Prestige 662H/HW Series ADSL 2+ 4-Port Security Gateway User’s Guide Version 3.
Prestige 662H/HW Series User’s Guide Copyright Copyright © 2004 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
Prestige 662H/HW Series User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules.
Prestige 662H/HW Series User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
Prestige 662H/HW Series User’s Guide Customer Support Please have the following information ready when you contact customer support. • • • • Product model and serial number. Warranty Information. Date that you received your device. Brief description of the problem and the steps you took to solve it. METHOD SUPPORT E-MAIL TELEPHONEA WEB SITE LOCATION SALES E-MAIL FAX FTP SITE support@zyxel.com.tw +886-3-578-3942 WORLDWIDE NORTH AMERICA GERMANY DENMARK NORWAY SWEDEN FINLAND a. 5 www.zyxel.
Prestige 662H/HW Series User’s Guide Customer Support 6
Prestige 662H/HW Series User’s Guide 7 Customer Support
Prestige 662H/HW Series User’s Guide Table of Contents Copyright .................................................................................................................. 2 Federal Communications Commission (FCC) Interference Statement ............... 3 ZyXEL Limited Warranty.......................................................................................... 4 Customer Support....................................................................................................
Prestige 662H/HW Series User’s Guide 3.1.1 Encapsulation ...........................................................................................60 3.1.1.1 ENET ENCAP .................................................................................60 3.1.1.2 PPP over Ethernet ..........................................................................60 3.1.1.3 PPPoA .............................................................................................60 3.1.1.4 RFC 1483 ............................
Prestige 662H/HW Series User’s Guide 6.3 DNS Server Address Assignment ......................................................................79 6.4 LAN TCP/IP ........................................................................................................80 6.4.1 Factory LAN Defaults ................................................................................80 6.4.2 IP Address and Subnet Mask ...................................................................80 6.4.3 RIP Setup .................
Prestige 662H/HW Series User’s Guide 8.12.3 Authentication Required: WPA-PSK .....................................................106 8.13 Configuring Local User Authentication ...........................................................108 8.14 Configuring RADIUS ......................................................................................109 Chapter 9 WAN Setup............................................................................................................ 112 9.1 WAN Overview ........
Prestige 662H/HW Series User’s Guide Chapter 12 Time and Date....................................................................................................... 142 12.1 Configuring Time and Date ............................................................................142 Chapter 13 Firewalls................................................................................................................ 144 13.1 Firewall Overview ......................................................................
Prestige 662H/HW Series User’s Guide 14.3.3.3 Source Address ...........................................................................160 14.3.3.4 Destination Address ....................................................................161 14.4 Connection Direction Example .......................................................................161 14.4.1 LAN to WAN Rules ...............................................................................161 14.4.2 WAN to LAN Rules ...............................
Prestige 662H/HW Series User’s Guide Chapter 17 Anti-Virus Packet Scan ........................................................................................ 204 17.1 Overview ........................................................................................................204 17.1.1 Types of Computer Viruses ..................................................................204 17.2 Signature-Based Virus Scan ..........................................................................204 17.2.
Prestige 662H/HW Series User’s Guide 19.7 NAT Traversal ................................................................................................222 19.7.1 NAT Traversal Configuration .................................................................223 19.7.2 Remote DNS Server .............................................................................223 19.8 ID Type and Content ......................................................................................224 19.8.
Prestige 662H/HW Series User’s Guide Chapter 22 Logs Screens........................................................................................................ 264 22.1 Logs Overview ...............................................................................................264 22.1.1 Alerts and Logs .....................................................................................264 22.2 Configuring Log Settings ................................................................................
Prestige 662H/HW Series User’s Guide 24.6.1 Diagnostic General Screen ...................................................................290 24.6.2 Diagnostic DSL Line Screen .................................................................291 24.7 Firmware Screen ............................................................................................293 Chapter 25 Introducing the SMT ............................................................................................ 296 25.
Prestige 662H/HW Series User’s Guide Chapter 30 Internet Access .................................................................................................... 320 30.1 Internet Access Overview ..............................................................................320 30.2 IP Policies ......................................................................................................320 30.3 IP Alias .............................................................................................
