P-660HW-D Series 802.11g Wireless ADSL 2+ 4-port Gateway User’s Guide Version 3.
P-660HW-D Series User’s Guide Copyright Copyright © 2006 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
P-660HW-D Series User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules.
P-660HW-D Series User’s Guide This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. ZyXEL Communications Corporation declared that ZyXEL device is limited in CH1~11 from 2400 to 2483.5 MHz by specified firmware controlled in USA. Certifications 1 Go to www.zyxel.com 2 Select your product from the drop-down list box on the ZyXEL home page to go to that product's page. 3 Select the certification you wish to view from this page.
P-660HW-D Series User’s Guide Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • To reduce the risk of fire, use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord. • Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. ONLY qualified service personnel can service the device. Please contact your vendor for further information.
P-660HW-D Series User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
P-660HW-D Series User’s Guide Customer Support Please have the following information ready when you contact customer support. • • • • Product model and serial number. Warranty Information. Date that you received your device. Brief description of the problem and the steps you took to solve it. METHOD SUPPORT E-MAIL TELEPHONEA WEB SITE FAX FTP SITE REGULAR MAIL LOCATION CORPORATE HEADQUARTERS (WORLDWIDE) CZECH REPUBLIC DENMARK FINLAND SALES E-MAIL support@zyxel.com.tw +886-3-578-3942 sales@zyxel.
P-660HW-D Series User’s Guide TELEPHONEA WEB SITE SALES E-MAIL FAX FTP SITE info@pl.zyxel.com +48-22-5286603 www.pl.zyxel.com ZyXEL Communications ul.Emilli Plater 53 00-113 Warszawa Poland www.zyxel.ru ZyXEL Russia Ostrovityanova 37a Str. Moscow, 117279 Russia www.zyxel.es ZyXEL Communications Alejandro Villegas 33 1º, 28043 Madrid Spain www.zyxel.se ZyXEL Communications A/S Sjöporten 4, 41764 Göteborg Sweden www.ua.zyxel.com ZyXEL Ukraine 13, Pimonenko Str.
P-660HW-D Series User’s Guide 9 Customer Support
P-660HW-D Series User’s Guide Table of Contents Copyright .................................................................................................................. 2 Federal Communications Commission (FCC) Interference Statement ............... 3 Safety Warnings ....................................................................................................... 5 ZyXEL Limited Warranty.......................................................................................... 6 Customer Support..
P-660HW-D Series User’s Guide 2.4.6 Status: Packet Statistics ............................................................................50 2.4.7 Changing Login Password .......................................................................51 Chapter 3 Wizard Setup for Internet Access ......................................................................... 54 3.1 Introduction ........................................................................................................54 3.
P-660HW-D Series User’s Guide 5.3.1 ATM Traffic Classes ..................................................................................79 5.3.1.1 Constant Bit Rate (CBR) .................................................................79 5.3.1.2 Variable Bit Rate (VBR) ...................................................................79 5.3.1.3 Unspecified Bit Rate (UBR) .............................................................79 5.4 Zero Configuration Internet Access ...............................
P-660HW-D Series User’s Guide 7.3 Wireless Performance Overview ......................................................................109 7.3.1 Quality of Service (QoS) .........................................................................109 7.4 General Wireless LAN Screen ........................................................................110 7.4.1 No Security ............................................................................................. 111 7.4.2 WEP Encryption .....................
P-660HW-D Series User’s Guide Chapter 9 Firewalls................................................................................................................ 142 9.1 Firewall Overview ............................................................................................142 9.2 Types of Firewalls ............................................................................................142 9.2.1 Packet Filtering Firewalls ........................................................................
P-660HW-D Series User’s Guide 10.4.2 Alerts .....................................................................................................157 10.5 General Firewall Policy ...............................................................................157 10.6 Firewall Rules Summary ...............................................................................158 10.6.1 Configuring Firewall Rules ..................................................................160 10.6.2 Customized Services .......
P-660HW-D Series User’s Guide 13.6.3 Bandwidth Management Priorities ........................................................188 13.7 Over Allotment of Bandwidth ..........................................................................189 13.8 Configuring Summary ...................................................................................189 13.9 Bandwidth Management Rule Setup ............................................................190 13.9.1 Rule Configuration .................................
P-660HW-D Series User’s Guide 16.4.2 Web Configurator Easy Access ............................................................218 Chapter 17 System .................................................................................................................. 222 17.1 General Setup ................................................................................................222 17.1.1 General Setup and System Name ........................................................222 17.1.2 General Setup .......
P-660HW-D Series User’s Guide Introduction to DSL ................................................................................................ 250 ADSL Overview...................................................................................................... 250 Advantages of ADSL .............................................................................................. 250 Appendix C Wall-mounting Instructions.................................................................................
P-660HW-D Series User’s Guide PPPoE ................................................................................................................... 288 PPPoE in Action..................................................................................................... 288 Benefits of PPPoE.................................................................................................. 288 Traditional Dial-up Scenario ...................................................................................
P-660HW-D Series User’s Guide List of Figures Figure 1 Protected Internet Access Applications ................................................................ 36 Figure 2 LAN-to-LAN Application Example ......................................................................... 37 Figure 3 Front Panel ........................................................................................................... 37 Figure 4 Password Screen ...........................................................................
P-660HW-D Series User’s Guide Figure 39 Internet Connection (PPPoE) .............................................................................. 80 Figure 40 Advanced Internet Connection Setup ................................................................. 82 Figure 41 More Connections ............................................................................................... 84 Figure 42 More Connections Edit ........................................................................................
P-660HW-D Series User’s Guide Figure 82 SYN Flood ........................................................................................................... 146 Figure 83 Smurf Attack ....................................................................................................... 147 Figure 84 Stateful Inspection ............................................................................................... 148 Figure 85 Firewall: General .............................................................
P-660HW-D Series User’s Guide Figure 125 Internet Connection Properties: Advanced Settings ......................................... 217 Figure 126 Internet Connection Properties: Advanced Settings: Add ................................. 217 Figure 127 System Tray Icon .............................................................................................. 217 Figure 128 Internet Connection Status ................................................................................
P-660HW-D Series User’s Guide Figure 168 Red Hat 9.0: Static IP Address Setting in ifconfig-eth0 Figure 169 Red Hat 9.0: DNS Settings in resolv.conf .................................. 268 ...................................................... 268 Figure 170 Red Hat 9.0: Restart Ethernet Card ................................................................ 269 Figure 171 Red Hat 9.0: Checking TCP/IP Properties ......................................................
P-660HW-D Series User’s Guide 25 List of Figures
P-660HW-D Series User’s Guide List of Tables Table 1 ADSL Standards .................................................................................................... 32 Table 2 Front Panel LEDs .................................................................................................. 37 Table 3 Web Configurator Screens Summary .................................................................... 43 Table 4 Status Screen .............................................................................
P-660HW-D Series User’s Guide Table 39 MAC Address Filter ............................................................................................. 123 Table 40 WMM QoS Priorities ............................................................................................ 124 Table 41 Commonly Used Services ................................................................................... 124 Table 42 Wireless LAN: QoS ....................................................................................
P-660HW-D Series User’s Guide Table 82 Remote Management: FTP ................................................................................. 204 Table 83 SNMP Traps ........................................................................................................ 206 Table 84 Remote Management: SNMP .............................................................................. 207 Table 85 Remote Management: DNS ................................................................................
P-660HW-D Series User’s Guide Table 125 PPP Logs ........................................................................................................... 297 Table 126 UPnP Logs ........................................................................................................ 298 Table 127 Content Filtering Logs ....................................................................................... 298 Table 128 Attack Logs ...........................................................................
P-660HW-D Series User’s Guide Preface Congratulations on your purchase of the P-660HW-D series 802.11g Wireless ADSL 2+ 4port Gateway. P-660HW comes with built-in IEEE 802.11g wireless capability allowing wireless connectivity. P-660HW-D has a 4-port switch that allows you to connect up to 4 computers to the P-660HW-D without purchasing a switch/hub. Note: Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com for global products, or at www.us.zyxel.
P-660HW-D Series User’s Guide User Guide Feedback Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you.
P-660HW-D Series User’s Guide CHAPTER 1 Getting To Know Your P-660HWD This chapter describes the key features and applications of your ZyXEL device. 1.1 Introducing the P-660HW-D The ZyXEL device is an ADSL2+ gateway that allows super-fast, secure Internet access over analog (POTS) or digital (ISDN) telephone lines (depending on your model). In the ZyXEL device product name, “H” denotes an integrated 4-port switch (hub) and “W” denotes an included wireless LAN card that provides wireless connectivity.
P-660HW-D Series User’s Guide 1.2 Features High Speed Internet Access Your ZyXEL device can support downstream transmission rates of up to 24Mbps and upstream transmission rates of 3.5Mbps. Actual speeds attained depend on the ADSL service you subscribed to, distance from your ISP, line quality, etc.
P-660HW-D Series User’s Guide Universal Plug and Play (UPnP) Using the standard TCP/IP protocol, the ZyXEL device and other UPnP enabled devices can dynamically join a network, obtain an IP address and convey its capabilities to other devices on the network. PPPoE (RFC2516) PPPoE (Point-to-Point Protocol over Ethernet) emulates a dial-up connection. It allows your ISP to use their existing network configuration with newer broadband technologies such as ADSL.
P-660HW-D Series User’s Guide Housing Your ZyXEL device's compact and ventilated housing minimizes space requirements making it easy to position anywhere in your busy office. 4-port Switch A combination of switch and router makes your ZyXEL device a cost-effective and viable network solution. You can connect up to four computers to the ZyXEL device without the cost of a hub. Use a hub to add more than four computers to your LAN. 1.2.1 Wireless Features Wireless LAN The ZyXEL device supports the IEEE 802.
P-660HW-D Series User’s Guide Output Power Management Output power management is the ability to set the level of output power. There may be interference or difficulty with channel assignment when there is a high density of APs within a coverage area. In this case you can lower the output power of each access point, thus enabling you to place access points closer together.
P-660HW-D Series User’s Guide Figure 2 LAN-to-LAN Application Example 1.4 Front Panel LEDs The following figure shows the front panel LEDs. Figure 3 Front Panel The following table describes the LEDs. Table 2 Front Panel LEDs LED COLOR STATUS DESCRIPTION POWER Green On The ZyXEL device is receiving power and functioning properly. Blinking The ZyXEL device is rebooting or performing diagnostics. On Power to the ZyXEL device is too low. Off The system is not ready or has malfunctioned.
P-660HW-D Series User’s Guide Table 2 Front Panel LEDs (continued) LED COLOR STATUS DESCRIPTION DSL Green On The DSL line is up. Blinking The ZyXEL device is initializing the DSL line. Off The DSL line is down. On The Internet connection is up. Blinking The ZyXEL device is sending/receiving data. Off The Internet connection is down. INTERNET Green 1.5 Hardware Connection Refer to the Quick Start Guide for information on hardware connection.
P-660HW-D Series User’s Guide 39 Chapter 1 Getting To Know Your P-660HW-D
P-660HW-D Series User’s Guide CHAPTER 2 Introducing the Web Configurator This chapter describes how to access and navigate the web configurator. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyXEL device setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions. The recommended screen resolution is 1024 by 768 pixels.
P-660HW-D Series User’s Guide status only. Click Login to proceed to a screen asking you to change your password or click Cancel to revert to the default password. Figure 4 Password Screen 6 If you entered the user password, skip the next two steps and refer to Section 2.4.2 on page 45 for more information about the Status screen.
P-660HW-D Series User’s Guide Figure 6 Select a Mode Note: The management session automatically times out when the time period set in the Administrator Inactivity Timer field expires (default five minutes). Simply log back into the ZyXEL device if this happens to you. 2.3 Resetting the ZyXEL device If you forget your password or cannot access the web configurator, you will need to use the RESET button at the back of the ZyXEL device to reload the factory-default configuration file.
P-660HW-D Series User’s Guide Figure 7 Web Configurator: Main Screen Click the Logout icon at any time to exit the web configurator. Use submenus to configure ZyXEL device features. Note: Click the icon (located in the top right corner of most screens) to view embedded help.
P-660HW-D Series User’s Guide Table 3 Web Configurator Screens Summary (continued) LINK/ICON SUB-LINK FUNCTION LAN IP Use this screen to configure LAN TCP/IP settings, enable Any IP and other advanced properties. DHCP Setup Use this screen to configure LAN DHCP settings. Client List Use this screen to view current DHCP client information and to always assign an IP address to a MAC address (and host name). IP Alias Use this screen to partition your LAN interface into subnets.
P-660HW-D Series User’s Guide Table 3 Web Configurator Screens Summary (continued) LINK/ICON SUB-LINK FUNCTION Remote MGMT WWW Use this screen to configure through which interface(s) and from which IP address(es) users can use HTTPS or HTTP to manage the ZyXEL device. Telnet Use this screen to configure through which interface(s) and from which IP address(es) users can use Telnet to manage the ZyXEL device.
