FCC ID: GZ54387WG Wireless Router

Wireless Broadband Router 4387WG User Manual 2003 All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of the seller. Disclaimer Information in this document is subject to change without notice. The material contained herein is supplied without representation or warranty of any kind. The seller therefore assumes no responsibility and shall have no liability of any kind arising from the supply or use of this document or the material contained herein. Trademarks Microsoft and Windows are registered trademarks of Microsoft Corporation. All other trademarks mentioned in this document are the property of their respective owners. Draft Version May 07, 2003 FAW:2.02.14.xx Safety Instr For Instal uctions lation Use only the type of power source indicated on the marking labels.

@ Use only the power adapter supplied with the product.

@ Do not overload wall outlet or extension cords as this may increase the risk of electric shock or file. If the power cord is frayed, replace it with a new one.

@ Proper ventilation is necessary to prevent the product overheating. Do not block or cover the slots and openings on the device, which are intended for ventilation and proper operation. It is recommended to mount the product with a stack.

@ Do not place the product near any source of heat or expose it to direct sunshine.

@ Do not expose the product to moisture. Never spill any iquid on the product.

@ Do not attempt to connect with any computer accessory or electronic product without instructions from qualified service personnel. This may result in risk of electronic shock or file.

@ Do not place this product on an unstable stand or table. For Using

@ Power off and unplug this product from the wall outlet when it is not in use or before cleaning. Pay attention to the temperature of the power adapter. The temperature might be high. e = After powering off the product, power on the product at least 15 seconds later.

@ Do not block the ventilating openings of this product. e When the product is expected to be not in use for a period of time, unplug the power cord of the product to prevent it from the damage of storm or sudden increases in rating. il For Service Do not attempt to disassemble or open covers of this unit yourself. Nor should you attempt to service the product yourself, which may void the users authority to operate it. Contact qualified service personnel under the following conditions:

If the power cord or plug is damaged or frayed. If liquid has been spilled into the product. If the product has been exposed to rain or water. If the product does not operate normally when the operating instructions are followed.

@ = If the product has been dropped or the cabinet has been damaged. e@ = If the product exhibits a distinct change in performance. FCC Information FCC Statement This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. FCC Conditions This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:

(1) This device may not cause harmful interference.

(2) this device must accept any interference received, including interference that may cause undesired operation FCC Caution Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. FCC Radiation Exposure Statement This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20cm between the radiator & your body. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.

About This User Manual For brevity, throughout this manual the Wireless Broadband Router is referred to as the router or the device and following terms or abbreviations are used interchangeably:

e@ Access Point-AP

@ Wireless LAN-WLAN

@ Ethernet network-LAN-network This User Manual contains information on how to install and configure your Wireless Broadband Router to get your network started accessing the Internet. From now on, we will guide you through the correct configuration steps to get your device up and run. 802.11g Draft Compliance Notice iv Though 802.11g is mentioned as a feature of this wireless device, users should be aware that the device supports only draft-level 802.11g specification. At the time of the release of this product, 802.11g remains in draft form, which has yet to be finalized and ratified by IEEE. Contents 1 Introduction.... VA OVC WIOWes sin ccisesinviasenineniaeninraeninraasninesiue nine iausan susie 1 1.2 Features 1.3 Package Contents . 1.4 System Requirement 2.00.00... cceceeceeteeteetenteeteettenee 3 Hardware Description & Installation............. 5 2.1 Physical Outlook. Front Panel Rear Panel and Connectors. 2.2 Hardware Connection Choosing a Place for the Router Connecting the Wireless Broadband Router.. Setting Up Ethernet / WLAN Client BM OVE IWC Ws sis cssusniennausnirnimnirniesnivrnineninrnsanenanisnaS 9 3.2 Setting up TCP/IP For Windows 98/ME For Windows 2000/XP... 3.2 Setting up Wireless Client 3.3 Checking Connection with the Router.......0.....ceeeee 15 4 Web Configuration ........0...cc:cceeeteeees 17 4.1 Accessing Web-Based Configuration Utility To enable Your Settings 4.2 Viewing System Status ....0.00...ccceceeeeeeceeeeeeeeeeeeeeeee 4.3 Configuration for NAT Routing Mode WAN Configuration for NAT Routing Mode . LAN Configuration for NAT Routing Mode Viewing Current DHCP Assignments Wireless Broadband Router User Manual 4.4 Configuration for Bridge Mode... 4.5 Wireless LAN (2.4G) Configuration.. 4.6 Wireless LAN Security ..........cceccecceceeeereeteneeteeneenee 4.6 Filters Specifing Your IP Filter Rules.. FIRED TYPOS scm omacaeenranavenumemannmmumeenmmomENS Filter Scenario of the Wireles Broadband Router-...... 38 Viewing Filter Log Other Firewall Settings.. 4.7 Forwarding Setting Up Forwarding Entries ... If you have a Web server on your network... ........... 42 4.8 Administration... cece eter eee etneneeeees 44 5 Troubleshooting 0.0.0... eeeeeeeeeeees 47 A Implementing 802.1%............ cece 49 ALT OVOVIOW ooo ect cern terete tiertnteerenenieeiees A.2 802.1x Function A.2.1 Required Components A.2.2 Authentication Procedure A.2.3 EAP and Authentication Type... A.3 Configuration Example Part 1. Windows 2000 Server.. Part 2: Access Point Part 3: 802.1x Station.... B Specification... vi 1 Introduction 1.1 Overview Thank you for choosing this Wireless Broadband Router. This Wireless Broadband Route is a multi-function device featuring a wireless 54Mbps Access Point, a 4-port LAN switch and a WAN port which extends your existing broadband Cable/ADSL connection. It allows your Internet connection to be shared through either the S4Mbps Access Point feature or the 10/100Base-TX Ethernet switch. Now your wired and wireless network are integrated to enjoy various bandwidth-consuming applications over the Internet. With the support of new emerged 802.11g draft standard, the Access Point provides data transfer of up to 54 Mbps, up to 5 times faster than 802.11b. Since draft 802.119 draft operates on the same frequency of 2.4 GHz as 802.11b, it is backwards compatible with existing Wi-Fi 802.11b devices. The benefit is that you can preserve the existing 802.11b infrastructure while migrating to the new screaming fast 802. 11g draft standard. The router can act as a DHCP server to automatically assign IP addresses to your LAN devices. With the built-in Network Address Translation (NAT) function, your LAN can access the Internet through a single external IP address and at the same time is protected against outside intruders. The router can also be configured to filter internal access to the Internet. It is designed to provide a reliable Internet access solution for the corporate environment, the small office and the home user. Wireless Broadband Router User Manual 1.2 Features One 10/100 Base-TX RJ-45 auto sensing and crossover Ethernet WAN port for Broadband connection (Cable/DSL or direct Ethernet) Four RJ-45 LAN ports for 10/100Base-TX auto sensing &

crossover Ethernet Switch LAN connection 802.11g draft Wireless LAN 802.1x security One external and one built-in antennas for wireless technology PPPoE (PPP over Ethernet) Client with Keep Alive/Connect On Demand Support PAP and CHAP Authentication DHCP Client MAC Address Cloning DHCP Server NAT Firewall Support Bridge Mode Support 802.1D Spanning Tree Bridging P Filtering, IP Forwarding DMZ Hosting ASCII/HEX Format 64/128 Bit WEP Key for Wireless LAN Allow/Deny List for Wireless LAN VPN Support (IPSec Passthrough, and PPTP Passthrough) Configurable through Web Browser via WAN/LAN Software Upgrade NTP/Manual System Clock Configuration Saving/Retrieving Event Log 1. Introduction. 1.3 Package Contents Check the contents of the package against the pack contents checklist below. If any of the items is missing, then contact the dealer from whom the equipment was purchased.

@ Wireless Broadband Router x1

@ Power Adapter and Cord (or AC Power Adapter) x1 e CD-ROM x1

@ =RJ-45 Ethernet Cable x1 1.4 System Requirements

@ Cable/ADSL modem and an Internet access account for Internet connection

@ One computer with 10/100Base-T Ethernet card and TCPIIP protocol installed for initial setup

@ = Internet Explorer 5.0 or higher for Web configuration

@ 802.11g draft or 802.11b compliant wireless adapters (for wireless connection) 2 Hardware Description &

Installation 2.1 Physical Outlook Front Panel The following illustration shows the front panel of the Wireless Broadband Router:

PWR WLAN WAN. LANT LAN2 LAN3 LANS LED Indicators The Wireless Broadband Router is equipped with seven LEDs on the front panel as described in the table below LEDs [Function _|Color status |Description Power Green of [No power is supplied to the unit Solid [Power is connected to the unit WLAN [Wireless LAN [Green of (WLAN interface is net initialized Port properly, ReaeyiACtNty lon WLAN interface is initialized properly and ready, Blinking |Transmitting/receiving packets Jon the WLAN port LAN LAN Pot Green or Power is off or no Ethernet 14 Status (100 Mbps)* device is connected on Ethemet device is connected Wireless Broadband Router User Manual LEDs [Function _|Color Status [Description Green Blinking |Transmittingreceiving packets

