitor Menu Screens Summary FOLDER OR LINK TAB FUNCTION System Status Port Statistics Display packet statistics for each physical port Interface Status Display general interface information and packet statistics Traffic Statistics Collect and display traffic statistics Session Monitor Display the status of all current sessions IP MAC Binding List the devices that have received an IP address from NXC interfaces using IP MAC binding Login Users List the users currently logged into the NXC Dynamic Guest List the dynamic guest accounts in the NXC s local database USB Storage Display details about a USB device connected to the NXC Wireless AP Information AP List Display information about t
376. nce to open a screen that shows which settings use the entry This field is a sequential value and it is not associated with a specific service group Name This field displays the name of each service group Description This field displays the description of each service group if any NXC2500 User s Guide Chapter 19 Services 19 3 1 Add Edit Service Group Rule The Add Edit Service Group Rule screen allows you to create a new service group or edit an existing one To access this screen go to the Service Group screen and click either the Add icon or an Edit icon Figure 123 Configuration gt Object gt Service gt Service Group gt Add Edit Q Add Service Group Rule 2 x Configuration Name Y Description Member List Available Member Object A Any_UDP Any_TCP AH AIM NEW_ICO AUTH BGP BOOTP_CLIENT BOOTP_SERVER v En Cancel The following table describes the labels in this screen Table 111 Configuration gt Object gt Service gt Service Group gt Add Edit LABEL DESCRIPTION Name Enter the name of the service group You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Description Enter a description of the service group if any You can use up to 60 printable ASCII characters Member List The Member list displays the names of the s
377. ndex authorization server 227 backing up configuration files 315 Base DN 230 Basic Service Set See BSS 405 Bind DN 230 234 boot module 320 BSS 405 C CA 412 and certificates 242 CA Certificate Authority see certificates Calling Station ID 200 captive portal 155 authentication 155 page 155 type 156 CEF Common Event Format 300 308 cellular status 71 Certificate Authority CA 412 see certificates Certificate Management Protocol CMP 248 Certificate Revocation List CRL 242 vs OCSP 257 certificates 241 advantages of 242 and CA 242 and FTP 288 and HTTPS 272 and SSH 285 and WWW 274 certification path 242 250 255 expired 242 factory default 242 file formats 242 fingerprints 251 256 importing 245 not used for encryption 242 revoked 242 self signed 242 247 serial number 250 255 storage space 244 253 thumbprint algorithms 243 thumbprints 243 used for authentication 242 verifying fingerprints 243 certification requests 247 248 certifications 417 notices 417 viewing 417 channel 407 interference 407 CLI 21 37 button 37 messages 37 popup window 37 Reference Guide 2 cold start 22 commands 21 sent by Web Configurator 37 Common Event Format CEF 300 308 common services 387 computer names 109 119 123 configuration information 325 330 object based 21 configuration files 313 at restart 316 backing up 315 downloading 317 329 335 downloading with FTP 288 editing 313 h
378. nding an ACK to the client DHCP server assigned Ss to s s The DHCP server feature assigned a client the IP address that it requested The DHCP client s hostname and MAC address are listed Table 186 E mail Daily Report Logs LOG MESSAGE DESCRIPTION Email Daily Report has been activated The daily e mail report function has been turned on The NXC will e mail a daily report about the selected items at the scheduled time if the required settings are configured correctly Email Daily Report has been deactivated The daily e mail report function has been turned off The NXC will not e mail daily reports Email daily report has been sent successfully Cannot resolve mail server address Ss The NXC sent a daily e mail report mail successfully The listed SMTP address configured for the daily e mail report function is incorrect Mail server authentication failed The user name or password configured for authenticating with the e mail server is incorrect Failed to send report Mail From address S sl is inconsistent with SMTP account s2 The user name and password configured for authenticating with the e mail server are correct but the listed sender e mail address does not match the listed SMTP e mail account Failed to connect to mail server SS The NXC could not connect to the SMTP e mail server s The address configured for the server
379. nect to the NXC via the console port using a terminal emulation program The DNS screen Section 24 6 on page 265 configures the DNS Domain Name System server used for mapping a domain name to its corresponding IP address and vice versa The WWW screens Section 24 7 on page 271 configure settings for HTTP or HTTPS access to the NXC and how the login and access user screens look The SSH screen Section 24 8 on page 282 configures SSH Secure SHell for securely accessing the NXC s command line interface You can specify which zones allow SSH access and from which IP address the access can come The Telnet screen Section 24 9 on page 287 configures Telnet for accessing the NXC s command line interface Specify which zones allow Telnet access and from which IP address the access can come The FTP screen Section 24 10 on page 288 specifies from which zones FTP can be used to access the NXC You can also specify from which IP addresses the access can come You can upload and download the NXC s firmware and configuration files using FTP Please also see Chapter 26 on page 313 for more information about firmware and configuration files The SNMP screen Section 24 11 on page 290 configures the device s SNMP settings including from which zones SNMP can be used to access the NXC You can also specify from which IP addresses the access can come The Auth Server screen Section 24 12 on page 292 configures the device to operate as a RADI
380. ned 1 Packet Nternet Groper is a protocol that sends out ICMP echo requests to test whether or not a remote host is reachable POP3 TCP 110 Post Office Protocol version 3 lets a client computer get e mail from a POP3 server through a temporary connection TCP IP or other PPTP TCP 1723 Point to Point Tunneling Protocol enables secure transfer of data over public networks This is the control channel PPTP_TUNNEL User Defined 47 PPTP Point to Point Tunneling Protocol GRE enables secure transfer of data over public networks This is the data channel RCMD TCP 512 Remote Command Service REAL_AUDIO TCP 7070 A streaming audio service that enables real time sound over the web REXEC TCP 514 Remote Execution Daemon RLOGIN TCP 513 Remote Login RTELNET TCP 107 Remote Telnet RTSP TCP UDP 554 The Real Time Streaming media control Protocol RTSP is a remote control for multimedia on the Internet SFTP TCP 115 Simple File Transfer Protocol NXC2500 User s Guide Appendix B Common Services Table 195 Commonly Used Services continued NAME PROTOCOL PORT S DESCRIPTION SMTP TCP 25 Simple Mail Transfer Protocol is the message exchange standard for the Internet SMTP enables you to move messages from one e mail server to another SNMP TCP UDP 161 Simple Network Management Program SNMP TRAPS TCP UDP 162 Traps for use with the SNMP RFC 1215 SQL NET TCP
381. neral Settings 4 Enable Interface Properties Interface Name lano VID 1 Zone LAN B Description Optional Member Configuration Port Name Member Tx Tagging 1 get yes no 2 ge2 yes no ge3 yes no 4 ges yes no 5 ges yes no ges yes no IP Address Assignment Get Automatically Use Fixed IP Address IP Address 192 168 1 1 The value should be a subnet mask 255 255 255 0 Gateway Optional Metric o 0 15 Related Setting Configure Policy Route Interface Parameters Egress Bandwidth 1048576 Kbps Ingress Bandwidth 1048576 Kbps MTU 1500 Bytes DHCP Setting DHCP None i Enable IP MAC Binding E Enable Logs for IP MAC Binding Violation Static DHCP Table Add IPAddress MAC Description Page 1 of 1 Show 50 items No data to display Connectivity Check Enable Connectivity Check Check Method icmp y Check Period 30 5 30 seconds Check Timeout 5 1 10 seconds Check Fail Tolerance 5 1 10 Check Default Gateway 172 23 30 254 Check this address Each field is explained in the following table Table 56 Configuration gt Network gt Interface gt VLAN gt Add Edit LABEL DESCRIPTION Show Hide Click this button to display a greater or lesser number of configuration fields Advanced Settings General Settings Enable Select this to turn this interface on Clear this to disable this interface NXC2500 User s Guide 117 Chapter 8 Interfa
382. nf Target file OK Cancel Specify a name for the duplicate configuration file Use up to 25 characters including a ZA Z0 9 amp _ 1 Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file NXC2500 User s Guide 317 Chapter 26 File Manager Table 156 Maintenance gt File Manager gt Configuration File continued LABEL DESCRIPTION Apply Use this button to have the NXC use a specific configuration file Click a configuration file s row to select it and click Apply to have the NXC use that configuration file The NXC does not have to restart in order to use a different configuration file although you will need to wait for a few minutes while the system reconfigures The following screen gives you options for what the NXC is to do if it encounters an error in the configuration file gt Apply Configuration File 2x Apply Configuration File File Name system default conf Tf applying the configuration file encounters an error Immediately stop applying the configuration file Immediately stop applying the configuration file and roll back to the previous configuration Ignore errors and finish applying the configuration file Ignore errors and finish applying the configuration file and then roll back to the previous configuration v OK Cancel Immediately stop applying the configuration file this i
383. nfiguration gt Object gt Service gt Service Service Service Group Configuration 5 Any_UDP 6 BGP 7 BOOTP_CLIENT 8 BOOTP_SERVER g CU_SEEME_TCP1 10 CU_SEEME_TCP2 11 CU_SEEME_UDP1 12 CU_SEEME_UDP2 O add 3 2 Name a Content 1 AH Protocol 51 2 AIM TCP 5190 3 AUTH TCP 113 4 Any_TCP TCP 65535 UDP 65535 TCP 179 UDP 68 UDP 67 TCP 7648 TCP 24032 UDP 7648 UDP 24032 13 DNS_TCP TCP 53 14 DNS_UDP UDP 53 15 ESP Protocol 50 16 FINGER TCP 79 17 FTP TCP 20 21 18 H323 TCP 1720 19 HTTP TCP 80 20 HTTPS TCP 443 Page 1 of 4 Displaying 1 20 of 72 NXC2500 User s Guide Chapter 19 Services The following table describes the labels in this screen Table 108 Configuration gt Object gt Service gt Service LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Select an entry and click Object Reference to open a screen that shows which settings use Reference the entry This field is a sequential value and it is not associated with a specific service Name This field displays the name of each service Content This field displays a description of each service 19 2 1 Add Edit Service Rule The Add Edit Service Rule screen allows you
384. ng information for these reports You cannot schedule data collection you have to start and stop it manually in the Traffic Statistics screen Figure 25 Monitor gt System Status gt Traffic Statistics Traffic Statistics Data Collection Y Collect Statistics since 2013 01 07 Mon 11 23 24 to 2013 01 07 Mon 11 33 58 Apply Reset Statistics Interface vlanO Sort By Service Port Refresh Flush Data Service Port Protocol Direction Amount 1 others Port 17500 UDP Ingress u 40 420 KBytes others Port 17500 UDP Egress i 40 420 KBytes others Port 1900 UDP Ingress m 23 667 KBytes others Port 1900 UDP Egress 23 667 KBytes snmp trap Port 162 UDP Ingress 18 200 KBytes snmp trap Port 162 UDP Egress 18 200 KBytes netbios ns Port 137 UDP Ingress hal 13 494 KBytes netbios ns Port 137 UDP Egress lal 13 494 KBytes others Port 21090 Ingress lel 8 184 KBytes others Port 21090 Egress 8 184 KBytes netbios dgm Port 1 Ingress 4 601 KBytes netbios das others Port 0 Egress 200 Bytes Page a of 1 Show 50 vw items Displaying 1 20 of 20 There is a limit on the number of records shown in the report See Table 25 on page 67 for more information The following table describes the labels in this screen Table 24 Monitor gt System Status gt Traffic Statistics LABEL DESCRIPTION Data Collection Collect Statistics Select this to have the NXC collec
385. ng CLI command is and what warning message is 1st s is CLI command 2nd s is warning message when apply CLI command Resetting system Before apply configuration file System resetted Now apply s After the system reset it started to apply the configuration file s is configuration file name Running s An administrator ran the listed shell script s is script file name NXC2500 User s Guide 379 Appendix A Log Descriptions Table 185 DHCP Logs LOG MESSAGE DESCRIPTION Can t find any lease for this client DHCP pool full o S All of the IP addresses in the DHCP pool are already assigned to DHCP clients so there is no IP address to give to the listed DHCP client DHCP server offered s to s s The DHCP server feature gave the listed IP address to the computer with the listed hostname and MAC address Requested s from s S The NXC received a DHCP request for the specified IP address from the computer with the listed hostname and MAC address No applicable lease found for DHCP request s DHCP released s with s S There is no matching DHCP lease for a DHCP client s request for the specified IP address A DHCP client released the specified IP address The DHCP client s hostname and MAC address are listed Sending ACK to s The DHCP server feature received a DHCP client s inform packet and is se
386. ngs in the Routing Table section Routing Table This section shows the corresponding settings according to the function box you click in the Routing Flow section The following fields are available if you click Direct Route or Main Route in the Routing Flow section H This field is a sequential value and it is not associated with any entry Destination This is the destination IP address of a route Gateway This is the IP address of the next hop gateway or the interface through which the traffic is routed Interface This is the name of an interface associated with the route Metric This is the route s priority among the displayed routes Flags This indicates additional information for the route The possible flags are e A this route is currently activated e this is a static route e C this is a direct connected route e O this is a dynamic route learned through OSPF e R this is a dynamic route learned through RIP e G the route is to a gateway router in the same network e this is a route which forces a route lookup to fail e B this is a route which discards packets e L this is a recursive route Persist This is the remaining time of a dynamically learned route The NXC removes the route after this time period is counted down to zero The following fields are available if you click Policy Route in the Routing Flow section This field is a sequential value and it is not associ
387. nguage Select the Web Configurator language Log amp Report Email Daily Report Configure where and how to send daily reports and what reports to send Log Settings Configure the system log e mail logs and remote syslog servers NXC2500 User s Guide Chapter 3 The Web Configurator 3 3 2 4 Maintenance Menu Use the maintenance menu screens to manage configuration and firmware files run diagnostics and reboot or shut down the NXC Table 12 Maintenance Menu Screens Summary FOLDER OR LINK TAB FUNCTION File Manager Configuration File Manage and upload configuration files for the NXC Firmware Package View the current firmware version and to upload firmware Shell Script Manage and run shell script files for the NXC Diagnostics Diagnostic Collect diagnostic information Packet Capture Capture packets for analysis Core Dump Connect a USB device to the NXC and save the NXC operating system kernel to it here System Log Connect a USB device to the NXC and archive the NXC system logs to it here Wireless Frame Capture wireless frames from APs for analysis Capture Packet Flow Routing Status Check how the NXC determines where to route a packet Explore SNAT Status View a clear picture on how the NXC converts a packet s source IP address and check the related settings Reboot Restart the NXC Shutdown Turn off the NXC 3 3 3 Warning Message
388. nnels This text box lists the channels that are available in the 5 GHz band Select the channels that you want the AP to use and click the right arrow button to add them NXC2500 User s Guide Chapter 7 Wireless Table 49 Configuration gt Wireless gt DCS continued LABEL DESCRIPTION Channels This text box lists the channels that you allow the AP to use Select any channels that selected you want to prevent the AP from using it and click the left arrow button to remove them Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 7 7 Technical Reference The following section contains additional technical information about the features described in this chapter 7 7 1 Dynamic Channel Selection When numerous APs broadcast within a given area they introduce the possibility of heightened radio interference especially if some or all of them are broadcasting on the same radio channel If the interference becomes too great then the network administrator must open his AP configuration options and manually change the channel to one that no other AP is using or at least a channel that has a lower level of interference in order to give the connected stations a minimum degree of interference Dynamic channel selection frees the network administrator from this task by letting the AP do it automatically The AP can scan the area around
389. not overlap though it is possible for this to happen with DHCP clients In the example above if the NXC gets a packet with a destination address of 5 5 5 5 it might not find any entries in the routing table In this case the packet is dropped However if there is a default router to which the NXC should send this packet you can specify it as a gateway in one of the interfaces For example if there is a default router at 200 200 200 100 you can create a gateway at 200 200 200 100 on ge2 In this case the NXC creates the following entry in the routing table Table 57 Example Routing Table Entry for a Gateway IP ADDRESS ES DESTINATION 0 0 0 0 0 200 200 200 100 The gateway is an optional setting for each interface If there is more than one gateway the NXC uses the gateway with the lowest metric or cost If two or more gateways have the same metric the NXC uses the one that was set up first the first entry in the routing table If the interface gets its IP address and subnet mask from a DHCP server the DHCP server also specifies the gateway if any Interface Parameters The NXC restricts the amount of traffic into and out of the NXC through each interface e Egress bandwidth sets the amount of traffic the NXC sends out through the interface to the network e Ingress bandwidth sets the amount of traffic the NXC allows in through the interface from the network 1 If you set the bandwidth restrictions very high
390. ns Select 20 MHz if you want to lessen radio interference with other wireless devices in your neighborhood Guard Interval Set the guard interval for this radio profile to either short or long The guard interval is the gap introduced between data transmission from users in order to reduce interference Reducing the interval increases data transfer rates but also increases interference Increasing the interval reduces data transfer rates but also reduces interference Enable A MPDU Aggregation Select this to enable A MPDU aggregation Message Protocol Data Unit MPDU aggregation collects Ethernet frames along with their 802 11n headers and wraps them in a 802 11n MAC header This method is useful for increasing bandwidth throughput in environments that are prone to high error rates A MPDU Limit Enter the maximum frame size to be aggregated NXC2500 User s Guide Chapter 16 AP Profile Table 95 Configuration gt Object gt AP Profile gt Add Edit Radio Profile continued LABEL DESCRIPTION A MPDU Enter the maximum number of frames to be aggregated each time Subframe Enable A MSDU Aggregation Select this to enable A MSDU aggregation Mac Service Data Unit MSDU aggregation collects Ethernet frames without any of their 802 11n headers and wraps the header less payload in a single 802 11n MAC header This method is useful for increasing bandwidth throughput It is also more effi
391. nse before the attempt is a failure and how many consecutive failures are required before the NXC stops routing to the gateway The NXC resumes routing to the gateway the first time the gateway passes the connectivity check Enable Connectivity Check Select this to turn on the connection check Check Method Select the method that the gateway allows Select icmp to have the NXC regularly ping the gateway you specify to make sure it is still available Select tcp to have the NXC regularly perform a TCP handshake with the gateway you specify to make sure it is still available Check Period Enter the number of seconds between connection check attempts Check Timeout Enter the number of seconds to wait for a response before the attempt is a failure Check Fail Tolerance Enter the number of consecutive failures before the NXC stops routing through the gateway Check Default Select this to use the default gateway for the connectivity check Gateway Check this Select this to specify a domain name or IP address for the connectivity check Enter address that domain name or IP address in the field next to it Check Port This field only displays when you set the Check Method to tcp Specify the port number to use for a TCP connectivity check DHCP Setting These fields appear when you set the Interface Type to Internal or General NXC2500 User s Guide Chapter 8 Interfaces
392. nsion Slot This field displays the name of each extension slot Device This field displays the name of the device connected to the extension slot or none if no device is detected Status Ready A USB storage device connected to the NXC is ready for the NXC to use none The NXC is unable to mount a USB storage device connected to the NXC Top 5 Station Displays the top 5 Access Points AP with the highest number of station aka wireless client connections This field displays the rank of the station AP MAC This field displays the MAC address of the AP to which the station belongs NXC2500 User s Guide Chapter 4 Dashboard Table 15 Dashboard continued LABEL DESCRIPTION Max Station This field displays the maximum number of wireless clients that have connected to this Count AP AP Description This field displays the AP s description The default description is AP followed by the AP s MAC address 4 2 1 CPU Usage Use this screen to look at a chart of the NXC s recent CPU usage To access this screen click Show CPU Usage in the dashboard Figure 17 Dashboard gt CPU Usage 100 90 80 70 60 50 40 30 20 10 16 41 Refresh Interval 5 minutes Refresh Now Last Update 2013 01 05 12 41 06 20 41 00 41 04 41 08 41 12 41 The following table describes the labels in this screen Table 16 Das
393. nsole 1 Click the Console button on the Web Configurator title bar Help Z About Site Map AObject Reference J Conso Show tonsole Window NXC2500 User s Guide Chapter 3 The Web Configurator 2 Enter the IP address of the NXC and click OK Wiese lipo er Ne ok ann 4 You may be prompted to authenticate your account password depending on the type of device that you are logging into Enter the password and click OK ES NXC2500 User s Guide Chapter 3 The Web Configurator 5 If your login is successful the command line appears and the status bar at the bottom of the Console updates to reflect your connection state P Welcome to Console Mozilla Firefox Ai yen ameb guages deh board cone tied CLI Messages Click CLI to look at the CLI commands sent by the Web Configurator These commands appear in a popup window such as the following Figure 12 CLI Messages E Baa alix Pf Clear CLI start 0 show capwap station all CLI End 0 show rogue ap detection monitoring 22 CLI End Click Clear to remove the currently displayed information See the Command Reference Guide for information about the commands NXC2500 User s Guide Chapter 3 The Web Configurator 3 3 2 Navigation Panel Use the menu items on the navigation panel to open screens to configure NXC features Click the arrow in the middle of the right edge of the