P-660HW-D Series User’s Guide Figure 8 Status Screen The following table describes the labels shown in the Status screen. Table 4 Status Screen LABEL DESCRIPTION Refresh Interval Select a number of seconds or None from the drop-down list box to refresh all screen statistics automatically at the end of every time interval or to not refresh the screen statistics. Apply Click this button to refresh the status screen statistics.
P-660HW-D Series User’s Guide Table 4 Status Screen LABEL DESCRIPTION LAN Information IP Address This is the LAN port IP address. IP Subnet Mask This is the LAN port IP subnet mask. DHCP This is the WAN port DHCP role - Server, Relay or None. WLAN Information SSID This is the descriptive name used to identify the ZyXEL device in the wireless LAN. Channel This is the channel number used by the ZyXEL device now. WEP This displays the status of WEP data encryption.
P-660HW-D Series User’s Guide 2.4.3 Status: Any IP Table Click the Any IP Table hyperlink in the Status screen. The Any IP table shows current readonly information (including the IP address and the MAC address) of all network devices that use the Any IP feature to communicate with the ZyXEL device. Figure 9 Status: Any IP Table The following table describes the labels in this screen. Table 5 Status: Any IP Table LABEL DESCRIPTION # This is the index number of the host computer.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 6 Status: WLAN Status LABEL DESCRIPTION # This is the index number of an associated wireless station. MAC Address This field displays the MAC (Media Access Control) address of an associated wireless station. Association TIme This field displays the time a wireless station first associated with the ZyXEL device. Refresh Click Refresh to reload this screen. 2.4.
P-660HW-D Series User’s Guide Figure 12 Status: Packet Statistics The following table describes the fields in this screen. Table 7 Status: Packet Statistics LABEL DESCRIPTION System Monitor System up Time This is the elapsed time the system has been up. Current Date/Time This field displays your ZyXEL device’s present date and time. CPU Usage This field specifies the percentage of CPU utilization. Memory Usage This field specifies the percentage of memory utilization.
P-660HW-D Series User’s Guide Table 7 Status: Packet Statistics (continued) LABEL DESCRIPTION RxPkts This field displays the number of packets received on this port. Errors This field displays the number of error packets on this port. Tx B/s This field displays the number of bytes transmitted in the last second. Rx B/s This field displays the number of bytes received in the last second. Up Time This field displays the elapsed time this port has been up.
P-660HW-D Series User’s Guide CHAPTER 3 Wizard Setup for Internet Access This chapter provides information on the Wizard Setup screens for Internet access in the web configurator. 3.1 Introduction Use the wizard setup screens to configure your system for Internet access with the information given to you by your ISP. Note: See the advanced menu chapters for background information on these fields. 3.
P-660HW-D Series User’s Guide Figure 15 Wizard: Welcome 3 The wizard attempts to detect which WAN connection type you are using. If the wizard detects your connection type and your ISP uses PPPoE or PPPoA, go to Section 3.2.1 on page 54. The screen varies depending on the connection type you use.
P-660HW-D Series User’s Guide Figure 17 Auto Detection: Failed 3.2.1 Automatic Detection 1 If you have a PPPoE or PPPoA connection, a screen displays prompting you to enter your Internet account information. Enter the username, password and/or service name exactly as provided. 2 Click Next and see Section 3.3 on page 59 for wireless connection wizard setup. Figure 18 Auto-Detection: PPPoE 3.2.
P-660HW-D Series User’s Guide Figure 19 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen. Table 8 Internet Access Wizard Setup: ISP Parameters 55 LABEL DESCRIPTION Mode From the Mode drop-down list box, select Routing (default) if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge. Encapsulation Select the encapsulation type your ISP uses from the Encapsulation drop-down list box.
P-660HW-D Series User’s Guide 2 The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode. Configure the fields and click Next to continue. See Section 3.3 on page 59 for wireless connection wizard setup Figure 20 Internet Connection with PPPoE The following table describes the fields in this screen. Table 9 Internet Connection with PPPoE LABEL DESCRIPTION User Name Enter the user name exactly as your ISP assigned.
P-660HW-D Series User’s Guide The following table describes the fields in this screen. Table 10 Internet Connection with RFC 1483 LABEL DESCRIPTION IP Address This field is available if you select Routing in the Mode field. Type your ISP assigned IP address in this field. Back Click Back to go back to the previous wizard screen. Next Click Next to continue to the next wizard screen. Exit Click Exit to close the wizard screen without saving your changes.
P-660HW-D Series User’s Guide Table 11 Internet Connection with ENET ENCAP (continued) LABEL DESCRIPTION Second DNS Server As above. Back Click Back to go back to the previous wizard screen. Apply Click Apply to save your changes back to the ZyXEL device. Exit Click Exit to close the wizard screen without saving your changes. Figure 23 Internet Connection with PPPoA The following table describes the fields in this screen.
P-660HW-D Series User’s Guide Figure 24 Connection Test Failed-1 • If the following screen displays, check if your account is activated or click Restart the Internet/Wireless Setup Wizard to verify your Internet access settings. Figure 25 Connection Test Failed-2. 3.3 Wireless Connection Wizard Setup After you configure the Internet access information, use the following screens to set up your wireless LAN. 1 Select Yes and click Next to configure wireless settings. Otherwise, select No and skip to Step 6.
P-660HW-D Series User’s Guide Figure 26 Connection Test Successful 2 Use this screen to activate the wireless LAN and OTIST. Click Next to continue.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 13 Wireless LAN Setup Wizard 1 LABEL DESCRIPTION Active Select the check box to turn on the wireless LAN. Enable OTIST Select the check box to enable OTIST if you want to transfer your ZyXEL device’s SSID and WPA-PSK security settings to wireless clients that support OTIST and are within transmission range. You must also activate and start OTIST on the wireless client at the same time.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 14 Wireless LAN Setup Wizard 2 LABEL DESCRIPTION Network Name(SSID) Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN. If you change this field on the ZyXEL device, make sure all wireless stations use the same SSID in order to access the network. Channel Selection The range of radio frequencies used by IEEE 802.11b/g wireless devices is called a channel.
P-660HW-D Series User’s Guide Figure 29 Manually assign a WPA key The following table describes the labels in this screen. Table 15 Manually assign a WPA key LABEL DESCRIPTION Pre-Shared Key Type from 8 to 63 case-sensitive ASCII characters. You can set up the most secure wireless connection by configuring WPA in the wireless LAN screens. You need to configure an authentication server to do this. Back Click Back to display the previous screen. Next Click Next to proceed to the next screen.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 16 Manually assign a WEP key LABEL DESCRIPTION Key The WEP keys are used to encrypt data. Both the ZyXEL device and the wireless stations must use the same WEP key for data transmission. Enter any 5, 13 or 29 ASCII characters or 10, 26 or 58 hexadecimal characters ("0-9", "A-F") for a 64-bit, 128-bit or 256-bit WEP key respectively. Back Click Back to display the previous screen.
P-660HW-D Series User’s Guide Figure 32 Internet Access and WLAN Wizard Setup Complete 7 Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the rest of this guide for more detailed information on the complete range of ZyXEL device features. If you cannot access the Internet, open the web configurator again to confirm that the Internet settings you configured in the wizard setup are correct.
P-660HW-D Series User’s Guide CHAPTER 4 Bandwidth Management Wizard This chapter shows you how to configure basic bandwidth management using the wizard screens. 4.1 Introduction Bandwidth management allows you to control the amount of bandwidth going out through the ZyXEL device’s WAN port and prioritize the distribution of the bandwidth according to service bandwidth requirements. This helps keep one service from using all of the available bandwidth and shutting out other users. 4.
P-660HW-D Series User’s Guide Table 17 Media Bandwidth Management Setup: Services (continued) SERVICE DESCRIPTION eMule These programs use advanced file sharing applications relying on central servers to search for files. They use default port 4662. WWW The World Wide Web (WWW) is an Internet system to distribute graphical, hyperlinked information, based on Hyper Text Transfer Protocol (HTTP) - a client/server protocol for the World Wide Web.
P-660HW-D Series User’s Guide Figure 34 Wizard: Welcome 3 Activate bandwidth management and select to allocate bandwidth to packets based on the service requirements. Figure 35 Bandwidth Management Wizard: General Information The following fields describe the label in this screen.
P-660HW-D Series User’s Guide 4 Use the second wizard screen to select the services that you want to apply bandwidth management and select the priorities that you want to apply to the services listed. Figure 36 Bandwidth Management Wizard: Configuration The following table describes the labels in this screen. Table 19 Bandwidth Management Wizard: Configuration LABEL DESCRIPTION Active Select an entry’s Active check box to turn on bandwidth management for the service/ application.
P-660HW-D Series User’s Guide Table 19 Bandwidth Management Wizard: Configuration LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL device. Exit Click Exit to close the wizard screen without saving your changes. 5 Follow the on-screen instructions and click Finish to complete the wizard setup and save your configuration.
P-660HW-D Series User’s Guide 71 Chapter 4 Bandwidth Management Wizard
P-660HW-D Series User’s Guide Chapter 4 Bandwidth Management Wizard 72
P-660HW-D Series User’s Guide 73 Chapter 4 Bandwidth Management Wizard
P-660HW-D Series User’s Guide CHAPTER 5 WAN Setup This chapter describes how to configure WAN settings. 5.1 WAN Overview A WAN (Wide Area Network) is an outside connection to another network or the Internet. 5.1.1 Encapsulation Be sure to use the encapsulation method required by your ISP. The ZyXEL device supports the following methods. 5.1.1.1 ENET ENCAP The MAC Encapsulated Routing Link Protocol (ENET ENCAP) is only implemented with the IP network protocol.
P-660HW-D Series User’s Guide 5.1.1.3 PPPoA PPPoA stands for Point to Point Protocol over ATM Adaptation Layer 5 (AAL5). A PPPoA connection functions like a dial-up Internet connection. The ZyXEL device encapsulates the PPP session based on RFC1483 and sends it through an ATM PVC (Permanent Virtual Circuit) to the Internet Service Provider’s (ISP) DSLAM (digital access multiplexer). Please refer to RFC 2364 for more information on PPPoA. Refer to RFC 1661 for more information on PPP. 5.1.1.
P-660HW-D Series User’s Guide 5.1.3.1 Scenario 1: One VC, Multiple Protocols PPPoA (RFC-2364) encapsulation with VC-based multiplexing is the best combination because no extra protocol identifying headers are needed. The PPP protocol already contains this information. 5.1.3.2 Scenario 2: One VC, One Protocol (IP) Selecting RFC-1483 encapsulation with VC-based multiplexing requires the least amount of overhead (0 octets).
P-660HW-D Series User’s Guide 5.1.5.3 IP Assignment with ENET ENCAP Encapsulation In this case you can have either a static or dynamic IP. For a static IP you must fill in all the IP Address and ENET ENCAP Gateway fields as supplied by your ISP. However for a dynamic IP, the ZyXEL device acts as a DHCP client on the WAN port and so the IP Address and ENET ENCAP Gateway fields are not applicable (N/A) as the DHCP server assigns them to the ZyXEL device. 5.1.
P-660HW-D Series User’s Guide If you want the dial-backup route to take first priority over the traffic-redirect route or even the normal route, all you need to do is set the dial-backup route’s metric to "1" and the others to "2" (or greater). IP Policy Routing overrides the default routing behavior and takes priority over all of the routes mentioned above. 5.
P-660HW-D Series User’s Guide 5.3.1 ATM Traffic Classes These are the basic ATM traffic classes defined by the ATM Forum Traffic Management 4.0 Specification. 5.3.1.1 Constant Bit Rate (CBR) Constant Bit Rate (CBR) provides fixed bandwidth that is always available even if no data is being sent. CBR traffic is generally time-sensitive (doesn't tolerate delay). CBR is used for connections that continuously require a specific amount of bandwidth.
P-660HW-D Series User’s Guide • the ZyXEL device is in bridge mode • you set the ZyXEL device to use a static (fixed) WAN IP address. 5.5 Internet Connection To change your ZyXEL device’s WAN Internet access settings, click Network > WAN. The screen differs by the encapsulation. See Section 5.1 on page 74 for more information. Figure 39 Internet Connection (PPPoE) The following table describes the labels in this screen.
P-660HW-D Series User’s Guide Table 20 Internet Connection (continued) LABEL DESCRIPTION Encapsulation Select the method of encapsulation used by your ISP from the drop-down list box. Choices vary depending on the mode you select in the Mode field. If you select Bridge in the Mode field, select either PPPoA or RFC 1483. If you select Routing in the Mode field, select PPPoA, RFC 1483, ENET ENCAP or PPPoE. User Name (PPPoA and PPPoE encapsulation only) Enter the user name exactly as your ISP assigned.