(10 Mbps) Jon the LAN port, WAN [WAN Port Green ott Power is off or no broadband Status device is connected jon Broadbend device is connected Blinking |Transmittingfreceiving packets jon the WAN port Rear Panel and Connectors The following figure illustrates the rear panel of your Wireless Broadband Router. errr. toad VAC LANA) LANS)-LAN2 LAN WAN pefault The following table describes the components on the rear panel Connector Description 12 AC Power connector LAN Ports 1-4 |Ru-45 Connectors. Integrated port 10/100BaseT switch. Connects to a hub, switch or NIC-equipped PC in your network. The LAN ports|

support Auto-MDIX feature which eliminates the need for crossover cables WAN Ru-45 connector. Connects to the Cable/ADSL Moder. The WAN port also supports Auto-MDIX feature which eliminates the need for crossover cables Load Default To reset the device to factory defaults, insert a straightened paperclip into the reset / Load Default hole to press the button. Keep pressing and power cycle (off and on) the device. Wait for at least 5 seconds to release the button, Then wait for the device to finish booting, If you want to restore your customized settings after loading defaults, refer to "4.8 Administration for more information 2. Hardware Description & Installation 2.2 Hardware Connection Choosing a Place for the Router Place the device close to the power outlet for the cable to reach it easily. Avoid placing the device in places where people may walk on the cables. Also keep it away from direct sunshine or heat sources. Place the device on a flat and stable stand. Connecting the Wireless Broadband Router Prior to connecting the hardware, make sure to power off your Ethernet device, Cable/ADSL modem and Wireless Broadband Router. Then follow the steps below to connect the related devices. Step 1 Step 2 Step 3 Connecting Your network to the LAN port. Attach one end of the Ethernet cable with Ru-45 connectors to your hub, switch or a PCs Ethernet port, and the other end to the LAN port of your Wireless Broadband Router. Connecting Cable/ADSL Modem to the InternethWAN port. Connect the Ethernet cable attaching to your Cable/ADSL modem to the Internet/WAN or WAN port of your Wireless Broadband Router. Connecting the power adapter. Connect the power adapter cord to the power jack on the back of the Wireless Broadband Router. Then connect the adapter to a power outlet. Caution: Use only the adapter supplied with the router. Connecting the wrong adapter could damage the device. Wireless Broadband Router User Manual The figure below illustrates a connection diagram example:

a HEE ss eee] 802.11g / 802.11b Wireless Client PC / Hub / Switch Guu o &

YavAC LANE LANG LANE LANE WAN ha Cable/ADSL

3 Setting Up Ethemet / WLAN Client This chapter describes how to configure a computer for initial connection to the device. If you have modified the routers network setting, your LAN / WLAN clients should make appropriate changes in order to make successful connection. 3.1 Overview To access the Wireless Broadband Routers Web-based Configuration Utility, at least one properly configured PC must be connected to the device and reside on the same subnet with the Wireless Broadband Router. The easiest way to make the connection is attaching your host computer's NIC directly to the LAN port of the device, though it is also allowed to configure the device via a wireless client. Whatever your connection method, the computer's Ethernet wireless interface must be on the same subnet with the router. As the Wireless Broadband Router is configured with these default values:

e@ IP address: 192.168.1.1

@ Subnet mask: 255.255.255.0

@ DHCP server: Enabled with the IP address pool from 192.168.1.100 to 192.168.1.150. So you should set up your NICs or wireless adapters TCP/IP settings as one of the following:

1. Touse dynamic IP: Set your PC to be DHCP client to accept the dynamic IP from the router's DHCP server. 2. Touse static IP: Set the IP address as 192.168.1.x (x is between 2 and 254), subnet mask as 255.255.255.0 and the gateway as 192.168.1.1 to be on the same subnet with the router. Wireless Broadband Router User Manual 10 The default TCP/IP setting for Windows is acting as a DHCP client. Please proceed to next section to verify or, if necessary, configure your TCP/IP settings. 3.2 Setting up TCP/IP Before proceeding, make sure your computer is equipped with Ethernet network card or wireless adapter and has appropriate network card driver and TCP/IP installed. Notes:

1. If TCP/IP protocol is not installed on your PC, refer to Windows documentations for installation instructions. 2. For initial verification, we suggest that you connect only one PC directly to an LAN port on the Wireless Broadband Router, not through a hub. For Windows 98/ME Step 1 Click on the Start menu, point to Settings and click on Control Panel. Step 2 Double-click the Network icon. Step 3 In the Network window, highlight TCP/IP protocol for your NIC or wireless adapter and click Properties. Step 4 Choose one of the methods as required:

Option A: Using DHCP On the IP Address tab, select Obtain an IP address automatically. Then an IP address will be automatically assigned to your computer. 3. Setting Up Ethernet / WLAN Client bezier [2]

Bidngs | Adveneed | Newios |

DNS Configuation | Getowey | WINS Corian PAddess An IP addhess can be automaticaly assigned to this computer. I your network dos not automatically assign IP addresses, ask your network administrator for an address, and then type it in the space below.

(ann IP addiess stomatal) Specity an IP addiess:

Option B: Using Fixed IP Address

@ Onthe IP Address tab, select Specify an IP address.

@ Then set the IP address as 192.168.1.x (x is between 2 and 254), subnet mask as 255.255.255.0.

@ Select the Gateway tab and set the gateway to 192.168.1.1. Step 5 Click OK twice to finish the configuration. If your network settings have been changed, you will be prompted to restart your computer. Click Yes to have new settings take effect. 11 Weekes Bowdband Rowe User Mal a Check/Renew IP Aderees under Wrdows 98/ME The folowing steps help you veiyifyour network adapter gets an IPaddress uthin he OHCP P peel range 192.1681.100 =

192.168.1160 by detul)ofthe rue. Inet, you mayneed 1 rane the IPinfrmaton, ep 1 fromthe Start menu oie Runto openthe Run dialog box Step Enter winipefgin the dialog boxandthen olde OK. step Seleetthe Bhemet or WLAN adapter fom he drop-down litte show te IP address, Inecescary, lik Release andthen Rerew to get anew IP adress, 1 For Windows 2000P Step Clok onthe Start menu, pointte Settings and clon Cartrel Pan sep2 Doubled the Network and Oshup Connections or Network Corrections ion, ep2. Figh-dlethe Local ies Connection ison fr your NIC oruirles adapter andthen click Properties. Step3._Onthe General tab, highlight IrterretPrctocel (TCP/IP) andthe cll Properties, sap Choose one ofthe mebods a required tion i: sing HCE Onthe IP Adress tb, enable Obtain an Padres automatically andthen ck han an IP adres willbe autmatallyasdgned your computer 3. Setting Up Ethernet / WLAN Client

(Eire ene [zl Genet |

You can get IP settings assigned sutomaticaly if your network supports this canabliy, Otherwise, you need to ack your netvictk administator for the appropriate IP settings. Obtain an IP addhess automatically

=~ Use the folowing IP adeese; @$ $$

Advanced Cancel Obtain DNS server addiess automaticaly Use the folowing DNS server addiesces:

Option B: Using Fixed IP Address Select Use the following IP address and enter these settings:

e |P address: 192.168.1.x (x is between 2 and 254)

@ Subnet mask: 255.255.255.0.

@ Default Gateway: 192.168.1.1. Check/Renew IP Address under Windows 2000/XP The following steps help you verify if your network adapter gets an IP address within the DHCP IP pool range (192.168.1.100 ~

192.168.1.150 by default) of the router. If not, you may need to renew the IP information. Step 1 Click Run from the Start menu to open the Run dialog box. Step 2 Type emd in the dialog box and then click OK. Step 3 At prompt, type ipconfig to see the IP information from DHCP server. Step 4 If you want to get a new IP address, type ipconfig frelease to release the previous IP address and then type ipconfig /renew to get a new one. 13 Wireless Broadband Router User Manual 14 3.2 Setting up Wireless Client If you choose to access the router via a wireless client, also verify the following:

1. Make sure your PC is equipped with 802.11g draft or 802.11b wireless adapter and has appropriate WLAN card driver/utility and TCP/IP installed. 2. Set the wireless adapter to use appropriate TCP/IP settings as described in previous section. 3. Launch the wireless adapters provided utility and verify that your wireless client is configured with these settings:

@ Operation Mode: Infrastructure e SSID: 802.11g-Sample e Authentication: Open

@ WEP Mode: Disabled 3. Setting Up Ethernet / WLAN Client 3.3 Checking Connection with the Router You can use the Ping command to verify whether or not your Ethernet/Wireless client has successfully connected to the Wireless Broadband Router. To execute ping command, open the DOS window and ping the IP address of the router at the DOS prompt. For example:

ping 192.168.1.1 If the following response occurs:

Reply from 192.168.1.1 bytes=32 time=100ms TTL=253 Then the connection between the Wireless Broadband Router and the network has been successfully established. Otherwise, if you get a failed ping with the response of:

Request time out Then the connection is fail. Verify your network setting is correct. For Ethernet client, also check the cable between the router and the PC. 1S Web Configuration 4.1 Accessing Web-Based Configuration Utility Once your PC is properly configured as described in "3. Setting Up Ethernet / WLAN Client", you can proceed as follows for initial configuration:

1. Start your Web browser and type http://192.168.1.1 in the URL field. This address is the default private IP of your router. Back" Foward Stop _Refiesh_ Home

(Addess[ _tp77i92.168.1.1 Search Favoites Histo Note: If the router's LAN port has been specified with new IP address, enter the new IP instead. 2. After connecting to the device, you will be prompted to enter the username and password. Leave the username empty and enter the default password of admin. er eee [20d Please type your user name and password Sie: 192.1681. Reakn Wireless Broadband Router UserName fi Password TT Save ths password in your password list

(o_o Figure 4-1 Login to Web Configuration Utility After you login, the System Overview page of the Wireless Broadband Router displays. From now on the Wireless Broadband Router acts as a Web server sending HTML pages/forms on your request. You can click the menu options at the top to start your configuration task. 17 Wireless Broadband Router User Manual 18 While working with this Web Configuration Utility, corresponding configuration fields are displayed according to your specific selection to avoid any possible canflicting setting. In addition, should you input invalid values, the utility provides instant prompt to help you recaver from error inputs. To enable Your Settings After you have customized the settings and then click the Apply button, the device will begin registering your settings. You will be prompted to wait for a few seconds for the router to commit changes to permanent storage. During this process, itis important not to power on or off the router otherwise damage may be caused to the device. After the settings have been registered, the screen will return to previous page and the settings are effective. You may then proceed with other configuration tasks. Submitting Settings Committing values...done Please wait for 15 Seconds. Figure 4-2 Applying Changes 4, Web Configuration 4.2 Viewing System Status Clicking System Overview in the menu bar will display the System Overview page which shows the basic information of your Wireless Broadband Router, including the system, WAN/LAN interface and Wireless LAN interface information. You may click the Update button to update the overall status. If firewall is enabled, an additional item Firewall is displayed at the bottom of the page. Clicking the Show Log button under this item will display the firewall activity log in a separate window. Stem, icles LAN icles LAN 2 Lan eee AN Wace At tess Ennwaning Administaton This pag dsplays summary forthe router status Click the buon o update Ui |

Syom System Tine: 19700101 024014 Fmware Version: 2021407 Wa oteoce Nar Rong cps0s624s47 WP AddiowSubnet Mosk: 0000/0000 Default Gateways NS Servers:

WANS Server ost Name:

Doman Name:

La intertoce MAC Addeess: 009055 284476 1W AddomeSubnet Mase 1928 112952552550 DICE Server: Enabled etve DHCP Leases:

Wiel LA Access Point Mame: 1194"

(2.46) netace $910; EEE 60D 11 LAN assim: cos 2430 Channel 0:

Fewatt tty Loa: Showteg Figure 4-3 System Overview 19 Wireless Broadband Router User Manual 20 4.3 Configuration for NAT Routing Mode Prior to configuring your Wireless Broadband Router, you must decide whether to configure the device as a router or as a bridge. This section only describes how to set up the device to act asa router. For bridge configuration, see "4.4 Configuration for Bridge Mode for instructions. When operating as a router, the device communicates with your ISP through the WAN port. Depending on the connection type offered by your ISP, you may get the WAN IP address by one of the following means:

@ DHCP Client: In this connection type, your router acts as a DHCP client and requests IP information from the DHCP server on the ISP side. Select this option if your ISP assigns you with a dynamic IP address each time you log on.

@ PPPoE Client: Some ISPs use a PPPoE session to make connection with their clients. If this is the case, you should enable this option and finish the PPPoE Client settings. The WAN port of the device will be assigned a public IP address from your ISPs server.

@ = =PPTP Client: This router supports VPN (Virtual Private Network) pass-through for both PPTP (Point-to-Point Tunneling Protocol) and IPSec (IP Security). VPN allows corporations to extend their own corporate network through private "tunnels" over the public Internet. If your ISP, e.g., European DSL service providers, uses PPTP as a connection method, you should use this option.

@ Manual Config: If your ISP assigns you a fixed IP address, you should select this option and manually enter the IP information provided by your ISP. Different configuration items will be displayed depending on your connection type. Consult with your ISP which option applies to you and obtain related information for correct configuration. Then proceed to finish the following procedures. 4. Web Configuration WAN Configuration for NAT Routing Mode Click WAN in the configuration menu to enter the WAN configuration page and carry out the procedures below. Part 1. Configuring general settings. 1. In the WANILAN Relation item, select the NAT Routing option. This option allows the device to act as a router and use the built-in NAT function to translate your multiple private IP addresses to a single public IP address. However, only outgoing requests are allowed to pass through the device unless you specify otherwise. Outside users cannot see your private local IP addresses. This leaves your home or business network hidden from outside intruders. In the Protocol item, select a protocol type according to the connection type offered by your ISP. If required, in the MAC Address field, enter your network adapters MAC address in the format of xx:xx:xX:XX:XX:XX. Otherwise just keep the default values. This field allows you to clone a network adapters MAC address to the WAN port of the router. Some ISPs use the MAC address of NIC, which was connected to your Cable/ADSL modem, for static mapping and thus give you the same IP address each time the Cable/ADSL modem requests for IP address for the Ethernet port. If this is the case, this feature removes the need of asking your ISP to change the registered MAC address and you can still use the same given IP for the router's WAN port. In the Host Name field, you may supply a host name for this router if this is required by your ISP. Some ISPs only respond to a DHCP request with a valid Host Name. If a host name is not necessary for your ISP, just leave it blank. 21 Wireless Broadband Router User Manual 22 Part 2. Configuring protocol-specific settings According to the connection type you selected above, proceed to set up related parameters. DHCP Client If DHCP Client is your option, no other configuration is needed. You may just click Apply to end your WAN settings. After the connection to your ISP is established, the information provided by your ISP will be displayed in the Status group. General WANILANRelation: = NAT Routing Bridging Protocol: DHCP Client PPPoE Client PPT Client C Manual Config MAC Address: [00:90:96:32:61:29 Host Name:

Status IP AddressiSubnet Mask: 0.0.0.0/0.0.0.0 Default Gateway:

DNS Servers:

WINS Servers:

Domain Name:

Cancel Figure 4-4 WAN Configuration-DHCP Client

> PPPoE Client If PPPoE Client is your option, configure these fields as required by your ISP. PPPoE Connection Status: This item is not configurable. It displays whether the connection is up or down. Username/Password: Enter the username and password provided by your ISP used to log on to Internet connection. Connection Mode: Select your PPP connection from these options:

Keep Alive: This feature will keep your PPPoE-enabled Internet connection always alive. This is done by sending echo requests periodically to ISP to prevent the connection from being terminated by ISP. 4. Web Configuration. Connect on Demand: If enabled, the router will trigger a PPP session for connection to the Internet if any client PC on your LAN sends out a request for Internet access. However, the router automatically disconnects the PPP session after the WAN connection has been idle for the amount of time you specified in the Max Idle Time box. If your Internet account is billed based on the amount of time of your Internet connection, you probably want to enable this option and enter an idle time value best suitable for your network. Manual Connect: If enabled, the system administrator can manually connect or disconnect the PPP session by clicking the Connect/Disconnect buttons in this page. MTU/MRU: Allows you to adjust the Maximum Transmission/Receive Unit in bytes for the WAN interface. The packets larger than the specified values will be fragmented before being transmitted. It's suggested not to modify the MTU/MRU settings unless instructed by your ISP. After you finish the WAN settings, click Apply to submit your changes. Then you can check the PPPoE Connection Status item to see if the connection is established. To verify whether WAN interface has successfully obtained an IP address and related information from your ISP, please check the WAN Interface group in the System Overview page. General WAN/LAN Relation: = @ NAT Routing Bridging Protocol: DHCP Client PPPOE Client C PPTP Client Manual Config MAC Address: [00:50:96:32:61:28 HostName: [|

PPPoE Client PPPoE Connection Status: Down Username:

Password:

Connection Mode: @ Keep Alive Connect on Demand, Max Idle Time: [E_ (min) Manual Connect | Connect Disconnect mtu: [i464 mru: [f454 Cancel Figure 4-5 WAN Configuration-PPPoE Client 23 Wireless Broadband Router User Manual 24

> PPTP Client lf PPTP Client is your option, configure these fields as required. Username/Password: Enter the access credentials, i.e., username and password, for the router to initiate a PPTP connection to the PPTP server. Server IP Address: Enter the IP address of the PPTP server. IP Address/Subnet Mask: Enter the Internet IP address/subnet mask that the ISP assigns to this router for reaching the PPTP server. Idle Disconnect: If you want to automatically terminate the connection to your ISP when there is no connection for a period of time, check this option and enter the desired idle time. After you finish the WAN settings, click Apply to submit your changes. To see the details of your WAN connection, please check the WAN Interface group in the System Overview page. General WAN/LAN Relation: = @ NAT Routing Bridging Protocol: = DHCP Client C PPPoE Client @ PPTP Client C Manual Config MAC Address: [00:30:96:30:h7:08 Host Name:

PPTP Client Username:

Password:

Server IP Address:

IP Address:

Subent Mask:

Idle Disconnect: T Disconnect after minutes of no activity, Cancel Figure 4-6 WAN Configuration-PPTP Client 4. Web Configuration