394. nterface Status This icon is lit when the entry is active and dimmed when the entry is inactive Name This field displays the name of the interface NXC2500 User s Guide Chapter 8 Interfaces Table 55 Configuration gt Network gt Interface gt VLAN continued LABEL DESCRIPTION IP Address This field displays the current IP address of the interface If the IP address is 0 0 0 0 the interface does not have an IP address yet This screen also shows whether the IP address is a static IP address STATIC or dynamically assigned DHCP IP addresses are always static in virtual interfaces VID This field displays the VLAN ID number Member This field displays the Ethernet interface s that is a member of this VLAN Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 8 3 2 Add Edit VLAN This screen lets you configure IP address assignment interface bandwidth parameters DHCP settings and connectivity check for each VLAN interface To access this screen click the Add icon at the top of the Add column or click an Edit icon next to a VLAN interface in the VLAN Summary screen The following screen appears NXC2500 User s Guide Chapter 8 Interfaces Figure 61 Configuration gt Network gt Interface gt VLAN gt Add Edit Q Edit Vian viano 21x Hide Advanced Settings Ge
395. ntermediate rate steps between the maximum and minimum data rates The IEEE 802 11g data rate and modulation are as follows Table 196 IEEE 802 119 DATA RATE MBPS MODULATION 1 DBPSK Differential Binary Phase Shift Keyed 2 DQPSK Differential Quadrature Phase Shift Keying 5 5 11 CCK Complementary Code Keying 6 9 12 18 24 36 48 54 OFDM Orthogonal Frequency Division Multiplexing Wireless Security Overview Wireless security is vital to your network to protect wireless communication between wireless clients access points and the wired network NXC2500 User s Guide Appendix D Wireless LANs Wireless security methods available on the NXC are data encryption wireless client authentication restricting access by device MAC address and hiding the NXC identity The following figure shows the relative effectiveness of these wireless security methods available on your NXC Table 197 Wireless Security Levels SECURITY LEVEL SECURITY TYPE Least Unique SSID Default Secure Unique SSID with Hide SSID Enabled MAC Address Filtering WEP Encryption 1EEE802 1x EAP with RADIUS Server Authentication Wi Fi Protected Access WPA WPA2 Most Secure Note You must enable the same wireless security settings on the NXC and on all wireless clients that you want to associate with it IEEE 802 1x RADIUS In June 2001 the IEEE 802 1x standard was designed to ext
396. ntication server AES Advanced Encryption Standard is a block cipher that uses a 256 bit mathematical algorithm NXC2500 User s Guide Appendix D Wireless LANs called Rijndael They both include a per packet key mixing function a Message Integrity Check MIC named Michael an extended initialization vector IV with sequencing rules and a re keying mechanism WPA and WPA2 regularly change and rotate the encryption keys so that the same encryption key is never used twice The RADIUS server distributes a Pairwise Master Key PMK key to the AP that then sets up a key hierarchy and management system using the PMK to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients This all happens in the background automatically The Message Integrity Check MIC is designed to prevent an attacker from capturing data packets altering them and resending them The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC If they do not match it is assumed that the data has been tampered with and the packet is dropped By generating unique data encryption keys for every data packet and by creating an integrity checking mechanism MIC with TKIP and AES it is more difficult to decrypt data on a Wi Fi network than WEP and difficult for an intruder to break into the network The enc
397. ntly logged in 52 58 default lease time 178 180 default reauthentication time 178 181 default type for Ext User 170 ext group user type 170 Ext User type 170 ext user type 170 groups see user groups guest type 170 guest manager type 170 lease time 174 limited admin type 169 lockout 179 mac address type 170 171 reauthentication time 174 types of 169 user type 170 user names 173 V Vantage Report VRPT 300 308 virtual interfaces not DHCP clients 121 Virtual Local Area Network see VLAN VLAN 113 advantages 114 and MAC address 114 ID 114 VLAN interfaces 103 VRPT Vantage Report 300 308 W warm start 22 warning message popup 41 warranty 417 note 417 Web Configurator 21 29 access 29 access users 182 requirements 29 supported browsers 29 WEP Wired Equivalent Privacy 188 Wi Fi Protected Access 188 413 Windows Internet Naming Service see WINS Windows Internet Naming Service see WINS WINS 109 119 123 WINS server 109 wireless client WPA supplicants 414 wireless security 409 WLAN interference 407 security parameters 416 WPA 188 413 key caching 414 pre authentication 414 user authentication 414 vs WPA PSK 414 wireless client supplicant 414 with RADIUS application example 415 WPA2 188 413 user authentication 414 vs WPA2 PSK 414 wireless client supplicant 414 with RADIUS application example 415 WPA2 Pre Shared Key WPA2 PSK 413 WPA2 PSK 413 414 application
398. ntroller addresses option The Control And Provisioning of Wireless Access Points Protocol allows a Wireless Termination Point WTP to use DHCP to discover the Access Controllers to which it is to connect This option carries a list of Pv4 addresses indicating one or more CAPWAP ACs available to the WTP TFTP Server 150 The option contains one or more Pv4 addresses that the client may use The current use of this option is for downloading configuration from a VolP server via TFTP however the option may be used for purposes other than contacting a VolP configuration server 8 3 VLAN Interfaces A Virtual Local Area Network VLAN divides a physical network into multiple logical networks The standard is defined in IEEE 802 1q NXC2500 User s Guide Chapter 8 Interfaces Note By default the NXC acts a bridge device This means all interfaces gel g6 are grouped together into a single VID vlan0 Also note that vlan0 cannot be removed and the VID cannot be changed Figure 58 Example Before VLAN In this example there are two physical networks and three departments A B and C The physical networks are connected to hubs and the hubs are connected to the router Alternatively you can divide the physical networks into three VLANs Figure 59 Example After VLAN VLAN ID 1 VLAN ID 2 e e e e e e e e el Each VLAN is a separate network with separate IP addresses subnet masks and gateways
399. number Register H 323 ALG extra port d failed H323 ALG apply additional signal port failed d Port number Register H 323 ALG signal port d failed H323 ALG apply signal port failed d Port number Register FTP ALG extra port d failed FTP ALG apply additional signal port failed d Port number Register FTP ALG signal port d failed FTP ALG apply signal port failed d Port number Table 179 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION 1 Algorithm mismatch between the certificate and the search constraints 2 Key usage mismatch between the certificate and the search constraints 3 Certificate was not valid in the time interval 4 Not used 5 Certificate is not valid 6 Certificate signature was not verified correctly 7 Certificate was revoked by a CRL 8 Certificate was not added to the cache 9 Certificate decoding failed 10 Certificate was not found anywhere 11 Certificate chain looped did not find trusted root 12 Certificate contains critical extension that was not handled 13 Certificate issuer was not valid CA specific information missing 14 Not used NXC2500 User s Guide 375 Appendix A Log Descriptions 376 Table 179 Certificate Path Verification Failure Reason Codes continued Table 180 Interface Logs CODE DE
400. number of seconds to wait for a response before the attempt is a failure Check Fail Enter the number of consecutive failures before the NXC stops routing through the Tolerance gateway Check Default Select this to use the default gateway for the connectivity check Gateway Check this Select this to specify a domain name or IP address for the connectivity check Enter address that domain name or IP address in the field next to it Check Port This field only displays when you set the Check Method to tcp Specify the port number to use for a TCP connectivity check OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide Chapter 8 Interfaces 8 4 Technical Reference The following section contains additional technical information about the features described in this chapter IP Address Assignment Most interfaces have an IP address and a subnet mask This information is used to create an entry in the routing table In most interfaces you can enter the IP address and subnet mask manually In many interfaces you can also let the IP address and subnet mask be assigned by an external DHCP server on the network In this case the interface is a DHCP client Virtual interfaces however cannot be DHCP clients You have to assign the IP address and subnet mask manually In general the IP address and subnet mask of each interface should
401. o configure your SNMP settings including from which zones SNMP can be used to access the NXC You can also specify from which IP addresses the access can come Figure 169 Configuration gt System gt SNMP General Settings Y Enable Server Port 161 Get Community public Set Community private Trap Community Optional Destination Optional E Trap CAPWAP Event Service Control Add Address Action ALL Accept Show 50 items Displaying 1 1 of 1 NXC2500 User s Guide EM Chapter 24 System 24 12 The following table describes the labels in this screen Table 145 Configuration gt System gt SNMP LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address es in the Service Control table to access the NXC using this service Server Port You may change the server port number for a service if needed however you must use the same port number in order to use that service for remote management Get Community Enter the Get Community which is the password for the incoming Get and GetNext requests from the management station The default is public and allows all requests Set Community Enter the Set community which is the password for incoming Set requests from the management station The default is private and allows all requests Trap Community Type the trap community which is the passw
402. o not use the write command the changes will be lost when the NXC restarts You could use multiple write commands in a long script Figure 185 Maintenance gt File Manager gt Shell Script Configuration File Firmware Package Shell Scripts L File Name i Last Modified Page 1 of 1 Show 50 items No data to display Upload Shell Script To upload a shell script browse to the location of the file zysh and then click Upload File Path NXC2500 User s Guide Chapter 26 File Manager Each field is described in the following table Table 158 Maintenance gt File Manager gt Shell Script LABEL DESCRIPTION Rename Use this button to change the label of a shell script file on the NXC You cannot rename a shell script to the name of another shell script in the NXC Click a shell script s row to select it and click Rename to open the Rename File screen 1 Rename 2 x Source file wiz VPN 2 zysh Target file OK Cancel Specify the new name for the shell script file Use up to 25 characters including a zA Z0 9 amp _ 1 Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file Remove Click a shell script file s row to select it and click Delete to delete the shell script file from the NXC A pop up window asks you to confirm that you want to delete the shell script file Click O
403. o show to which devices it has assigned an IP address This is the index number of an IP MAC binding entry IP Address This is the IP address that the NXC assigned to a device Host Name This field displays the name used to identify this device on the network the computer name The NXC learns these from the DHCP client requests MAC Address This field displays the MAC address to which the IP address is currently assigned Last Access This is when the device last established a session with the NXC through this interface Description This field displays the descriptive name that helps identify the entry Refresh Click this button to update the information in the screen NXC2500 User s Guide KN Chapter 5 Monitor 5 8 Login Users Use this screen to look at a list of the users currently logged into the NXC To access this screen click Monitor gt System Status gt Login Users Figure 28 Monitor gt System Status gt Login Users Current User List User ID Reauth Lease T Type IP Address User info a 1 admin unlimited 00 30 00 http https 192 168 1 33 admin admin Page 1 of 1 Show 50 items Displaying 1 1 of 1 The following table describes the labels in this screen Table 28 Monitor gt System Status gt Login Users LABEL DESCRIPTION Force Logout Select a user ID and click this icon to end a user s session This field is a sequential value and is not associated
404. ociated with the SSID profile NXC2500 User s Guide Chapter 16 AP Profile 16 3 1 1 Add Edit SSID Profile This screen allows you to create a new SSID profile or edit an existing one To access this screen click the Add button or select an SSID profile from the list and click the Edit button Figure 108 Configuration gt Object gt AP Profile gt Add Edit SSID Profile Q Add SSID Profile 45 Create new Object y Profile Name SSID Security Profile MAC Filtering Profile Qos VLAN ID Hidden SSID Enable Intra BSS Traffic blocking 2 X la a ZyXEL default v disable v WMM y 1 1 4094 r canc The following table describes the labels in this screen Table 97 Configuration gt Object gt AP Profile gt Add Edit SSID Profile LABEL DESCRIPTION Create new Select an object type from the list to create a new one associated with this SSID profile Object Profile Name Enter up to 31 alphanumeric characters for the profile name This name is only visible in the Web Configurator and is only for management purposes Spaces and underscores are allowed SSID Enter the SSID name for this profile This is the name visible on the network to wireless clients Enter up to 32 characters spaces and underscores are allowed Security Profile Select a security profile from this list to associate with this SSID If none exist you can use the Create new Object
405. of the outgoing SMTP server NXC2500 User s Guide Chapter 25 Log and Report Table 149 Configuration gt Log Report gt Email Daily Report continued LABEL DESCRIPTION Mail Subject Type the subject line for the outgoing e mail Select Append system name to add the NXC s system name to the subject Select Append date time to add the NXC s system date and time to the subject Mail From Type the e mail address from which the outgoing e mail is delivered This address is used in replies Mail To Type the e mail address or addresses to which the outgoing e mail is delivered SMTP Select this check box if it is necessary to provide a user name and password to the SMTP Authentication server User Name This box is effective when you select the SMTP Authentication check box Type the user name to provide to the SMTP server when the log is e mailed Password This box is effective when you select the SMTP Authentication check box Type the password to provide to the SMTP server when the log is e mailed Retype to Retype your new password for confirmation Confirm Send Report Click this button to have the NXC send the daily e mail report immediately Now Time for Select the time of day hours and minutes when the log is e mailed Use 24 hour notation sending report Report Items Select the information to include in the report Select Reset counters after sending repor
406. ogout Welcome Session Captive Portal gt Captive Error Portal Default Login Page Internal N A Customized Login Internal Login Access Captive Portal gt Login Page Page Uploaded Web Portal Internal Login Logout Welcome Session File Error 14 1 2 What You Can Do in this Chapter The Captive Portal screen Section 14 2 on page 157 configures which HTTP based network services default to the captive portal page when a client makes an initial network connection The Login Page screen Section 14 3 on page 162 assigns a default login page or create a customized one NXC2500 User s Guide Chapter 14 Captive Portal 14 2 Captive Portal This screen allows you to configure which HTTP based network services default to the captive portal page when client makes an initial network connection Click Configuration gt Captive Portal to access this screen Note You can configure the look and feel of the captive portal web page on the Login Page screen see Section 14 3 on page 162 for details Figure 81 Configuration gt Captive Portal Login Page General Settings E Enable Captive Portal Internal Web Portal External Login URL out URL Welcome URL Session URL Optional Error URL Optional Download the external web portal example Authentication Method default Exceptional Services Qadd E Exceptional Services Page 1 of 1 Show 50 w items No data to display Authenticatio
407. ogram a program to enable fast transfer of files including large files TCP 21 that may not be possible by e mail H 323 TCP 1720 NetMeeting uses this protocol NXC2500 User s Guide 387 Appendix B Common Services 388 Table 195 Commonly Used Services continued NAME PROTOCOL PORT S DESCRIPTION HTTP TCP 80 Hyper Text Transfer Protocol a client server protocol for the world wide web HTTPS TCP 443 HTTPS is a secured http session often used in e commerce CMP User Defined 1 Internet Control Message Protocol is often used for diagnostic or routing purposes ICQ UDP 4000 This is a popular Internet chat program IGMP MULTICAST User Defined 2 Internet Group Management Protocol is used when sending packets to a specific group of hosts IKE UDP 500 The Internet Key Exchange algorithm is used for key distribution and management IRC TCP UDP 6667 This is another popular Internet chat program MSN Messenger TCP 1863 Microsoft Networks messenger service uses this protocol NEW 1CQ TCP 5190 An Internet chat program NEWS TCP 144 A protocol for news groups NFS UDP 2049 Network File System NFS is a client server distributed file service that provides transparent file sharing for network environments NNTP TCP 119 Network News Transport Protocol is the delivery mechanism for the USENET newsgroup service PING User Defi
408. ones 10 1 Overview Set up zones to configure network security and network policies in the NXC A zone is a group of interfaces The NXC uses zones instead of interfaces in many security and policy settings Zones cannot overlap Each interface can be assigned to just one zone 10 1 1 What You Can Do in this Chapter The Zone screens see Section 10 2 on page 136 manage the NXC s zones 10 1 2 What You Need to Know The following terms and concepts may help as you read this chapter Effects of Zones on Different Types of Traffic Zones effectively divide traffic into three types intra zone traffic inter zone traffic and extra zone traffic which are affected differently by zone based security and policy settings Intra zone Traffic e Intra zone traffic is traffic between interfaces in the same zone e In each zone you can either allow or prohibit all intra zone traffic Inter zone Traffic Inter zone traffic is traffic between interfaces in different zones Extra zone Traffic e Extra zone traffic is traffic to or from any interface that is not assigned to a zone e Some zone based security and policy settings may apply to extra zone traffic especially if you can set the zone attribute in them to Any or All See the specific feature for more information NXC2500 User s Guide 135 Chapter 10 Zones 10 2 Zone The Zone screen provides a summary of all zones In addition this screen allows you to add edit and
409. onsole port Address Su u u u has been put into lockout state Too many failed login attempts were made from an IP address so the NXC is blocking login attempts from that IP address u u u u the source address of the user s login attempt Failed login attempt to EnterpriseWLAN from s login on a lockout address A login attempt came from an IP address that the NXC has locked out u u u u the source address of the user s login attempt Failed login attempt to EnterpriseWLAN from s the max number reach of user The NXC blocked a login because the maximum login capacity for the particular service has already been reached s service name Failed login attempt to EnterpriseWLAN from s reach the max number of simultaneous logon The NXC blocked a login because the maximum simultaneous login capacity for the administrator or access account has already been reached s service name NXC2500 User s Guide Appendix A Log Descriptions Table 171 User Logs continued LOG MESSAGE DESCRIPTION User s has been denied access from SS The NXC blocked a login according to the access control configuration s service name User s has been denied access from SS The NXC blocked a login attempt by the specified user name because of an invalid user name or password 2nd s service name LDAP AD Port IP s Wrong IP or Po
410. or IP MAC Binding Violation Static DHCP Table MAC Address Setting Use Default MAC Address Overwrite Default MAC Address Related Setting Configure Policy Route E general B ge2 P2 i 1 4094 none B 80 82 DC 6E A8 98 Optional 0 0 0 0 0 0 0 0 Optional 1048576 kbps El 1048576 Kbps 1500 Bytes icmp 30 5 30 seconds 5 1 10 seconds 5 1 10 0 0 0 0 Dor am DHCP Server y AAA me onus y y ge21P y infinite days hours Optional minutes Optional DO Add y Name Code Type Value Page 1 of1 Show 50 v items SH Add a IPAddress MAC Page 1 of 1 B0 B2 DC 6E A8 98 Description Show 50 items No data to display No data to display E 2x NXC2500 User s Guide Chapter 8 Interfaces This screen s fields are described in the table below Table 51 Configuration gt Network gt Interface gt Ethernet gt Edit LABEL DESCRIPTION Show Hide Advanced Settings Click this button to display a greater or lesser number of configuration fields General Settings Enable Interface Select this to enable this interface Clear this to disable this interface Interface Properties Interface Type Select to which type of network you will connect this interface When you select internal or external the rest of the screen s options automatically adjust to correspond The NXC automatically adds default route and SNAT settings for tra
411. or instance it is tagged as such WMM_VOICE All wireless traffic to the SSID is tagged as voice data This is recommended if an SSID is used for activities like placing and receiving VolP phone calls WMM_ VIDEO All wireless traffic to the SSID is tagged as video data This is recommended for activities like video conferencing WMM_BEST_EFFORT All wireless traffic to the SSID is tagged as best effort meaning the data travels the best route it can without displacing higher priority traffic This is good for activities that do not require the best bandwidth throughput such as surfing the Internet WMM_BACKGROUND All wireless traffic to the SSID is tagged as low priority or background traffic meaning all other access categories take precedence over this one If traffic from an SSID does not have strict throughput requirements then this access category is recommended For example an SSID that only has network printers connected to it VLAN ID Enter the VLAN ID that will be used to tag all traffic originating from this SSID if the VLAN is different from the native VLAN Hidden SSID Select this if you want to hide your SSID from wireless clients This tells any wireless clients in the vicinity of the AP using this SSID profile not to display its SSID name as a potential connection Not all wireless clients respect this flag and display it anyway When an SSID is hidden and a wireless client cannot see it
412. or service expiration was successful System bootup Do expiration daily check The device processes a service expiration day check immediately after it starts up After register Do expiration daily check immediately The device processes a service expiration day check immediately after device registration NXC2500 User s Guide Appendix A Log Descriptions Table 172 Registration Logs continued LOG MESSAGE DESCRIPTION Time is up Do expiration daily check The processes a service expiration day check every 24 hrs Read MyZyXEL com storage has failed Read data from EEPROM has failed Open proc MRD has failed This error message is shown when getting MAC address IDP service has expired The IDP service period has expired The device can find this through either a service expiration day check via MyZyXEL com server or by the device s own count Content Filter service has expired The content filtering service period has expired The device can find this through either a service expiration day check via MyZyXEL com server or by the device s own count Unknown TLS SSL version d The device only supports SSLv3 protocol d SSL version assigned by client Load trusted root certificates has failed The device needs to load the trusted root certificate before the device can verify a server s certificate This log displays if the de