P-660HW-D Series User’s Guide Table 20 Internet Connection (continued) LABEL DESCRIPTION Cancel Click Cancel to begin configuring this screen afresh. Advanced Setup Click this button to display the Advanced Internet Connection Setup screen and edit more details of your WAN setup. 5.5.1 Configuring Advanced Internet Connection Setup To edit your ZyXEL device's advanced WAN settings, click the Advanced Setup button in the Internet Connection screen. The screen appears as shown.
P-660HW-D Series User’s Guide Table 21 Advanced Internet Connection Setup (continued) LABEL DESCRIPTION ATM QoS Type Select CBR (Continuous Bit Rate) to specify fixed (always-on) bandwidth for voice or data traffic. Select UBR (Unspecified Bit Rate) for applications that are non-time sensitive, such as e-mail. Select VBR-nRT (Variable Bit Rate-non Real Time) or VBR-RT (Variable Bit Rate-Real Time) for bursty traffic and bandwidth sharing with other applications.
P-660HW-D Series User’s Guide Figure 41 More Connections The following table describes the labels in this screen. Table 22 More Connections LABEL DESCRIPTION # This is the index number of a connection. Active This display whether this connection is activated. Clear the check box to disable the connection. Select the check box to enable it. Name This is the descriptive name for this connection. VPI/VCI This is the VPI and VCI values used for this connection.
P-660HW-D Series User’s Guide Figure 42 More Connections Edit The following table describes the labels in this screen. Table 23 More Connections Edit 85 LABEL DESCRIPTION Active Select the check box to activate or clear the check box to deactivate this connection. Name Enter a unique, descriptive name of up to 13 ASCII characters for this connection. Mode Select Routing from the drop-down list box if your ISP allows multiple computers to share an Internet account.
P-660HW-D Series User’s Guide Table 23 More Connections Edit (continued) LABEL DESCRIPTION User Name (PPPoA and PPPoE encapsulation only) Enter the user name exactly as your ISP assigned. If assigned a name in the form user@domain where domain identifies a service name, then enter both components exactly as given. Password (PPPoA and PPPoE encapsulation only) Enter the password associated with the user name above. Service Name (PPPoE only) Type the name of your PPPoE service here.
P-660HW-D Series User’s Guide Table 23 More Connections Edit (continued) LABEL DESCRIPTION Cancel Click Cancel to begin configuring this screen afresh. Advanced Setup Click this button to display the More Connections Advanced screen and edit more details of your WAN setup. 5.6.2 Configuring More Connections Advanced Setup To edit your ZyXEL device's advanced WAN settings, click the Advanced Setup button in the More Connections Edit screen. The screen appears as shown.
P-660HW-D Series User’s Guide Table 24 More Connections Advanced Setup (continued) LABEL DESCRIPTION Peak Cell Rate Divide the DSL line rate (bps) by 424 (the size of an ATM cell) to find the Peak Cell Rate (PCR). This is the maximum rate at which the sender can send cells. Type the PCR here. Sustain Cell Rate The Sustain Cell Rate (SCR) sets the average cell rate (long-term) that can be transmitted. Type the SCR, which must be less than the PCR. Note that system default is 0 cells/sec.
P-660HW-D Series User’s Guide Figure 45 Traffic Redirect LAN Setup 5.8 Configuring WAN Backup To change your ZyXEL device’s WAN backup settings, click Network > WAN > WAN Backup Setup. The screen appears as shown.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 25 WAN Backup Setup LABEL DESCRIPTION Backup Type Select the method that the ZyXEL device uses to check the DSL connection. Select DSL Link to have the ZyXEL device check if the connection to the DSLAM is up. Select ICMP to have the ZyXEL device periodically ping the IP addresses configured in the Check WAN IP Address fields.
P-660HW-D Series User’s Guide 91 Chapter 5 WAN Setup
P-660HW-D Series User’s Guide CHAPTER 6 LAN Setup This chapter describes how to configure LAN settings. 6.1 LAN Overview A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is a computer network limited to the immediate area, usually the same building or floor of a building. The LAN screens can help you configure a LAN DHCP server and manage IP addresses. See Section 6.3 on page 98 to configure the LAN screens. 6.1.
P-660HW-D Series User’s Guide 6.1.2 DHCP Setup DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyXEL device as a DHCP server or disable it. When configured as a server, the ZyXEL device provides the TCP/IP configuration for the clients. If you turn DHCP service off, you must have another DHCP server on your LAN, or else the computer must be manually configured. 6.1.2.
P-660HW-D Series User’s Guide 6.1.4 DNS Server Address Assignment Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. There are two ways that an ISP disseminates the DNS server addresses. • The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up.
P-660HW-D Series User’s Guide 6.2.1.1 Private IP Addresses Every machine on the Internet must have a unique address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks: • 10.0.0.0 — 10.255.255.255 • 172.16.0.0 — 172.31.255.255 • 192.168.0.0 — 192.168.
P-660HW-D Series User’s Guide 6.2.3 Multicast Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.
P-660HW-D Series User’s Guide Figure 48 Any IP Example The Any IP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the ZyXEL device’s IP address. Note: You must enable NAT/SUA to use the Any IP feature on the ZyXEL device. 6.2.4.
P-660HW-D Series User’s Guide 6.3 Configuring LAN IP Click LAN to open the IP screen. See Section 6.1 on page 92 for background information. Figure 49 LAN IP The following table describes the fields in this screen. Table 26 LAN IP LABEL DESCRIPTION TCP/IP IP Address Enter the IP address of your ZyXEL device in dotted decimal notation, for example, 192.168.1.1 (factory default). IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given).
P-660HW-D Series User’s Guide Figure 50 Advanced LAN Setup The following table describes the labels in this screen. Table 27 Advanced LAN Setup LABEL DESCRIPTION RIP & Multicast Setup 99 RIP Direction Select the RIP direction from None, Both, In Only and Out Only. RIP Version Select the RIP version from RIP-1, RIP-2B and RIP-2M. Multicast IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a multicast group.
P-660HW-D Series User’s Guide 6.4 DHCP Setup Use this screen to configure the DNS server information that the ZyXEL device sends to the DHCP client devices on the LAN. Figure 51 DHCP Setup The following table describes the labels in this screen. Table 28 DHCP Setup LABEL DESCRIPTION DHCP Setup DHCP If set to Server, your ZyXEL device can assign IP addresses, an IP default gateway and DNS servers to Windows 95, Windows NT and other systems that support the DHCP client.
P-660HW-D Series User’s Guide Table 28 DHCP Setup LABEL DESCRIPTION Primary DNS Server Secondary DNS Server This field is not available when you set DHCP to Relay. Enter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask. If the fields are left as 0.0.0.0, the ZyXEL device acts as a DNS proxy and forwards the DHCP client’s DNS query to the real DNS server learned through IPCP and relays the response back to the computer.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 29 LAN Client List LABEL DESCRIPTION IP Address Enter the IP address that you want to assign to the computer on your LAN with the MAC address specified below. The IP address should be within the range of IP addresses you specified in the DHCP Setup for the DHCP client. MAC Address Enter the MAC address of a computer on your LAN. Add Click Add to add a static DHCP entry.
P-660HW-D Series User’s Guide Figure 53 Physical Network & Partitioned Logical Networks To change your ZyXEL device’s IP alias settings, click Network > LAN > IP Alias. The screen appears as shown. Figure 54 LAN IP Alias The following table describes the labels in this screen. Table 30 LAN IP Alias 103 LABEL DESCRIPTION IP Alias 1, 2 Select the check box to configure another LAN network for the ZyXEL device. IP Address Enter the IP address of your ZyXEL device in dotted decimal notation.
P-660HW-D Series User’s Guide Table 30 LAN IP Alias LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Select the RIP direction from Both/In Only/Out Only/None. When set to Both or Out Only, the ZyXEL device will broadcast its routing table periodically.
P-660HW-D Series User’s Guide 105 Chapter 6 LAN Setup
P-660HW-D Series User’s Guide CHAPTER 7 Wireless LAN This chapter discusses how to configure the wireless network settings in your ZyXEL device. See the appendices for more detailed information about wireless networks. 7.1 Wireless Network Overview The following figure provides an example of a wireless network. Figure 55 Example of a Wireless Network The wireless network is the part in the blue circle. In this wireless network, devices A and B are called wireless clients.
P-660HW-D Series User’s Guide • Every wireless client in the same wireless network must use security compatible with the AP. Security stops unauthorized devices from using the wireless network. It can also protect the information that is sent in the wireless network. 7.2 Wireless Security Overview The following sections introduce different types of wireless security you can set up in the wireless network. 7.2.1 SSID Normally, the AP acts like a beacon and regularly broadcasts the SSID in the area.
P-660HW-D Series User’s Guide 7.2.3 User Authentication Authentication is the process of verifying whether a wireless device is allowed to use the wireless network. You can make every user log in to the wireless network before they can use it. This is called user authentication. However, every wireless client in the wireless network has to support IEEE 802.1x to do this. For wireless networks, there are two typical places to store the user names and passwords for each user.
P-660HW-D Series User’s Guide Usually, you should set up the strongest encryption that every wireless client in the wireless network supports. For example, suppose the AP does not have a local user database, and you do not have a RADIUS server. Therefore, there is no user authentication. Suppose the wireless network has two wireless clients. Device A only supports WEP, and device B supports WEP and WPA. Therefore, you should set up Static WEP in the wireless network.
P-660HW-D Series User’s Guide 7.4 General Wireless LAN Screen Note: If you are configuring the ZyXEL device from a computer connected to the wireless LAN and you change the ZyXEL device’s SSID or WEP settings, you will lose your wireless connection when you press Apply to confirm. You must then change the wireless settings of your computer to match the ZyXEL device’s new settings. Click Network > Wireless LAN to open the General screen.
P-660HW-D Series User’s Guide Table 32 Wireless LAN: General LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL device. Cancel Click Cancel to reload the previous configuration for this screen. Advanced Setup Click Advanced Setup to display the Wireless Advanced Setup screen and edit more details of your WLAN setup. See the rest of this chapter for information on the other labels in this screen. 7.4.
P-660HW-D Series User’s Guide 7.4.2 WEP Encryption WEP encryption scrambles the data transmitted between the wireless clients and the access points to keep network communications private. It encrypts unicast and multicast communications in a network. Both the wireless clients and the access points must use the same WEP key. Your ZyXEL device allows you to configure up to four 64-bit, 128-bit or 256-bit WEP keys but only one key can be enabled at any one time.
P-660HW-D Series User’s Guide Table 34 Wireless: Static WEP Encryption LABEL DESCRIPTION WEP Key The WEP keys are used to encrypt data. Both the ZyXEL device and the wireless clients must use the same WEP key for data transmission. If you want to manually set the WEP key, enter any 5, 13 or 29 characters (ASCII string) or 10, 26 or 58 hexadecimal characters ("0-9", "A-F") for a 64-bit, 128-bit or 256-bit WEP key respectively. Apply Click Apply to save your changes back to the ZyXEL device.
P-660HW-D Series User’s Guide The following table describes the wireless LAN security labels in this screen. Table 35 Wireless: WPA-PSK/WPA2-PSK LABEL DESCRIPTION Security Mode Choose WPA-PSK or WPA2-PSK from the drop-down list box. WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field. Select the check box to have both WPA2 and WPA wireless clients be able to communicate with the ZyXEL device even when the ZyXEL device is using WPA2PSK or WPA2.
P-660HW-D Series User’s Guide Figure 60 Wireless: WPA/WPA2 The following table describes the wireless LAN security labels in this screen. Table 36 Wireless: WPA/WPA2 LABEL DESCRIPTION WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field. Select the check box to have both WPA2 and WPA wireless clients be able to communicate with the ZyXEL device even when the ZyXEL device is using WPA2-PSK or WPA2.
P-660HW-D Series User’s Guide Table 36 Wireless: WPA/WPA2 LABEL DESCRIPTION Group Key Update Timer (In Seconds) The Group Key Update Timer is the rate at which the AP (if using WPA-PSK/ WPA2-PSK key management) or RADIUS server (if using WPA(2) key management) sends a new group key out to all clients. The re-keying process is the WPA(2) equivalent of automatically changing the WEP key for an AP and all stations in a WLAN on a periodic basis.
P-660HW-D Series User’s Guide Figure 61 Advanced The following table describes the labels in this screen. Table 37 Wireless LAN: Advanced LABEL DESCRIPTION Wireless Advanced Setup RTS/CTS Threshold Enter a value between 0 and 2432. If you select the Enable 802.11g+ mode checkbox, this field is grayed out and the ZyXEL device uses 4096 automatically. Fragmentation Threshold It is the maximum data fragment size that can be sent. Enter a value between 256 and 2432. If you select the Enable 802.