> Manual Config If Manual Config is your option, configure these fields as required by your ISP. IP Address/Subnet Mask: Enter the fixed IP address and subnet mask given by your ISP in respective fields. The default values are 0.0.0.0/0.0.0.0. Default Gateway: The IP address of the default gateway of the router. It is the IP that the router first contact to communicate with the Internet. DNS Servers: Specifies the |P address of the Domain Name Server. Your LAN side DHCP clients use the DNS to mapa domain name to its corresponding IP address and vice versa. Up to three DNS servers are allowed. If no DNS server is specified or the specified servers are not available, the router will automatically assign a DNS server to the DHCP clients. WINS Servers: Optional for Windows Internet Names Service. Enter the IP addresses of WINS servers if required. Domain Name: Optional. Allows you to supply a domain name for the router. After you finish the WAN settings, click Apply to submit your changes. General WANILAN Relation: = @ NAT Routing Bridging Protoco DHCP Client PPPoE Client C PPTP Client @ Manual Config MAC Address: [00:90:96:32:61:29 Host Name:

Manual Config IP Address:

Subnet Mask:

Defauit Gateway:

DNS Servers: I WINS Servers: vf Domain Name:

Cancel Figure 4-7 WAN Configuration-Manual Config 25 Wireless Broadband Router User Manual 26 LAN Configuration for NAT Routing Mode Your router communicates with your LAN through its LAN port. The LAN configuration page allows you to define the private IP address and DHCP server settings over the LAN interface. 1. In Manual Config > IP Address & Subnet Mask fields, enter the IP address and subnet mask for the LAN port. By default, the IP address and subnet mask of the LAN port is 192.168.1.1 and 255.255.255.0 respectively. Note that if you change the private IP address and apply the changes, the PC from which you configure the router will lose the communication to the router. To reconnect, you may need to renew the IP address of the PC or change to an IP address compatible with the new LAN port IP address. In DHCP Server > Service field, select whether to enable DHPC service on the LAN and WLAN port. The Wireless Broadband Router implements a built-in DHCP

(Dynamic Host Configuration Protocol) server on its LAN and WLAN interface, which dynamically assigns IP addresses to the DHCP clients on the LAN / WLAN. The DHCP server also provides a default gateway (the router's LAN IP address) and DNS addresses for DHCP clients to access the Internet. DHCP function spares you the hassle of manually assigning a fixed IP address to each PC on the LAN / WLAN. It is probably you already have a DHCP server on your network and you do not enable this function. DHCP server is enabled by default. If you disable DHCP server, just click Apply to submit your changes. Otherwise proceed to next step. If DHCP server is enabled, enter the fields below:

DHCP Lease Time: Specify the time that a network device can lease a private IP address before the DHCP server reassigning the IP address. Note: If the WAN port (when set to acts as a DHCP client) does not get an IP address upon startup, the LAN clients will be assigned with a lease time of 1 minute instead of the time value specified in this field. This is to ensure LAN clients will come back to renew its lease to update the parameters

(default gateway, DNS server, etc.) when WAN port gets an IP address later from the ISP. After the update of these 4, Web Configuration parameters, the lease time assigned to LAN clients turns to the lease time you specified. IP Pool Range: Specify the starting and ending IP address of the IP address pool. Whenever a network device requests for an IP address, the router will allocate an unused IP address from this pool and lease them to the device for a specified amount of time. en se Win Lat SE uate tent mean Adin Manual Config Waddes: [iT oe Pir] eos Figure 4-8 LAN Configuration in Router Mode Viewing Current DHCP Assignments When DHCP server function is enabled, the router keeps a record of any machine (either Ethernet or Wireless node) that has leased IP from the specified IP pool. The DHCP lease table is displayed under System Overview > LAN Interface:

LAN Interface MAC Address: 0)90:40:10:

IP Adldress/Subnet Mask: 192.168.1.1/

DHCP Server: Enabled Active DHCP Leases:

[00:90:96 00:45:32 [192.168 7 101 | expired Figure 4-9 DHCP Lease Table 27 Wireless Broadband Router User Manual 28 4.4 Configuration for Bridge Mode A bridge connects two or more LANs together and bases the forwarding decision on the MAC address. Under Bridge mode, filters and forwarding are not applicable. Acting as a bridge, the devices supports DHCP server service. To set up the bridge mode, perform the procedures below. Part 1. Enable bridging function. Go to the WAN configuration page and select the Bridging option as the WAN/LAN relation and then click Apply to commit the changes. Sein Wiles Winks Lan oa, wat a sleet ste imam FatatdloAmibraon aiie| cosa Figure 4-10 Enabling Bridging Mode Part 2. LAN configuration. 1. Inthe Protocol item, select DHCP Client or Manual Config as required. DHCP Client: Select this option if there is already a DHCP server in your network which assigns IP to this bridge. If enabled, no further configuration is needed since the DHCP. server will pass the required IP information. Click Apply to submit your changes. Note: After committing the settings, your configuring PC may lose connection to the device. To reconnect, you will need to make sure the PC uses an IP address in the same subnet as the device. 4, Web Configuration

= re i Tipp ogo he A cae ple a Wi A ate sors] ee Figure 4-11 Bridge Mode-DHCP Client Manual Config: If enabled, manually enter the IP address and its subnet mask in IP Address & Subnet Mask fields. For Manual Config setting only, in DHCP Server > Service item, select whether to have your bridge act as a DHCP server. If you disable DHCP service, no further configuration is required. Just click Apply to submit your changes. Note: After committing this setting, your configuring PC may lose connection to the device. To reconnect, you will need to make sure the PC uses an IP address in the same subnet as the manually entered IP. If DHCP server service is enabled, proceed to set up the items below:

DHCP Lease Time: Specify the time that a network device can lease a private IP address before the device reassigning the IP address. IP Pool Range: Specify the starting and ending IP address of the IP address pool. Whenever a network device requests an Internet session, the device will allocate an unused IP addresses from this pool and lease them to the device fora specified amount of time. Default Gateway & DNS Servers: Specify the default gateway and DNS servers for your network. These settings allow your network to access the Internet After finishing the settings above, click Apply to submit the changes. Note: Under Manual Config setting, after DHCP Server takes effect, your configuring PC will need to renew its IP address to connect to the device. 29 Wireless Broadband Router User Manual ont te LAN nace ap on Welt LAM nee. on Cot (eAddem [ETE Seimetinke ERERET eta Cae [FETETT 1? Sar Swe Female Come once Leme Tine: fF ov) wretinge TRIO ~ TT Dns seme [, [, 7 eee] ee Figure 4-12 Bridge Mode-Manual Config 30

4. Web Configuration 4.5 Wireless LAN (2.4G) Configuration The Wireless Broadband Router implements Access Point capability which connects wireless clients to a wired LAN. It allows wireless nodes to access network resources and share the broadband Internet connection. With the default values, the router

(Access Point) can be easily associated by a wireless client. We suggest that you customize the wireless settings to prevent unauthorized association.

> Basic Configuration Access Point Name: The name used for identifying the Access Point. SSID: Service Set ID. It uniquely identifies a logical network domain name of your WLAN. Do not broadcast SSID: If this option is disabled, the AP (also referred to as an open AP) will periodically broadcast its SSID to allow the wireless clients to recognize their presence. However, this creates a security hole since any wireless station with SSID set to any or got the broadcast may associate to your AP. It is recommended to enable this option to have your AP only accept stations whose SSIDs are the same as this APs. BSSID: The MAC address of the AP. Channel ID: The radio frequency used for communication. Select a channel out of the available cannels or use the default, Auto, to have the AP automatically scan and select a channel when it starts up.

> Advanced Configuration We suggest you not to modify the Advanced parameters unless specific requirement is required. The parameters are described as below. Beacon Interval: Defines the periodic interval at which the Access Point sends out a beacon. 31 Wireless Broadband Router User Manual 32 RTS Threshold: Request to send threshold. It specifies the packet size beyond which the AP invokes its RTS/CTS mechanism. Packets that exceed the specified RTS threshold trigger the RTS/CTS mechanism. Fragment Threshold: It determines whether packets will be fragmented and at what size. On an 802.11 wireless LAN, packets exceed the fragmentation threshold are fragmented, i.e., split into, smaller units suitable for the circuit size. On the other hand, packets smaller than the specified fragmentation threshold value are not fragmented. DTIM Interval: Specifies the Deferred Traffic Indicator Map (DTIM) period. This value determines at which interval the AP will send its broadcast traffic. The default value is 1. Data Rate: The default setting, Auto, allows the AP to automatically use the fastest possible data rate. Selecting a specific rate forces the AP to transmit at a particular speed. Operational Mode: This item allows you to choose from these communication options:

e =Auto: Both 802.11g draft and 802.11b clietns can communicate with this AP. The data rate will be automatically adjusted.

@ 802.119: Only 802.11g wirless clients can communicate with the AP.

@ =802.11b: Only 802.11b clients can communicate with the AP. 4.6 Wireless LAN Security When implementing a wireless network, it is important to secure the data transmitted over the wireless network. This Wireless Broadband Router provides a couple of approaches to protect your wireless network: WEP, MAC address access control and 802. 1x. 4. Web Configuration p> 802.1x The 802.1X standard is designed to enhance the security of a wireless network. For more information on 802.1x, please refer to the appendix A Implementing 802. 1x.