413. or service this device during a thunderstorm There is a remote risk of electric shock from lightning Connect ONLY suitable accessories to the device Do NOT open the device or unit Opening or removing covers can expose you to dangerous high voltage points or other risks ONLY qualified service personnel should service or disassemble this device Please contact your vendor for further information Make sure to connect the cables to the correct ports Place connecting cables carefully so that no one will step on them or stumble over them Always disconnect all cables from this device before servicing or disassembling Use ONLY an appropriate power adaptor or cord for your device Connect it to the right supply voltage for example 110V AC in North America or 230V AC in Europe Do NOT allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor or cord Do NOT use the device if the power adaptor or cord is damaged as it might cause electrocution If the power adaptor or cord is damaged remove it from the device and the power source Do NOT attempt to repair the power adaptor or cord Contact your local vendor to order a new one Do not use the device outside and make sure all the connections are indoors There is a remote risk of electric shock from lightning The PoE Power over Ethernet devices that supply or receive power and their connected Ethernet cables must all be complet
414. or the device Service expiration check has failed s The service expiration day check failed this log will append an error message returned by the MyZyXEL com server s error message returned by myZyXEL com server Service expiration check has succeeded The service expiration day check was successful Service expiration check has failed Because of lack must fields The device received an incomplete response from the myZyXEL com server and it caused a parsing error for the device Server setting rror The device could not retrieve the myZyXEL com server s IP address or FQDN from local Resolve server IP has failed The device could not resolve the myZyXEL com server s FQDN to an IP address through gethostbyname Verify server s certificate has failed The device could not process an HTTPS connection because it could not verify the myZyXEL com server s certificate Connect to MyZyXEL com server has failed The device could not connect to the MyZyXEL com server Do account check The device started to check whether or not the user name in MyZyXEL com s database Do device register The device started device registration Do trial service activation The device started trail service activation Do standard service activation The device started standard service activation Do expiration check The device started the service expiration da
415. or the device to shut down before you manually turn off or remove the power It does not turn off the power You can also use the CLI command shutdown to shutdown the NXC NXC2500 User s Guide 347 Chapter 30 Shutdown NXC2500 User s Guide Troubleshooting 31 1 Overview This chapter offers some suggestions to solve problems you might encounter 31 1 1 General This section provides a broad range of troubleshooting tips for your device None of the LEDs turn on Make sure that you have the power cord connected to the NXC and plugged in to an appropriate power source Make sure that you have both power cords connected to the NXC and plugged into appropriate power sources Make sure you have both of the NXC s power switches turned on Make sure you have the NXC turned on Check all cable connections If the LEDs still do not turn on you may have a hardware problem In this case you should contact your local vendor Cannot access the NXC from the LAN Check the cable connection between the NXC and your computer or switch Ping the NXC from a LAN computer Make sure your computer s Ethernet card is installed and functioning properly Also make sure that its IP address is in the same subnet as the NXC s In the computer click Start gt Programs gt Accessories and then Command Prompt In the Command Prompt window type ping followed by the NXC s LAN IP address 192 168 1 1 is the default and then pr
416. or via the physical or Web Configurator console port See the Command Reference Guide for CLI details The default settings for the console port are as follows Table 3 Console Port Default Settings SETTING VALUE Speed 115200 bps Data Bits 8 Parity None Stop Bit 1 Flow Control Off 1 5 Object based Configuration The NXC stores information or settings as objects You use these objects to configure many of the NXC s features and settings Once you configure an object you can reuse it in configuring other features When you change an object s settings the NXC automatically updates all the settings or rules that use the object You can create address objects based on an interface s IP address subnet or gateway The NXC automatically updates every rule or setting that uses these objects whenever the interface s IP address settings change For example if you change an Ethernet interface s IP address the NXC automatically updates the rules or settings that use the interface based LAN subnet address object You can use the Configuration gt Object screens to create objects before you configure features that use them If you are in a screen that uses objects you can also usually select Create new Object to be able to configure a new object Use the Object Reference screen to see what objects are configured and which configuration settings reference specific objects NXC2500 User s Guide EN Chapter
417. orage The NXC does not stop or start the system processes when you apply configuration files or run shell scripts although you may temporarily lose access to network resources NXC2500 User s Guide Hardware Installation and Connection 2 1 Rack mounted Installation Note ZyXEL provides a sliding rail accessory for your use with your device Please contact your local vendor for details The NXC can be mounted on an ElA standard size 19 inch rack or in a wiring closet with other equipment Follow the steps below to mount your NXC on a standard ElA rack using a rack mounting kit Make sure the rack will safely support the combined weight of all the equipment it contains and that the position of the NXC does not make the rack unstable or top heavy Take all necessary precautions to anchor the rack securely before installing the unit Note Leave 10 cm of clearance at the sides and 20 cm in the rear Use a 2 Phillips screwdriver to install the screws Note Failure to use the proper screws may damage the unit 2 1 1 Rack Mounted Installation Procedure 1 Align one bracket with the holes on one side of the NXC and secure it with the included bracket screws smaller than the rack mounting screws NXC2500 User s Guide 23 Chapter 2 Hardware Installation and Connection Attach the other bracket in a similar fashion 2 NXC2500 User s Guide Chapter 2 Hardware Installation and Connection 3 After att
418. ord username admin password 4321 user type admin configure ge3 interface ge3 ip address 172 16 37 240 255 255 255 0 ip gateway 172 16 37 254 metric 1 exit create address objects for remote management use the address group in case we want to open up remot address object TW_SUBNET 172 16 37 0 24 object group address TW_TEAM management later address object TW_SUBNE exit enable Telnet access not enabled by default unlik lp telnet server other services open WLAN to NXC firewall for TW_TEAM for remot firewall WLAN NXC insert 4 sourceip TW_TEAM service TELNET action allow exit write management While configuration files and shell scripts have the same syntax the NXC applies configuration files differently than it runs shell scripts This is explained below Table 155 Configuration Files and Shell Scripts in the NXC Configuration Files conf Shell Scripts zysh e Resets to default configuration e Goes into CLI Configuration mode e Runs the commands in the configuration file e Goes into CLI Privilege mode Runs the commands in the shell script You have to run the aforementioned exampl e as a Shell script because the first command is run in Privilege mode If you remove the first command you have to run the example as a configuration file because the rest of the commands are e Comments in Conf
419. ord sent with each trap to the SNMP manager The default is public and allows all requests Destination Type the IP address of the SNMP manager to which your SNMP traps are sent Trap CAPWAP Event Select this option to have the NXC send a trap to the SNMP manager when a managed AP is connected to or disconnected from the NXC Service Control This specifies from which computers you can access which NXC zones Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This the index number of the service control rule The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy Zone This i
420. ork The NXC supports SNMP version one SNMPv1 and version two SNMPv2c The next figure illustrates an SNMP management operation Figure 168 SNMP Management Model Managed Device Managed Device Managed Device MANAGER An SNMP managed network consists of two main types of component agents and a manager An agent is a management software module that resides in a managed device the NXC An agent translates the local management information from the managed device into a form compatible with SNMP The manager is the console through which network administrators perform network management functions It executes applications that control and monitor managed devices The managed devices contain object variables managed objects that define each piece of information to be collected about a device Examples of variables include such as number of packets received node port status etc A Management Information Base MIB is a collection of managed objects SNMP allows a manager and agents to communicate for the purpose of accessing these objects SNMP itself is a simple request response protocol based on the manager agent model The manager issues a request and the agent returns responses using the following protocol operations e Get Allows the manager to retrieve an object variable from the agent e GetNext Allows the manager to retrieve the next object variable from a table or list within an agent In SNMPv1 when a manager wants to ret
421. ork gt Interface gt Ethernet gt Edit select DHCP Server in the DHCP Setting section and then click Add or Edit in the Extended Options table NXC2500 User s Guide Chapter 8 Interfaces Figure 57 Configuration gt Network gt Interface gt Ethernet gt Edit gt Add Edit Extended Options Add DHCP Option Option Name Code Type Value des User Defined bo User_Defined hansararanararara canarias BOOLEAN v a Cancel The following table describes labels that can appear in this screen Table 53 Configuration gt Network gt Interface gt Ethernet gt Edit gt Add Edit Extended Options LABEL DESCRIPTION Option Name Select which DHCP option that you want to add in the DHCP packets sent through the interface See Table 54 on page 113 for more information This field displays the name of the selected DHCP option If you selected User Defined in the Option field enter a descriptive name to identify the DHCP option You can enter up to 16 characters a z A Z 0 9 and _ with no spaces allowed The first character must be alphabetical a z A Z Code This field displays the code number of the selected DHCP option If you selected User Defined in the Option field enter a number for the option This field is mandatory Type This is the type of the selected DHCP option If you selected User Defined in the Option field
422. ormation on MAC address user accounts An external server can use the wireless client s account username password or Calling Station ID for MAC authentication Configure the ones the external server uses Delimiter Account Select the separator the external server uses for the two character pairs within account MAC addresses Case Account Select the case upper or lower the external server requires for letters in the account MAC addresses NXC2500 User s Guide Chapter 16 AP Profile Table 99 Configuration gt Object gt AP Profile gt SSID gt Security Profile gt Add Edit Security Profile LABEL DESCRIPTION Delimiter Calling RADIUS servers can require the MAC address in the Calling Station ID RADIUS attribute Station ID Select the separator the external server uses for the pairs in calling station MAC addresses Case Calling Select the case upper or lower the external server requires for letters in the calling Station ID station MAC addresses 802 1X Select this to enable 802 1x secure authentication Reauthentication Enter the interval in seconds between authentication requests Enter a O for unlimited Timer requests PSK Select this option to use a Pre Shared Key with WPA encryption Pre Shared Key Enter a pre shared key of between 8 and 63 case sensitive ASCII characters including spaces and symbols or 64 hexadecimal characters Cipher Type Select an enc
423. ou read this chapter One time Schedules One time schedules begin on a specific start date and time and end on a specific stop date and time One time schedules are useful for long holidays and vacation periods Recurring Schedules Recurring schedules begin at a specific start time and end at a specific stop time on selected days of the week Sunday Monday Tuesday Wednesday Thursday Friday and Saturday Recurring schedules always begin and end in the same day Recurring schedules are useful for defining the workday and off work hours NXC2500 User s Guide 221 Chapter 20 Schedules 20 2 Schedule Summary The Schedule summary screen provides a summary of all schedules in the NXC To access this screen click Configuration gt Object gt Schedule Figure 124 Configuration gt Object gt Schedule Schedule One Time Q Add Name Page 1 Recurring Add Arcor Name Page 1 Start Day Time Stop Day Time of 1 50 items No data to display Start Time Stop Time of1 No data to display The following table describes the labels in this screen Table 112 Configuration gt Object gt Schedule LABEL DESCRIPTION One Time Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it
424. outes 130 and static routes 132 and zones 17 103 as DHCP relays 122 as DHCP servers 122 260 bandwidth management 121 default configuration 18 DHCP clients 121 Ethernet see also Ethernet interfaces gateway 121 general characteristics 103 IP address 121 metric 121 MTU 121 overlapping IP address and subnet mask 121 static DHCP 122 subnet mask 121 types 103 VLAN see also VLAN interfaces Internet Control Message Protocol see ICMP Internet Explorer 29 IP policy routing see policy routes IP protocols 215 ICMP see ICMP TCP see TCP UDP see UDP IP static routes see static routes IP MAC binding 149 exempt list 153 monitor 69 static DHCP 152 Java NXC2500 User s Guide Index permissions 29 JavaScripts 29 K key pairs 241 L lastgood conf 316 318 LDAP 227 and users 170 Base DN 230 Bind DN 230 234 directory 227 directory structure 229 Distinguished Name see DN DN 229 231 233 password 234 port 233 236 search time limit 233 SSL 233 license key 88 upgrading 88 licensing 85 Lightweight Directory Access Protocol see LDAP local user database 228 log messages categories 304 305 308 309 310 debugging 80 regular 80 types of 80 logged in users 58 logout Web Configurator 31 logs descriptions 359 e mail profiles 299 e mailing log messages 82 303 formats 300 log consolidation 304 settings 299 syslog servers 299 system 299 types of 299 MAC address 185 and VL
425. oved deleted Create interface s The wireless device failed to create the specified WLAN interface s Remove the wireless device and reinstall it IEEE 802 1x or WPA is not enabled Error configuring WPA state System internal error o 802 1X or WPA enabled System internal error The NXC was not able to configure the wireless device to use WPA Remove the wireless device and reinstall it System internal Error enabling WPA 802 1X error The NXC was not able to enable WPA IEEE 802 1X NXC2500 User s Guide 377 Appendix A Log Descriptions 378 Table 181 WLAN Logs continued LOG MESSAGE DESCRIPTION Station has associated Interface Ss MAC s A wireless client with the specified MAC address second s associated with the specified WLAN interface first s WPA or WPA2 enterprise EAP timeout Interface s MAC Ss There was an EAP timeout for a wireless client connected to the specified WLAN interface first s The MAC address of the wireless client is listed second s Station association has failed Maximum associations have reached the maximum number Interface s MAC s A wireless client with the specified MAC address second s failed to connect to the specified WLAN interface first s because the WLAN interface already has its maximum number of wireless clients WPA authentication has failed
426. overlap that the other one Figure 53 An Alternative Four Channel Deployment 1 5 9 13 ES A A e TODZ 90bz TIH arroz TvZ EzbZ 9zvz Bzv7 TEbT cevz BEb7 Tobz Ebbz Spbz 8rbz TSZ esvz 9svz BSbZ TIZ E9p7 8902 ELbz BLb7 esbz s6b7 7 7 2 Load Balancing Because there is a hard upper limit on an AP s wireless bandwidth load balancing can be crucial in areas crowded with wireless users Rather than let every user connect and subsequently dilute the available bandwidth to the point where each connecting device receives a meager trickle the load balanced AP instead limits the incoming connections as a means to maintain bandwidth integrity There are two kinds of wireless load balancing available on the NXC Load balancing by station number limits the number of devices allowed to connect to your AP If you know exactly how many stations you want to let connect choose this option For example if your company s graphic design team has their own AP and they have 10 computers you can load balance for 10 Later if someone from the sales department visits the graphic design team s offices for a meeting and he tries to access the network his computer s connection is delayed giving it the opportunity to connect to a different neighboring AP If he still connects to the AP regardless of the delay then the AP may boot other people who are already connected in order to associate with the new connection NXC2500 User s Gu
427. ow applied 314 lastgood conf 316 318 managing 315 startup config conf 318 startup config bad conf 316 syntax 314 system default conf 318 uploading 319 uploading with FTP 288 use without restart 313 connectivity check 108 120 console port speed 264 cookies 29 NXC2500 User s Guide Index copyright 417 CPU usage 51 54 CTS Clear to Send 408 current date time 52 261 and schedules 221 daylight savings 262 setting manually 264 time server 264 D date 261 daylight savings 262 default interfaces and zones 18 port mapping 17 device introduction 17 DHCP 122 260 and DNS servers 123 and domain name 260 and interfaces 122 client list 57 pool 122 static DHCP 122 diagnostics 325 330 Digital Signature Algorithm public key algorithm see DSA directory 227 directory service 227 file structure 229 disclaimer 417 Distinguished Name DN 229 231 233 DN 229 231 233 DNS 265 address records 268 domain name forwarders 269 domain name to IP address 268 IP address to domain name 268 Mail eXchange MX records 270 pointer PTR records 268 DNS servers 265 269 and interfaces 123 documentation related 2 domain name 260 Domain Name System see DNS DSA 247 DSCP 340 dynamic guest 70 dynamic guest account 70 170 Dynamic Host Configuration Protocol see DHCP dynamic WEP key exchange 412 E EAP Authentication 411 e mail daily statistics report 298 encryption 413 RSA 250 ESS 406 E
428. p by one when you take this action Object Reference You cannot delete certificates that any of the NXC s features are configured to use Select an entry and click Object Reference to open a screen that shows which settings use the entry This field displays the certificate index number The certificates are listed in alphabetical order Name This field displays the name used to identify this certificate It is recommended that you give each certificate a unique name Type This field displays what kind of certificate this is REQ represents a certification request and is not yet a valid certificate Send a certification request to a certification authority which then issues a certificate Use the My Certificate mport screen to import the certificate and replace the request SELF represents a self signed certificate CERT represents a certificate issued by a certification authority NXC2500 User s Guide Chapter 23 Certificates Table 122 Configuration gt Object gt Certificate gt My Certificates continued LABEL DESCRIPTION Subject This field displays identifying information about the certificate s owner such as CN Common Name OU Organizational Unit or department O Organization or company and C Country It is recommended that each certificate have unique subject information Issuer This field displays identifying information about the certificate s issuing ce
429. pdate server s FQDN to an IP address through gethostbyname The update process stopped Build query message failed Some information was missing in the packets that the device sent to the server Starting signature update The device started an IDP signature update IDP signature download has succeeded The device successfully downloaded an IDP signature file IDP has signature update succeeded The device successfully downloaded and applied an DP signature file IDP signature download has failed The device still cannot download the IDP signature after 3 retries NXC2500 User s Guide Appendix A Log Descriptions Table 172 Registration Logs continued LOG MESSAGE DESCRIPTION Anti Virus signature download has succeeded The device successfully downloaded an anti virus signature file Anti Virus signature update has succeeded The device successfully downloaded and applied an anti virus signature file Anti Virus signature download has failed The device still cannot download the anti virus signature after 3 retries System protect signature download has succeeded The device successfully downloaded the system protect signature file System protect signature update has succeeded The device successfully downloaded and applied a system protect signature file System protect signature download has failed The devi
430. pears Figure 101 Guest Account List The following table describes the labels in this screen Table 91 Guest Account List LABEL DESCRIPTION This is the rank of an account in the list Guest Name This is the descriptive name for an account User Name This is the user name of an account Password This is the password of an account Guest s Print Click this icon to print out the account information and the notes you specified in the User Group gt Setting screen for dynamic guests Return Click this icon to go back to the previous screen 184 NXC2500 User s Guide Chapter 15 User Group The following figure shows the dynamic guest account printout example Figure 102 Preview of Dynamic Guest Account Printout Welcome Guest Here is your account information to access the WLAN Network Account MGMSVY 7N Password F23GSRMC Account Expiration Tine 2013 04 08 23 59 SSID balabala Key 12345678 An Guest Dynamic Here is your account information to access the WLAN Network Guest Account LC7V6ZS3 Note Password 2C8U9FPC Account Expiration Time 2013 04 08 23 59 SSID balabala Key 12345678 15 5 MAC Address The MAC Address screen maps wireless client MAC addresses to MAC roles MAC address user accounts See page 171 for more on MAC address user accounts and MAC roles Click Configuration gt Object gt User Group gt MAC Address to open this screen Fi
431. ple www zyxel com tw is a fully qualified domain name where www is the host zyxel is the third level domain com is the second level domain and tw is the top level domain Underscores are not allowed Use as a prefix in the FQDN for a wildcard domain name for example example com IP Address Enter the IP address of the host in dotted decimal notation OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit this screen without saving 268 NXC2500 User s Guide Chapter 24 System 24 6 6 Domain Zone Forwarder A domain zone forwarder contains a DNS server s IP address The NXC can query the DNS server to resolve domain zones for features like the time server A domain zone is a fully qualified domain name without the host For example zyxel com is the domain zone for the www zyxel com fully qualified domain name 24 6 7 Add Domain Zone Forwarder Click the Add icon in the Domain Zone Forwarder table to add a domain zone forwarder record Figure 150 Configuration gt System gt DNS gt Add Domain Zone Forwarder Add Domain Zone Forwarder 2X Domain Zone DNS Server DNS Server s from ISP ge2 v First DNS Server N A Second DNS Server N A Third DNS Server N A Public DNS Server Nn The following table describes the labels in this screen Table 136 Configuration gt System gt DNS gt
432. pload Click Upload to begin the upload process This process may take up to two minutes After you see the Firmware Upload in Process screen wait two minutes before logging into the NXC again Figure 182 Firmware Upload In Process Firmware upload is in progress k Note The NXC automatically reboots after a successful upload The NXC automatically restarts causing a temporary network disconnect In some operating systems you may see the following icon on your desktop Figure 183 Network Temporarily Disconnected SD Local Area Connection Network cable unplugged After five minutes log in again and check your new firmware version in the Dashboard screen 320 NXC2500 User s Guide Chapter 26 File Manager If the upload was not successful the following message appears in the screen Figure 184 Firmware Upload Error Error Message x errno 42007 errmsg Firmware content error on 26 4 Shell Script Use shell script files to have the NXC use commands that you specify Use a text editor to create the shell script files They must use a zysh filename extension Click Maintenance gt File Manager gt Shell Script to open this screen Use the Shell Script screen to store name download upload and run shell script files You can store multiple shell script files on the NXC at the same time Note You should include write commands in your scripts If you d