P-660HW-D Series User’s Guide Table 37 Wireless LAN: Advanced LABEL DESCRIPTION Max. Frame Burst Enable Maximum Frame Burst to help eliminate collisions in mixed-mode networks (networks with both IEEE 802.11g and IEEE 802.11b traffic) and enhance the performance of both pure IEEE 802.11g and mixed IEEE 802.11b/g networks. Maximum Frame Burst sets the maximum time, in micro-seconds, that the ZZyXEL device transmits IEEE 802.11g wireless traffic only.
P-660HW-D Series User’s Guide Note: If you hold in the RESET button too long, the device will reset to the factory defaults! 7.5.1.1.2 Web Configurator Click the Network > Wireless LAN > OTIST. The following screen displays. Figure 62 OTIST The following table describes the labels in this screen. Table 38 OTIST LABEL DESCRIPTION Setup Key Type an OTIST Setup Key of exactly eight ASCII characters in length. The default OTIST setup key is "01234567".
P-660HW-D Series User’s Guide 7.5.1.2 Wireless Client Start the ZyXEL utility and click the Adapter tab. Select the OTIST check box, enter the same Setup Key as your AP’s and click Save. Figure 63 Example Wireless Client OTIST Screen 7.5.2 Starting OTIST Note: You must click Start in the AP OTIST web configurator screen and in the wireless client(s) Adapter screen all within three minutes (at the time of writing).
P-660HW-D Series User’s Guide 3 In the wireless client, you see this screen if it can't find an OTIST-enabled AP (with the same Setup key). Click OK to go back to the ZyXEL utility main screen. Figure 67 No AP with OTIST Found • If there is more than one OTIST-enabled AP within range, you see a screen asking you to select one AP to get settings from. 7.5.3 Notes on OTIST 1 If you enabled OTIST in the wireless client, you see this screen each time you start the utility.
P-660HW-D Series User’s Guide 7.6 MAC Filter The MAC filter screen allows you to configure the ZyXEL device to give exclusive access to up to 32 devices (Allow) or exclude up to 32 devices from accessing the ZyXEL device (Deny). Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. You need to know the MAC address of the devices to configure this screen.
P-660HW-D Series User’s Guide The following table describes the labels in this menu. Table 39 MAC Address Filter LABEL DESCRIPTION Active MAC Filter Select the check box to enable MAC address filtering. Filter Action Define the filter action for the list of MAC addresses in the MAC Address table.
P-660HW-D Series User’s Guide 7.7.2 WMM QoS Priorities The following table describes the priorities that you can apply to traffic that the ZyXEL device sends to the wireless network. Table 40 WMM QoS Priorities PRIORITY LEVELS: Highest Typically used for voice traffic or video that is especially sensitive to jitter (variations in delay). Use the highest priority to reduce latency for improved voice quality.
P-660HW-D Series User’s Guide Table 41 Commonly Used Services 125 SERVICE DESCRIPTION HTTP(TCP:80) Hyper Text Transfer Protocol - a client/server protocol for the world wide web. HTTPS(TCP:443) HTTPS is a secured http session often used in e-commerce. ICQ(UDP:4000) This is a popular Internet chat program. IKE(UDP:500) The Internet Key Exchange algorithm is used for key distribution and management. IPSEC_TUNNEL(AH:0) The IPSEC AH (Authentication Header) tunneling protocol uses this service.
P-660HW-D Series User’s Guide Table 41 Commonly Used Services SERVICE DESCRIPTION SSH(TCP/UDP:22) Secure Shell Remote Login Program. STRM WORKS(UDP:1558) Stream Works Protocol. SYSLOG(UDP:514) Syslog allows you to send system logs to a UNIX server. TACACS(UDP:49) Login Host Protocol used for (Terminal Access Controller Access Control System). TELNET(TCP:23) Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments. It operates over TCP/IP networks.
P-660HW-D Series User’s Guide Figure 70 Wireless LAN: QoS The following table describes the fields in this screen. Table 42 Wireless LAN: QoS LABEL DESCRIPTION QoS 127 Enable WMM QoS Select the check box to enable WMM QoS on the ZyXEL device. WMM QoS Policy Select Default to have the ZyXEL device automatically give a service a priority level according to the ToS value in the IP header of packets it sends.
P-660HW-D Series User’s Guide 7.8.2 Application Priority Configuration To edit a WMM QoS application entry, click the edit icon under Modify. The following screen displays. Figure 71 Application Priority Configuration The following table describes the fields in this screen. Table 43 Application Priority Configuration LABEL DESCRIPTION Application Priority Configuration Name Type a description of the application priority.
P-660HW-D Series User’s Guide Table 43 Application Priority Configuration 129 LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL device. Cancel Click Cancel to return to the previous screen without saving your changes.
P-660HW-D Series User’s Guide CHAPTER 8 Network Address Translation (NAT) Screens This chapter discusses how to configure NAT on the ZyXEL device. 8.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network. 8.1.
P-660HW-D Series User’s Guide 8.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
P-660HW-D Series User’s Guide 8.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyXEL device can communicate with three distinct WAN networks. More examples follow at the end of this chapter. Figure 73 NAT Application With IP Alias 8.1.5 NAT Mapping Types NAT supports five types of IP/port mapping. They are: • One to One: In One-to-One mode, the ZyXEL device maps one local IP address to one global IP address.
P-660HW-D Series User’s Guide Port numbers do NOT change for One-to-One and Many-to-Many No Overload NAT mapping types. The following table summarizes these types. Table 45 NAT Mapping Types TYPE IP MAPPING One-to-One ILA1ÅÆ IGA1 Many-to-One (SUA/PAT) ILA1ÅÆ IGA1 ILA2ÅÆ IGA1 … Many-to-Many Overload ILA1ÅÆ IGA1 ILA2ÅÆ IGA2 ILA3ÅÆ IGA1 ILA4ÅÆ IGA2 … Many-to-Many No Overload ILA1ÅÆ IGA1 ILA2ÅÆ IGA2 ILA3ÅÆ IGA3 … Server Server 1 IPÅÆ IGA1 Server 2 IPÅÆ IGA1 Server 3 IPÅÆ IGA1 8.
P-660HW-D Series User’s Guide Figure 74 NAT General The following table describes the labels in this screen. Table 46 NAT General LABEL DESCRIPTION Active Network Address Translation (NAT) Select this check box to enable NAT. SUA Only Select this radio button if you have just one public WAN IP address for your ZyXEL device. Full Feature Select this radio button if you have multiple public WAN IP addresses for your ZyXEL device. Apply Click Apply to save your changes back to the ZyXEL device.
P-660HW-D Series User’s Guide 8.4.1 Default Server IP Address In addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen. Note: If you do not assign a Default Server IP address, the ZyXEL device discards all packets received for ports that are not specified here or in the remote management setup. 8.4.
P-660HW-D Series User’s Guide Figure 75 Multiple Servers Behind NAT Example 8.5 Configuring Port Forwarding Note: The Port Forwarding screen is available only when you select SUA Only in the NAT > General screen. If you do not assign a Default Server IP address, the ZyXEL device discards all packets received for ports that are not specified here or in the remote management setup. Click Network > NAT > Port Forwarding to open the following screen.
P-660HW-D Series User’s Guide The following table describes the fields in this screen. Table 48 NAT Port Forwarding LABEL DESCRIPTION Default Server Setup Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. If you do not assign a Default Server IP address, the ZyXEL device discards all packets received for ports that are not specified here or in the remote management setup.
P-660HW-D Series User’s Guide The following table describes the fields in this screen. Table 49 Port Forwarding Rule Setup LABEL DESCRIPTION Active Click this check box to enable the rule. Service Name Enter a name to identify this port-forwarding rule. Start Port Enter a port number in this field. To forward only one port, enter the port number again in the End Port field. To forward a series of ports, enter the start port number here and the end port number in the End Port field.
P-660HW-D Series User’s Guide Figure 78 Address Mapping Rules The following table describes the fields in this screen. Table 50 Address Mapping Rules 139 LABEL DESCRIPTION # This is the rule index number. Local Start IP This is the starting Inside Local IP Address (ILA). Local IP addresses are N/A for Server port mapping. Local End IP This is the end Inside Local IP Address (ILA). If the rule is for all local IP addresses, then this field displays 0.0.0.0 as the Local Start IP address and 255.255.
P-660HW-D Series User’s Guide 8.6.1 Address Mapping Rule Edit To edit an address mapping rule, click the rule’s edit icon in the Address Mapping screen to display the screen shown next. Figure 79 Edit Address Mapping Rule The following table describes the fields in this screen. Table 51 Edit Address Mapping Rule LABEL DESCRIPTION Type Choose the port mapping type from one of the following. • One-to-One: One-to-One mode maps one local IP address to one global IP address.
P-660HW-D Series User’s Guide Table 51 Edit Address Mapping Rule (continued) LABEL 141 DESCRIPTION Edit Details Click this link to go to the Port Forwarding screen to edit a server mapping set that you have selected in the Server Mapping Set field. Back Click Back to return to the previous screen. Apply Click Apply to save your changes back to the ZyXEL device. Cancel Click Cancel to begin configuring this screen afresh.
P-660HW-D Series User’s Guide CHAPTER 9 Firewalls This chapter gives some background information on firewalls and introduces the ZyXEL device firewall. 9.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term “firewall” is a system or group of systems that enforces an access-control policy between two networks.
P-660HW-D Series User’s Guide 9.2.2 Application-level Firewalls Application-level firewalls restrict access by serving as proxies for external servers. Since they use programs written for specific Internet services, such as HTTP, FTP and telnet, they can evaluate network packets for valid application-specific data.
P-660HW-D Series User’s Guide • The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail, FTP, and the World Wide Web. However, “inbound access” will not be allowed unless you configure remote management or create a firewall rule to allow a remote host to use a specific service. 9.3.1 Denial of Service Attacks Figure 80 Firewall Application 9.
P-660HW-D Series User’s Guide Some of the most common IP ports are: Table 52 Common IP Ports 21 FTP 53 DNS 23 Telnet 80 HTTP 25 SMTP 110 POP3 9.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing.
P-660HW-D Series User’s Guide Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established. • SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the targeted system to issue a SYN-ACK response.
P-660HW-D Series User’s Guide Figure 83 Smurf Attack 9.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 53 ICMP Commands That Trigger Alerts 5 REDIRECT 13 TIMESTAMP_REQUEST 14 TIMESTAMP_REPLY 17 ADDRESS_MASK_REQUEST 18 ADDRESS_MASK_REPLY 9.4.2.2 Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are the following - all others are illegal.
P-660HW-D Series User’s Guide 9.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall. Often, many DoS attacks also employ a technique known as "IP Spoofing" as part of their attack.
P-660HW-D Series User’s Guide The previous figure shows the ZyXEL device’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked. 9.5.1 Stateful Inspection Process In this example, the following sequence of events occurs when a TCP packet leaves the LAN network through the firewall's WAN interface.
P-660HW-D Series User’s Guide • Allow certain types of traffic from the Internet to specific hosts on the LAN. • Allow access to a Web server to everyone but competitors. • Restrict use of certain protocols, such as Telnet, to authorized users on the LAN. These custom rules work by evaluating the network traffic’s Source IP address, Destination IP address, IP protocol type, and comparing these to rules set by the administrator. Note: The ability to define firewall rules is a very powerful tool.
P-660HW-D Series User’s Guide A similar situation exists for ICMP, except that the ZyXEL device is even more restrictive. Specifically, only outgoing echoes will allow incoming echo replies, outgoing address mask requests will allow incoming address mask replies, and outgoing timestamp requests will allow incoming timestamp replies. No other ICMP packets are allowed in through the firewall, simply because they are too dangerous and contain too little tracking information.
P-660HW-D Series User’s Guide • Encourage your company or organization to develop a comprehensive security plan. Good network administration takes into account what hackers can do and prepares against attacks. The best defense against hackers and crackers is information. Educate all employees about the importance of security and how to minimize risk.
P-660HW-D Series User’s Guide 9.7.1.1 When To Use Filtering • To block/allow LAN packets by their MAC addresses. • To block/allow special IP packets which are neither TCP nor UDP, nor ICMP packets. • To block/allow both inbound (WAN to LAN) and outbound (LAN to WAN) traffic between the specific inside host/network "A" and outside host/network "B". If the filter blocks the traffic from A to B, it also blocks the traffic from B to A.
P-660HW-D Series User’s Guide CHAPTER 10 Firewall Configuration This chapter shows you how to enable and configure the ZyXEL device firewall. 10.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyXEL device has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.CLI (Command Line Interpreter) commands provide limited configuration options and are only recommended for advanced users. 10.
P-660HW-D Series User’s Guide Note: If you configure firewall rules without a good understanding of how they work, you might inadvertently introduce security risks to the firewall and to the protected network. Make sure you test your rules after you configure them. For example, you may create rules to: • Block certain types of traffic, such as IRC (Internet Relay Chat), from the LAN to the Internet.