> WEP WEP Mode: WEP (Wired Equivalent Privacy) is an authentication algorithm which encrypts your data and protects your Wireless LAN against eavesdropping. WEP is disabled by default. If you want to protect your data when it is transferred from one station to another, you should enable this security option. For security concern, we strongly suggest you enable WEP function. To enable WEP, select 64 bits or 128 bits option as the encryption algorithm. The higher the bit number, the greater the complexity and the security of the encryption. Authentication Mode: Authentication is a process in which the AP validates if wireless clients are qualified to access the APs service. This happens prior to any wireless client can associate to an AP. The IEEE 802.11 defines two types of algorithms in authentication:

the Open System and Shared Key.

@ Open System: The authentication is done through a pseudo process, accepting all kinds of requests, mainly used in cases where connectivity is more important than security. If WEP is disabled, the Authentication Mode is set to Open.

@ Shared Key : Utilizes WEP capability to further verify ifa wireless client is authorized to share this APs resource. If the client has the wrong key or no key, it will fail authentication and will not be allowed to associate with the AP. This option is only available when WEP is enabled and you need to configure the WEP keys used for authentication and data encryptiong. WEP Key Type: Select ASCII or Hexadecimal as the key format you want to use. 33 Wireless Broadband Router User Manual 34 WEP Keys: Enter one to four WEP keys in either ASCII or Hexadecimal format as specified. The key length depends on the encryption algorithm (64 bits or 128 bits) you selected. Note that when using Hexadecimal format, only digits 0-9 and letters A-F, a-f are allowed. Valid key length for each encryption type is as below. ASCII Format HEX Format 64 Bit 5 ASCII characters 10 hexadecimal digits 128 Bit 13 ASCII characters 26 hexadecimal digits Specifing a default key to encrypt outging data Aside from entering your WEP keys, you should select one of the entered keys to encrypt the data before being transmitted. The AP always transmits data encrypted using this WEP Key. The key number (1,2,3,4) is also transmitted. The receiving station will use the key number to determine which key to use for decryption. If the key value does not match with the transmitting station, the decryption will fail. To ensure successful decryption, have your wireless stations set identical key tables. Note: All wireless stations must use identical encryption algorithm level and key values (same key position in its key table) to ensure successful data transmission. Access Control MAC Address Access Control: This AP has the capability to control the wireless client access based on the MAC address of a wireless client. We offer you the flexibility to customize your own control policy based on these options:

e = Allow: If selected, only the wireless client whose MAC address is in the MAC Address List is allowed to access this AP. e Deny: If selected, only the wireless client whose MAC address is in the list cannot access this AP. Others clients are granted access.

@ Disable: No access control. All the clients are allowed to access this AP. 4. Web Configuration When entering MAC address in the list, up to 12 MAC entries are allowed. WLAN | WA Soman re Oo atom sang Adiiaton

"hic page coniqn EEE 0.19 Ae Wea LAN ine, rece Palatname: Tg fee Ce oo Operational ose: [593]

aa] os Figure 4-13 Wireless LAN Configuration Samm, wy um Mt niin ne

=== SEE arte o\ imo neces Com WAChddvem Acem Oss AoW C Oany WACAddrem tite |. [>

Sy ey Figure 4-14 Wireless LAN Security Configuration 35 Wireless Broadband Router User Manual 36 4.6 Filters When your Wireless Broadband Router operates as a router, the built-in NAT function provides your LAN with the Internet access via the single public IP of the WAN port. That means all network devices are allowed to access various Internet service. Under this circumstance, network security becomes an important issue and system administrators may need to build access control to protect the network. The filter feature serves as a basic firewall security measure for your network. When filter function is enabled, the Wireless Broadband Router inspects all data packets arrive from LAN side and determines if packets are allowed to pass through the WAN port depending on whether packets match your filter rules and whether your filter type is Listed Pass or Listed Block. In addition to filter settings, the Filters page also allows to configure other firewall settings, including WAN Management, WAN Port Ping Reply and Report Log to TFTP Server. Specifing Your IP Filter Rules If you are going to specify your filter rules, follow the procedures below. In the Firewall item, select the Enable option. 2. Inthe Filter Type item, select the action (Listed Pass or Listed Block) to be performed on the IP packets matching your filter rules. 3. Inthe four filter types, select whether to enable or disable each filter. 4. Ifa filter is enabled, enter the criteria in provided fields. Click More to add more criteria if required. See next section for more information. 5. Click Apply to commit your changes. 4. Web Configuration Filter Types When setting up filter rules, you can define the Filter rules based on the LAN machines MAC address, IP address or the protocol type of the data packet. Each filter type is described as below. Note: Based on OSI reference model, MAC Filters demand higher priority than IP Filters while IP Filters higher than Port Filters. MAC Filters: The MAC address of the LAN machine from which packets are allowed (or prohibited) to pass through the WAN port. Up to 12 entries are allowed. IP Filters: The range of IP addresses of the LAN machines from which packets are allowed (or prohibited) to pass through the WAN port. You may enter the same address in both (Start and End) ields to define a single IP address. Up to 5 entries are allowed. TCP Port Filters: Allows (or prohibits) certain LAN machine to use TCP based service in the specified port range through the WAN port. Up to 12 entries are allowed. For example, to allow (or prohibit) local PC 192.168.1.210 to use FTP service (using TCP port 21):

IP Address Start End 192.168.1.210 20 21 UDP Port Filters: This field allows you to allow (or prohibit) certain LAN machine to use UDP based service in the specified port range through the WAN port. Up to 12 entries are allowed. For example, to allow (or prohibit) local PC 192.168.1.210 to use ping service (using UDP port 53):

IP Address Start End 192.168.1.210 53 53 37 Wireless Broadband Router User Manual Filter Scenario of the Wireles Broadband Router When setting up your firewall policy, note the filter scenario used by the router:

When Filter Type is Listed Block:

If all the filters are disabled: No filter rule is specified to block any packet. All packets can pass through the WAN port. (Defaults) If any filter is enabled: only the packets matching the specified rule are blocked; other packets can pass through the WAN port. When Filter Type is Listed Pass:

If all the filters are disabled: No filter rule is specified to allow any packet to pass. All packets are blocked. If any filter is enabled: Only the packets matching the specified rule can pass; other packets are blocked. Sate Wide Wl La cane wan ory aot ae ms Fenwaing Aiton This poe congue LAM The LAN machines ached by he rs ll nae bl communicate a =o wareoe waraiPestnie Cems ioeg ee] oan Tanner

_ TOP Pon Fer: emvie Cosale

CIF eo] cme Figure 4-15 Filters 38 4. Web Configuration Viewing Filter Log When filter feature is enabled, the router will keep a record of the packets discarded. To view the firewall activity log, go to System Overview > Firewall > Activity Log and click the Show Log button. Filter activity log is displayed in a separate window with a maximum of 32 entries. Clicking the Update button allows to refresh the log with newly reported data. The log types are defined as below:

Type Description il Blocked packets, from WAN side, by DoS (Deny of Service) protection mechanism. 2: Blocked packets, from LAN side, by MAC/IP/TCP/UDP filter. Other Firewall Settings WAN Management: Available only when Firewall is enabled. If available, this item is disabled by default that rejects any external access from the WAN port. If this option is enabled, a WAN Port iled is displayed with the default value 80. If required, you may enter another port number used by the external WAN access. f WAN Management is enabled using a non-80 port, the router's HTTP service (Web Configuration Utility) will be accessible via the routers WAN port IP address following by a colon and the non-80 port:

http://<WAN IP address>:<non-80 port>

For example, if 7234 is entered, a remote user can access and configure the router at hitp:/203.1.2.3:1234 where 203.1.2.3 indicates the WAN port's IP address. f WAN Management is enabled using standard port 80, no suffix is required. f WAN Management is enabled using port 80, your publicly accessible Web server (if any) on LAN side should use a non-80 39 Wireless Broadband Router User Manual 40 HTTP port. And you need to use the Forwarding feature to shift external HTTP requests to the non-80 port number used by the Web server on LAN side. WAN Port Ping Reply: Available only when Firewall is enabled. If available, this setting determines if an external host will get reply when trying to ping the IP address of your WAN port. Its disabled by default. Report Log to TFTP Server: Available only when Firewall is enabled. If available, it specifies whether to report firewall event log to your TFTP server. If enabled, a LAN TFTP Server field is present for you to specify the IP address of the TFTP server. All the filter logs are sent to TFTP server although only 32 entries are displayed in Show Log window (see System Overview page). 4. Web Configuration 4.7 Forwarding This page allows you to configure the Forwarding and DMZ

(De-Militarized Zone) features. Unlike Filter which governs outgoing traffic, Forwarding is used to provide external access to your local machines. This is commonly used when you have publicly accessible virtual servers on your local network. By default, forwarding entry is empty and any external access to your LAN is blocked. Once you define a forwarding entry, incoming packets (identified by its port number) that match your Forwarding criteria will be forwarded to the port range of the specified local machine. Otherwise packets are blocked. Forwarding serves as a measure of security that protects your network from hazardous packets. However, if you designate a DMZ sever, incoming packets that do not match the forwarding criteria will be redirected to the DMZ IP address. That is, forwarding demands a higher priority than DMZ. Setting Up Forwarding Entries To set up your forwarding entries, enter these fields:

DMZ IP Address: DMZ setting allows a local machine to be exposed to the Internet. If you specify a DMZ host here, the incoming packets containing no port information specified in the Forwarding table are forwarded to the DMZ host. TCP Port Forwards: In the first Start and End fields, define the port range for the incoming TCP service you want to forward. In the IP Address filed, enter the IP address of the virtual server to which packets are forwarded. The Start/End fields on right side define the port range for the TCP service on the virtual server. For example, you have a virtual server 192.168.1.210 running FTP service and you allow external access by the setting below:

Start End IP Address Start End 20 21 192.168.1.210 20 21 41 Wireless Broadband Router User Manual 42 UDP Port Forwards: The configuration is the same as setting TCP Port Forwards, only that the entry applies to UDP service. When the router gets outside TCP/UDP requests destined for the WAN port, it determines whether the services are allowed according to your forwarding settings. For example, if you do not specify FTP virtual service in Forwarding table, incoming FTP requests (identified by port number in packets) are blocked or otherwise sent to DMZ host (if specified). On the other hand, if an FTP forwarding entry has been set up, the FTP requests will be able to be forwarded to the specified machine. If you have a Web server on your network... If you enable WAN Management (i.e., allow external access from the WAN port, see 4.6 Filters) and want to designate another Web server on your local network, take either of the procedures below to avoid port confliction:

Option 1: In Filters page, with WAN Management enabled, enter a port number other than 80 (for example, 1234) and reserve the number 80 for your Web server. If any external host wants to access your Web management server through the WAN port, it should use the address below. http://204. 717.200.7143 (i.e., the WAN IP address):1234 Option 2: Have WAN Management to use the standard port number 80 and your Web server (e.g., 192.168.1.4) to use another port number (e.g., 8080). In this case, you need to shift the incoming HTTP request (destined for local Web server) to port 8080 of your Web server, the forwarding entry may look like this:

Start End IP Address Start End 8080 8080 192.168.1.4 8080 8080 With the settings above, an external host trying to access your local Web server should use the address like this:

http://204. 717.200.7143 (i.e., the WAN IP address):8080 4. Web Configuration If you do not enter the suffix :8080, the external host's packets will contain the standard port number 80 and the router will not forward the packets since no forwarding entry matches. As a result, if a WAN computer tries to access the LAN's Web server, it will turn to access the Web service on the WAN port, i.e., the Web Configuration Utility of the router instead. Suse Wiles LA Wels Lat oma, wan wa fan alos (ite antag Adnan mz Aten Colo oo x) UP Part Fanaa

[ ef ue]

Bee | ean Figure 4-16 Forwarding Wireless Broadband Router User Manual 44 4.8 Administration

> System Clock Configuration Network administrators may want to synchronize date and time among network devices. This can be done by synchronizing the local clock to an available NTP server or manually specifying the date and time in this router for your network. Option 1: Using an existing NTP server. 1. In Set by item, enable the Network Time Protocol option. In NTP Server field, enter the IP address of the NTP server. In Update Interval item, select your update interval as 1, 2 or 7 days. 4. In Time Zone field, select a time zone according your geographic location. Option 2: Specifying the router as your network NTP server. 1. In Set by item, enable the Manual Setup option. 2. Manually enter the date and time information in respective fields.

> Management Setup Username&Password: For administration security, specify required User Name and Password and re-enter password in corresponding field for confirmation. This setting limits your Web-based manager access to users with the correct credentials. By default, the user name is empty and the password is admin.

> Firmware Upgrade This option allows you to upgrade the Wireless Broadband Router with new firmware. After upgrading, your customized configuration will still exist and not reset to the factory defaults. To upgrade, download required firmware file to your host PC and follow the steps below:

4. Web Configuration 1. Inthe Locate New Firmware field, click Browse to locate the firmware file. 2. Click the Upgrade button to start upgrade and then wait for a few minutes as the utility prompts. You will return to the Administration page while the process is complete. Note: Do not interrupt the upgrade process otherwise it might cause damage to your Wireless Broadband Router. After upgrade, you can see the new firmware version in Current Firmware version field.

> User Configurations Save Current Configurations: Allows you to save your customized settings to the device. Once your router is properly configured, you may wish to save current settings. The saved settings can be retrieved easily if required, even after you reload factory defaults. Retrieve User Configurations: If you have loaded factory defaults

(either via the Load Default button on the back panel or via the Restore button in this group), you can restore your settings by clicking the Retrieve button. Important: After retrieving your desired configuration file, you must reboot the device to enable the retrieved settings. Restore Factory Defaults: To restore factory defaults, click the Restore button and then wait for a few seconds as the utility prompts. You will return to the Administration page while the process is complete. This feature is basically the same as resetting via the Load Default button (see Rear Panel and Connectors) on the device but it allows you to remotely perform the reset task.

> System Reboot: This option allows to you remotely reboot the device. 45 Wireless Broadband Router User Manual 46 Management Setup mare Upgrade User Configuration Sytem cles LA les LA erga WiclastAK flies Eanwauling Atinisaon rernoiot ,cocsas [Fil Netware Protocol Manual Stup

[= veargeg 2002) mntn op 05) [bate fg 22) Tinea 10 [mite 5) nae C Diable ae) 2021407 10305 Biota | Uparce|

Es Frio ae

[epost Figure 4-17 Administration

5 Troubleshooting

| cannot access the Web-based configuration utility from the Ethernet computer used to configure the router. Check that the LAN LED is on. If the LED is not on, check that the cable for the LAN connection is securely connected. Check that your computer resides on the same subnet with the routers LAN IP address. If your computer act as a DHCP client, check that your computer has been assigned an IP address from the DHCP server. If not, you will need to renew the IP address. See the check/renew IP address section under 3.2 Setting up TCP/IP for instructions. Use the ping command to ping the routers LAN IP address to verify the connection. Make sure your browser is not configured to use a proxy server. Check that the IP address you entered is correct. If the router's LAN IP address has been changed, you should enter the reassigned IP address instead.

| can browse the routers Web-based configuration but cannot access the Internet. Check the WAN LED is illuminated. If not, check the physical connection between the router and the DSL/Cable modem is OK. If WAN LED is illuminated, open the WAN page of the Web configuration utility and check the status group to see if the routers WAN port has successfully obtained an IP address. Make sure you are use the correction method (DHCP client, PPPoE client, PPTP client or Manual) as required by your ISP. Also ensure you have entered correct 47 Wireless Broadband Router User Manual settings provided by your ISP. For cable users, if you ISP required a fixed Ethernet card MAC address, make sure you have cloned the network adapters MAC address to the WAN port of the router.

(See the MAC Address field in WAN page.) My wireless client cannot communicate with another Ethernet computer. Ensure your wireless adapter functions properly. You may open the Device Manager in Windows to see if the adapter is proper installed. Make sure your wireless client is configured to use Infrastructure mode. Also make sure the client uses the same SSID and security settings (if enabled) with the AP. Ensure that the wireless adapters TCP/IP settings are correct as required by your network administrator. Check that the wireless adapters MAC address is not in the MAC address list if Access Control is enabled to use a deny list. (See Wireless LAN page in Web configuration utility.) If you are using a 802.11b wireless adapter, check that the Operational Mode item (in Wireless LAN page) is not limited to use 802.11g. On the other hand, if you are using an 802.11g draft adapter, check the Operational Mode item is not configured to use 802.11b only. Use the ping command to verify the wireless client's communication.with the router's LAN port and with the opposite computer. If the wireless client can successfully ping the routers LAN port but fails to ping the opposite computer, then verify the TCP/IP settings of the opposite computer. After | retrieved my saved configuration file, the retrieved settings do not take effect. 48 After you retrieved the desired file, you must reboot the router to have retrieved settings take effect. A Implementing 802.1x A.1 Overview In a typical 802.11-based wireless network, the security is often established by the proper settings of SSID broadcast, security mode, WEP keys and MAC-address-based access control. However, for a network carrying sensitive information, a more enhanced and effective security mechanism might be needed to further protect the network against eavesdroppers. In this circumstance, 802.1x would be a better choice to offer a higher-level security solution. Compared with the WEP encryption as defined by IEEE 802.11, 802.1x function offers the following advantages:

e Security: When a station requests access to a network, it is required to be authenticated by a central authentication server. Only an authenticated user is granted the network acccess and thererby unauthorized access is blocked.

@ Centralized user administration: The WEP key does not need to be set at each station. Instead, centralized user authentication, authorization and accounting are used in 802.1x.

@ Dynamic key distribution: 802.1x can provides WEP keys on a per-user, per-session basis. It's more secure in that even an eavesdropper obtains a WEP key, it is no longer valid after a user session terminates. It is also more effective than fixed WEP keys since it spares system administrators the tasks of updating the fixed WEP keys.