433. pload a configuration file named system default conf or lastgood conf If you upload startup config conf it will replace the current configuration and immediately apply the new settings File Path Type in the location of the file you want to upload in this field or click Browse to find it Browse Click Browse to find the conf file you want to upload The configuration file must use a conf filename extension You will receive an error message if you try to upload a fie of a different format Remember that you must decompress compressed zip files before you can upload them Upload Click Upload to begin the upload process This process may take up to two minutes 26 3 Firmware Package Click Maintenance gt File Manager gt Firmware Package to open this screen Use the Firmware Package screen to check your current firmware version and upload firmware to the NXC Note The Web Configurator is the recommended method for uploading firmware You only need to use the command line interface if you need to recover the firmware See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it Find the firmware package at www zyxel com in a file that usually uses the system model name with a bin extension for example nxc bin The NXC s firmware package cannot go through the NXC when you enable the anti virus Destroy compressed files that could not be deco
434. ply IP MAC binding Figure 79 Configuration gt Network gt P MAC Binding gt Exempt List OQ Add 2 Edit Jf Remove Page fi of 1 Show 50 v items No data to display Summary Exempt List IP MAC Binding Exempt List Start IP End IP Apply The following table describes the labels in this screen Table 73 Configuration gt Network gt P MAC Binding gt Exempt List LABEL DESCRIPTION Add Click this to create a new entry Edit Click an entry or select it and click Edit to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so This is the index number of the P MAC binding list entry Name Enter a name to help identify this entry Start IP Enter the first IP address in a range of IP addresses for which the NXC does not apply I P MAC binding End IP Enter the last IP address in a range of IP addresses for which the NXC does not apply I P MAC binding Apply Click Apply to save your changes back to the NXC NXC2500 User s Guide Chapter 13 IP MAC Binding NXC2500 User s Guide Captive Portal 14 1 Overview A captive portal can intercepts network traffic according to the authentication policies until the user authenticates his or her connection usually through a specifically designated login web page As an added security
435. policies that define what services they can use User Role Priority The NXC checks the following in order of priority 1 User role setting in ext user 2 User role setting in ext group user 3 User role setting in default user Idap users ad users radius users NXC2500 User s Guide 171 Chapter 15 User Group 15 2 User Summary 172 The User screen provides a summary of all user accounts To access this screen click Configuration gt Object gt User Group Figure 92 Configuration gt Object gt User Group gt User Configuration O Add X Edit fif Remove 3 Object Reference UserName admin Idap users radius users ad users mac users guest Andrea User Type Description admin Administration account External LDAP Users External RADIUS Users External AD Users MAC Authentication Users guest Local User limited admin Local User ext user ext user ext user mac address Page 1 of 1 Show 50 v items Displaying 1 8 of 8 The following table describes the labels in this screen Table 82 Configuration gt Object gt User Group gt User LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Reference Select an entry and cl
436. port click or to display or hide details about a source IP address s sessions Destination This field displays the destination IP address and port in each active session If you are looking at the sessions by destination IP report click or to display or hide details about a destination IP address s sessions Rx This field displays the amount of information received by the source in the active session Tx This field displays the amount of information transmitted by the source in the active session Duration This field displays the length of the active session in seconds NXC2500 User s Guide Chapter 5 Monitor 5 7 IP MAC Binding Monitor Click Monitor gt System Status gt I P MAC Binding to display the following screen This screen lists the devices that have received an IP address from NXC interfaces with IP MAC binding enabled and have ever established a session with the NXC Devices that have never established a session with the NXC do not display in the list Figure 27 Monitor gt System Status gt P MAC Binding IP MAC Binding Monitor Table Interface none v IP Address Host Name MAC Address Last Access Description of 1 Show 50 items No data to display Page 1 The following table describes the labels in this screen Table 27 Monitor gt System Status gt IP MAC Binding LABEL DESCRIPTION Interface Select a NXC interface that has IP MAC binding enabled t
437. pter NAT Loopback Suppose a NAT 1 1 rule maps a public IP address to the private IP address of a LAN SMTP e mail server to give WAN users access NAT loopback allows other users to also use the rule s original IP to access the mail server For example a LAN user s computer at IP address 192 168 1 89 queries a public DNS server to resolve the SMTP server s domain name xxx LAN SMTP com in this example and gets the SMTP server s mapped public IP address of 1 1 1 1 Figure 71 LAN Computer Queries a Public DNS Server 192 168 1 21 NXC2500 User s Guide Chapter 11 NAT The LAN user s computer then sends traffic to IP address 1 1 1 1 NAT loopback uses the IP address of the NXC s LAN interface 192 168 1 1 as the source address of the traffic going from the LAN users to the LAN SMTP server Figure 72 LAN to LAN Traffic 192 168 1 21 The LAN SMTP server replies to the NXC s LAN IP address and the NXC changes the source address to 1 1 1 1 before sending it to the LAN user The return traffic s source matches the original destination address 1 1 1 1 If the SMTP server replied directly to the LAN user without the traffic going through NAT the source would not match the original destination address which would cause the LAN user s computer to shut down the session Figure 73 LAN to LAN Return Traffic 192 168 1 21 NXC2500 User s Guide Chapter 11 NAT NXC2500 User s Guide ALG 12 1 O
438. r Figure 207 Basic Service Set ESS An Extended Service Set ESS consists of a series of overlapping BSSs each containing an access point with each access point connected together by a wired network This wired connection between APs is called a Distribution System DS This type of wireless LAN topology is called an Infrastructure WLAN The Access Points not only provide communication with the wired network but also mediate wireless network traffic in the immediate neighborhood NXC2500 User s Guide Appendix D Wireless LANs An ESSID ESS IDentification uniquely identifies each ESS All access points and their associated wireless clients within the same ESS must have the same ESSID in order to communicate Figure 208 Infrastructure WLAN ARIAS KF A 7 7 ae M a ee G n roa on 4 we AB Channel A channel is the radio frequency ies used by wireless devices to transmit and receive data Channels available depend on your geographical area You may have a choice of channels for your region so you should use a channel different from an adjacent AP access point to reduce interference Interference occurs when radio signals from different access points overlap causing interference and degrading performance Adjacent channels partially overlap however To avoid interference due to overlap your AP should be on a channel at least five channels away from a channel that an adjacent AP is using For
439. r changed an ISP account profile s options 1st s profile type 2nd s profile name o Account s s has been added A user added a new ISP account profile lst s profile type 2nd s profile name NXC2500 User s Guide Appendix A Log Descriptions Table 183 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled Force user authentication will be turned on because HTTP server was turned on Force User Authentication will be disabled due to http server is disabled Force user authentication will be turned off because HTTP server was turned off Force User Authentication may not work properly Table 184 File Manager Logs LOG MESSAGE DESCRIPTION ERROR S S Apply configuration failed this log will be what CLI command is and what error message is lst s is CLI command 2nd s is error message when apply CLI command WARNING S s Apply configuration failed this log will be what CLI command is and what warning message is 1st s is CLI command 2nd s is warning message when apply CLI command ERROR S S Run script failed this log will be what wrong CLI command is and what error message is 1st s is CLI command 2nd s is error message when apply CLI command WARNING S s Run script failed this log will be what wro
440. r that you typed This is the index number of the service control rule The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy Zone This is the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny Authentication Client Authentication Select a method the HTTPS or HTTP server uses to authenticate a client Method You must have configured the authentication methods in the Auth method screen Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 7 5 Service Control Rules Click Add or Edit in the Service Control table in a WWW SSH TELNET FTP or SNMP screen to add a service control rule Figure 156 Configuration gt System gt Service Control Rule gt Add Edit Create new Object v Address Object Zone Action ALL v ALL v Accept v NXC2500 User s Guide 275 Chapter 24 System The follow
441. re 127 Example Directory Service Client and Server The following describes the user authentication procedure via an LDAP AD server A user logs in with a user name and password pair The NXC tries to bind or log in to the LDAP AD server When the binding process is successful the NXC checks the user information in the directory against the user name and password pair NXC2500 User s Guide 227 Chapter 21 AAA Server 4 If it matches the user is allowed access Otherwise access is blocked RADIUS Server RADIUS Remote Authentication Dial In User Service authentication is a popular protocol used to authenticate users by means of an external server instead of or in addition to an internal device user database that is limited to the memory capacity of the device In essence RADIUS authentication allows you to validate a large number of users from a central location Figure 128 RADIUS Server Network Example Authentication Capability List This list displays the NXC s authentication capabilities Table 115 Authentication Capability List EXTERNAL INTERNAL AUTHENTICATION METHOD RADIUS AD LDAP RADIUS EAP TLS O O O O EAP TTLS oA O O O Mschapv2 Mschap EAP TTLS X X X O eap EAP TTLS O O O O pap EAP PEAP oA O O O Mschapv2 EAP PEAP X X X O TLS EAP MD5 X X X O A Must set domain authentication AAA Servers Supported by the NXC The following lis
442. re is in progress although you cannot modify the frame capture settings The NXC s throughput or performance may be affected while a frame capture is in progress After the NXC finishes the capture it saves a combined capture file for all APs The total number of frame capture files that you can save depends on the file sizes and the available flash storage space Once the flash storage space is full adding more frame captures will fail Stop Click this button to stop a currently running frame capture and generate a combined capture file for all APs Reset Click this button to return the screen to its last saved settings 27 6 1 Wireless Frame Capture Files Click Maintenance gt Diagnostics gt Wireless Frame Capture gt Files to open this screen This screen lists the files of wireless frame captures the NXC has performed You can download the files to your computer where you can study them using a packet analyzer also known as a network or protocol analyzer such as Wireshark Figure 195 Maintenance gt Diagnostics gt Wireless Frame Capture gt Files Diagnostics Packet Capture Core Dump System Log Wireless Frame Capture Capture Files Captured Packet Files y File Name Page 1 Last Modified Show 50 items No data to display NXC2500 User s Guide Chapter 27 Diagnostics The following table describes the labels in this screen Table 167 Maintenance gt Diagnostics gt Wireless Frame
443. red Mode APs for monitor mode Use the arrow buttons to move APs off this list and onto the Captured MON Mode APs list Capture MON Mode This column displays the monitor mode configured APs selected to for wireless APs frame capture Misc Setting NXC2500 User s Guide Chapter 27 Diagnostics Table 166 Maintenance gt Diagnostics gt Wireless Frame Capture gt Capture continued LABEL DESCRIPTION File Size Specify a maximum size limit in kilobytes for the total combined size of all the capture files on the NXC including any existing capture files and any new capture files you generate Note If you have existing capture files you may need to set this size larger or delete existing capture files The valid range is 1 to 50000 The NXC stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires File Prefix Specify text to add to the front of the file name in order to help you identify frame capture files You can modify the prefix to also create new frame capture files each time you perform a frame capture operation Doing this does no overwrite existing frame capture files The file format is file prefix cap For example monitor cap Capture Click this button to have the NXC capture frames according to the settings configured in this screen You can configure the NXC while a frame captu
444. reen check mark and or in alerts red exclamation point for the e mail settings specified in E Mail Server 1 The NXC does not e mail debugging information even if it is recorded in the System log E mail Server 2 E mail Select whether each category of events should be included in log messages when it is e mailed green check mark and or in alerts red exclamation point for the e mail settings specified in E Mail Server 2 The NXC does not e mail debugging information even if it is recorded in the System log Remote Server 1 4 OK For each remote server select what information you want to log from each Log Category except All Logs see below Choices are disable all logs red X do not log any information from this category enable normal logs green check mark log regular information and alerts from this category enable normal logs and debug logs yellow check mark log regular information alerts and debugging information from this category Click this to save your changes and return to the previous screen Cancel Click this to return to the previous screen without saving your changes NXC2500 User s Guide Chapter 25 Log and Report 312 NXC2500 User s Guide File Manager 26 1 Overview Configuration files define the NXC s settings Shell scripts are files of commands that you can store on the NXC and run when you need them You can apply a configuration file
445. reserve means the NXC does not modify the DSCP value of the route s outgoing packets default means the NXC sets the DSCP value of the route s outgoing packets to 0 The af choices stand for Assured Forwarding The number following the af identifies one of four classes and one of three drop preferences The wmm entries are for QoS For more information on QoS and WMM categories see page 134 SNAT This is the source IP address that the route uses It displays none if the NXC does not perform NAT for this route Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings NXC2500 User s Guide Chapter 9 Policy and Static Routes 9 2 1 Add Edit Policy Route Click Configuration gt Network gt Routing to open the Policy Route screen Then click the Add or Edit icon to open the Policy Route Edit screen Use this screen to configure or edit a policy route Figure 63 Configuration gt Network gt Routing gt Policy Route gt Add Edit 3 Add Policy Route 2 x Hide Advanced Settings Create new Object Configuration V Enable Description Optional Criteria User any v Incoming Interface M Please select one member gel y Source Address any v Destination Address any 7 DSCP Code any v Schedule none v Service any v Source Port any m Next Hop Type Interface v Interface gel y Auto Disable DSCP Markin
446. rface also describes a network that is directly connected to the NXC For example You connect the LAN network to the interface e Zones are groups of interfaces used to ease security policy configuration 8 1 1 What You Can Do in this Chapter e The Ethernet screens Section 8 2 on page 104 configure the Ethernet interfaces Ethernet interfaces are the foundation for defining other interfaces and network policies The VLAN screens Section 8 3 on page 113 divide the physical network into multiple logical networks VLAN interfaces receive and send tagged frames The NXC automatically adds or removes the tags as needed 8 1 2 What You Need to Know The following terms and concepts may help as you read this chapter Interface Characteristics Interfaces generally have the following characteristics although not all characteristics apply to each type of interface An interface is a logical entity through which layer 3 packets pass An interface is bound to a physical port or another interface Many interfaces can share the same physical port An interface belongs to at most one zone e Many interfaces can belong to the same zone Types of Interfaces You can create several types of interfaces in the NXC Ethernet interfaces are the foundation for defining other interfaces and network policies VLAN interfaces receive and send tagged frames The NXC automatically adds or removes the tags as needed NXC2500 Us
447. rieve all elements of a table from an agent it initiates a Get operation followed by a series of GetNext operations e Set Allows the manager to set values for object variables within an agent e Trap Used by the agent to inform the manager of some events 200 NXC2500 User s Guide Chapter 24 System 24 11 1 Supported MIBs The NXC supports MIB II that is defined in RFC 1213 and RFC 1215 The NXC also supports private MIBs zywall mib and zyxel zywall ZLD Common mib to collect information about CPU and memory usage and VPN total throughput The focus of the MIBs is to let administrators collect statistical data and monitor status and performance You can download the NXC s MIBs from www zyxel com 24 11 2 SNMP Traps The NXC will send traps to the SNMP manager when any one of the following events occurs Table 144 SNMP Traps OBJECT LABEL OBJECT ID DESCRIPTION Cold Start 1 3 6 1 6 3 1 1 5 1 This trap is sent when the NXC is turned on or an agent restarts linkDown 1 3 6 1 6 3 1 1 5 3 This trap is sent when the Ethernet link is down linkUp 1 3 6 1 6 3 1 1 5 4 This trap is sent when the Ethernet link is up authenticationFailure 1 3 6 1 6 3 1 1 5 5 This trap is sent when an SNMP request comes from non authenticated hosts 24 11 3 Configuring SNMP To change your NXC s SNMP settings click Configuration gt System gt SNMP tab The screen appears as shown Use this screen t
448. rs from the entity maintaining the server usually a certification authority Password Type the password up to 31 ASCII characters from the entity maintaining the CRL directory server usually a certification authority Certificate These read only fields display detailed information about the certificate Information Type This field displays general information about the certificate CA signed means that a Certification Authority signed the certificate Self signed means that the certificate s owner signed the certificate not a certification authority X 509 means that this certificate was created and signed according to the ITU T X 509 recommendation that defines the formats for public key certificates Version This field displays the X 509 version number Serial Number This field displays the certificate s identification number given by the certification authority Subject This field displays information that identifies the owner of the certificate such as Common Name CN Organizational Unit OU Organization O and Country C Issuer This field displays identifying information about the certificate s issuing certification authority such as Common Name Organizational Unit Organization and Country With self signed certificates this is the same information as in the Subject Name field NXC2500 User s Guide Chapter 23 Certificates Table 127 Configuration gt Object gt Certificate gt
449. rt sd LDAP AD Wrong IP or Port Please check the AAA server setting Domain auth fail Domain auth fail Please check the domain auth related setting Failed to join domain Access denied Failed to join domain Access denied Please check the AD server Table 172 Registration Logs LOG MESSAGE DESCRIPTION Send registration message to MyZyXEL com server has failed The device was not able to send a registration message to MyZyXEL com Get server respons has failed The device sent packets to the MyZyXEL com server but did not receive a response The root cause may be that the connection is abnormal Timeout for get server response zysh need to catch MyZyXEL com agent s return code this log will be shown when timeout User has existed The user name already exists in MyZyXEL com s database So the user can t use it for device registration and needs to specify another one User does not exist The user name does not yet exist in MyZyXEL com s database So the user can use it for device registration Internal server error MyZyXEL com s database had an error when checking the user name Device registration has failed s Device registration failed an error message returned by the MyZyXEL com server will be appended to this log s error message returned by the myZyXEL com server Device registration has succeeded The device registered succe
450. rtificate is from the NXC You see the following Security Alert screen in Internet Explorer Select Yes to proceed to the Web Configurator login screen if you select No then Web Configurator access is blocked Figure 157 Security Alert Dialog Box Internet Explorer Security Alert Information you exchange with this site cannot be viewed or F changed by others However there is a problem with the site s security certificate The security certificate was issued by a company you have not chosen to trust View the certificate to determine whether you want to trust the certifying authority iv The security certificate date is valid The name on the security certificate is invalid or does not match the name of the site Do you want to proceed View Certificate 276 NXC2500 User s Guide Chapter 24 System 24 7 6 2 Avoiding Browser Warning Messages Here are the main reasons your browser displays warnings about the NXC s HTTPS server certificate and what you can do to avoid seeing the warnings e The issuing certificate authority of the NXC s HTTPS server certificate is not one of the browser s trusted certificate authorities The issuing certificate authority of the NXC s factory default certificate is the NXC itself since the certificate is a self signed certificate For the browser to trust a self signed certificate import the self signed certificate into your operating system as a trusted certificat
451. rtification authority such as a common name organizational unit or department organization or company and country With self signed certificates this is the same information as in the Subject field Valid From This field displays the date that the certificate becomes applicable Valid To This field displays the date that the certificate expires The text displays in red and includes an Expired message if the certificate has expired Import Click Import to open a screen where you can save a certificate to the NXC Refresh Click Refresh to display the current validity status of the certificates NXC2500 User s Guide Chapter 23 Certificates 23 2 1 Add My Certificates Click Configuration gt Object gt Certificate gt My Certificates and then the Add icon to open the My Certificates Add screen Use this screen to have the NXC create a self signed certificate enroll a certificate with a certification authority or generate a certification request Figure 137 Configuration gt Object gt Certificate gt My Certificates gt Add Q Add My Certificates 21x Configuration Name O Subject Information 9 HostIP Address 0 Host Domain Name E Mail Organizational Unit Optional Organization Optional Town City Optional State Province Optional Country Optional Key Type RSA y B Key Length 1024 Y bits Create a self signed certificate Create a certifi