Prestige 662H/HW Series User’s Guide 34.2 Applying NAT .................................................................................................344 34.3 NAT Setup ......................................................................................................346 34.3.1 Address Mapping Sets ..........................................................................346 34.3.1.1 SUA Address Mapping Set .........................................................347 34.3.1.
Prestige 662H/HW Series User’s Guide Chapter 38 System Security ................................................................................................... 380 38.1 System Security .............................................................................................380 38.1.1 System Password .................................................................................380 38.1.2 Configuring External RADIUS Server ...................................................380 38.1.3 IEEE802.1x ..
Prestige 662H/HW Series User’s Guide 40.4.6 TFTP Upload Command Example ........................................................408 40.4.7 Uploading Via Console Port ..................................................................408 40.4.8 Uploading Firmware File Via Console Port ...........................................408 40.4.9 Example Xmodem Firmware Upload Using HyperTerminal ..................409 40.4.10 Uploading Configuration File Via Console Port ..................................409 40.4.
Prestige 662H/HW Series User’s Guide 45.4 IKE Setup .......................................................................................................441 45.5 Manual Setup .................................................................................................443 45.5.1 Active Protocol ......................................................................................443 45.5.2 Security Parameter Index (SPI) ............................................................
Prestige 662H/HW Series User’s Guide Configuring ...................................................................................................... 464 Verifying Settings ............................................................................................. 465 Windows 2000/NT/XP ............................................................................................ 465 Verifying Settings .............................................................................................
Prestige 662H/HW Series User’s Guide IEEE 802.1x ........................................................................................................... 490 Advantages of the IEEE 802.1x ............................................................................. 490 RADIUS Server Authentication Sequence....................................................... 491 Appendix I Types of EAP Authentication ..............................................................................
Prestige 662H/HW Series User’s Guide Appendix O Firewall Commands ............................................................................................. 530 Appendix O Sys Firewall Commands .....................................................................530 Appendix P NetBIOS Filter Commands .................................................................................. 532 Introduction .........................................................................................................
Prestige 662H/HW Series User’s Guide List of Figures Figure 1 Prestige Internet Access Application .................................................................... 51 Figure 2 Firewall Application ............................................................................................... 52 Figure 3 Prestige LAN-to-LAN Application .......................................................................... 52 Figure 4 Password Screen ..................................................................
Prestige 662H/HW Series User’s Guide Figure 37 Example of Traffic Shaping ................................................................................. 114 Figure 38 WAN Setup (PPPoE) .......................................................................................... 115 Figure 39 Traffic Redirect Example ..................................................................................... 118 Figure 40 Traffic Redirect LAN Setup ...................................................................
Prestige 662H/HW Series User’s Guide Figure 80 Content Access Control: General: Diagnose .................................................... 198 Figure 81 Content Access Control: User Profiles .............................................................. 199 Figure 82 Content Access Control: Online Status .............................................................
Prestige 662H/HW Series User’s Guide Figure 123 View Logs ......................................................................................................... 267 Figure 124 E-mail Log Example .......................................................................................... 268 Figure 125 Application-based Bandwidth Management Example ....................................... 271 Figure 126 Subnet-based Bandwidth Management Example .............................................
Prestige 662H/HW Series User’s Guide Figure 166 Menu 11.1 Remote Node Profile ...................................................................... 328 Figure 167 Menu 11.3 Remote Node Network Layer Options ............................................ 330 Figure 168 Sample IP Addresses for a TCP/IP LAN-to-LAN Connection ........................... 332 Figure 169 Menu 11.5 Remote Node Filter (RFC 1483 or ENET Encapsulation) ............... 333 Figure 170 Menu 11.
Prestige 662H/HW Series User’s Guide Figure 209 NetBIOS_LAN Filter Rules Summary .............................................................. 365 Figure 210 IGMP Filter Rules Summary ............................................................................ 365 Figure 211 Menu 21.1.x.1 TCP/IP Filter Rule ..................................................................... 367 Figure 212 Executing an IP Filter ........................................................................................