P-660HW-D Series User’s Guide 4 Does a rule that allows Internet users access to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the LAN, Internet users may be able to connect to computers with running FTP servers. 5 Does this rule conflict with any existing rules? 6 Once these questions have been answered, adding rules is simply a matter of plugging the information into the correct fields in the web configurator screens. 10.3.
P-660HW-D Series User’s Guide 10.4.1 LAN to WAN Rules The default rule for LAN to WAN traffic is that all users on the LAN are allowed nonrestricted access to the WAN. When you configure a LAN to WAN rule, you in essence want to limit some or all users from accessing certain services on the WAN. WAN to LAN Rules The default rule for WAN to LAN traffic blocks all incoming connections (WAN to LAN).
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 56 Firewall: General LABEL DESCRIPTION Active Firewall Select this check box to activate the firewall. The ZyXEL device performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated. Bypass Triangle Route Select this check box to have the ZyXEL device firewall permit the use of triangle route topology on the network.
P-660HW-D Series User’s Guide Figure 86 Firewall Rules The following table describes the labels in this screen. Table 57 Firewall Rules LABEL DESCRIPTION Firewall Rules Storage Space in Use This read-only bar shows how much of the ZyXEL device's memory for recording firewall rules it is currently using. When you are using 80% or less of the storage space, the bar is green. When the amount of space used is over 80%, the bar is red.
P-660HW-D Series User’s Guide Table 57 Firewall Rules (continued) LABEL DESCRIPTION Action This field displays whether the firewall silently discards packets (Drop), discards packets and sends a TCP reset packet or an ICMP destination-unreachable message to the sender (Reject) or allows the passage of packets (Permit) Schedule This field tells you whether a schedule is specified (Yes) or not (No). Log This field shows you whether a log is created when packets match this rule (Yes) or not (No).
P-660HW-D Series User’s Guide Figure 87 Firewall: Edit Rule 161 Chapter 10 Firewall Configuration
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 58 Firewall: Edit Rule LABEL DESCRIPTION Active Select this option to enable this firewall rule. Action for Matched Packet Use the drop-down list box to select what the firewall is to do with packets that match this rule. Select Drop to silently discard the packets without sending a TCP reset packet or an ICMP destination-unreachable message to the sender.
P-660HW-D Series User’s Guide Table 58 Firewall: Edit Rule (continued) LABEL DESCRIPTION Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. 10.6.2 Customized Services Configure customized services and port numbers not predefined by the ZyXEL device. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) website.
P-660HW-D Series User’s Guide 10.6.3 Configuring A Customized Service Click a rule number in the Firewall Customized Services screen to create a new custom port or edit an existing one. This action displays the following screen. Refer to Section 9.1 on page 142 for more information. Figure 89 Firewall: Configure Customized Services The following table describes the labels in this screen.
P-660HW-D Series User’s Guide Figure 90 Firewall Example: Rules 3 In the Rules screen, select the index number after that you want to add the rule. For example, if you select “6”, your new rule becomes number 7 and the previous rule 7 (if there is one) becomes rule 8. 4 Click Add to display the firewall rule configuration screen. 5 In the Edit Rule screen, click the Edit Customized Services link to open the Customized Service screen.
P-660HW-D Series User’s Guide Figure 92 Firewall Example: Edit Rule: Destination Address 9 Use the Add >> and Remove buttons between Available Services and Selected Services list boxes to configure it as follows. Click Apply when you are done. Note: Custom services show up with an “*” before their names in the Services list box and the Rules list box.
P-660HW-D Series User’s Guide Figure 93 Firewall Example: Edit Rule: Select Customized Services On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following. Rule 1 allows a “MyService” connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN.
P-660HW-D Series User’s Guide Figure 94 Firewall Example: Rules: MyService 10.8 Predefined Services The Available Services list box in the Edit Rule screen (see Section 10.6.1 on page 160) displays all predefined services that the ZyXEL device already supports. Next to the name of the service, two fields appear in brackets. The first field indicates the IP protocol type (TCP, UDP, or ICMP). The second field indicates the IP port number that defines the service.
P-660HW-D Series User’s Guide Table 61 169 Predefined Services (continued) SERVICE DESCRIPTION H.323(TCP:1720) Net Meeting uses this protocol. HTTP(TCP:80) Hyper Text Transfer Protocol - a client/server protocol for the world wide web. HTTPS HTTPS is a secured http session often used in e-commerce. ICQ(UDP:4000) This is a popular Internet chat program. IPSEC_TRANSPORT/ TUNNEL(AH:0) The IPSEC AH (Authentication Header) tunneling protocol uses this service.
P-660HW-D Series User’s Guide Table 61 Predefined Services (continued) SERVICE DESCRIPTION SSDP(UDP:1900) Simole Service Discovery Protocol (SSDP) is a discovery service searching for Universal Plug and Play devices on your home network or upstream Internet gateways using DUDP port 1900. SSH(TCP/UDP:22) Secure Shell Remote Login Program. STRMWORKS(UDP:1558) Stream Works Protocol. SYSLOG(UDP:514) Syslog allows you to send system logs to a UNIX server.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 62 Firewall: Anti Probing LABEL DESCRIPTION Respond to PING on The ZyXEL device does not respond to any incoming Ping requests when Disable is selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply to incoming WAN Ping requests. Otherwise select LAN & WAN to reply to both incoming LAN and WAN Ping requests. Do Not Respond to Requests for Unauthorized Services.
P-660HW-D Series User’s Guide If your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks and are often busy), then the default values should be reduced. You should make any changes to the threshold values before you continue configuring firewall rules. 10.10.
P-660HW-D Series User’s Guide 10.10.3 Configuring Firewall Thresholds The ZyXEL device also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values specified for the threshold and timeout apply to all TCP connections. Click Firewall, and Threshold to bring up the next screen. Figure 96 Firewall: Threshold The following table describes the labels in this screen.
P-660HW-D Series User’s Guide Table 63 Firewall: Threshold (continued) LABEL DESCRIPTION DEFAULT VALUES Maximum Incomplete Low This is the number of existing half-open 80 existing half-open sessions. sessions that causes the firewall to stop deleting half-open sessions. The ZyXEL device continues to delete half-open requests as necessary, until the number of existing half-open sessions drops below this number.
P-660HW-D Series User’s Guide 175 Chapter 10 Firewall Configuration
P-660HW-D Series User’s Guide C H A P T E R 11 Content Filtering This chapter covers how to configure content filtering. 11.1 Content Filtering Overview Internet content filtering allows you to create and enforce Internet access policies tailored to your needs. Content filtering gives you the ability to block web sites that contain key words (that you specify) in the URL. You can set a schedule for when the ZyXEL device performs content filtering.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 64 Content Filter: Keyword LABEL DESCRIPTION Active Keyword Blocking Select this check box to enable this feature. Block Websites that contain This box contains the list of all the keywords that you have configured the these keywords in the URL: ZyXEL device to block. Delete Highlight a keyword in the box and click Delete to remove it. Clear All Click Clear All to remove all of the keywords from the list.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 65 Content Filter: Schedule LABEL DESCRIPTION Schedule Select Active Everyday to Block to make the content filtering active everyday. Otherwise, select Edit Daily to Block and configure which days of the week (or everyday) and which time of the day you want the content filtering to be active. Active Select the check box to have the content filtering to be active on the selected day.
P-660HW-D Series User’s Guide 179 Chapter 11 Content Filtering
P-660HW-D Series User’s Guide CHAPTER 12 Static Route This chapter shows you how to configure static routes for your ZyXEL device. 12.1 Static Route Each remote node specifies only the network to which the gateway is directly connected, and the ZyXEL device has no knowledge of the networks beyond. For instance, the ZyXEL device knows about network N2 in the following figure through remote node Router 1.
P-660HW-D Series User’s Guide Figure 101 Static Route The following table describes the labels in this screen. Table 67 Static Route LABEL DESCRIPTION # This is the number of an individual static route. Active Select the check box to activate this static route. Otherwise, clear the check box. Name This is the name that describes or identifies this route. Destination This parameter specifies the IP network address of the final destination. Routing is always based on network number.
P-660HW-D Series User’s Guide Figure 102 Static Route Edit The following table describes the labels in this screen. Table 68 Static Route Edit LABEL DESCRIPTION Active This field allows you to activate/deactivate this static route. Route Name Enter the name of the IP static route. Leave this field blank to delete this static route. Destination IP Address This parameter specifies the IP network address of the final destination. Routing is always based on network number.
P-660HW-D Series User’s Guide 183 Chapter 12 Static Route
P-660HW-D Series User’s Guide CHAPTER 13 Bandwidth Management This chapter contains information about configuring bandwidth management, editing rules and viewing the ZyXEL device’s bandwidth management logs. 13.1 Bandwidth Management Overview ZyXEL’s Bandwidth Management allows you to specify bandwidth management rules based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth rules.
P-660HW-D Series User’s Guide The following figure shows LAN subnets. You could configure one bandwidth class for subnet A and another for subnet B. Figure 103 Subnet-based Bandwidth Management Example 13.4 Application and Subnet-based Bandwidth Management You could also create bandwidth classes based on a combination of a subnet and an application. The following example table shows bandwidth allocations for application specific traffic from separate LAN subnets.
P-660HW-D Series User’s Guide 13.5.1 Priority-based Scheduler With the priority-based scheduler, the ZyXEL device forwards traffic from bandwidth classes according to the priorities that you assign to the bandwidth classes. The larger a bandwidth class’s priority number is, the higher the priority. Assign real-time applications (like those using audio or video) a higher priority number to provide smoother operation. 13.5.
P-660HW-D Series User’s Guide 13.6.2 Maximize Bandwidth Usage Example Here is an example of a ZyXEL device that has maximize bandwidth usage enabled on an interface. The following table shows each bandwidth class’s bandwidth budget. The classes are set up based on subnets. The interface is set to 10240 kbps. Each subnet is allocated 2048 kbps. The unbudgeted 2048 kbps allows traffic not defined in any of the bandwidth filters to go out when you do not select the maximize bandwidth option.
P-660HW-D Series User’s Guide • Research requires more bandwidth but only gets its budgeted 2048 kbps because all of the unbudgeted and unused bandwidth goes to the higher priority sales and marketing classes. 13.6.2.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth The following table shows the amount of bandwidth that each class gets.
P-660HW-D Series User’s Guide 13.7 Over Allotment of Bandwidth You can set the bandwidth management speed for an interface higher than the interface’s actual transmission speed. Higher priority traffic gets to use up to its allocated bandwidth, even if it takes up all of the interface’s available bandwidth. This could stop lower priority traffic from being sent. The following is an example.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 75 Media Bandwidth Management: Summary LABEL DESCRIPTION Interface These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source.
P-660HW-D Series User’s Guide Figure 105 Bandwidth Management: Rule Setup The following table describes the labels in this screen. Table 76 Bandwidth Management: Rule Setup 191 LABEL DESCRIPTION Direction Select LAN to apply bandwidth management to traffic that the ZyXEL device forwards to the LAN. Select WAN to apply bandwidth management to traffic that the ZyXEL device forwards to the WAN. Select WLAN to apply bandwidth management to traffic that the ZyXEL device forwards to the WLAN.
P-660HW-D Series User’s Guide Table 76 Bandwidth Management: Rule Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL device. Cancel Click Cancel to begin configuring this screen afresh. 13.9.1 Rule Configuration Click the Edit icon or select User Defined from the Service drop-down list in the Rule Setup screen to configure a bandwidth management rule.
P-660HW-D Series User’s Guide Table 77 Bandwidth Management Rule Configuration (continued) LABEL DESCRIPTION Rule Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces. BW Budget Specify the maximum bandwidth allowed for the rule in kbps. The recommendation is a setting between 20 kbps and 20000 kbps for an individual rule. Priority Select a priority from the drop down list box. Choose High, Mid or Low.
P-660HW-D Series User’s Guide Table 77 Bandwidth Management Rule Configuration (continued) LABEL DESCRIPTION Protocol Select the protocol (TCP or UDP) or select User defined and enter the protocol (service type) number. 0 means any protocol number. Back Click Back to go to the previous screen. Apply Click Apply to save your changes back to the ZyXEL device. Cancel Click Cancel to begin configuring this screen afresh.
P-660HW-D Series User’s Guide Figure 107 Bandwidth Management: Monitor 195 Chapter 13 Bandwidth Management
P-660HW-D Series User’s Guide CHAPTER 14 Dynamic DNS Setup This chapter discusses how to configure your ZyXEL device to use Dynamic DNS. 14.1 Dynamic DNS Overview Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.
P-660HW-D Series User’s Guide Figure 108 Dynamic DNS The following table describes the fields in this screen. Table 79 Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic DNS Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider. Dynamic DNS Type Select the type of service that you are registered for from your Dynamic DNS service provider. Host Name Type the domain name assigned to your ZyXEL device by your Dynamic DNS provider.