452. rvers List ccccsscessesscessesscesceceeessessessecnacstecssaeeseesersesessnneess 263 24 4 2 TIME SEIS SUMCHMAM ZAIN drainai ai aana iaioa aa dakiena Aa 263 PS Consolo SSA sa 264 24 O DNS LUST A A A iia 265 24 6 1 DNS Server Address ASEIONIMBAL si ier axatepedeiceie sonsidanetboonaesentamuteaces 265 24 52 Lomiguina The DNS GOCEN mn 265 Pe MES A A A eialomdeies 268 24 04 PP RECO ii den et edi edd as 268 24 6 5 AO Sr Ade S UA RECO ii AAA A AS 268 2466 Doman Zone POV AIOE si is 269 24 0 7 Add Domai o A 269 24 eS MA REGO ori AA 270 24 BO Add MA Record an dada 270 NXC2500 User s Guide EN Table of Contents SER 10 A O Serie Conal ssp A 270 A tanith E A A E N E 271 24 7 1 Serice Access LIMIAIONS lt p 271 aa T e osa NEE ai di 272 AFO a e TO E acne to ea osen tupac aa 272 SA TA COMUNA Serit LOMO siste 273 24 7 ORIO ND RUES raso ral saab indians 275 pe Wed TIPS EMP ri 276 La MPO NP ere rt ert oer Treen renter Peat er Te Tree reer er rere rrr re Tere remy Serre errr re rere rr rrr irre Tere ry erty 282 SA A IQM cun ia 283 2432 8SH implementacion he NXG usos 284 2483 hequitemente tor Using SSA sii aa 284 AEA TATU So na 284 24 85 Examples of Secure Telnet Using SSH soni 285 AA II aca ii id ii ecatuiuts 287 ELIT iaa 288 A meata ee eae 290 a e PINES A A saab bandas iie 291 2112 SNMP TADS eE 291 2d eel Ea ME Ads 291 PA Ne Ue ICAI SUN did 292 BA Tit RADIUS IRIE oricine a r aare a EN AE EiS 294 ZME a A 2s csr E A O E
453. ryption cipher type from the list e auto This automatically chooses the best available cipher based on the cipher in use by the wireless client that is attempting to make a connection tkip This is the Temporal Key Integrity Protocol encryption method added later to the WEP encryption protocol to further secure Not all wireless clients may support this e aes This is the Advanced Encryption Standard encryption method It is a more recent development over TKIP and considerably more robust Not all wireless clients may support this Group Key Update Timer Enter the interval in seconds at which the AP updates the group WPA encryption key Pre Authentication This field is available only when you set Security Mode to wpa2 or wpa2 mix and enable 802 1x authentication Enable or Disable pre authentication to allow the AP to send authentication information to other APs on the network allowing connected wireless clients to switch APs without having to re authenticate their network connection OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 16 3 3 MAC Filter List This screen allows you to create and manage security configurations that can be used by your SSIDs To access this screen click Configuration gt Object gt AP Profile gt SSID gt MAC Filter List Note You can have a maximum of 32 MAC filtering profiles on the N
454. ryption mechanisms used for WPA 2 and WPA 2 PSK are the same The only difference between the two is that WPA 2 PSK uses a simple common password instead of user specific credentials The common password approach makes WPA 2 PSK susceptible to brute force password guessing attacks but it s still an improvement over WEP as it employs a consistent single alphanumeric password to derive a PMK which is used to generate unique temporal encryption keys This prevent all wireless devices sharing the same encryption keys a weakness of WEP User Authentication WPA and WPA2 apply IEEE 802 1x and Extensible Authentication Protocol EAP to authenticate wireless clients using an external RADIUS database WPA2 reduces the number of key exchange messages from six to four CCMP 4 way handshake and shortens the time required to connect to a network Other WPA2 authentication features that are different from WPA include key caching and pre authentication These two features are optional and may not be supported in all wireless devices Key caching allows a wireless client to store the PMK it derived through a successful authentication with an AP The wireless client uses the PMK when it tries to connect to the same AP and does not need to go with the authentication process again Pre authentication enables fast roaming by allowing the wireless client already connecting to an AP to perform IEEE 802 1x authentication with another AP before connecting to i
455. s Suppose you want to assign ports 21 25 to one FTP Telnet and SMTP server A in the example port 80 to another B in the example and assign a default server IP address of 192 168 1 35 to a third C in the example You assign the LAN IP addresses and the ISP assigns the WAN IP address The NAT network appears as a single host on the Internet Figure 68 Multiple Servers Behind NAT Example 192 168 1 1 LAN D 192 168 C 192 168 1 35 L 11 1 1 What You Can Do in this Chapter 1 36 The NAT screens see Section 11 2 on page 139 display and manage the list of NAT rules and see their configuration details You can also create new NAT rules and edit or delete existing ones 11 2 NAT Summary The NAT summary screen provides a summary of all NAT rules and their configuration In addition this screen allows you to create new NAT rules and edit and delete existing NAT rules To access this NXC2500 User s Guide Chapter 11 NAT screen login to the Web Configurator and click Configuration gt Network gt NAT The following screen appears providing a summary of the existing NAT rules Figure 69 Configuration gt Network gt NAT Configuration Q Note If you v nt to configure SNAT please go to Policy Route Q Add Status Name Page 1 Mapping Type Interface Original IP Mapped IP Protocol Original Port Mapped Port Show 50 v items No data to display Apply Reset The followin
456. s Warning messages such as those resulting from misconfiguration display in a popup window Figure 14 Warning Message Error Message GAO errno 48001 errmsg Invalid network netmask 3 3 4 Tables and Lists The Web Configurator tables and lists are quite flexible and provide several options for how to display their entries Manipulating Table Display Here are some of the ways you can manipulate the Web Configurator tables NXC2500 User s Guide Chapter 3 The Web Configurator 1 Click a column heading to sort the table s entries according to that column s criteria Configuration Q Add J User Type Description 8 MACexamp e mac address Local User 4 ad users ext user External AD Users 1 admin admin Administration account 7 boss guest manager Local User 6 guest guest Local User 2 Idap users ext user External LDAP Users 5 mac users mac address MAC Authentication Users 3 radius users ext user External RADIUS Users Page 1 of 1 Show 50 v items Displaying 1 8 of 8 Click the down arrow next to a column heading for more options about how to display the entries The options available vary depending on the type of fields in the column Here are some examples of what you can do Sort in ascending alphabetical order Sort in descending reverse alphabetical order Select which columns to display Group entries by field Show entries in groups Filter by mathematical operator
457. s lt gt or or searching for text Configuration Q Add Z Y a UserName er Type Description 8 MACexample Sort Ascending Local User 4 ad users Z Sort Descending External AD Users 1 admin inistration account 7 boss Columns ser 6 guest Group By This Field V User Name ser Zi ewes E Show in Groups Y User Type l DAP Users 5 mac users Y Description thentication Users 3 radius users E Filters b RADIUS Users Page fi of 1 Show 50 items Displaying 1 8 of 8 NXC2500 User s Guide Chapter 3 The Web Configurator 3 Select a column heading cell s right border and drag to re size the column Configuration Q Add A w gs User Name 1 admin 2 Idap users 3 radius users 4 ad users 5 mac users 6 guest 7 boss 8 MACexample Page 1 of 1 User Type dmin xt user xt user xt user ac address uest uest manager mac address 1 50 v items Description Administration account External LDAP Users External RADIUS Users External AD Users MAC Authentication Users Local User Local User Local User Displaying 1 8 of 8 4 Select a column heading and drag and drop it to change the column order A green check mark displays next to the column s title when you drag the column to a valid new location Configuration Q Add j Ww UserName 3 radius users 5 mac users 2 Idap users 6 guest 7 boss 1 admin 4 ad users 8 MACexample Pag
458. s gt Add Edit O Add Address Rule Name Address Type IP Address 2 X 0 aad HOST v 0 0 0 0 Cancel NXC2500 User s Guide Chapter 18 Addresses The following table describes the labels in this screen Table 105 Configuration gt Object gt Address gt Address gt Add Edit LABEL DESCRIPTION Name Type the name used to refer to the address You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive Address Type Select the type of address you want to create Choices are HOST RANGE SUBNET INTERFACE IP INTERFACE SUBNET and INTERFACE GATEWAY Note The NXC automatically updates address objects that are based on an interface s IP address subnet or gateway if the interface s IP address settings change For example if you change ge1 s IP address the NXC automatically updates the corresponding interface based LAN subnet address object IP Address This field is only available if the Address Type is HOST This field cannot be blank Enter the IP address that this address object represents Starting IP This field is only available if the Address Type is RANGE This field cannot be blank Enter Address the beginning of the range of IP addresses that this address object represents Ending IP This field is only available if the Address Type is RANGE This
459. s Guide Chapter 13 IP MAC Binding Interfaces Used With IP MAC Binding P MAC address bindings are grouped by interface You can use IP MAC binding with Ethernet and VLAN interfaces You can also enable or disable P MAC binding and logging in an interface s configuration screen 13 2 IP MAC Binding Summary Click Configuration gt Network gt IP MAC Binding to open the IP MAC Binding Summary screen This screen lists the total number of IP to MAC address bindings for devices connected to each supported interface Figure 76 Configuration gt Network gt P MAC Binding gt Summary IP MAC Binding Summary AEdit Activate Inactivate Status Interface Number of Binding 2 Y ge2 0 ge3 0 ges 0 ges ges vlanO of 1 Show 50 v items Displaying 1 7 of 7 The following table describes the labels in this screen Table 70 Configuration gt Network gt P MAC Binding gt Summary LABEL DESCRIPTION Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Activate To turn on an entry select it and click Activate Inactivate To turn off an entry select it and click Inactivate H This field is a sequential value and it is not associated with a specific entry Status This icon is lit when the entry is active and dimmed when the entry is inactive Interface This is the name of an interface that supports IP MAC bindin
460. s log will be sent to the VRPT server 1st s physical port name 2nd s physical port status 1st u physical port Tx packets 2nd u physical port Rx packets 3rd u physical port packets collisions 4th u physical port Tx Bytes s 5th u physical port Rx Bytes s 3rd s physical port up time kts Su xB s u RxB s u name s Status s TxP RxPkts u Colli u T Interface statistics log This log will be sent to the VRPT server lst s interface name 2nd s interface status 1st u variable interface Tx packets 2nd u variable interface Rx packets 3rd u interface packets collisions 4th u interface Tx Bytes s 5th u interface Rx Bytes s NXC2500 User s Guide Appendix A Log Descriptions Table 180 Interface Logs continued LOG MESSAGE DESCRIPTION member Interface s connect MS CHAPv2 authentication failed the server must support mS CHAPv2 and failed MS CHAPv2 verify that the authentication failed this does not include cases where the mutual authentication Servers does not support MS CHAPv2 s interface name failed Interface s connect MS CHAP authentication failed the server must support MS CHAP and verify failed MS CHAP that the authentication failed this does not include cases where the server authentication does not support MS CHAP s interface name failed Interface s connect CHAP authentication failed t
461. s mode disabled Received packet is not an ARP response packet A packet was received but it is not an ARP response packet Receive an ARP response The device received an ARP response Receive ARP respons from s s The device received an ARP response from the listed source o The request IP is s sent from s The device accepted a request Received ARP response NOT for the request IP address The device received an ARP response that is NOT for the requested IP address Receive an ARP response from the client issuing the DHCP request The device received an ARP response from the client issuing the DHCP request Receive an ARP response from an unknown client The device received an ARP response from an unknown client In total received Sd arp response packets for the requested IP address The device received the specified total number of ARP response packets for the requested IP address Clear arp cache successfully The ARP cache was cleared successfully Client MAC address is not an Ethernet address A client MAC address is not an Ethernet address DHCP request received via interface Ss s s src_mac s with requested IP SS The device received a DHCP request through the specified interface IP confliction is detected Send back DHCP NAK IP conflict was detected Send back DHCP NAK Clear ARP cache done Clear ARP cach
462. s not recommended because it would leave the rest of the configuration blank If the interfaces were not configured before the first error the console port may be the only way to access the device Immediately stop applying the configuration file and roll back to the previous configuration this gets the NXC started with a fully valid configuration file as quickly as possible Ignore errors and finish applying the configuration file this applies the valid parts of the configuration file and generates error logs for all of the configuration file s errors This lets the NXC apply most of your configuration and you can refer to the logs for what to fix Ignore errors and finish applying the configuration file and then roll back to the previous configuration this applies the valid parts of the configuration file generates error logs for all of the configuration file s errors and starts the NXC with a fully valid configuration file Click OK to have the NXC start applying the configuration file or click Cancel to close the screen This column displays the number for each configuration file entry This field is a sequential value and it is not associated with a specific address The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space File Name This column displays the label that identifies a configuration file You cannot delete the
463. s the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to access Action This displays whether the computer with the IP address specified above can access the NXC zone s configured in the Zone field Accept or not Deny Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings Authentication Server You can set the NXC to work as a RADIUS server to exchange messages with a RADIUS client such as an AP for user authentication and authorization Click Configuration gt System gt Auth NXC2500 User s Guide Chapter 24 System Server tab The screen appears as shown Use this screen to enable the authentication server feature of the NXC and specify the RADIUS client s IP address Figure 170 Configuration gt System gt Auth Server General Settings V Enable Authentication Server Authentication Server Certificate default y Authentication Method default y Trusted Client add 2 Status Profile Name IP Address Mask Description 1 test 172 16 1 11 255 255 255 0 Page 1 of 1 Show 50 litems Displaying 1 1 of 1 a The following table describes the labels in this screen Table 146 Configuration gt System gt Auth Server LABEL Enable DESCRIPTION Select the check box to have the NXC act as a
464. se the attempt always fails Once an ext user user has been authenticated the NXC tries to get the user type from the external server If the external server does not have the information the NXC sets the user type for this session to User Ext Group User Accounts Ext Group User accounts work are similar to ext user accounts but allow you to group users by the value of the group membership attribute configured for the AD or LDAP server Ext Server Accounts Ext Server accounts are admin accounts that can log into the NXC from the WAN and which are authenticated by an associated RADIUS server Dynamic Guest Accounts Dynamic guest accounts are guest accounts but are created dynamically with the guest manager account and stored in the NXC s local user database A dynamic guest account has a dynamically created user name and password A dynamic guest account user can access the NXC s services only within a given period of time and will become invalid after the expiration date time You cannot modify or edit a dynamic guest account NXC2500 User s Guide Chapter 15 User Group MAC Address Accounts Use an external server to authenticate wireless clients by MAC address After authentication the NXC maps the wireless client to a mac address user account MAC role Configure user aware features to control MAC address user access to network services For example do the following to give a notebook access to a network printer
465. ser Group gt Group gt Add Edit Group LABEL DESCRIPTION Name Type the name for this user group You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive User group names have to be different than user names Description Enter the description of the user group if any You can use up to 60 characters punctuation marks and spaces Member List The Member list displays the names of the users and user groups that have been added to the user group The order of members is not important Select users and groups from the Available list that you want to be members of this group and move them to the Member list You can double click a single entry to move it or use the Shift or Ctrl key to select multiple entries and use the arrow button to move them Move any members you do not want included to the Available list OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 15 4 Setting This screen controls default settings login settings lockout settings and other user settings for the NXC You can also use this screen to specify when users must log in to the NXC before it routes traffic for them To access this screen login to the Web Configurator and click Configuration gt Object gt User Group gt Setting 176 NXC2500 User s Guide Chapter 15 User
466. ssfully with the myZyXEL com server Registration has failed Because of lack must fields The device received an incomplete response from the myZyXEL com server and it caused a parsing error for the device o s Trial service activation has failed s Trail service activation failed for the specified service an error message returned by the MyZyXEL com server will be appended to this log lst s service name 2nd s error message returned by the myZyXEL com server s Trial service activation has succeeded Trail service was activated successfully for the specified service s service name Trial service activation has failed Because of lack must fields The device received an incomplete response from the myZyXEL com server and it caused a parsing error for the device NXC2500 User s Guide Appendix A Log Descriptions Table 172 Registration Logs continued LOG MESSAGE DESCRIPTION Standard service activation has failed s Standard service activation failed this log will append an error message returned by the MyZyXEL com server s error message returned by the myZyXEL com server Standard service activation has succeeded Standard service activation has succeeded Standard service activation has failed Because of lack must fields The device received an incomplete response from the myZyXEL com server and it caused a parsing error f
467. st Key Algorithm This field displays the type of algorithm that was used to generate the certificate s key pair the NXC uses RSA encryption and the length of the key set in bits 1024 bits for example Subject Alternative Name This field displays the certificate owner s IP address IP domain name DNS or e mail address EMAIL Key Usage This field displays for what functions the certificate s key can be used For example DigitalSignature means that the key can be used to sign certificates and KeyEncipherment means that the key can be used to encrypt text Basic Constraint This field displays general information about the certificate For example Subject Type CA means that this is a certification authority s certificate and Path Length Constraint 1 means that there can only be one certification authority in the certificate s path This field does not display for a certification request NXC2500 User s Guide Chapter 23 Certificates Table 124 Configuration gt Object gt Certificate gt My Certificates gt Edit LABEL DESCRIPTION MD5 Fingerprint This is the certificate s message digest that the NXC calculated using the MD5 algorithm SHA1 Fingerprint This is the certificate s message digest that the NXC calculated using the SHA1 algorithm Certificate in PEM Base 64 Encoded This read only text box displays the certificate or certi
468. ster about this problem Before accepting this certificate you should examine this site s certificate carefully Are you willing to to accept this certificate for the purpose of identifying the Web site 172 20 37 202 Examine Certificate O Accept this certificate permanently gt HA MF this session O Do not accept this certificate and do not connect to this Web site 3 The certificate is stored and you can now connect securely to the Web Configurator A sealed padlock appears in the address bar which you can click to open the Page Info gt Security window to view the web page s security information 8 Page Info DER General Forms Links Media 15 Web Site Identity Verified The web site 172 20 37 202 supports authentication for the page you are viewing The identity of this web site has been verified by ZyXEL a certificate authority you trust for this purpose View the security certificate that verifies this web site s qe identity Connection Encrypted High grade Encryption AES 256 256 bit The page you are viewing was encrypted before being transmitted over the Internet Encryption makes it very difficult for unauthorized people to view information traveling between computers Itis therefore very unlikely that anyone read this page as it traveled across the network NXC2500 User s Guide Appendix C Importing Certificates Installing a Stand Alone Certificate File in Firefox 1 2 Rath
469. sures to protect against unauthorized access to or unauthorized alteration disclosure or destruction of data These include internal reviews of our data collection storage and processing practices and security measures as well as physical security measures to guard against unauthorized access to systems where we store personal data We pst Loe ABR 1 e a ae lt a n i A Y I accept the terms in the Privacy Policy The following table describes the labels in this screen Table 41 Configuration gt Licensing gt Registration LABEL DESCRIPTION General Settings If you select existing myZyXEL com account only the User Name and Password fields are available new myZyXEL com If you haven t created an account at myZyXEL com select this option and configure account the following fields to create an account and register your NXC existing myZyXEL com If you already have an account at myZyXEL com select this option and enter your account user name and password in the fields below to register your NXC UserName Enter a user name for your myZyXEL com account The name should be from six to 20 alphanumeric characters and the underscore Spaces are not allowed Check Click this button to check with the myZyXEL com database to verify the user name you entered has not been used Password Enter a password of between six and 20 alphanumeric characters and the underscore Spaces are not allowed Confirm Password