Prestige 662H/HW Series User’s Guide Figure 252 Telnet Into Menu 24.7.2 System Maintenance ................................................. 406 Figure 253 FTP Session Example of Firmware File Upload ............................................... 407 Figure 254 Menu 24.7.1 As Seen Using the Console Port ................................................. 408 Figure 255 Example Xmodem Upload ................................................................................ 409 Figure 256 Menu 24.7.
Prestige 662H/HW Series User’s Guide Figure 7 Windows 95/98/Me: TCP/IP Properties: IP Address ............................................. 464 Figure 8 Windows 95/98/Me: TCP/IP Properties: DNS Configuration ................................ 465 Figure 9 Windows XP: Start Menu ...................................................................................... 466 Figure 10 Windows XP: Control Panel ................................................................................
Prestige 662H/HW Series User’s Guide List of Tables Table 1 ADSL Standards .................................................................................................... 44 Table 2 IEEE802.11g .......................................................................................................... 46 Table 3 Web Configurator Screens Summary .................................................................... 57 Table 4 Internet Access Wizard Setup: First Screen .....................................
Prestige 662H/HW Series User’s Guide Table 37 Dynamic DNS ...................................................................................................... 141 Table 38 Time and Date ..................................................................................................... 143 Table 39 Common IP Ports ................................................................................................ 147 Table 40 ICMP Commands That Trigger Alerts .................................................
Prestige 662H/HW Series User’s Guide Table 80 Configuring UPnP ................................................................................................ 252 Table 81 Log Settings ......................................................................................................... 265 Table 82 View Logs ............................................................................................................ 267 Table 83 SMTP Error Messages .......................................................
Prestige 662H/HW Series User’s Guide Table 123 Menu 15.1.1 First Set ........................................................................................ 349 Table 124 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set ......................... 350 Table 125 Abbreviations Used in the Filter Rules Summary Menu .................................... 365 Table 126 Rule Abbreviations Used ................................................................................... 366 Table 127 Menu 21.1.x.
Prestige 662H/HW Series User’s Guide Table 3 Allowed IP Address Range By Class ..................................................................... 475 Table 4 “Natural” Masks .................................................................................................... 475 Table 5 Alternative Subnet Mask Notation ......................................................................... 476 Table 6 Two Subnets Example ...................................................................................
Prestige 662H/HW Series User’s Guide Table 46 Syslog Logs ......................................................................................................... 551 Table 47 RFC-2408 ISAKMP Payload Types .....................................................................
Prestige 662H/HW Series User’s Guide Preface Congratulations on your purchase of the Prestige 662HW Wireless ADSL Security Gateway or the Prestige 662H ADSL Security Gateway. Note: Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com for global products, or at www.us.zyxel.com for North American products. The Prestige 662HW has the built-in IEEE 802.
Prestige 662H/HW Series User’s Guide Refer to the included CD for support documents. • Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. They contain connection information and instructions on getting started. • Web Configurator Online Help Embedded web help for descriptions of individual screens and supplementary information. • ZyXEL Glossary and Web Site Please refer to www.zyxel.
Prestige 662H/HW Series User’s Guide Introduction to DSL DSL (Digital Subscriber Line) technology enhances the data capacity of the existing twistedpair wire that runs between the local telephone company switching offices and most homes and offices.
Prestige 662H/HW Series User’s Guide 43 Introduction to DSL
Prestige 662H/HW Series User’s Guide CHAPTER 1 Getting To Know Your Prestige This chapter describes the key features and applications of your Prestige. 1.1 Introducing the Prestige Your Prestige integrates high-speed 10/100Mbps auto-negotiating LAN interface(s) and a high-speed ADSL port into a single package. The Prestige is ideal for high-speed Internet browsing and making LAN-to-LAN connections to remote networks. The Prestige is an ADSL router compatible with the ADSL/ADSL2/ADSL2+ standards.
Prestige 662H/HW Series User’s Guide Models ending in “1”, for example Prestige 662HW-61, denote a device that works over the analog telephone system, POTS (Plain Old Telephone Service). Models ending in “3” denote a device that works over ISDN (Integrated Synchronous Digital System). Models ending in “7” denote a device that works over T-ISDN (UR-2). Note: Only use firmware for your Prestige’s specific model. Refer to the label on the bottom of your Prestige.