P-660HW-D Series User’s Guide Table 79 Dynamic DNS (continued) LABEL DESCRIPTION Dynamic DNS server auto detect IP Address Select this option only when there are one or more NAT routers between the ZyXEL device and the DDNS server. This feature has the DDNS server automatically detect and use the IP address of the NAT router that has a public IP address. Note: The DDNS server may not be able to detect the proper IP address if there is an HTTP proxy server between the ZyXEL device and the DDNS server.
P-660HW-D Series User’s Guide 199 Chapter 14 Dynamic DNS Setup
P-660HW-D Series User’s Guide CHAPTER 15 Remote Management Configuration This chapter provides information on configuring remote management. 15.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyXEL device interface (if any) from which computers. Note: When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access.
P-660HW-D Series User’s Guide • The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the ZyXEL device will disconnect the session immediately. • There is already another remote management session with an equal or higher priority running. You may only have one remote management session running at one time. • There is a firewall rule that blocks it. 15.1.
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 80 Remote Management: WWW LABEL DESCRIPTION Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL device using this service.
P-660HW-D Series User’s Guide Figure 111 Remote Management: Telnet The following table describes the labels in this screen. Table 81 Remote Management: Telnet LABEL DESCRIPTION Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL device using this service.
P-660HW-D Series User’s Guide Figure 112 Remote Management: FTP The following table describes the labels in this screen. Table 82 Remote Management: FTP LABEL DESCRIPTION Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL device using this service.
P-660HW-D Series User’s Guide Figure 113 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyXEL device). An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions.
P-660HW-D Series User’s Guide 15.6.2 SNMP Traps The ZyXEL device will send traps to the SNMP manager when any one of the following events occurs: Table 83 SNMP Traps TRAP NAME DESCRIPTION 0 coldStart (defined in RFC-1215) A trap is sent after booting (power on). 1 warmStart (defined in RFC-1215) A trap is sent after booting (software reboot). 6 whyReboot (defined in ZYXELMIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start).
P-660HW-D Series User’s Guide The following table describes the labels in this screen. Table 84 Remote Management: SNMP LABEL DESCRIPTION SNMP Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL device using this service.
P-660HW-D Series User’s Guide Figure 115 Remote Management: DNS The following table describes the labels in this screen. Table 85 Remote Management: DNS LABEL DESCRIPTION Port The DNS service port number is 53. Access Status Select the interface(s) through which a computer may send DNS queries to the ZyXEL device. Secured Client IP A secured client is a “trusted” computer that is allowed to send DNS queries to the ZyXEL device.
P-660HW-D Series User’s Guide Figure 116 Remote Management: ICMP The following table describes the labels in this screen. Table 86 Remote Management: ICMP 209 LABEL DESCRIPTION ICMP Internet Control Message Protocol is a message control and error-reporting protocol between a host server and a gateway to the Internet. ICMP uses Internet Protocol (IP) datagrams, but the messages are processed by the TCP/IP software and directly apparent to the application user.
P-660HW-D Series User’s Guide CHAPTER 16 Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configurator. 16.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network.
P-660HW-D Series User’s Guide 16.1.3 Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 16.
P-660HW-D Series User’s Guide The following table describes the fields in this screen. Table 87 Configuring UPnP LABEL DESCRIPTION Active the Universal Plug and Select this check box to activate UPnP. Be aware that anyone could use Play (UPnP) Feature a UPnP application to open the web configurator's login screen without entering the ZyXEL device's IP address (although you must still enter the password to access the web configurator).
P-660HW-D Series User’s Guide Figure 118 Add/Remove Programs: Windows Setup: Communication 3 In the Communications window, select the Universal Plug and Play check box in the Components selection box. Figure 119 Add/Remove Programs: Windows Setup: Communication: Components 4 Click OK to go back to the Add/Remove Programs Properties window and click Next. 5 Restart the computer when prompted.
P-660HW-D Series User’s Guide 16.3.2 Installing UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP. 1 Click start and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components …. Figure 120 Network Connections 4 The Windows Optional Networking Components Wizard window displays. Select Networking Service in the Components selection box and click Details.
P-660HW-D Series User’s Guide Figure 122 Networking Services 6 Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 16.4 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the ZyXEL device. Make sure the computer is connected to a LAN port of the ZyXEL device. Turn on your computer and the ZyXEL device. 16.4.
P-660HW-D Series User’s Guide Figure 123 Network Connections 3 In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created. Figure 124 Internet Connection Properties 4 You may edit or delete the port mappings or click Add to manually add port mappings.
P-660HW-D Series User’s Guide Figure 125 Internet Connection Properties: Advanced Settings Figure 126 Internet Connection Properties: Advanced Settings: Add Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 5 Select Show icon in notification area when connected option and click OK. An icon displays in the system tray.
P-660HW-D Series User’s Guide 6 Double-click on the icon to display your current Internet connection status. Figure 128 Internet Connection Status 16.4.2 Web Configurator Easy Access With UPnP, you can access the web-based configurator on the ZyXEL device without finding out the IP address of the ZyXEL device first. This comes helpful if you do not know the IP address of the ZyXEL device. Follow the steps below to access the web configurator. 1 Click Start and then Control Panel.
P-660HW-D Series User’s Guide Figure 129 Network Connections 4 An icon with the description for each UPnP-enabled device displays under Local Network. 5 Right-click on the icon for your ZyXEL device and select Invoke. The web configurator login screen displays.
P-660HW-D Series User’s Guide Figure 130 Network Connections: My Network Places 6 Right-click on the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device.
P-660HW-D Series User’s Guide 221 Chapter 16 Universal Plug-and-Play (UPnP)
P-660HW-D Series User’s Guide CHAPTER 17 System Use this screen to configure the ZyXEL device’s time and date settings. 17.1 General Setup 17.1.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes. However, because some ISPs check this name you should enter your computer's "Computer Name". • In Windows 95/98 click Start, Settings, Control Panel, Network.
P-660HW-D Series User’s Guide Figure 132 System General Setup The following table describes the labels in this screen. Table 88 System General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field. This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.
P-660HW-D Series User’s Guide Table 88 System General Setup LABEL DESCRIPTION Admin Password If you log in with the admin password, you can configure the advanced features as well as the wizard setup on the ZyXEL device. Old Password Type the default admin password (1234) or the existing password you use to access the system for configuring advanced features. New Password Type your new system password (up to 30 characters).
P-660HW-D Series User’s Guide The following table describes the fields in this screen. Table 89 System Time Setting LABEL DESCRIPTION Current Time and Date Current Time This field displays the time of your ZyXEL device. Each time you reload this page, the ZyXEL device synchronizes the time with the time server. Current Date This field displays the date of your ZyXEL device. Each time you reload this page, the ZyXEL device synchronizes the date with the time server.
P-660HW-D Series User’s Guide Table 89 System Time Setting (continued) LABEL DESCRIPTION Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time starts in most parts of the United States on the first Sunday of April. Each time zone in the United States starts using Daylight Saving Time at 2 A.M. local time.
P-660HW-D Series User’s Guide 227 Chapter 17 System
P-660HW-D Series User’s Guide CHAPTER 18 Logs This chapter contains information about configuring general log settings and viewing the ZyXEL device’s logs. Refer to the appendix for example log message explanations. 18.1 Logs Overview The web configurator allows you to choose which categories of events and/or alerts to have the ZyXEL device log and then display the logs or have the ZyXEL device send them to an administrator (as e-mail) or to a syslog server. 18.1.
P-660HW-D Series User’s Guide Figure 134 View Log The following table describes the fields in this screen. Table 90 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings screen display in the drop-down list box. Select a category of logs to view; select All Logs to view logs from all of the log categories that you selected in the Log Settings page. Time This field displays the time the log was recorded. Message This field states the reason for the log.
P-660HW-D Series User’s Guide Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the log is full. Selecting many alert and/or log categories (especially Access Control) may result in many emails being sent. Figure 135 Log Settings The following table describes the fields in this screen. Table 91 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below.
P-660HW-D Series User’s Guide Table 91 Log Settings LABEL DESCRIPTION Send Log To The ZyXEL device sends logs to the e-mail address specified in this field. If this field is left blank, the ZyXEL device does not send logs via e-mail. Send Alerts To Alerts are real-time notifications that are sent as soon as an event, such as a DoS attack, system error, or forbidden web access attempt occurs. Enter the E-mail address where the alert messages will be sent.
P-660HW-D Series User’s Guide 18.3.1 Example E-mail Log An "End of Log" message displays for each mail in which a complete log has been sent. The following is an example of a log sent by e-mail. • • • • You may edit the subject title. The date format here is Day-Month-Year. The date format here is Month-Day-Year. The time format is Hour-Minute-Second. "End of Log" message shows that a complete log has been sent.
P-660HW-D Series User’s Guide 233 Chapter 18 Logs
P-660HW-D Series User’s Guide CHAPTER 19 Tools This chapter describes how to upload new firmware, manage configuration and restart your ZyXEL device. 19.1 Firmware Upgrade Find firmware at www.zyxel.com in a file that (usually) uses the system model name with a.bin extension, for example, "ZyXEL device.bin". The upload process uses HTTP (Hypertext Transfer Protocol) and may take up to two minutes. After a successful upload, the system will reboot. Only use firmware for your device’s specific model.
P-660HW-D Series User’s Guide Table 92 Firmware Upgrade (continued) LABEL DESCRIPTION Browse... Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them. Upload Click Upload to begin the upload process. This process may take up to two minutes.
P-660HW-D Series User’s Guide Figure 140 Error Message 19.2 Configuration Screen Click Maintenance > Tools > Configuration. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next. Figure 141 Configuration 19.2.1 Backup Configuration Backup configuration allows you to back up (save) the ZyXEL device’s current configuration to a file on your computer.
P-660HW-D Series User’s Guide 19.2.2 Restore Configuration Restore configuration allows you to upload a new or previously saved configuration file from your computer to your ZyXEL device. Table 93 Maintenance Restore Configuration LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse... to find it. Browse... Click Browse... to find the file you want to upload. Remember that you must decompress compressed (.ZIP) files before you can upload them.
P-660HW-D Series User’s Guide Figure 144 Configuration Restore Error 19.2.3 Back to Factory Defaults Pressing the RESET button in this section clears all user-entered configuration information and returns the ZyXEL device to its factory defaults. You can also press the RESET button on the rear panel to reset the factory defaults of your ZyXEL device. Refer to the chapter about introducing the web configurator for more information on the RESET button. 19.
P-660HW-D Series User’s Guide 239 Chapter 19 Tools
P-660HW-D Series User’s Guide CHAPTER 20 Diagnostic These read-only screens display information to help you identify problems with the ZyXEL device. 20.1 General Diagnostic Click Maintenance > Diagnostic to open the screen shown next. Figure 146 Diagnostic: General The following table describes the fields in this screen. Table 94 Diagnostic: General LABEL DESCRIPTION TCP/IP Address Type the IP address of a computer that you want to ping in order to test a connection.
P-660HW-D Series User’s Guide 20.2 DSL Line Diagnostic Click Maintenance > Diagnostic > DSL Line to open the screen shown next. Figure 147 Diagnostic: DSL Line The following table describes the fields in this screen. Table 95 Diagnostic: DSL Line LABEL DESCRIPTION ATM Status Click this button to view ATM status. ATM Loopback Test Click this button to start the ATM loopback test. Make sure you have configured at least one PVC with proper VPIs/VCIs before you begin this test.
P-660HW-D Series User’s Guide CHAPTER 21 Troubleshooting This chapter covers potential problems and the corresponding remedies. 21.1 Problems Starting Up the ZyXEL device Table 96 Troubleshooting Starting Up Your ZyXEL device PROBLEM CORRECTIVE ACTION None of the LEDs turn on when I turn on the ZyXEL device. Make sure that the ZyXEL device’s power adaptor is connected to the ZyXEL device and plugged in to an appropriate power source.
P-660HW-D Series User’s Guide 21.3 Problems with the WAN Table 98 Troubleshooting the WAN PROBLEM CORRECTIVE ACTION The DSL LED is off. Check the telephone wire and connections between the ZyXEL device DSL port and the wall jack. Make sure that the telephone company has checked your phone line and set it up for DSL service. Reset your ADSL line to reinitialize your link to the DSLAM. For details, refer to the Table 95 on page 241. 243 I cannot get a WAN IP address from the ISP.
P-660HW-D Series User’s Guide 21.4 Problems Accessing the ZyXEL device Table 99 Troubleshooting Accessing the ZyXEL device PROBLEM CORRECTIVE ACTION I cannot The default user password is “user” and admin password is “1234”. The Password access the field is case-sensitive. Make sure that you enter the correct password using the proper ZyXEL device. case. If you have changed the password and have now forgotten it, you will need to upload the default configuration file.
P-660HW-D Series User’s Guide 245 Chapter 21 Troubleshooting
P-660HW-D Series User’s Guide APPENDIX A Product Specifications See also the Introduction chapter for a general overview of the key features. Specification Tables Table 100 Device Default IP Address 192.168.1.1 Default Subnet Mask 255.255.255.0 (24 bits) Default Password 1234 DHCP Pool 192.168.1.33 to 192.168.1.