470. system processes many others have no particular meaning Unlike TCP and UDP Internet Control Message Protocol ICMP IP protocol 1 is mainly used to send error messages or to investigate problems For example ICMP is used to send the response if a computer cannot be reached Another use is ping ICMP does not guarantee delivery but networks often treat ICMP messages differently sometimes looking at the message itself to decide where to send it NXC2500 User s Guide 215 Chapter 19 Services Service Objects and Service Groups Use service objects to define IP protocols e TCP applications e UDP applications e ICMP messages e user defined services for other types of IP protocols These objects are used in policy routes Use service groups when you want to create the same rule for several services instead of creating separate rules for each service Service groups may consist of services and other service groups The sequence of members in the service group is not important 19 2 Service Summary The Service summary screen provides a summary of all services and their definitions In addition this screen allows you to add edit and remove services To access this screen log in to the Web Configurator and click Configuration gt Object gt Service gt Service Click a column s heading cell to sort the table entries by that column s criteria Click the heading cell again to reverse the sort order Figure 120 Co
471. t Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA At the time of writing the most widely available supplicant is the WPA patch for Windows XP Funk Software s Odyssey client The Windows XP patch is a free download that adds WPA capability to Windows XP s built in Zero Configuration wireless client However you must run Windows XP to use it NXC2500 User s Guide Appendix D Wireless LANs WPA 2 with RADIUS Application Example To set up WPA 2 you need the IP address of the RADIUS server its port number default is 1812 and the RADIUS shared secret A WPA 2 application example with an external RADIUS server looks as follows A is the RADIUS server DS is the distribution system 1 The AP passes the wireless client s authentication request to the RADIUS server 2 The RADIUS server then checks the user s identification against its database and grants or denies network access accordingly 3 A 256 bit Pairwise Master Key PMK is derived from the authentication process by the RADIUS server and the client 4 The RADIUS server distributes the PMK to the AP The AP then sets up a key hierarchy and management system using the PMK to dynamically generate unique data encryption keys The keys are used to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients Figure 210
472. t If none are available you can create one in Configuration gt Object gt Schedule Authentication Select whether authentication is required or not necessary for this rule Force User Select this option to redirect HTTP traffic to the login screen if the user has not logged in Authentication yet OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving NXC2500 User s Guide Chapter 14 Captive Portal 14 3 Login Page The login page appears whenever the captive portal intercepts network traffic preventing unauthorized users from gaining access to the network Use this page to select the default login page or customize it Click Configuration gt Captive Portal gt Login Page to display it Figure 84 Configuration gt Captive Portal gt Login Page Select Type Use Default Login Page 9 Use Customized Login Page Use uploaded file Logo File To upload a logo file gif pna jpa browse to the location of the file and then click Upload support format gif pna jpg maximum size 100K suggest pixel size T 103 29 x Fie Path Upload Select a fie path NXC2500 Customized Login Page Title TitleColor Message Color NXC2500 378ec9 Color CSS color code CSS color code black Color y Note Message Background support format gif pna jpg maximum size 100K Picture 3 Color CS
473. t Network gt NAT gt Add Edit LABEL DESCRIPTION Create new Use to configure any new settings objects that you need to use in this screen Object Enable Rule Use this option to turn the NAT rule on or off Rule Name Type in the name of the NAT rule The name is used to refer to the NAT rule You may use 1 31 alphanumeric characters underscores _ or dashes but the first character cannot be a number This value is case sensitive NXC2500 User s Guide Chapter 11 NAT Table 68 Configuration gt Network gt NAT gt Add Edit continued LABEL DESCRIPTION Classification Select what kind of NAT this rule is to perform Virtual Server This makes computers on a private network behind the NXC available to a public network outside the NXC like the Internet 1 1 NAT If the private network server will initiate sessions to the outside clients select this to have the NXC translate the source IP address of the server s outgoing traffic to the same public IP address that the outside clients use to access the server Many 1 1 NAT If you have a range of private network servers that will initiate sessions to the outside clients and a range of public IP addresses select this to have the NXC translate the source IP address of each server s outgoing traffic to the same one of the public IP addresses that the outside clients use to access the server The private and public ranges must have
474. t Static Route LABEL DESCRIPTION Add Click this to create a new static route Edit Double click an entry or select it and click Edit to open a screen where you can modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so NXC2500 User s Guide Chapter 9 Policy and Static Routes Table 61 Configuration gt Network gt Routing gt Static Route continued LABEL DESCRIPTION This is the number of an individual static route Destination This is the destination IP address Subnet Mask This is the IP subnet mask Next Hop This is the IP address of the next hop gateway or the interface through which the traffic is routed The gateway is a router or switch on the same segment as your NXC s interface s The gateway helps forward packets to their destinations Metric This is the route s priority among the NXC s routes The smaller the number the higher priority the route has 9 3 1 Static Route Setting Select a static route index number and click Add or Edit The screen shown next appears Use this screen to configure the required information for a static route Figure 65 Configuration gt Network gt Routing gt Static Route gt Add Edit IPv4 Static Route Setting Destination IP Subnet Mask O Gateway IP Interface Metric pT The following table descri
475. t The NXC ignores any errors in the configuration file or shell script and applies all of the valid commands The NXC still generates a log for any errors 26 2 Configuration File Click Maintenance gt File Manager gt Configuration File to open this screen Use the Configuration File screen to store run and name configuration files You can also download configuration files from the NXC to your computer and upload configuration files from your computer to the NXC Once your NXC is configured and functioning properly it is highly recommended that you back up your configuration file before making further configuration changes The backup configuration file will be useful in case you need to return to your previous settings NXC2500 User s Guide a Chapter 26 File Manager Configuration File Flow at Restart e If there is not a startup config conf when you restart the NXC whether through a management interface or by physically turning the power off and back on the NXC uses the system default conf configuration file with the NXC s default settings e If there is a startup config conf the NXC checks it for errors and applies it If there are no errors the NXC uses it and copies it to the lastgood conf configuration file as a back up file If there is an error the NXC generates a log and copies the startup config conf configuration file to the startup config bad conf configuration file and tries the existing lastgood con
476. t Wireless gt AP Information gt Radio List continued LABEL DESCRIPTION Frequency This indicates the wireless frequency currently being used by the radio This shows when the radio is in monitor mode Channel ID This indicates the radio s channel ID Station This displays the number of stations aka wireless clients associated with the radio Rx PKT This displays the total number of packets received by the radio Tx PKT This displays the total number of packets transmitted by the radio Rx FCS Error Count This indicates the number of received packet errors accrued by the radio Tx Retry Count This indicates the number of times the radio has attempted to re transmit packets The following table describes the icons in this screen Table 35 Monitor gt Wireless gt AP Information gt Radio List Icons LABEL DESCRIPTION When an AP is being load balanced this icon means it is operating over the maximum allocated bandwidth When an AP is being load balanced this icon means it is operating under the maximum allocated bandwidth NXC2500 User s Guide Chapter 5 Monitor 5 12 1 AP Mode Radio Information This screen allows you to view detailed information about a selected radio s SSID s wireless traffic and wireless clients for the preceding 24 hours To access this window select an entry and click the More Information button in the Radio List screen
477. t Identity Protection No No Yes Yes No WPA and WPA2 Wi Fi Protected Access WPA is a subset of the IEEE 802 11i standard WPA2 IEEE 802 11i isa wireless security standard that defines stronger encryption authentication and key management than WPA Key differences between WPA or WPA2 and WEP are improved data encryption and user authentication If both an AP and the wireless clients support WPA2 and you have an external RADIUS server use WPA2 for stronger data encryption If you don t have an external RADIUS server you should use WPA2 PSK WPA2 Pre Shared Key that only requires a single identical password entered into each access point wireless gateway and wireless client As long as the passwords match a wireless client will be granted access to a WLAN If the AP or the wireless clients do not support WPA2 just use WPA or WPA PSK depending on whether you have an external RADIUS server or not Select WEP only when the AP and or wireless clients do not support WPA or WPA2 WEP is less secure than WPA or WPA2 Encryption Both WPA and WPA2 improve data encryption by using Temporal Key Integrity Protocol TKIP Message Integrity Check MIC and IEEE 802 1x WPA and WPA2 use Advanced Encryption Standard AES in the Counter mode with Cipher block chaining Message authentication code Protocol CCMP to offer stronger encryption than TKIP TKIP uses 128 bit keys that are dynamically generated and distributed by the authe
478. t data for the report If the NXC has already been collecting data the collection period displays to the right The progress is not tracked here real time but you can click the Refresh button to update it Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings Statistics Interface Select the interface from which to collect information You can collect information from Ethernet or VLAN interfaces NXC2500 User s Guide Chapter 5 Monitor Table 24 Monitor gt System Status gt Traffic Statistics continued LABEL DESCRIPTION Sort By Select the type of report to display Choices are Host I P Address User displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one Service Port displays the most used protocols or service ports and the amount of traffic for each one Web Site Hits displays the most visited Web sites and how many times each one has been visited Each type of report has different information in the report below Refresh Click this button to update the report display Flush Data Click this button to discard all of the screen s statistics and update the report display These fields are available when the report type is Host I P Address User This field is the rank of each record The IP addresses and users are sorted by the amount of traffic
479. t entries move up by one when you take this action Move To change an entry s position in the numbered list select the method and click Move to display a field to type a number for where you want to put it and press ENTER to move the rule to the number that you typed This the index number of the service control rule The ordering of your rules is important as rules are applied in sequence The entry with a hyphen instead of a number is the NXC s non configurable default policy The NXC applies this to traffic that does not match any other configured rule It is not an editable rule To apply other behavior configure a rule that traffic will match so the NXC will not have to use the default policy Zone This is the zone on the NXC the user is allowed or denied to access Address This is the object name of the IP address es with which the computer is allowed or denied to send DNS queries Action This displays whether the NXC accepts DNS queries from the computer with the IP address specified above through the specified zone Accept or discards them Deny NXC2500 User s Guide 267 Chapter 24 System 24 6 3 Address Record An address record contains the mapping of a Fully Qualified Domain Name FQDN to an IP address An FQDN consists of a host and domain name For example www zyxel com is a fully qualified domain name where www is the host zyxel is the second level domain and com is the top
480. t is safer faster and smarter because you re using portal Think you NXC2500 User s Guide 167 Chapter 14 Captive Portal Figure 91 External Web Portal Error Page Example ZyXEL Validate user has failed Login failure Please click Retry to login again Here are the error codes the NXC sends to the External Web Portal Error page Table 79 External Web Portal Error Page Error Codes ERROR CODE TITLE MESSAGE 1 Login denied Validation failed 2 Login denied Login attempt from a locked out address 3 Login denied Simultaneous admin access logons or users have reached the maximum number Here are the HTTP parameters the NXC uses with the external URL Table 80 HTTP Parameters for External URL PARAMETER DESCRIPTION LOGIN WELCOME SESSION LOGOUT ERROR gw_addr NXC IP Address V V V V error_num Login error code V auth_hour The remaining hours before V authentication timeout auth_min The remaining minutes before V authentication timeout auth_sec The remaining seconds before V authentication timeout lease_time Total remaining seconds before lease V timeout username Login username V cgi_str The CGI for user login The admin V type is admin cgi and the user related type is login cgi Ses_time Accounting session timeout V 168 NXC2500 User s Guide 15 1 Overview User Group This chapter describes ho
481. t successfully if you only want to see statistics for a 24 hour period Reset All Click this to discard all report data and start all of the counters over at zero Counters Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 25 3 Log Settings These screens control log messages and alerts A log message stores the information for viewing for example in the View Log tab or regular e mailing later and an alert is e mailed immediately Usually alerts are used for events that require more serious attention such as system errors and attacks The NXC provides a system log and supports e mail profiles and remote syslog servers The system log is available on the View Log tab the e mail profiles are used to mail log messages to the specified destinations and the other four logs are stored on specified syslog servers The Log Settings tab also controls what information is saved in each log For the system log you can also specify which log messages are e mailed where they are e mailed and how often they are e mailed For alerts the Log Settings tab controls which events generate alerts and where alerts are e mailed The Log Settings Summary screen provides a summary of all the settings You can use the Log Settings Edit screen to maintain the detailed settings such as log categories e mail addresses server names etc for any log Alternatively if you want to
482. tag or untag AP doesn t support s feature MAC 02x 02x 02x 02x 502x 0 2x AP s An AP doesn t support a feature 1st s feature name 2st 02x 7th 02x Managed AP MAC Address 8th s Managed AP Description Table 189 CAPWAP Client Logs LOG MESSAGE DESCRIPTION AP Start Discovery Type s Start the CAPWAP Client service 1st s Discovery type Static DHCP DNS Broadcast AP Reset Discovery Type s Reset the CAPWAP Client service 1st s Discovery type Static DHCP DNS Broadcast Connect to WLAN Controller CAPWAP Client connected to the WLAN Controller 1st s WLAN Controller IP Address IP s Disconnect from WLAN Controller CAPWAP Client disconnected from to the WLAN Controller 1st s WLAN Controller IP Address NXC2500 User s Guide Appendix A Log Descriptions Table 189 CAPWAP Client Logs LOG MESSAGE DESCRIPTION Updated Configuration by a WLAN Configuration upgraded success by WLAN Controller Controller Success Partial Update Updated Configuration by a WLAN Configuration upgraded fail by WLAN Controller Controller Fail ReBoot by a WLAN Controller Reboot the WTP by WLAN Controller IP ds 1st s WLAN Controller IP Address Firmware Upgraded by WLAN Firmware upgraded by WLAN Controller ller 2 CORED IAS 1st s WLAN Controller IP Address Apply Configuration by a WLAN Configuration apply su
483. te certificates that any of the NXC s features are configured to use Select an entry and click Object Reference to open a screen that shows which settings use the entry This field displays the certificate index number The certificates are listed in alphabetical order Name This field displays the name used to identify this certificate Subject This field displays identifying information about the certificate s owner such as CN Common Name OU Organizational Unit or department O Organization or company and C Country It is recommended that each certificate have unique subject information Issuer This field displays identifying information about the certificate s issuing certification authority such as a common name organizational unit or department organization or company and country With self signed certificates this is the same information as in the Subject field Valid From This field displays the date that the certificate becomes applicable Valid To This field displays the date that the certificate expires The text displays in red and includes an Expired message if the certificate has expired Import Click Import to open a screen where you can save the certificate of a certification authority that you trust from your computer to the NXC Refresh Click this button to display the current validity status of the certificates NXC2500 User s Guide Chapter 23 Certificates 23 3 1
484. te contains the certificate owner s identity and public key Certificates provide a way to exchange public keys for use in authentication 23 1 1 What You Can Do in this Chapter The My Certificate screens Section 23 2 on page 244 generate and export self signed certificates or certification requests and import the NXC s CA signed certificates The Trusted Certificates screens Section 23 3 on page 252 save CA certificates and trusted remote host certificates to the NXC The NXC trusts any valid certificate that you have imported as a trusted certificate It also trusts any valid certificate signed by any of the certificates that you have imported as a trusted certificate 23 1 2 What You Need to Know The following terms and concepts may help as you read this chapter When using public key cryptology for authentication each host has two keys One key is public and can be made openly available The other key is private and must be kept secure These keys work like a handwritten signature in fact certificates are often referred to as digital signatures Only you can write your signature exactly as it should look When people know what your signature looks like they can verify whether something was signed by you or by someone else In the same way your private key writes your digital signature and your public key allows people to verify whether data was signed by you or by someone else This process works as follows
485. ted by open source software NXC2500 User s Guide Chapter 25 Log and Report The following table describes the fields in this screen Table 154 Configuration gt Log Report gt Log Settings gt Log Category Settings LABEL DESCRIPTION System log Use the System Log drop down list to change the log settings for all of the log categories disable all logs red X do not log any information for any category for the system log or e mail any logs to e mail server 1 or 2 enable normal logs green check mark create log messages and alerts for all categories for the system log If e mail server 1 or 2 also has normal logs enabled the NXC will e mail logs to them enable normal logs and debug logs yellow check mark create log messages alerts and debugging information for all categories The NXC does not e mail debugging information even if this setting is selected USB Storage Use the USB Storage drop down list to change the log settings for saving logs to a connected USB storage device disable all logs red X do not log any information for any category to a connected USB storage device enable normal logs green check mark create log messages and alerts for all categories and save them to a connected USB storage device enable normal logs and debug logs yellow check mark create log messages alerts and debugging information for all categories and save them to a connected USB storag
486. ted to abnormal working conditions Note Repair or replacement as provided under this warranty is the exclusive remedy of the purchaser This warranty is in lieu of all other warranties express or implied including any implied warranty of merchantability or fitness for a particular use or purpose ZyXEL shall in no event be held liable for indirect or consequential damages of any kind to the purchaser To obtain the services of this warranty contact your vendor You may also refer to the warranty policy for the region in which you bought the device at http www zyxel com web support_warranty_info php NXC2500 User s Guide 417 Appendix E Legal Information Registration Register your product online to receive e mail notices of firmware upgrades and information at www zyxel com for global products or at www us zyxel com for North American products Open Source Licenses This product contains in part some free software distributed under GPL license terms and or GPL like licenses Open source licenses are provided with the firmware package You can download the latest firmware at www zyxel com To obtain the source code covered under those Licenses please contact support zyxel com tw to get it Safety Warnings Do NOT use this product near water for example in a wet basement or near a swimming pool Do NOT expose your device to dampness dust or corrosive liquids Do NOT store things on the device Do NOT install use
487. tem gt DNS gt Add Service Control Rule Q Add Service Control 2x US Create new Object Address Object ALL v Zone ALL v Action Accept v 270 NXC2500 User s Guide Chapter 24 System The following table describes the labels in this screen Table 138 Configuration gt System gt DNS gt Add Service Control Rule LABEL DESCRIPTION Create new Use this to configure any new settings objects that you need to use in this screen Object Address Object Select ALL to allow or deny any computer to send DNS queries to the NXC Select a predefined address object to just allow or deny the computer with the IP address that you specified to send DNS queries to the NXC Zone Select ALL to allow or prevent DNS queries through any zones Select a predefined zone on which a DNS query to the NXC is allowed or denied Action Select Accept to have the NXC allow the DNS queries from the specified computer Select Deny to have the NXC reject the DNS queries from the specified computer OK Click OK to save your customized settings and exit this screen Cancel Click Cancel to exit this screen without saving 24 7 WWW Overview The following figure shows secure and insecure management of the NXC coming in from the WAN HTTPS and SSH access are secure HTTP and Telnet management access are not secure Figure 153 Secure and Insecure Service Access From the WAN WAN IIS HTTP lt lt
488. ter up to 60 characters spaces and underscores allowed OK Click OK to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes 202 NXC2500 User s Guide 17 MON Profile 17 1 Overview This screen allows you to set up monitor mode configurations that allow your connected APs to scan for other wireless devices in the vicinity Once detected you can use the MON Mode screen Chapter 7 on page 89 to classify them as either rogue or friendly and then manage them accordingly 17 1 1 What You Can Do in this Chapter The MON Profile screen Section 17 2 on page 204 creates preset monitor mode configurations that can be used by the APs 17 1 2 What You Need To Know The following terms and concepts may help as you read this chapter Active Scan An active scan is performed when an 802 11 compatible wireless monitoring device is explicitly triggered to scan a specified channel or number of channels for other wireless devices broadcasting on the 802 11 frequencies by sending probe request frames Passive Scan A passive scan is performed when an 802 11 compatible monitoring device is set to periodically listen to a specified channel or number of channels for other wireless devices broadcasting on the 802 11 frequencies NXC2500 User s Guide Chapter 17 MON Profile 17 2 MON Profile This screen allows you to create monitor mode configurations that can