Prestige 662H/HW Series User’s Guide Content Filtering Content filtering allows you to block access to forbidden Internet web sites, schedule when the Prestige should perform the filtering and give trusted LAN IP addresses unfiltered Internet access. Content Access Control The Prestige can control access privileges to website and services through Content Access Control (CAC). Content Access Control is defined as the ability for a LAN administrator to control a LAN user’s Internet access privileges.
Prestige 662H/HW Series User’s Guide External Antenna The Prestige is equipped with an antenna connector and comes with a detachable 5dBi antenna to provide clear radio signal between the wireless stations and the access points. Note: Under the CE regulations, when using a 5dBi or higher gain antenna with the Prestige 662HW, the maximum antenna power output must be less or equal to 20dBm. Refer to the support note for more information.
Prestige 662H/HW Series User’s Guide PPPoE Support (RFC2516) PPPoE (Point-to-Point Protocol over Ethernet) emulates a dial-up connection. It allows your ISP to use their existing network configuration with newer broadband technologies such as ADSL. The PPPoE driver on the Prestige is transparent to the computers on the LAN, which see only Ethernet and are not aware of PPPoE thus saving you from having to manage PPPoE clients on individual computers.
Prestige 662H/HW Series User’s Guide • • • • • • • • • • Supports Multi-Mode standard (ANSI T1.413, Issue 2; G.dmt (G.992.1); G.lite (G992.2)). TCP/IP (Transmission Control Protocol/Internet Protocol) network layer protocol. ATM Forum UNI 3.1/4.0 PVC. Supports up to 8 PVCs (UBR, CBR, VBR). Multiple Protocol over AAL5 (RFC 1483). PPP over AAL5 (RFC 2364). PPP over Ethernet over AAL5 (RFC 2516). RFC 1661. PPP over PAP (RFC 1334). PPP over CHAP (RFC 1994).
Prestige 662H/HW Series User’s Guide Multiplexing The Prestige supports VC-based and LLC-based multiplexing. Encapsulation The Prestige supports PPPoA (RFC 2364 - PPP over ATM Adaptation Layer 5), RFC 1483 encapsulation over ATM, MAC encapsulated routing (ENET encapsulation) as well as PPP over Ethernet (RFC 2516).
Prestige 662H/HW Series User’s Guide Housing Your Prestige's compact and ventilated housing minimizes space requirements making it easy to position anywhere in your busy office. 1.1.2 Applications for the Prestige Here are some example uses for which the Prestige is well suited. 1.1.2.1 Internet Access The Prestige is the ideal high-speed Internet access solution. Your Prestige supports the TCP/ IP protocol, which the Internet uses exclusively.
Prestige 662H/HW Series User’s Guide Figure 2 Firewall Application 1.1.3.1 LAN to LAN Application You can use the Prestige to connect two geographically dispersed networks over the ADSL line. A typical LAN-to-LAN application for your Prestige is shown as follows. Figure 3 Prestige LAN-to-LAN Application 1.1.4 Prestige Hardware Installation and Connection Refer to the Quick Start Guide for information on hardware installation and connection and LED descriptions.
Prestige 662H/HW Series User’s Guide 53 Chapter 1 Getting To Know Your Prestige
Prestige 662H/HW Series User’s Guide CHAPTER 2 Introducing the Web Configurator This chapter describes how to access and navigate the web configurator. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy Prestige setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions with JavaScript enabled. Recommended screen resolution is 1024 by 768 pixels. 2.1.
Prestige 662H/HW Series User’s Guide Figure 4 Password Screen 6 It is highly recommended you change the default password! Enter a new password, retype it to confirm and click Apply; alternatively click Ignore to proceed to the main menu if you do not want to change the password now. Note: If you do not change the password, the following screen appears every time you log in. Figure 5 Change Password at Login 7 You should now see the SITE MAP screen.