P-660HW-D Series User’s Guide Table 101 Firmware 247 ADSL Standards Multi-Mode standard (ANSI T1.413,Issue 2; G.dmt(G.992.1); G.lite(G992.2)). ADSL2 G.dmt.bis (G.992.3) ADSL2 G.lite.bis (G.992.4) ADSL2+ (G.992.
P-660HW-D Series User’s Guide Table 101 Firmware (continued) Firewall Stateful Packet Inspection. Prevent Denial of Service attacks such as Ping of Death, SYN Flood, LAND, Smurf etc. Real time E-mail alerts. Reports and logs. NAT/SUA Port Forwarding 1024 NAT sessions Multimedia application PPTP under NAT/SUA IPSec passthrough SIP ALG passthrough VPN passthrough Content Filtering Web page blocking by URL keyword.
P-660HW-D Series User’s Guide 249 Appendix A Product Specifications
P-660HW-D Series User’s Guide APPENDIX B About ADSL Introduction to DSL DSL (Digital Subscriber Line) technology enhances the data capacity of the existing twistedpair wire that runs between the local telephone company switching offices and most homes and offices.
P-660HW-D Series User’s Guide 2 Because your line is dedicated (not shared), transmission speeds between you and the device to which you connect at your service provider are not affected by other users. With cable modems, transmission speeds drop significantly as more users go on-line because the line is shared. 3 ADSL can be "always on" (connected).
P-660HW-D Series User’s Guide APPENDIX C Wall-mounting Instructions Do the following to hang your ZyXEL device on a wall. Note: See the product specifications appendix for the size of screws to use and how far apart to place them. 1 Locate a high position on wall that is free of obstructions. Use a sturdy wall. 2 Drill two holes for the screws. Make sure the distance between the centers of the holes matches what is listed in the product specifications appendix.
P-660HW-D Series User’s Guide 253 Appendix C Wall-mounting Instructions
P-660HW-D Series User’s Guide APPENDIX D Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.
P-660HW-D Series User’s Guide Figure 149 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add. 2 Select Adapter and then click Add. 3 Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: 1 In the Network window, click Add.
P-660HW-D Series User’s Guide 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click OK. 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab. • • If your IP address is dynamic, select Obtain an IP address automatically.
P-660HW-D Series User’s Guide Figure 151 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • • If you do not know your gateway’s IP address, remove previously installed gateways. If you have a gateway IP address, type it in the New gateway field and click Add. 5 Click OK to save and close the TCP/IP Properties window. 6 Click OK to close the Network window. Insert the Windows CD if prompted. 7 Turn on your ZyXEL device and restart your computer when prompted.
P-660HW-D Series User’s Guide Figure 152 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 153 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties.
P-660HW-D Series User’s Guide Figure 154 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 155 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP). • 259 If you have a dynamic IP address click Obtain an IP address automatically.
P-660HW-D Series User’s Guide • • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. Click Advanced. Figure 156 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
P-660HW-D Series User’s Guide Figure 157 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields.
P-660HW-D Series User’s Guide Figure 158 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT). 11Turn on your ZyXEL device and restart your computer (if prompted). Verifying Settings 1 Click Start, All Programs, Accessories and then Command Prompt.
P-660HW-D Series User’s Guide Figure 159 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 160 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list.
P-660HW-D Series User’s Guide 4 For statically assigned settings, do the following: • • • • From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your ZyXEL device in the Router address box. 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save changes to your configuration. 7 Turn on your ZyXEL device and restart your computer (if prompted).
P-660HW-D Series User’s Guide Figure 162 Macintosh OS X: Network 4 For statically assigned settings, do the following: • • • • From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your ZyXEL device in the Router address box. 5 Click Apply Now and close the window. 6 Turn on your ZyXEL device and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the Network window.
P-660HW-D Series User’s Guide Note: Make sure you are logged in as the root administrator. Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click Network. Figure 163 Red Hat 9.0: KDE: Network Configuration: Devices 2 Double-click on the profile of the network card you wish to configure. The Ethernet Device General screen displays as shown.
P-660HW-D Series User’s Guide • • If you have a dynamic IP address click Automatically obtain IP address settings with and select dhcp from the drop down list. If you have a static IP address click Statically set IP Addresses and fill in the Address, Subnet mask, and Default Gateway Address fields. 3 Click OK to save the changes and close the Ethernet Device General screen. 4 If you know your DNS server IP address(es), click the DNS tab in the Network Configuration screen.
P-660HW-D Series User’s Guide 1 Assuming that you have only one network card on the computer, locate the ifconfigeth0 configuration file (where eth0 is the name of the Ethernet card). Open the configuration file with any plain text editor. • If you have a dynamic IP address, enter dhcp in the BOOTPROTO= field. The following figure shows an example. Figure 167 Red Hat 9.
P-660HW-D Series User’s Guide Figure 170 Red Hat 9.0: Restart Ethernet Card [root@localhost init.d]# network restart Shutting down interface eth0: Shutting down loopback interface: Setting network parameters: Bringing up loopback interface: Bringing up interface eth0: [OK] [OK] [OK] [OK] [OK] 21.4.1 Verifying Settings Enter ifconfig in a terminal screen to check your TCP/IP properties. Figure 171 Red Hat 9.
P-660HW-D Series User’s Guide APPENDIX E IP Subnetting IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1. IP addresses are categorized into different classes. The class of an address depends on the value of its first octet. • Class “A” addresses have a 0 in the left most bit.
P-660HW-D Series User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B” address has a valid range of 128 to 191. The first octet of a class “C” address begins with “110”, and therefore has a range of 192 to 223.
P-660HW-D Series User’s Guide For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128. The following table shows all possible subnet masks for a class “C” address using both notations. Table 105 Alternative Subnet Mask Notation SUBNET MASK SUBNET MASK “1” BITS LAST OCTET BIT VALUE 255.255.255.0 /24 0000 0000 255.255.255.128 /25 1000 0000 255.255.255.192 /26 1100 0000 255.255.255.224 /27 1110 0000 255.255.255.240 /28 1111 0000 255.255.255.
P-660HW-D Series User’s Guide Table 107 Subnet 1 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 0 IP Address (Binary) 11000000.10101000.00000001. 00000000 Subnet Mask 255.255.255. 128 Subnet Mask (Binary) 11111111.11111111.11111111. 10000000 Subnet Address: 192.168.1.0 Lowest Host ID: 192.168.1.1 Broadcast Address: 192.168.1.127 Highest Host ID: 192.168.1.126 Table 108 Subnet 2 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1.
P-660HW-D Series User’s Guide Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
P-660HW-D Series User’s Guide Table 112 Subnet 4 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 192 IP Address (Binary) 11000000.10101000.00000001. 11000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: 192.168.1.192 Lowest Host ID: 192.168.1.193 Broadcast Address: 192.168.1.255 Highest Host ID: 192.168.1.254 Example Eight Subnets Similarly use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110).
P-660HW-D Series User’s Guide Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID. A class “B” address has two host ID octets available for subnetting and a class “A” address has three host ID octets (see Table 102 on page 270) available for subnetting. The following table is a summary for class “B” subnet planning. Table 115 Class B Subnet Planning NO.
P-660HW-D Series User’s Guide 277 Appendix E IP Subnetting
P-660HW-D Series User’s Guide APPENDIX F Command Interpreter The following describes how to use the command interpreter. You can telnet to access the CLI (Command Line Interface) on the ZyXEL device. See the included disk or zyxel.com for more detailed information on these commands. Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable. Accessing the CLI Use the following steps to telnet into your ZyXEL device.
P-660HW-D Series User’s Guide 279 Appendix F Command Interpreter
P-660HW-D Series User’s Guide APPENDIX G Firewall Commands The following describes the firewall commands. Table 116 Firewall Commands FUNCTION COMMAND DESCRIPTION config edit firewall active This command turns the firewall on or off. config retrieve firewall This command returns the previously saved firewall settings. config save firewall This command saves the current firewall settings.
P-660HW-D Series User’s Guide Table 116 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION E-mail config edit firewall e-mail mail-server This command sets the IP address to which the e-mail messages are sent. config edit firewall e-mail return-addr This command sets the source e-mail address of the firewall e-mails. config edit firewall e-mail email-to This command sets the e-mail address to which the firewall e-mails are sent.
P-660HW-D Series User’s Guide Table 116 Firewall Commands (continued) FUNCTION Sets COMMAND DESCRIPTION config edit firewall attack minute-high <0-255> This command sets the threshold rate of new half-open sessions per minute where the ZyXEL device starts deleting old half-opened sessions until it gets them down to the minutelow threshold. config edit firewall attack minute-low <0-255> This command sets the threshold of half-open sessions where the ZyXEL device stops deleting half-opened sessions.
P-660HW-D Series User’s Guide Table 116 Firewall Commands (continued) FUNCTION Rules 283 COMMAND DESCRIPTION Config edit firewall set tcp-idle-timeout This command sets how long ZyXEL device lets an inactive TCP connection remain open before considering it closed. Config edit firewall set log This command sets whether or not the ZyXEL device creates logs for packets that match the firewall’s default rule set.
P-660HW-D Series User’s Guide Table 116 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION config edit firewall set rule destaddrsingle This command sets the rule to have the ZyXEL device check for traffic with this individual destination address.
P-660HW-D Series User’s Guide Table 116 Firewall Commands (continued) FUNCTION 285 COMMAND DESCRIPTION config delete firewall set rule This command removes the specified rule in a firewall configuration set.
P-660HW-D Series User’s Guide APPENDIX H NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls.
P-660HW-D Series User’s Guide The filter types and their default settings are as follows. Table 117 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and WAN This field displays whether NetBIOS packets are blocked or forwarded Block between the LAN and the WAN. IPSec Packets This field displays whether NetBIOS packets sent through a VPN connection are blocked or forwarded. Trigger dial Forward This field displays whether NetBIOS packets are allowed to initiate Disabled calls.
P-660HW-D Series User’s Guide APPENDIX I PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access Concentrator where the PPP session terminates (see Figure 172 on page 289). One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.
P-660HW-D Series User’s Guide Figure 172 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC is acting as a L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the PPP frames to the ISP. The L2TP tunnel is capable of carrying multiple PPP sessions.
P-660HW-D Series User’s Guide APPENDIX J Splitters and Microfilters This appendix tells you how to install a POTS splitter or a telephone microfilter. Connecting a POTS Splitter When you use the Full Rate (G.dmt) ADSL standard, you can use a POTS (Plain Old Telephone Service) splitter to separate the telephone and ADSL signals. This allows simultaneous Internet access and telephone service on the same line. A splitter also eliminates the destructive interference conditions caused by telephone sets.
P-660HW-D Series User’s Guide 2 Connect a cable from the wall jack to the “wall side” of the microfilter. 3 Connect the “phone side” of the microfilter to your telephone as shown in the following figure. 4 After you are done, make sure that your telephone works. If your telephone does not work, disconnect the microfilter and contact either your local telephone company or the provider of the microfilter.
P-660HW-D Series User’s Guide ZyXEL device With ISDN This section relates to people who use their ZyXEL device with ADSL over ISDN (digital telephone service) only. The following is an example installation for the ZyXEL device with ISDN.
P-660HW-D Series User’s Guide 293 Appendix J Splitters and Microfilters
P-660HW-D Series User’s Guide APPENDIX K Log Descriptions This appendix provides descriptions of example log messages. Table 118 System Maintenance Logs LOG MESSAGE DESCRIPTION Time calibration is successful The router has adjusted its time based on information from the time server. Time calibration failed The router failed to get information from the time server. WAN interface gets IP:%s A WAN interface got a new IP address from the DHCP, PPPoE, PPTP or dial-up server.
P-660HW-D Series User’s Guide Table 118 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION Successful HTTPS login Someone has logged on to the router's web configurator interface using HTTPS protocol. HTTPS login failed Someone has failed to log on to the router's web configurator interface using HTTPS protocol. Table 119 System Error Logs LOG MESSAGE DESCRIPTION %s exceeds the max.
P-660HW-D Series User’s Guide Table 121 TCP Reset Logs LOG MESSAGE DESCRIPTION Under SYN flood attack, sent TCP RST The router sent a TCP reset packet when a host was under a SYN flood attack (the TCP incomplete count is per destination host.) Exceed TCP MAX incomplete, sent TCP RST The router sent a TCP reset packet when the number of TCP incomplete connections exceeded the user configured threshold. (the TCP incomplete count is per destination host.
P-660HW-D Series User’s Guide Table 123 ICMP Logs LOG MESSAGE DESCRIPTION Firewall default policy: ICMP , , ICMP access matched the default policy and was blocked or forwarded according to the user's setting. For type and code details, see Table 135 on page 306.