* Whether the WEP key can be dynamically distributed depends on the authentication method used. 49 Wireless Broadband Router User Manual 50 A.2 802.1x Function This section explains the 802.1x function more specifically to help you better understand how the 802.1x operates. A.2.1 Required Components The following components are required to implement 802.1x on a wireless network:

e Access Point (the Authenticator) : It acts as a intermediary between the authentication server and the supplicant.

@ 802.1x station (the supplicant): A wireless station must use 802.1x-compliant software such as Windows XP built-in Wireless Zero Configuration Utility.

@ RADIUS Server (the authentication server): A server providing Remote Authentication Dial In User Service. It is a central server for managing authenticaticatoin, authorization and configuration for 802.1x stations. 5. Troubleshooting A.2.2 Authentication Procedure This section briefly describes the authentication procedure. In this section, the abbreviation STA is used to refer to the 802.1x wireless client. 1. When an unauthenticated STA attempts to connect to the AP, the authentication starts. In this initial stage, the STA sends an EAP-start message to the AP. The AP asks the STA to start the authentication. Then a series of message exchange between the AP and the STA will start:

a. The AP replies with an EAP-request/identity message requesting the STAs identity. b. The STA sends an EAP-response message containing its identity. c. The AP transfers all authentication-related messages to the authenticator server (the RADIUS server). The STA and the RADIUS server keep changing EAP messages to perform mutual authentication. AP acts as the intermediary only. While the authentication procedure is performed, only EAP traffic is allowed to pass through the AP; all other traffic are blocked. That is, the STA cannot yet join the network. The EAP authentication mechanisms can be MD5-challenge or EAP-TLS as required. When the STA passes the authentication, the RADIUS server reports to the AP. The AP in turn sends an EAP-success message to the STA. At this point, the WEP key can be distributed. (Whether the WEP key can be distributed depends on the authentication type.) The AP changes the originally controlled port state to be authorized so that other network traffic are allowed between the STA and the network. 51 Wireless Broadband Router User Manual The following figure depicts a successful authentication procedure:

p=

802.1x Station AP (RADIUS Client) RADIUS Server

@ STA associates with AP Qe AP asks STA to start authentication

STA and RADIUS server perform mutual authenticaion

(using AP as the intermediary) wg 6 RADIUS server reports to AP that STA has passed the authenticaion. It AP informs STA of successful authenticaion. 6 STA can join the netwok. 52 5. Troubleshooting A.2.3 EAP and Authentication Type The Extensible Authentication Protocol (EAP) is a method of conducting an authentication conversation between a client and an authentication server. Intermediate devices (such as the AP) do not take part in the conversation but just relay EAP messages between the parties performing the authentication. 802.1X employs the Extensible Authentication Protocol (EAP) as an authentication framework. The wireless network and the RADIUS sever should use the same method to perform the authentication procedure. Two commonly used EAP authentication mechanisms are MD5-challenge and EAP-TLS, which are described as below:

@ MD5-Challenge (Message Digest version 5) Using this method, the user must provide the user name and password to pass the authentication. In this type of authentication, the WEP key cannot be distributed.

@ EAP-TLS (Transport Layer Security). Using this method, the wireless client computer has to obtain a valid digital certificate from a Central Authority

(CA) or Smart Card for authentication. In this type of authentication, the WEP key can be distributed and the WEP key is created at random by the AP. 53 Wireless Broadband Router User Manual A.3 Configuration Example This section gives a specific example to explain how to establish an 802.1x environment. The following components will be used in our example network:

@ Windows 2000 Server Active Directory is installed. RADIUS server is installed using Internet Authentication Service. Certificate Services is installed (due to EAP-TLS is be used as the authentication method in our example.)

@ AP (Wireless Broadband Router) Connects to Windows 2000 Advanced Server through its LAN port. The Wireless Broadband Routers DHCP server is used (192.168.1.100~192.168.1.150). 802.1x and WEP Key distribution is enabled. The SSID is set to STR.

@ 802.1x Station AWLAN card supporting 128-bit WEP is used. Windows XP built-in Wireless Zero Configuration Utility is used for 802. 1x function. Authentication Mechanism EAP-TLS is used so that a session key is automatically generated for wireless packets encryption between the wireless client and the AP. LAN cS = 7 a iL \ or

802.1x Station AP (Wireless Broadband Router) Win2000 Server 192.168.1.1 192.168.1.10

= OSENIIXT, + SSID: STR + Active Directory

+ DHCP Server + RADIUS Server (IAS)

+ 802.1x enabled + Certificate Authority 54 5, Troubleshooting Part 1. Windows 2000 Server Assumption:

The following description assumes that Active Directory and a RADIUS server using Internet Authentication Service are already installed on the Windows 2000 server. For details on these services, refer to the online Help of Windows 2000. In Active Directory Users and Computers, a domain user lan was created and will be used in our example. Step 1: Install Certificate Authority. Select Control Panel > Add/Remove Programs > Add/Remove Windows Components > Certificate Services and then follow the on-screen prompts to proceed. For details on installing Certificate Service, refer to the online help of Windows 2000. As this is the first CA in our example Active Directory domain, we create an Enterprise Root CA named WirelessCA. Step 2: Create a Radius client for the RADIUS server. Install Internet Authentication Service (IAS) in Windows 2000 Server. For details on IAS, refer to the online Help of Windows 2000. Then take the following procedures to create a RADISU client. 1. Start Internet authentication service in Administrative Tools. 55 Broadband Router User Manual 56 Right-click Client in the Tree window and select New Client from the menu. kn ie |e Om Be rl [Stee [utes Tras Set Friendly name. In this example, NetAP is set. Leave the other items in the default setting and click Next. Di E Nee dt Tis ar esi cle Wecoteeyrane nts ee fiedy roe Far tote os Seen moans Set Client address. Enter the IP address of the AP. In this example, 192.168.1.1 is set. Set Shared secret. Enter the password for communication between the AP and the RADIUS server. In this example, secret is set. Leave the other items in the default setting and click Finish. Sec rton pry te ch int opsnn Peron) fies rt pete

[feu Series 3]

heat ag i nb ind vine -

Cs ae Ce] oe |

5. Troubleshooting Step 3: Create Remote Access Policies. 1 In the Tree window, right-click Remote Access Policies and select New Remote Access Policy from the menu. on ie /@ = ORES E cain Enter a friendly name for this policy an

= ex ane ech aber mel taser eee a arama ale er eee Seperate ccrenes Se een eae Per nw i ewe Eee) Click Add to add a condition. This exai

\d click Next. imple defines that this policy should be used when Client-Friendly-Name is NetAP. Various conditions are available. For d 2000 online Help. Click Next. letails, refer to Windows a4 See haye a ete ant ek he Ad ban Ts Pre abe doy LE +l Plone ube toma ced Fre anes RGIS ce 1S oe (Baitaseranus cen OS oy) CaetdaMadahae RADIUS py (AS co Depinefeste.. Tow paces ad day woes dar wht smptetornnn Fapesbacca" Tmroccaiseewres coo UiStinaie Siping Ba iS citrate usiPaes: Paden diet obra eae 1aSPartape Tppecsion st ast Ba iS Sor Tuned Tipe Tiaralea peta abe wed wcneGnt Winans poor sree 6 Ca) ej |

57 Wireless Broadband Router User Manual 4. Select Grant remote access permission. Click Next. x Peimissions Determine whether to grant ar deny remote access permission. You can use a Remote Access Policy ether to grant certain access privileges to a group of users, orto act ac alfiter and deny access privileges to a group of users. Ita user matches the speciied conditions:

Giant iencle sezees paimisiod Deny remote access permission

<Back Ea 5. Click the Edit Profile button and select the Authentication tab. Place a check mark in the Extensible Authentication Protocol check box. Select Smart Card or other Certificate for the EAP type. Click OK and then Finish. Ez Profile a es) Dial-in Constraints | IP | Mullin Authentication |] Eeryption | Advanced Check the authentication methods which are allowed for this connection. 1 Extensible Authentication Protocol Select the EAP tyne which is acceptable for this policy |

it Card or

[> Microsoft Encrypted Authentication version 2(MS-CHAP v2) 7 Microsoft Encrypted Authentication (MS-CHAP) T Encrypted Authentication (CHAP) T7 Unenerypted Authentication (PAP. SPAP]

j-Unauthenticated Bees any authentication method, |

| Allow remote PPP clients to connect without negotiating Cencel Apply Step 4: Enable remote access login for the user. 1. Go to Active Directory Users and Computers and double-

click on the user (lan in our example) to bring up its properties window. 58 5. Troubleshooting, 2. Select the Dial-in tab and select Allow access. Click OK. See Ec NT SSCs Serle eel Seve cae certecea eee l WenberOi Dtin. | Envionment | Sessore |

eemate Access Pernission (Diatin or VPN) Allow access Deny access en F Vert Caleb:

Callback Options No Callback Set by Calle (Routing and Remote Access Service only}

Always Callback to:

ie Dafne utes th anal fi this Diskin Ea connection Se Part 2: Access Point The following is the setting procedure for the AP. Step 1: Setting the 802.1x function at the AP. The following procedure is to enable the 802. 1x function. The other settings of the Wireless LAN page are omitted. 1. Enter the Web-Based Configuration Utility of the Wireless Broadband Router and go to the Wireless LAN Security page. In 802. 1x group:

802.1x: Select Used. WEP Key Distribution: Select Enable. If WEP key distribution is disabled, you will need to manually set the WEP keys instead. Re-authentication: Select Enable. This enables periodic 802. 1x client re-authentication. When authentication times out, the authenticator (AP) will request the stations to be reinitiate the authentication process. 59 Wireless Broadband Router User Manual 60 Interval: Specify how often the re-authentication occurs. Key Length: Set 5byte in this example. 3. In RADIUS group:

RADIUS Server1: Select Enable. IP Address: Enter the IP address of the RADIUS server. In this example, set 192.168.1.10. Port: Use the default 1812. The RADISU server uses this port for authentication. Shared Secret: This is a password shared between the AP and the RADIUS server. In this example, set secret. Time-out: Enter a response time-out value. In this example, set 5. RADIUS Server2: Select Disabled unless you have a backup RADIUS server. Sytem Mk we 8

= wan ta ry nalnn 8 mes Eanvaing inion Tis page congue th Wiles LAN Sauter wa. re eco Casa achduns eee Oe ow Oy MACAddeem tie | .-- [>

SSS aaa Ed Ce co}

cage 5. Troubleshooting Part 3: 802.1x Station The following provides the setting procedure for the 802. 1x station. Step 1. Install Certificate. 1. Temporarily, have the station join the wired network. Then open the Web browser and connect to the following URL:

http://sthe CAs IP address>/certsrv In this example, type http://192.168.1.10/certsrv in the URL field l Adress [MB hep f192.168.1.NOfcersryh 2. Log on to the domain using the user account lan that has been allowed remote access dial-in. 61 Wireless Broadband Router User Manual 4. Select User certificate request: User Certificate and click Next. choose Request Typ Pease selec ote otreqiestyeunousieto make sar corte roast 0 Advncea request Ali necessaydechig tomate has ateady been clei. You now sii your DDG Ame diem Gee SSB i i eran cemeateesues The ciety reused nas sive you, Elem 62 5. Troubleshooting You'll receive a confirmation message about accepting the certificate, click Yes aren ec |

1 Do you want ta ADD the Following certificate ta the Root Store?

Subject : WirelessCA, ASKRD, ASKRD, US, stelahg@mydomain Issuer : Sel Issued Time Validity : Monday, Apri 07, 2003 through Thursday, April 07, 2005 Serial Number : 48S8S8F3 916599AC 47164938 SEF 36671 Thumbprint (shat) : 1OABAE98 4C1BBB61 561E006F 80102662 BED7ESAF Thumbprint (md5) : 46CDDC73 96E 103C EBBBEDE2 SS6FOSFF ves No Notes:

1. To issue a certificate from the certificate authority and install it,

[Certificate Service Web Enrollment Support] needs to have been installed in the certificate authority. The above example issues and installs a certificate through the network. You can also export the certificate into a file and then import it to another wireless client. For more information, refer to the online Help of the certificate authority. Step 2. Setting the 802.1x function in the Wireless LAN station Next, set the 802. 1x function. 1. Launch Windows XP built-in Wireless Zero Configuration Utility and then select the Wireless Networks tab. Make sure the Use Windows to configure my wireless network settings check box is ticked. Sea ene aerated fix) General| Wireless Networks | Authentication | Advanced

[Use Windows to configue my wireless network settings Select the Authentication tab. Select the Enable network access control using IEEE 802.1x check box. Select Smart Card or other Certificate from the EAP type list. Then click Properties. 63 Wireless Broadband Router User Manual Pee created mee ale) General | Wireless Networks | Authentication | Advanced]

Select this option to provide authenticated network access for Uired and wireless Ethemet networks. Enable network access control using IEEE 802.1%

EAP ype: [Smart Card o: other Ceitificate

[TlAuthenticate as computer when computer information is available

[Clauthenticate as quest when user or computer information is unavailable 3. Select the Use a certificate on this computer radio button. Select the Validate server certificate check box. Select a reliable certificate authority from the Trusted root certificate authority list. In this example, select the certificate authority, WirelessCA, which was installed in Windows 2000 Server. Smart Card on other Certificate Properties ales}

When connecting:

Use my smart card Use a cettficate on this computer

(C1 Connect only it server name ends with:

tcetificate authori

[Duss a aitferent user name forthe connection 64 5. Troubleshooting Step 3. Connect to the eless Network 1. Make sure the properties of the target wireless network (STR) are set to use Data encryption (WEP enabled), and ensure The key is provided for me automatically is also selected Wireless Network Properties Network name (SID): [STR Wireless network key (WEP]

This network requires a key for the following ata enciyption (WEP enabled}

[Network Authentication [Shared mode}

he key is provided for me automatically

[This ie 8 computer-to-computer (ad hoc} network: wireless C0886 paints ate not used 2. Open the Connect to Wireless Network. Select the target 802.1x wireless network and click Connect. ena ha coh eeu The folowing netwaik(s) are available. To access a network, select itfrom the lst, and then click Connect, Available networks:

1 PE_Wireless i This network requires the use at a network key (WEP). To access this network, type the key, and then cick Connect. Networkkey:

Ityou are having dificuty connecting to a network, cick Advanced. 65 Wireless Broadband Router User Manual 66 Step 4. Check the connection status. A successful wireless connection is shown as the figure below. Highlighting the icon of the wireless adapter displays the connection details. The wireless client has been successfully authenticated and obtained an IP address (192. 168.1.100) from the DHCP server of the Wireless Broadband Router. File Edt View Favorites Tools Advanced Help Qe - - Bl Dawe eprauee| a cress |(@.Netwerk Connections | Ele A) Internet Gateway Je] Internet connection Disabled Internet Connection tz) Rename this connection Vow status ofthis connection Change settings ofthis connection

@ My network Paces Tih, D-Link OFE-Sa0Tx PcTFast et... Tsp Bi My documents

@ My Computer Details Wireless Network Connection Authentication succeeded IP Address: 192.168.1100 Sulbnet Mask: 255.255.255.0, Assigned by DHCP Access Point Network: STR Encryption: Enabled Signal Strenath: Excellent [wireless Network Connection (STR)|

ISpeed: 11.0 Mbps Signal Strength: Excellent Re-authentication When re-authentication interval passes (15 minute is set in our example), the re-authentication will be performed. Wireless Network Connection Attempting to authenticate Cy Wireless 802.119 Network 4... B Specification B.1 Hardware

@ = 125MHz MIPS CPU

@ 16MB SDRAM

@ 4MB Flash Memory

@ Wireless: 802.11g draft MiniPCl module

@ = =One external and one built-in antennas for wireless technology Interface

@ One 10/100 Base-TX RJ-45 auto sensing and crossover Ethernet WAN port for Broadband connection (Cable/DSL or direct Ethernet)

@ Four RJ-45 LAN ports for 10/100Base-TX auto sensing &

crossover Ethernet Switch LAN connection

@ 802.11g draft wireless LAN

@ One external and one built-in antennas for wireless technology Physical

@ Front Panel: 7 LEDs ( Power x 1, LAN x 4, WAN x 1, Wireless x 1)

@ Back Panel: Reset / Load Default button, Power Jack, RJ-45 LAN Port x 4, RJ-45 WAN Port x 1

@ Dimensions 170mm (L) x 135mm (W) x 45mm (H)

@ Case types:

Stand up / Lay down 67 Wireless Broadband Router User Manual Power Adapter and Environmental Requirement

@ ~=Power Adapter:

Input AC110V, Output 12V AC, 1A

@ Temperature: 0 to 40C (operation), -20 to 70 C (storage)

@ Relative Humidity: 5% to 90% (non-condensing) Electromagnetic Compliance

@ FCC Part 15 Class B CE

@ =EMl/immunity: VCCI class B e@ PTT: JATE B.2 Software WAN Port Features

@ PPPoE (PPP over Ethernet) Client with Keep Alive/Connect On Demand Support PAP and CHAP Authentication DHCP Client MAC Address Cloning Settable and Changeable IP Address LAN Port Features

@ DHCP Server

@ Settable and Changeable IP Address Router Features NAT Firewall Support Bridge Mode Support 802.1D Spanning Tree Bridging IP Filtering, IP Forwarding 68 5. Troubleshooting DMZ Hosting DNS Forwarding UPNP Support Microsoft NetMeeting Passthrough Support Microsoft XP Messenger Passthrough Support Security Features PAP and CHAP Authentication ASCII/HEX Format 64/128 Bit WEP Key for Wireless LAN Allow/Deny List for Wireless LAN 802.1x Security for Wireless LAN Supports IP packets filtering based on IP address, port number, and protocol VPN Support (IPSec Passthrough, and PPTP Passthrough) Wireless LAN Features Fully compatible to 802.11g draft standard Direct Sequence Spread Spectrum (DSSS) technology exploitation Seamless roaming within wireless LAN infrastructure Low power consumption via efficient power management Configuration and Management Features Configurable through Web Browser via WAN/LAN Software Upgrade DHCP Server function for IP distribution to local network users NTP/Manual System Clock Configuration Saving/Retrieving Event Log 69