Prestige 662H/HW Series User’s Guide 2 Press the RESET button for ten seconds or until the PWR/SYS LED begins to blink and then release it. When the PWR/SYS LED begins to blink, the defaults have been restored and the Prestige restarts. 2.1.3 Navigating the Prestige Web Configurator The following summarizes how to navigate the web configurator from the SITE MAP screen. We use the Prestige 662HW-61 web screens in this guide as an example. Screens vary slightly for different Prestige models.
Prestige 662H/HW Series User’s Guide Table 3 Web Configurator Screens Summary LINK SUB-LINK FUNCTION Wizard Setup Connection Setup Use these screens for initial configuration including general setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment. Media Bandwidth Use these screens to set up bandwidth control quickly. Mgnt Advanced Setup Password Use this screen to change your password. LAN Use this screen to configure LAN DHCP and TCP/IP settings.
Prestige 662H/HW Series User’s Guide Table 3 Web Configurator Screens Summary (continued) LINK SUB-LINK Media Bandwidth Summary Management FUNCTION Use this screen to allocate an interface's outgoing capacity to specific types of traffic. Class Setup Use this screen to define a bandwidth class. Monitor Use this screen to view bandwidth class statistics. Maintenance System Status This screen contains administrative and system-related information.
Prestige 662H/HW Series User’s Guide 59 Chapter 2 Introducing the Web Configurator
Prestige 662H/HW Series User’s Guide CHAPTER 3 Wizard Setup for Internet Access This chapter provides information on the Wizard Setup screens for Internet access in the web configurator. 3.1 Introduction Use the Wizard Setup screens to configure your system for Internet access with the information (provided by your ISP) that you fill in the Internet Account Information table in the Quick Start Guide. Your ISP may have already configured some of the fields in the wizard screens for you. 3.1.
Prestige 662H/HW Series User’s Guide 3.1.1.4 RFC 1483 RFC 1483 describes two methods for Multiprotocol Encapsulation over ATM Adaptation Layer 5 (AAL5). The first method allows multiplexing of multiple protocols over a single ATM virtual circuit (LLC-based multiplexing) and the second method assumes that each protocol is carried over a separate ATM virtual circuit (VC-based multiplexing). Please refer to the RFC for more detailed information. 3.1.
Prestige 662H/HW Series User’s Guide Figure 7 Internet Access Wizard Setup: First Screen The following table describes the fields in this screen. Table 4 Internet Access Wizard Setup: First Screen LABEL DESCRIPTION Mode From the Mode drop-down list box, select Routing (default) if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge. Encapsulation Select the encapsulation type your ISP uses from the Encapsulation drop-down list box.
Prestige 662H/HW Series User’s Guide If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the Prestige.
Prestige 662H/HW Series User’s Guide 3.3.1.4 Private IP Addresses Every machine on the Internet must have a unique address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks: • 10.0.0.0 — 10.255.255.255 • 172.16.0.0 — 172.31.255.255 • 192.168.0.
Prestige 662H/HW Series User’s Guide Figure 8 Internet Connection with PPPoE The following table describes the fields in this screen. Table 5 65 Internet Connection with PPPoE LABEL DESCRIPTION Service Name Type the name of your PPPoE service here. User Name Enter the user name exactly as your ISP assigned. If assigned a name in the form user@domain where domain identifies a service name, then enter both components exactly as given. Password Enter the password associated with the user name above.
Prestige 662H/HW Series User’s Guide Figure 9 Internet Connection with RFC 1483 The following table describes the fields in this screen. Table 6 Internet Connection with RFC 1483 LABEL DESCRIPTION IP Address This field is available if you select Routing in the Mode field. Type your ISP assigned IP address in this field. Network Address Translation Select None, SUA Only or Full Feature from the drop-sown list box. Refer to Chapter 10, on page 128 for more details.
Prestige 662H/HW Series User’s Guide Figure 10 Internet Connection with ENET ENCAP The following table describes the fields in this screen. Table 7 Internet Connection with ENET ENCAP LABEL DESCRIPTION IP Address A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. .