P-660HW-D Series User’s Guide Table 125 PPP Logs (continued) LOG MESSAGE DESCRIPTION ppp:LCP Closing The PPP connection’s Link Control Protocol stage is closing. ppp:IPCP Closing The PPP connection’s Internet Protocol Control Protocol stage is closing. Table 126 UPnP Logs LOG MESSAGE DESCRIPTION UPnP pass through Firewall UPnP packets can pass through the firewall.
P-660HW-D Series User’s Guide Table 127 Content Filtering Logs (continued) LOG MESSAGE DESCRIPTION Connecting to content filter server fail The connection to the external content filtering server failed. License key is invalid The external content filtering license key is invalid. Table 128 Attack Logs 299 LOG MESSAGE DESCRIPTION attack [TCP | UDP | IGMP | ESP | GRE | OSPF] The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF attack.
P-660HW-D Series User’s Guide Table 129 IPSec Logs LOG MESSAGE DESCRIPTION Discard REPLAY packet The router received and discarded a packet with an incorrect sequence number. Inbound packet authentication failed The router received a packet that has been altered. A third party may have altered or tampered with the packet. Receive IPSec packet, but no corresponding tunnel exists The router dropped an inbound packet for which SPI could not find a corresponding phase 2 SA.
P-660HW-D Series User’s Guide Table 130 IKE Logs (continued) 301 LOG MESSAGE DESCRIPTION Cannot resolve Secure Gateway Addr for rule <%d> The router couldn’t resolve the IP address from the domain name that was used for the secure gateway address. Peer ID: - The displayed ID information did not match between the two ends of the connection. vs.
P-660HW-D Series User’s Guide Table 130 IKE Logs (continued) LOG MESSAGE DESCRIPTION XAUTH fail! Username: The router was not able to use extended authentication to authenticate the listed username. Rule[%d] Phase 1 negotiation mode mismatch The listed rule’s IKE phase 1 negotiation mode did not match between the router and the peer. Rule [%d] Phase 1 encryption algorithm mismatch The listed rule’s IKE phase 1 encryption algorithm did not match between the router and the peer.
P-660HW-D Series User’s Guide Table 130 IKE Logs (continued) LOG MESSAGE DESCRIPTION Rule [%d] phase 2 mismatch The listed rule’s IKE phase 2 did not match between the router and the peer. Rule [%d] Phase 2 key length mismatch The listed rule’s IKE phase 2 key lengths (with the AES encryption algorithm) did not match between the router and the peer. Table 131 PKI Logs 303 LOG MESSAGE DESCRIPTION Enrollment successful The SCEP online certificate enrollment was successful.
P-660HW-D Series User’s Guide Table 131 PKI Logs (continued) LOG MESSAGE DESCRIPTION Rcvd data too large! Max size allowed: The router received directory data that was too large (the size is listed) from the LDAP server whose address and port are recorded in the Source field. The maximum size of directory data that the router allows is also recorded. Cert trusted: The router has verified the path of the certificate with the listed subject name.
P-660HW-D Series User’s Guide Table 132 Certificate Path Verification Failure Reason Codes (continued) CODE DESCRIPTION 26 Database method failed. 27 Path was not verified. 28 Maximum path length reached. Table 133 802.1X Logs LOG MESSAGE DESCRIPTION Local User Database accepts user. A user was authenticated by the local user database. Local User Database reports user credential error. A user was not authenticated by the local user database because of an incorrect user password.
P-660HW-D Series User’s Guide Table 134 ACL Setting Notes PACKET DIRECTION DIRECTION DESCRIPTION (L to W) LAN to WAN ACL set for packets traveling from the LAN to the WAN. (W to L) WAN to LAN ACL set for packets traveling from the WAN to the LAN. (L to L) LAN to LAN/ ZyXEL device ACL set for packets traveling from the LAN to the LAN or the ZyXEL device. (W to W) WAN to WAN/ ZyXEL device ACL set for packets traveling from the WAN to the WAN or the ZyXEL device.
P-660HW-D Series User’s Guide Table 135 ICMP Notes (continued) TYPE CODE DESCRIPTION 0 Timestamp request message Timestamp Reply 14 0 Timestamp reply message Information Request 15 0 Information request message Information Reply 16 0 Information reply message Table 136 Syslog Logs LOG MESSAGE DESCRIPTION Mon dd hr:mm:ss hostname src="" dst="" msg="" note="" devID="" cat=" "This message is
P-660HW-D Series User’s Guide Log Commands Go to the command interpreter interface. Configuring What You Want the ZyXEL device to Log 1 Use the sys logs load command to load the log setting buffer that allows you to configure which logs the ZyXEL device is to record. 2 Use sys logs category to view a list of the log categories. Figure 178 Displaying Log Categories Example Copyright (c) 1994 - 2004 ZyXEL Communications Corp.
P-660HW-D Series User’s Guide • Use the sys logs display [log category] command to show the logs in an individual ZyXEL device log category. • Use the sys logs clear command to erase all of the ZyXEL device’s logs. Log Command Example This example shows how to set the ZyXEL device to record the access logs and alerts and then view the results. ras> ras> ras> ras> sys sys sys sys #.time logs logs logs logs load category access 3 save display access source message 0|06/08/2004 05:58:21 |172.21.4.
P-660HW-D Series User’s Guide APPENDIX L Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless adapters (A, B, C).
P-660HW-D Series User’s Guide Figure 181 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN.
P-660HW-D Series User’s Guide Figure 182 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference. Interference occurs when radio signals from different access points overlap causing interference and degrading performance.
P-660HW-D Series User’s Guide Figure 183 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations. RTS/CTS is designed to prevent collisions due to hidden nodes.
P-660HW-D Series User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.
P-660HW-D Series User’s Guide Wireless Security Overview Wireless security is vital to your network to protect wireless communication between wireless clients, access points and the wired network. Wireless security methods available on the ZyXEL device are data encryption, wireless client authentication, restricting access by device MAC address and hiding the ZyXEL device identity. The following figure shows the relative effectiveness of these wireless security methods available on your ZyXEL device.
P-660HW-D Series User’s Guide RADIUS RADIUS is based on a client-server model that supports authentication, authorization and accounting. The access point is the client and the server is the RADIUS server. The RADIUS server handles the following tasks: • Authentication Determines the identity of the users. • Authorization Determines the network services available to authenticated users once they are connected to the network. • Accounting Keeps track of the client’s network activity.
P-660HW-D Series User’s Guide In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. The key is not sent over the network. In addition to the shared key, password information exchanged is also encrypted to protect the network from unauthorized access. Types of Authentication This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAPTTLS, PEAP and LEAP.
P-660HW-D Series User’s Guide PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication. EAP-GTC is implemented only by Cisco.
P-660HW-D Series User’s Guide WPA and WPA2 Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i standard. WPA2 (IEEE 802.11i) is a wireless security standard that defines stronger encryption, authentication and key management than WPA. Key differences between WPA or WPA2 and WEP are improved data encryption and user authentication. If both an AP and the wireless clients support WPA2 and you have an external RADIUS server, use WPA2 for stronger data encryption.
P-660HW-D Series User’s Guide By generating unique data encryption keys for every data packet and by creating an integrity checking mechanism (MIC), with TKIP and AES it is more difficult to decrypt data on a Wi-Fi network than WEP and difficult for an intruder to break into the network. The encryption mechanisms used for WPA(2) and WPA(2)-PSK are the same. The only difference between the two is that WPA(2)-PSK uses a simple common password, instead of user-specific credentials.
P-660HW-D Series User’s Guide 3 The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients. Figure 184 WPA(2) with RADIUS Application Example 21.4.2 WPA(2)-PSK Application Example A WPA(2)-PSK application looks as follows.
P-660HW-D Series User’s Guide Figure 185 WPA(2)-PSK Authentication Security Parameters Summary Refer to this table to see what other security parameters you should configure for each Authentication Method/ key management protocol type. MAC address filters are not dependent on how you configure these security features. Table 141 Wireless Security Relational Matrix AUTHENTICATION ENCRYPTION ENTER METHOD/ KEY METHOD MANUAL KEY MANAGEMENT PROTOCOL IEEE 802.
P-660HW-D Series User’s Guide 323 Appendix L Wireless LANs
P-660HW-D Series User’s Guide APPENDIX M Pop-up Windows, JavaScripts and Java Permissions In order to use the web configurator you need to allow: • Web browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). Note: Internet Explorer 6 screens are used here. Screens for other Internet Explorer versions may vary. Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device.
P-660HW-D Series User’s Guide Figure 187 Internet Options 3 Click Apply to save this setting. Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab. 2 Select Settings…to open the Pop-up Blocker Settings screen.
P-660HW-D Series User’s Guide Figure 188 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites.
P-660HW-D Series User’s Guide Figure 189 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed. 1 In Internet Explorer, click Tools, Internet Options and then the Security tab.
P-660HW-D Series User’s Guide Figure 190 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default). 6 Click OK to close the window.
P-660HW-D Series User’s Guide Figure 191 Security Settings - Java Scripting Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected. 5 Click OK to close the window.
P-660HW-D Series User’s Guide Figure 192 Security Settings - Java JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for
P-660HW-D Series User’s Guide Figure 193 Java (Sun) 331 Appendix M Pop-up Windows, JavaScripts and Java Permissions
P-660HW-D Series User’s Guide Index Numerics 110V AC 5 230V AC 5 A Abnormal Working Conditions 6 AC 5 access point 106 access point. See also AP. Accessories 5 Acts of God 6 Address Assignment 94 Address Resolution Protocol (ARP) 97 ADSLstandards 32 Advanced Encryption Standard 319 Airflow 5 Alternative Subnet Mask Notation 272 American Wire Gauge 5 Antenna gain 117 Any IP 33, 96 How it works 97 note 97 Any IP Setup 99 AP 106 AP (access point) 312 AP. See also access point.
P-660HW-D Series User’s Guide Copyright 2 Correcting Interference 3 Corrosive Liquids 5 Covers 5 CTS (Clear to Send) 313 Custom Ports Creating/Editing 164 Customer Support 7 Customized Services 163 Customized services 163 D Damage 5 Dampness 5 Danger 5 Dealer 3 Default 238 default LAN IP address 40 Defective 6 Denial of Service 143, 144, 172 Denmark, Contact Information 7 Destination Address 156 device model number 234 DHCP 34, 93, 94, 196, 222 DHCP client 34 DHCP relay 34 DHCP server 34 diagnostic 240 Di
P-660HW-D Series User’s Guide Guidelines For Enhancing Security 151 Introduction 143 LAN to WAN Rules 157 Policies 154 Rule Checklist 155 Rule Logic 155 Rule Security Ramifications 155 Services 168 Types 142 When To Use 153 firmware 234 upgrade 234 upload 234 upload error 235 Fitness 6 Fragmentation Threshold 313 Fragmentation threshold 313 France, Contact Information 7 FTP 134, 135, 200, 203 FTP Restrictions 200 Full Rate 290 Functionally Equivalent 6 G Gas Pipes 5 General Setup 222 General wireless LAN
P-660HW-D Series User’s Guide LAND 145, 146 Legal Rights 6 Liability 2 License 2 Lightning 5 Liquids, Corrosive 5 local (user) database 108 and encryption 109 Logs 228 navigating the web configurator 42 NetBIOS commands 147 Network Address Translation (NAT) 34 Network Management 135 New 6 NNTP 135 North America 5 North America Contact Information 7 Norway, Contact Information 7 M O MAC address 107 MAC address filter 107 MAC Address Filter Action 123 MAC Address Filtering 122 MAC Filter 122 Management I
P-660HW-D Series User’s Guide Benefits 74 PPPoE (Point-to-Point Protocol over Ethernet) 34 PPTP 135 Preamble Mode 314 Priorities 124, 188 Priority 191 Priority-based Scheduler 186 Product Model 7 Product Page 4 Product Serial Number 7 Products 6 Proof of Purchase 6 Proper Operating Condition 6 Purchase, Proof of 6 Purchaser 6 Q QoS 109 benefits 109 Qualified Service Personnel 5 Quick Start Guide 30 R Radio Communications 3 Radio Frequency Energy 3 Radio Interference 3 Radio Reception 3 Radio Technician 3
P-660HW-D Series User’s Guide Service Set IDentity. See SSID.
P-660HW-D Series User’s Guide Virtual Channel Identifier (VCI) 76 virtual circuit (VC) 75 Virtual Path Identifier (VPI) 76 Voltage Supply 5 Voltage, High 5 VPI & VCI 76 W Wall Mount 5 WAN (Wide Area Network) 74 WAN backup 89 WAN to LAN Rules 157 Warnings 5 Warranty 6 Warranty Information 7 Warranty Period 6 Water 5 Water Pipes 5 Web 201 Web Configurator 40, 42, 43, 151, 156 web configurator screen summary 43 Web Site 7 WEP (Wired Equivalent Privacy) 35 WEP Encryption 114 WEP encryption 112 Wet Basement 5