489. th any APs assigned to the load balancing task e Check to be sure that the AP profile which contains the load balancing settings is correctly assigned to the APs in question e The load balancing task may have been terminated because further load balancing on the APs in question is no longer required 31 2 Resetting the NXC If you cannot access the NXC by any method try restarting it by turning the power off and then on again If you still cannot access the NXC by any method or you forget the administrator password s you can reset the NXC to its factory default settings Any configuration files or shell scripts that you saved on the NXC should still be available afterwards Use the following procedure to reset the NXC to its factory default settings This overwrites the settings in the startup config conf file with the settings in the system default conf file Note This procedure removes the current configuration 1 Make sure the SYS LED is on and not blinking 2 Press the RESET button and hold it until the SYS LED begins to blink This usually takes about five seconds 3 Release the RESET button and wait for the NXC to restart You should be able to access the NXC using the default settings NXC2500 User s Guide Chapter 31 Troubleshooting 31 3 Getting More Troubleshooting Help Search for support information for your model at www zyxel com for more troubleshooting suggestions NXC2500 User s Guide 357
490. the Certificates dialog box click the Trusted Root Certificates Authorities tab select the certificate that you want to delete and then click Remove Certificates x Intended purpose lt All gt Intermediate Certification Authoritits Trusted Root Certification Authorities TJlisted Publ gt Issued To Issued By Expiratio Friendly Name A ES 172 20 37 202 172 20 37 202 5 21 2011 E aga Ecom RootCA ABA ECOM Root CA 7 10 2009 DST ABA ECOM E Autoridad Certifica Autoridad Certificador 6 29 2009 Autoridad Certif E Autoridad Certifica Autoridad Certificador 6 30 2009 Autoridad Certif EAbaltimore EZ byDST Baltimore EZ by DST 7 4 2009 DST Baltimore E Ebelgacom E TrustP Belgacom E Trust Prim 1 21 2010 Belgacom E Trus E caw HKT SecureN C amp W HKT SecureNet 10 16 2009 CW HKT Secure Ecaw HKT SecureN C amp W HKT SecureNet 10 16 2009 CW HKT Secure Edcaw HKT SecureN C amp W HKT SecureNet 10 16 2010 CW HKT Secure meot opor Certificate intended purposes lt All gt 4 Inthe Certificates confirmation click Yes Certificates Deleting system root certificates might prevent some Windows components from working properly If Update Root Certificates is installed any deleted third party root certificates will be restored automatically but the system root certificates will not Do you want to delete the selected certificate s 5 Inthe
491. the IP address of a DNS server This field displays N A if you have the NXC get a DNS server IP address from the ISP dynamically but the specified interface is not active Query Via This is the interface through which the NXC sends DNS queries to the entry s DNS server A MX Mail eXchange record identifies a mail server that handles the mail for a particular domain Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequent entries move up by one when you take this action This is the index number of the MX record Domain Name This is the domain name where the mail is destined for IP FQDN This is the IP address or Fully Qualified Domain Name FQDN of a mail server that handles the mail for the domain specified in the field above Service Control This specifies from which computers and zones you can send DNS queries to the NXC Add Click this to create a new entry Select an entry and click Add to create a new entry after the selected entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Note that subsequen
492. the beacon A high value helps save current consumption of the access point DTIM Delivery Traffic Indication Message DTIM is the time period after which broadcast and multicast packets are transmitted to mobile clients in the Active Power Management mode A high DTIM value can cause clients to lose connectivity with the network This value can be set from 1 to 255 Output Power Set the output power of the AP in this field If there is a high density of APs in an area decrease the output power of the NWA5160N to reduce interference with other APs Select one of the following 100 50 25 or 12 5 See the product specifications for more information on your NXC s output power Note Reducing the output power also reduces the NXC s effective broadcast radius Enable RSSI Threshold Use the Received Signal Strength Indication RSSI threshold to ensure wireless clients receive good throughput This allows only wireless clients with a strong signal to connect to the AP Select the check box and set a minimum client signal strength for connecting to the AP 20 dBm is the strongest signal you can require and 76 is the weakest Clear the check box to not require wireless clients to have a minimum signal strength to connect to the AP NXC2500 User s Guide Chapter 16 AP Profile Table 95 Configuration gt Object gt AP Profile gt Add Edit Radio Profile continued LABEL DESCRIPTION
493. the current IP address and subnet mask assigned to the interface Device Information System Name This field displays the name used to identify the NXC on any network Click the link to open the screen where you can change it Model Name This field displays the model name of this NXC Serial Number This field displays the serial number of this NXC MAC Address This field displays the MAC addresses used by the NXC Each physical port has one MAC Range address The first MAC address is assigned to physical port 1 the second MAC address is assigned to physical port 2 and so on Firmware This field displays the version number and date of the firmware the NXC is currently Version running Click the link to open the screen where you can upload firmware System Resources CPU Usage This field displays what percentage of the NXC s processing capability is currently being used Hover your cursor over this field to display the Show CPU Usage icon that takes you to a chart of the NXC s recent CPU usage Memory Usage This field displays what percentage of the NXC s RAM is currently being used Hover your cursor over this field to display the Show Memory Usage icon that takes you to a chart of the NXC s recent memory usage Flash Usage This field displays what percentage of the NXC s onboard flash memory is currently being used USB Storage Usage This field shows how much storage in th
494. thernet interfaces 103 and routing protocols 104 Ethernet ports 17 default settings 26 Extended Service Set Dentification 187 Extended Service Set See ESS 406 F FCC interference statement 417 file extensions configuration files 313 shell scripts 313 file manager 313 Firefox 29 firmware and restart 319 boot module see boot module current version 51 320 getting updated 319 uploading 319 320 uploading with FTP 288 flash usage 51 FQDN 268 fragmentation threshold 409 front panel ports 17 FTP 288 NXC2500 User s Guide Index additional signaling port 148 ALG 147 and address groups 289 and address objects 289 and certificates 288 and zones 289 signaling port 148 with Transport Layer Security TLS 288 Fully Qualified Domain Name see FQDN G ge 17 Gigabit Ethernet 17 ports 17 Guide CLI Reference 2 Quick Start 2 H hidden node 408 HTTP over SSL see HTTPS redirect to HTTPS 274 vs HTTPS 272 HTTPS 272 and certificates 272 authenticating clients 272 avoiding warning messages 277 example 276 vs HTTP 272 with Internet Explorer 276 HyperText Transfer Protocol over Secure Socket Layer see HTTPS IBSS 405 ICMP 215 IEEE 802 11g 409 IEEE 802 1q VLAN IEEE 802 1x 188 Independent Basic Service Set See IBSS 405 initialization vector IV 414 interface mapping 17 status 52 63 types 17 interfaces 17 103 and DNS servers 123 and NAT 142 and physical ports 17 103 and policy r
495. this using the certificate s fingerprint A certificate s fingerprint is a message digest calculated using the MD5 or SHA1 algorithm The following procedure describes how to check a certificate s fingerprint to verify that you have the actual certificate 1 Browse to where you have the certificate saved on your computer 2 Make sure that the certificate has a cer or crt file name extension ELondon Office cer y kd L ESLa office crt Remote Host Certificates 3 Double click the certificate s icon to open the Certificate window Click the Details tab and scroll down to the Thumbprint Algorithm and Thumbprint fields Certificate 21x General Details Certification Path Show lt a gt Field Value subject Glenn public key RSA 1024 Bits Falkey Usage Digital Signature Certificate Signing 3 DNS Name Glenn Basic Constraints Subject Type CA Path Length Cons C ES Thumbprint algorithm shal Thumbprint BOA7 2286 7960 FF92 52F4 6B4C AZ as 4 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields The secure method may very based on your situation Possible examples would be over the telephone or through an HTTPS connection NXC2500 User s Guide Chapter 23 Certificates 23 2 My Certificates Click Configuration gt Object gt Certificate gt My Certificates to open this screen This
496. tics for each physical port The Port Statistics Graph screen Section 5 3 1 on page 62 displays a line graph of packet statistics for each physical port The Interface Status screen Section 5 4 on page 63 displays all of the NXC s interfaces and their packet statistics The Traffic Statistics screen Section 5 5 on page 64 allows you to start or stop data collection and view statistics The Session Monitor screen Section 5 6 on page 67 displays sessions by user or service The IP MAC Binding screen Section 5 7 on page 69 displays lists of the devices that have received an IP address from NXC interfaces with P MAC binding enabled The Login Users screen Section 5 8 on page 70 displays a list of the users currently logged into the NXC The Dynamic Guest screen Section 5 9 on page 70 displays a list of the guest user accounts which are created automatically and allowed to access the NXC s services for a certain period of time The USB Storage screen Section 5 10 on page 71 displays information about a connected USB storage device The AP List screen Section 5 11 on page 73 displays which APs are currently connected to the NXC The Radio List screen Section 5 12 on page 75 displays statistics about the wireless radio transmitters in each of the APs connected to the NXC The Station List screen Section 5 13 on page 78 displays statistics pertaining to the connected stations or wireless clients The Det
497. tion files You cannot rename the lastgood conf system default conf and startup config conf files You cannot rename a configuration file to the name of another configuration file in the NXC Click a configuration file s row to select it and click Rename to open the Rename File screen 1 Rename 2 x Source file startup config back conf Target file OK Cancel Specify the new name for the configuration file Use up to 25 characters including a zA Z0 9 amp _ Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file Remove Click a configuration file s row to select it and click Remove to delete it from the NXC You can only delete manually saved configuration files You cannot delete the system default conf startup config conf and lastgood conf files A pop up window asks you to confirm that you want to delete the configuration file Click OK to delete the configuration file or click Cancel to close the screen without deleting the configuration file Download Click a configuration file s row to select it and click Download to save the configuration to your computer Copy Use this button to save a duplicate of a configuration file on the NXC Click a configuration file s row to select it and click Copy to open the Copy File screen P Copy File x Source file startup config co
498. tions e Cost Savings IPPR allows organizations to distribute interactive traffic on high bandwidth high cost paths while using low cost paths for batch traffic e Load Sharing Network administrators can use I PPR to distribute traffic among multiple paths Static Routes The NXC usually uses the default gateway to route outbound traffic from computers on the LAN to the Internet To have the NXC send data to devices not reachable through the default gateway use static routes Policy Routes Versus Static Routes e Policy routes are more flexible than static routes You can select more criteria for the traffic to match and can also use schedules and NAT NXC2500 User s Guide 125 Chapter 9 Policy and Static Routes e Policy routes are only used within the NXC itself Static routes can be propagated to other routers e Policy routes take priority over static routes If you need to use a routing policy on the NXC and propagate it to other routers you could configure a policy route and an equivalent static route DiffServ QoS is used to prioritize source to destination traffic flows All packets in the same flow are given the same priority CoS class of service is a way of managing traffic in a network by grouping similar types of traffic together and treating each type as a class You can use CoS to give different priorities to different packet types DiffServ Differentiated Services is a class of service CoS mod
499. to automatically select the radio channel upon which it broadcasts by scanning the area around it and determining what channels are currently being used by other devices Load Balancing Wireless Wireless load balancing is the process where you limit the number of connections allowed on an wireless access point AP or you limit the amount of wireless traffic transmitted and received on it so the AP does not become overloaded NXC2500 User s Guide Chapter 7 Wireless 7 2 Controller Use this screen to set how the NXC allows new APs to connect to the network Click Configuration gt Wireless gt Controller to access this screen Figure 42 Configuration gt Wireless gt Controller Controller Setting Registration Type 5 Manual 9 Always Accept Each field is described in the following table Table 43 Configuration gt Wireless gt Controller LABEL DESCRIPTION Registration Select Manual to add each AP to the NXC for management or Always Accept to Type automatically add APs to the NXC for management Note Select the Manual option for managing a specific set of APs This is recommended as the registration mechanism cannot automatically differentiate between friendly and rogue APs For details on how to handle rogue APs see Section 5 14 on page 79 APs must be connected to the NXC by a wired connection or network Apply Click Apply to save your changes back to the NXC Reset Click Reset to
500. to save the certificate on the NXC Cancel Click Cancel to quit and return to the previous screen 23 4 Technical Reference The following section contains additional technical information about the features described in this chapter OCSP OCSP Online Certificate Status Protocol allows an application or device to check whether a certificate is valid With OCSP the NXC checks the status of individual certificates instead of downloading a Certificate Revocation List CRL OCSP has two main advantages over a CRL The first is real time status information The second is a reduction in network traffic since the NXC only gets information on the certificates that it needs to verify not a huge list When the NXC requests certificate status information the OCSP server returns a expired current or unknown response NXC2500 User s Guide 257 Chapter 23 Certificates NXC2500 User s Guide System 24 1 Overview Use the system screens to configure general NXC settings 24 1 1 What You Can Do in this Chapter The Host Name screen Section 24 2 on page 260 configures a unique name for the NXC in your network The USB Storage screen Section 24 3 on page 260 configures the settings for the connected USB devices The Date Time screen Section 24 4 on page 261 configures the date and time for the NXC The Console Speed screen Section 24 5 on page 264 configures the console port speed when you con
501. to save your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide AP Profile 16 1 Overview This chapter shows you how to configure preset profiles for the Access Points APs connected to your NXC s wireless network 16 1 1 What You Can Do in this Chapter The Radio screen Section 16 2 on page 188 creates radio configurations that can be used by the APs e The SSID screen Section 16 3 on page 193 configures three different types of profiles for your networked APs 16 1 2 What You Need To Know The following terms and concepts may help as you read this chapter Wireless Profiles At the heart of all wireless AP configurations on the NXC are profiles A profile represents a group of saved settings that you can use across any number of connected APs You can set up the following wireless profile types e Radio This profile type defines the properties of an AP s radio transmitter You can have a maximum of 32 radio profiles on the NXC SSID This profile type defines the properties of a single wireless network signal broadcast by an AP Each radio on a single AP can broadcast up to 8 SSIDs You can have a maximum of 32 SSID profiles on the NXC Security This profile type defines the security settings used by a single SSID It controls the encryption method required for a wireless client to associate itself with the SSID You can have a ma
502. tomatically Use Fixed IP Select this if you want to specify the IP address subnet mask and gateway manually Address IP Address This field is enabled if you select Use Fixed IP Address Enter the IP address for this interface Subnet Mask This field is enabled if you select Use Fixed IP Address Enter the subnet mask of this interface in dot decimal notation The subnet mask indicates what part of the IP address is the same for all computers in the network Gateway This field is enabled if you select Use Fixed IP Address Enter the IP address of the gateway The NXC sends packets to the gateway when it does not know how to route the packet to its destination The gateway should be on the same network as the interface Metric Enter the priority of the gateway if any on this interface The NXC decides which gateway to use based on this priority The lower the number the higher the priority If two or more gateways have the same priority the NXC uses the one that was configured first Related Setting Configure Policy Route Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this VLAN Interface Parameters Egress Enter the maximum amount of traffic in kilobits per second the NXC can send through Bandwidth the interface to the network Allowed values are 0 1048576 NXC2500 User s Guide Chapter 8 Interfaces Table 56 Conf
503. trol table to access the NXC Web Configurator using secure HTTPs connections Server Port The HTTPS server listens on port 443 by default If you change the HTTPS server port to a different number on the NXC for example 8443 then you must notify people who need to access the NXC Web Configurator to use https NXC IP Address 8443 as the URL Authenticate Client Certificates Select Authenticate Client Certificates optional to require the SSL client to authenticate itself to the NXC by sending the NXC a certificate To do that the SSL client must have a CA signed certificate from a CA that has been imported as a trusted CA on the NXC Server Certificate Select a certificate the HTTPS server the NXC uses to authenticate itself to the HTTPS client You must have certificates already configured in the My Certificates screen Redirect HTTP to HTTPS To allow only secure Web Configurator access select this to redirect all HTTP connection requests to the HTTPS server Admin User Service Control Admin Service Control specifies from which zones an administrator can use HTTPS to manage the NXC using the Web Configurator You can also specify the IP addresses from which the administrators can manage the NXC User Service Control specifies from which zones a user can use HTTPS to log into the NXC You can also specify the IP addresses from which the users can access the NXC A
504. ts IP address to another DHCP client In the NXC some interfaces can provide DHCP services to the network In this case the interface can be a DHCP relay or a DHCP server As a DHCP relay the interface routes DHCP requests to DHCP servers on different networks You can specify more than one DHCP server If you do the interface routes DHCP requests to all of them It is possible for an interface to be a DHCP relay and a DHCP client simultaneously As a DHCP server the interface provides the following information to DHCP clients IP address If the DHCP client s MAC address is in the NXC s static DHCP table the interface assigns the corresponding IP address If not the interface assigns IP addresses from a pool defined by the starting address of the pool and the pool size Table 58 Example Assigning IP Addresses from a Pool START IP ADDRESS POOL SIZE RANGE OF ASSIGNED IP ADDRESS 50 50 50 33 5 50 50 50 33 50 50 50 37 75 75 75 1 200 75 75 75 1 75 75 75 200 99 99 1 1 1023 99 99 1 1 99 99 4 255 120 120 120 100 100 120 120 120 100 120 120 120 199 The NXC cannot assign the first address network address or the last address broadcast address in the subnet defined by the interface s IP address and subnet mask For example in the first entry if the subnet mask is 255 255 255 0 the NXC cannot assign 50 50 50 0 or 50 50 50 255 If the subnet mask is 255 255 0 0 the NXC cannot assign 50 50 0 0 or 50
505. ts the types of authentication server the NXC supports e Local user database The NXC uses the built in local user database to authenticate administrative users logging into the NXC s Web Configurator or network access users logging into the network through the NXC NXC2500 User s Guide Chapter 21 AAA Server e Directory Service LDAP AD LDAP Lightweight Directory Access Protocol AD Active Directory is a directory service that is both a directory and a protocol for controlling access to a network The directory consists of a database specialized for fast information retrieval and filtering activities You create and store user profile and login information on the external server e RADIUS RADIUS Remote Authentication Dial n User Service authentication is a popular protocol used to authenticate users by means of an external or built in RADIUS server RADIUS authentication allows you to validate a large number of users from a central location Note Because the NXC has an internal authentication database you can create local login accounts on it without needing to rely on an external authentication server The built in authentication server supports PEAP EAP TLS EAP TTLS Directory Structure The directory entries are arranged in a hierarchical order much like a tree structure Normally the directory structure reflects the geographical or organizational boundaries The following figure shows a basic directory structure bran
506. tup enter a Time Server Address 5 Click Apply 24 5 Console Speed This section shows you how to set the console port speed when you connect to the NXC via the console port using a terminal emulation program See Table 3 on page 21 for default console port settings NXC2500 User s Guide Chapter 24 System Click Configuration gt System gt Console Speed to open this screen Figure 147 Configuration gt System gt Console Speed Console Speed General Settings Console Port Speed 115200 v Cae The following table describes the labels in this screen Table 133 Configuration gt System gt Console Speed LABEL DESCRIPTION Console Port Speed Use the drop down list box to change the speed of the console port Your NXC supports 9600 19200 38400 57600 and 115200 bps default for the console port The Console Port Speed applies to a console port connection using terminal emulation software and NOT the Console in the NXC Web Configurator Status screen Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 6 DNS Overview DNS Domain Name System is for mapping a domain name to its corresponding IP address and vice versa The DNS server is extremely important because without it you must know the IP address of a machine before you can access it 24 6 1 DNS Server Address Assignment The NXC can get the DN
507. turn to the previous screen without saving your changes 25 3 3 Edit USB Storage Log Settings The Edit Log on USB Storage Setting screen controls the detailed settings for saving logs to a connected USB storage device Go to the Log Settings Summary screen and click the USB storage Edit icon NXC2500 User s Guide Chapter 25 Log and Report Figure 176 Configuration gt Log Report gt Log Settings gt Edit USB Storage Edit Log on USB Storage Setting 21x USB Storage 7 Duplicate logs to USB storage if ready EJ Active Log Py Selection y Selection Log Category 1 Account 2 Captive Portal 000 3 Authentication Server 000 4 Built in Service CAPWAP 6 Connectivity Check T Daily Report 8 Default 9 DHCP 10 Dynamic Guest Account 1 File Manager 2 Force Authentication Interface 4 IP MAC Binding Page 1 of1 Show 50 items Displaying 1 30 of 30 The following table describes the labels in this screen Table 152 Configuration gt Log amp Report gt Log Settings gt Edit USB Storage LABEL DESCRIPTION Duplicate logs to Select this to have the NXC save a copy of its system logs to a connected USB storage USB storage if device Use the Active Log section to specify what kinds of messages to include ready Active Log Selection Use the Selection drop down list to change the log settings for all of the log categories disable all logs re