Prestige 662H/HW Series User’s Guide Figure 11 Internet Connection with PPPoA The following table describes the fields in this screen. Table 8 Internet Connection with PPPoA LABEL DESCRIPTION User Name Enter the login name that your ISP gives you. Password Enter the password associated with the user name above. IP Address This option is available if you select Routing in the Mode field. A static IP address is a fixed IP that your ISP gives you.
Prestige 662H/HW Series User’s Guide 3.4.1 DHCP Setup DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the Prestige as a DHCP server or disable it. When configured as a server, the Prestige provides the TCP/IP configuration for the clients. If you turn DHCP service off, you must have another DHCP server on your LAN, or else the computer must be manually configured. 3.4.1.
Prestige 662H/HW Series User’s Guide Figure 13 Internet Access Wizard Setup: LAN Configuration The following table describes the fields in this screen. Table 9 Internet Access Wizard Setup: LAN Configuration LABEL DESCRIPTION LAN IP Address Enter the IP address of your Prestige in dotted decimal notation, for example, 192.168.1.1 (factory default). If you changed the Prestige's LAN IP address, you must use the new IP address if you want to access the web configurator again.
Prestige 662H/HW Series User’s Guide Figure 14 Internet Access Wizard Setup: Connection Tests 3.5.1 Test Your Internet Connection Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the rest of this User’s Guide for more detailed information on the complete range of Prestige features. If you cannot access the Internet, open the web configurator again to confirm that the Internet settings you configured in the Wizard Setup are correct.
Prestige 662H/HW Series User’s Guide CHAPTER 4 Wizard Setup for Media Bandwidth Management This chapter shows you how to configure basic bandwidth management using the wizard screens. 4.1 Introduction The web configurator’s Media Bandwidth Magnt. screens under Wizard Setup allows you to specify bandwidth classes based on an application (or service). You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth classes.
Prestige 662H/HW Series User’s Guide Table 10 Media Bandwidth Mgnt. Wizard Setup: Services (continued) SERVICE DESCRIPTION FTP File Transfer Program enables fast transfer of files, including large files that may not be possible by e-mail. FTP uses port number 21. E-Mail Electronic mail consists of messages sent through a computer network to specific groups or individuals.
Prestige 662H/HW Series User’s Guide Figure 15 Media Bandwidth Mgnt. Wizard Setup: First Screen The following table describes the labels in this screen. Table 11 Media Bandwidth Mgnt. Wizard Setup: First Screen LABEL DESCRIPTION Active Select the Active check box to have the Prestige apply bandwidth management to traffic going out through the Prestige’s WAN, LAN or WLAN port. Select the service to These checkboxes are applicable when you select the Active checkbox above.
Prestige 662H/HW Series User’s Guide Figure 16 Media Bandwidth Mgnt. Wizard Setup: Second Screen The following table describes the fields in this screen. Table 12 Media Bandwidth Mgnt. Wizard Setup: Second Screen LABEL DESCRIPTION Service These fields display the service(s) selected in the previous screen. Priority Select High, Mid or Low priority for each service to have your Prestige use a priority for traffic that matches that service.
Prestige 662H/HW Series User’s Guide CHAPTER 5 Password Setup This chapter provides information on the Password screen. 5.1 Password Overview It is highly recommended that you change the password for accessing the Prestige. 5.1.1 Configuring Password To change your Prestige’s password (recommended), click Password in the Site Map screen. Figure 18 Password The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide 77 Chapter 5 Password Setup
Prestige 662H/HW Series User’s Guide CHAPTER 6 LAN Setup This chapter describes how to configure LAN settings. 6.1 LAN Overview A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is a computer network limited to the immediate area, usually the same building or floor of a building. The LAN screens can help you configure a LAN DHCP server and manage IP addresses. 6.1.
Prestige 662H/HW Series User’s Guide 6.2 DNS Server Address DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The DNS server addresses that you enter in the DHCP setup are passed to the client machines along with the assigned IP address and subnet mask. There are two ways that an ISP disseminates the DNS server addresses.
Prestige 662H/HW Series User’s Guide 6.4 LAN TCP/IP The Prestige has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability. 6.4.1 Factory LAN Defaults The LAN parameters of the Prestige are preset in the factory with the following values: • IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits) • DHCP server enabled with 32 client IP addresses starting from 192.168.1.33.