508. ular log you can look at all the log messages by selecting All Logs or you can select a specific category of log messages for example user You can also look at the debugging log by selecting Debug Log All debugging messages have the same priority To access this screen click Monitor gt Log The log is displayed in the following screen Note When a log reaches the maximum number of log messages new log messages automatically overwrite existing log messages starting with the oldest existing log message first e For individual log descriptions see Appendix A on page 359 For the maximum number of log messages in the NXC see the datasheet NXC2500 User s Guide Chapter 5 Monitor Events that generate an alert as well as a log message display in red Regular logs display in black Click a column s heading cell to sort the table entries by that column s criteria Click the heading cell again to reverse the sort order Figure 37 Monitor gt View Log Logs Display Dynamic Guest Account Priority Source Address Destination Address Source Interface Destination Interface Service Keyword Protocol Message Destination Note 2013 03 22 15 59 Delete the expire dynamic guest account HMSZACPL Account 2013 03 22 15 59 Dynamic guest account HMSZACPL has expire Expire t Account 2013 03 22 15 55 Add dynamic guest account T9SYTCXR Dynamic G 2013 03 22 15 55 Add dynamic guest account XFAXHPA9 Dynamic G 20
509. urce interface to display only the log messages that include it Note This criterion only appears when you Show Filter Destination Enter a destination interface to display only the log messages that include it Interface Note This criterion only appears when you Show Filter Service Select a service type to display only the log messages related to it Note This criterion only appears when you Show Filter Keyword Enter a keyword to display only the log messages that include it Note This criterion only appears when you Show Filter Protocol Select a protocol to display only the log messages that include it Note This criterion only appears when you Show Filter Search Click this to start the log query based on the selected criteria If no criteria have been selected then this displays all log messages for the specified AP regardless Email Log Now Click this open a new e mail in your default e mail program with the selected log attached Refresh Click this to refresh the log table Clear Log Click this to clear the log on the specified AP This field is a sequential value and it is not associated with a specific log message Time This indicates the time that the log messages was created or recorded on the AP Priority This indicates the selected log message s priority Category This indicates the selected log message s category Message This displays content of the selected log m
510. ust allow writing it cannot be read only and use the FAT16 FAT32 EXT2 or EXT3 file system Click Configuration gt System gt USB Storage to open the screen as shown next Figure 144 Configuration gt System gt USB Storage Settings General Y Activate USB storage service Disk full warning when remaining space is less than 260 NXC2500 User s Guide Chapter 24 System The following table describes the labels in this screen Table 130 Configuration gt System gt USB Storage LABEL DESCRIPTION Activate USB Select this if you want to use the connected USB device s storage service Disk full warning Set a number and select a unit MB or to have the NXC send a warning message when remaining when the remaining USB storage space is less than the value you set here space is less than Apply Click Apply to save your changes back to the NXC Reset Click Reset to return the screen to its last saved settings 24 4 Date and Time For effective scheduling and logging the NXC system time must be accurate The NXC s Real Time Chip RTC keeps track of the time and date There is also a software mechanism to set the time manually or get the current time and date from an external server To change your NXC s time based on your local time zone and date click Configuration gt System gt Date Time The screen displays as shown You can manually set the NXC s time and date or
511. ute e favorisce il reimpiego e o riciclo dei materiali di cui e composta l apparecchiatura Lo smaltimento abusivo del prodotto da parte del detentore comporta l applicazione delle sanzioni amministrative previste dalla normativa vigente NXC2500 User s Guide Appendix E Legal Information RoHS ENGLISH DEUTSCH ESPA OL FRANCAIS Green Product Declaration Ls RoHS Directive 2011 65 EU VERIFIED WEEE Directive 2002 96 EC WEEE Waste Electrical and Electronic Equipment 2003 108 EC 2008 34 EC Capan Hoan Declaration Signature Name Title Raymond Huang Quality amp Customer Service Division Assistant VP Date yyyy mmidd 2013 02 01 Griines Produkt Erkl rung RoHS Richtlinie 2011 65 EU ElektroG Richtlinie 2002 96 EG ElektroG Uber Elektro und Elektronik Altger te 2003 108 EG 2008 34 EG Capan nag Unterschrift des Erkl renden Name Title Raymond Huang Quality amp Customer Service Division Assistant VP Date yyyy mm dd 2013 02 01 Declaraci n de Producto Ecol gico Directiva RoHS 2011 65 UE Directiva RAEE 2002 96 CE RAEE Residuos de Aparatos El ctricos y Electr nicos 2003 108 CE 2008 34 CE quere Huan Firma de declaraci n Nombre Titulo Raymond Huang Quality amp Customer Service Division Assistant VP Fecha aaaa mm dd 2013 02 01 D claration de Produit Vert Directive RoHS 2011 65 UE Directive DEEE 2002 96 CE
512. uthentication timeout settings To access this screen go to the Configuration gt Object gt User Group gt Setting screen and click one of the Default Authentication Timeout Settings section s Edit icons Figure 97 User Group gt Setting gt Edit User Authentication Timeout Settings 3 Edit User Authentication Timeout Settings 2 1Xx User Type admin Lease Time 1440 0 1440 minutes 0 is unlimited Reauthentication Time 1440 0 1440 minutes 0 is unlimited The following table describes the labels in this screen Table 87 User Group gt Setting gt Edit User Authentication Timeout Settings LABEL DESCRIPTION User Type This read only field identifies the type of user account for which you are configuring the default settings e admin this user can look at and change the configuration of the NXC e limited admin this user can look at the configuration of the NXC but not to change it e user this user has access to the NXC s services but cannot look at the configuration e guest this user has access to the NXC s services but cannot look at the configuration e ext user this user account is maintained in a remote server such as RADIUS or LDAP e ext group user this user account is maintained in a remote server such as RADIUS or LDAP e guest manager this user can log in via the web configurator login screen and create dynamic guest accounts using the Master Manager screen that pops up dynamic guest
513. uting Status SNAT Status In Out SNAT Table Note If you want to configure 1 1 SNAT please go to NAT NATRule Source Destination Outgoing SNAT Id d Page 1 of1 gt I Show 50 items No data to display Figure 202 Maintenance gt Packet Flow Explore gt SNAT Status Loopback SNAT SNAT Flow SNAT Table Q Note If you want to configure loopback SNAT please go to NAT Loopback SNAT will be only applied only when the initiator is located at the network which the server locates at NAT Rule Source Destination SNAT ofi i Show 50 items No data to display NXC2500 User s Guide Chapter 28 Packet Flow Explore Figure 203 Maintenance gt Packet Flow Explore gt SNAT Status Default SNAT Routing Status SNAT Flow SNAT Table Incoming 1 alnternal Interface Page 1 of 1 Show 50 items Outgoing SNAT a External Interface Outgoing Interface IP Displaying 1 1of 1 The following table describes the labels in this screen Table 169 Maintenance gt Packet Flow Explore gt SNAT Status LABEL DESCRIPTION SNAT Flow This section shows you the flow of how the NXC changes the source IP address for a packet according to the rules you have configured in the NXC Click a function box to display the related settings in the SNAT Table section SNAT Table The table fields in this section vary depending on the function box you select in the SNAT F
514. ve Log section Log Format This field displays the format of the log information It is read only VRPT Syslog ZyXEL s Vantage Report syslog compatible format CEF Syslog Common Event Format syslog compatible format Server Type the server name or the IP address of the syslog server to which to send log Address information Log Facility Select a log facility The log facility allows you to log the messages to different files in the syslog server Please see the documentation for your syslog program for more information Active Log Selection Use the Selection drop down list to change the log settings for all of the log categories disable all logs red X do not send the remote server logs for any log category enable normal logs green check mark send the remote server log messages and alerts for all log categories enable normal logs and debug logs yellow check mark send the remote server log messages alerts and debugging information for all log categories This field is a sequential value and it is not associated with a specific address Log Category This field displays each category of messages It is the same value used in the Display and Category fields in the View Log tab The Default category includes debugging messages generated by open source software Selection Select what information you want to log from each Log Category except All Logs see below Choices are disable all logs red X
515. ve your changes back to the NXC Cancel Click Cancel to exit this screen without saving your changes NXC2500 User s Guide 217 Chapter 19 Services 19 3 Service Group Summary The Service Group summary screen provides a summary of all service groups In addition this screen allows you to add edit and remove service groups To access this screen log in to the Web Configurator and click Configuration gt Object gt Service gt Service Group Figure 122 Configuration gt Object gt Service gt Service Group Configuration Add 2 Family O Y O Y O Y w O Name Description Allow_DMZ_To_EnterpriseWL System Default Allow From DMZ To EnterpriseWLAN Allow_WAN_To_EnterpriseWL System Default Allow From WAN To EnterpriseWLAN Allow_WLAN_To_EnterpriseW System Default Allow From WLAN To EnterpriseWLAN CU SEEME DNS IRC NetBIOS ROADRUNNER RTSP SNMP SNMP TRAPS SSH Show 50 v items Displaying 1 12 of 12 The following table describes the labels in this screen Table 110 Configuration gt Object gt Service gt Service Group LABEL DESCRIPTION Add Click this to create a new entry Edit Double click an entry or select it and click Edit to be able to modify the entry s settings Remove To remove an entry select it and click Remove The NXC confirms you want to remove it before doing so Object Reference Select an entry and click Object Refere
516. verview Application Layer Gateway ALG allows the following application to operate properly through the NXC s NAT e FTP File Transfer Protocol an Internet file transfer service The ALG feature is only needed for traffic that goes through the NXC s NAT 12 1 1 What You Can Do in this Chapter The ALG screen Section 12 2 on page 148 configures the FTP ALG settings 12 1 2 What You Need to Know The following terms and concepts may help as you read this chapter Application Layer Gateway ALG and NAT The NXC can function as an Application Layer Gateway ALG to allow certain NAT un friendly applications to operate properly through the NXC s NAT The NXC dynamically creates an implicit NAT session for the application s traffic from the WAN to the LAN The ALG on the NXC supports all of the NXC s NAT mapping types FTP ALG The FTP ALG allows TCP packets with a specified port destination to pass through If the FTP server is located on the LAN you must also configure NAT port forwarding rules if you want to allow access to the server from the WAN 12 1 3 Before You Begin You must also enable NAT in the NXC to allow sessions initiated from the WAN NXC2500 User s Guide 147 Chapter 12 ALG 12 2 ALG Click Configuration gt Network gt ALG to open this screen Use this screen to turn the ALG off or on configure the port numbers to which it applies Figure 74 Configuration gt Network gt ALG FT
517. vice failed to load it Certificate has expired Verification of a server s certificate failed because it has expired Self signed certificate Verification of a server s certificate failed because it is self signed Self signed certificate in certificate chain Verification of a server s certificate failed because there is a self signed certificate in the server s certificate chain Verify peer certificates has succeeded The device verified a server s certificate while processing an HTTPS connection Certification verification failed Depth d Number d s Error Verification of a server s certificate failed while processing an HTTPS connection This log identifies the reason for the failure 1st d certificate chain level 2nd d error number s error message Certificate issuer name s Verification of the specified certificate failed because the device could not get the certificate s issuer name s is the certificate name The wrong format for HTTP header The header format of a packet returned by a server is wrong Pimeout for get server response After the device sent packets to a server the device did not receive any response from the server The root cause may be a network delay issue Download file size is wrong The file size downloaded for AS is not identical with content length Parse HTTP header has failed Device
518. w rule rule u has been ti u is rule number appended DNS access control An administrator modified the rule u rule u has been ont ee u is rule number modified DNS access control has been rule u deleted An administrator removed the rule u u is rule number DNS access control rule u has been moved to Sd An administrator moved the rule u to index d u is previous index d variable is current index The default record of Zone Forwarder have reached the maximum number of 128 DNS servers The default record DNS servers is more than 128 Interface s ping check is successful Zone Forwarder adds DNS servers in records Ping check ok add DNS servers in bind s is interface name Interface s ping check is failed Zone Forwarder removes DNS servers in records Ping check failed remove DNS servers from bind s is interface name Interface s ping check is disabled Zone Forwarder adds DNS servers in records Ping check disabled add DNS servers in bind s is interface name Wizard apply DNS server failed Wizard apply DNS server failed Wizard adds DNS server Ss failed because DNS zone setting has conflictd Wizard apply DNS server failed because DNS zone conflicted s is the IP address of the DNS server Wizard adds DNS server Ss failed because Zon Forwarder numbers hav reached the maximum number of 32 Wizard apply
519. w to set up user accounts user groups and user settings for the NXC You can also set up rules that control when users have to log in to the NXC before the NXC routes traffic for them 15 1 1 What You Can Do in this Chapter The User screen see Section 15 2 on page 172 lets you see add and edit user accounts e The Group screen see Section 15 3 on page 175 provides a summary of all user groups In addition this screen allows you to add edit and remove user groups User groups may consist of access users and other user groups You cannot put admin users in user groups e The Setting screen see Section 15 4 on page 176 controls default settings login settings lockout settings and other user settings for the NXC You can also use this screen to specify when users must log in to the NXC before it routes traffic for them The MAC Address screen see Section 15 5 on page 185 lists all the mappings of MAC addresses to MAC address user accounts MAC roles 15 1 2 What You Need To Know The following terms and concepts may help as you read this chapter User Account A user account defines the privileges of a user logged into the NXC User accounts are used in controlling access to configuration and services in the NXC User Types These are the types of user accounts the NXC uses Table 81 Types of User Accounts TYPE ABILITIES LOGIN METHOD S Admin Users admin Change NXC configuration web
520. with any entry User ID This field displays the user name of each user who is currently logged in to the NXC Reauth Lease T This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user See Chapter 15 on page 169 Type This field displays the way the user logged in to the NXC IP address This field displays the IP address of the computer used to log in to the NXC MAC For an IEEE 802 1x or MAC authentication login this field displays the MAC address of the user s computer A displays for other types of login User Info This field displays the types of user accounts the NXC uses If the user type is ext user external user this field will show its external group information when you move your mouse over it If the external user matches two external group objects both external group object names will be shown Refresh Click this button to update the information in the screen 5 9 Dynamic Guest A dynamic guest account has a dynamically created user name and password that allows a guest user to access the Internet or the NXC s services in a specified period of time Multiple dynamic guest accounts can be automatically generated at one time for guest users by using the web configurator and the guest manager account Guest users can log in with the dynamic accounts 70 NXC2500 User s Guide Chapter 5 Monitor when connecting to an
521. ximum of 32 security profiles on the NXC MAC Filtering This profile provides an additional layer of security for an SSID allowing you to block access or allow access to that SSID based on wireless client MAC addresses If a client s MAC address is on the list then it is either allowed or denied depending on how you set up the MAC Filter profile You can have a maximum of 32 MAC filtering profiles on the NXC SSID The SSID Service Set Dentifier is the name that identifies the Service Set with which a wireless station is associated Wireless stations associating to the access point AP must have the same SSID In other words it is the name of the wireless network that clients use to connect to it NXC2500 User s Guide 187 Chapter 16 AP Profile WEP WEP Wired Equivalent Privacy encryption scrambles all data packets transmitted between the AP and the wireless stations associated with it in order to keep network communications private Both the wireless stations and the access points must use the same WEP key for data encryption and decryption WPA and WPA2 Wi Fi Protected Access WPA is a subset of the IEEE 802 11i standard WPA2 IEEE 802 11i is a wireless security standard that defines stronger encryption authentication and key management than WPA Key differences between WPA 2 and WEP are improved data encryption and user authentication IEEE 802 1x The IEEE 802 1x standard outlines enhanced security methods
522. y PKCS 12 For my certificate importation to be successful a certification request corresponding to the imported certificate must already exist on ZyWALL After the importation the certification request will automatically be deleted File Path Select a file path Password PKCS 12 only OK Cancel The following table describes the labels in this screen Table 125 Configuration gt Object gt Certificate gt My Certificates gt Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it You cannot import a certificate with the same name as a certificate that is already in the NXC Browse Click Browse to find the certificate file you want to upload Password This field only applies when you import a binary PKCS 12 format file Type the file s password that was created when the PKCS 12 file was exported OK Click OK to save the certificate on the NXC Cancel Click Cancel to quit and return to the My Certificates screen 23 3 Trusted Certificates Click Configuration gt Object gt Certificate gt Trusted Certificates to open the Trusted Certificates screen This screen displays a summary list of certificates that you have set the NXC to accept as trusted The NXC also accepts any valid certificate signed by a certificate on this list as NXC2500 User s Guide Chapter 23 Certificates being trustworthy
523. y check Build query message Some information was missing in the packets that the device sent to the has failed MyZyXEL com server Parse receive messag The device cannot parse the response returned by the MyZyXEL com server has failed Maybe some required fields are missing Change Anti Virus engine The device started to change the type of anti virus engine Change Anti Virus engine has failed s The device failed to change the type of anti virus engine s is the server response error message Change Anti Virus engine has succeeded The device successfully changed the type of anti virus engine NXC2500 User s Guide Appendix A Log Descriptions Table 172 Registration Logs continued LOG MESSAGE DESCRIPTION Change Anti Virus engine type has failed Because of lack must fields The device failed to change the type of anti virus engine because the response from the server is missing required fields server IP has Update stop Resolve failed The update has stopped because the device couldn t resolve the myZyXEL com server s FQDN to an IP address through gethostbyname Verify server s certificate has failed Update stop The device could not process an HTTPS connection because it could not verify the myZyXEL com server s certificate The update has stopped Send download request to update server has failed The device s atte
524. y networks or networks that are prone to interference If the Fragmentation Threshold value is smaller than the RTS CTS value see previously you set then the RTS Request To Send CTS Clear to Send handshake will never occur as data frames will be fragmented before they reach RTS CTS size Preamble Type Preamble is used to signal that data is coming to the receiver Short and long refer to the length of the synchronization field in a packet Short preamble increases performance as less time sending preamble means more time for sending data All IEEE 802 11 compliant wireless adapters support long preamble but not all support short preamble Use long preamble if you are unsure what preamble mode other wireless devices on the network support and to provide more reliable communications in busy wireless networks Use short preamble if you are sure all wireless devices on the network support it and to provide more efficient communications Use the dynamic setting to automatically use short preamble when all wireless devices on the network support it otherwise the NXC uses short preamble Note The wireless devices MUST use the same preamble mode in order to communicate IEEE 802 11g Wireless LAN IEEE 802 11g is fully compatible with the IEEE 802 11b standard This means an IEEE 802 11b adapter can interface directly with an IEEE 802 11g access point and vice versa at 11 Mbps or lower depending on range IEEE 802 11g has several i
525. y of certification authority certificates that validate a certificate The NXC does not trust a certificate if any certificate on its path has expired or been revoked Certification authorities maintain directory servers with databases of valid and revoked certificates A directory of certificates that have been revoked before the scheduled expiration is called a CRL Certificate Revocation List The NXC can check a peer s certificate against a directory server s list of revoked certificates The framework of servers software procedures and policies that handles keys is called PKI public key infrastructure Advantages of Certificates Certificates offer the following benefits e The NXC only has to store the certificates of the certification authorities that you decide to trust no matter how many devices you need to authenticate e Key distribution is simple and very secure since you can freely distribute public keys and you never need to transmit private keys Self signed Certificates You can have the NXC act as a certification authority and sign its own certificates Factory Default Certificate The NXC generates its own unique self signed certificate when you first turn it on This certificate is referred to in the GUI as the factory default certificate Certificate File Formats Any certificate that you want to import has to be in one of these file formats e Binary X 509 This is an ITU T recommendation that defines the formats

NXC2500 User's Guide

Contents

Download Pdf Manuals

Related Search

Related Contents