Prestige 662H/HW Series User’s Guide 6.4.4 Multicast Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.
Prestige 662H/HW Series User’s Guide Figure 20 Any IP Example The Any IP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the Prestige’s IP address. Note: You must enable NAT/SUA to use the Any IP feature on the Prestige. 6.5.
Prestige 662H/HW Series User’s Guide After all the routing information is updated, the computer can access the Prestige and the Internet as if it is in the same subnet as the Prestige. 6.6 Configuring LAN Click LAN and LAN Setup to open the following screen.
Prestige 662H/HW Series User’s Guide The following table describes the fields in this screen. Table 14 LAN Setup LABEL DESCRIPTION DHCP DHCP If set to Server, your Prestige can assign IP addresses, an IP default gateway and DNS servers to Windows 95, Windows NT and other systems that support the DHCP client. If set to None, the DHCP server will be disabled. If set to Relay, the Prestige acts as a surrogate DHCP server and relays DHCP requests and responses between the remote server and the clients.
Prestige 662H/HW Series User’s Guide Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. To change your Prestige’s static DHCP settings, click LAN, then the Static DHCP tab. The screen appears as shown. Figure 22 LAN: Static DHCP The following table describes the labels in this screen.
Prestige 662H/HW Series User’s Guide CHAPTER 7 DMZ This chapter describes how to configure the Prestige’s DMZ. 7.1 Introduction The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps Ethernet port provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death). These public servers can also still be accessed from the secure LAN.
Prestige 662H/HW Series User’s Guide Figure 23 DMZ The following table describes the labels in this screen.. Table 16 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your Prestige’s DMZ port in dotted decimal notation. Make sure the IP address is on a separate subnet from the LAN port. IP Subnet Mask The subnet mask specifies the network number portion of an IP address. Your Prestige will automatically calculate the subnet mask based on the IP address that you assign.
Prestige 662H/HW Series User’s Guide Table 16 DMZ (continued) LABEL DESCRIPTION Allow between DMZ Select this check box to forward NetBIOS packets from the LAN to the DMZ and and LAN from the DMZ to the LAN. If your firewall is enabled with the default policy set to block DMZ to LAN traffic, you also need to enable the default DMZ to LAN firewall rule that forwards NetBIOS traffic.Clear this check box to block all NetBIOS packets going from the LAN to the DMZ and from the DMZ to the LAN.
Prestige 662H/HW Series User’s Guide 89 Chapter 7 DMZ
Prestige 662H/HW Series User’s Guide CHAPTER 8 Wireless LAN Setup This chapter discusses how to configure Wireless LAN on the Prestige. 8.1 Introduction This section introduces the wireless LAN and some basic configurations. Wireless LANs can be as simple as two computers with wireless LAN cards communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN cards communicating through access points which bridge network traffic to the wired LAN. 8.1.
Prestige 662H/HW Series User’s Guide 8.1.3 ESS ID An Extended Service Set (ESS) is a group of access points or wireless gateways connected to a wired LAN on the same subnet. An ESS ID uniquely identifies each set. All access points or wireless gateways and their associated wireless stations in the same set must have the same ESSID. 8.1.4 RTS/CTS A hidden node occurs when two stations are within range of the same access point, but are not within range of each other.
Prestige 662H/HW Series User’s Guide If the RTS/CTS value is greater than the Fragmentation Threshold value (see next), then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size. Note: Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy. 8.1.
Prestige 662H/HW Series User’s Guide Figure 25 Prestige Wireless Security Levels If you do not enable any wireless security on your Prestige, your network is accessible to any wireless networking device that is within range. Use the Prestige web configurator to configurator to set up your wireless LAN security settings. Refer to the chapter on using the Prestige web configurator to see how to access the web configurator. 8.
Prestige 662H/HW Series User’s Guide Click Wireless LAN, Wireless to open the Wireless screen. Figure 26 Wireless LAN The following table describes the fields in this screen. Table 17 Wireless LAN LABEL DESCRIPTION Enable Wireless LAN The wireless LAN is turned off by default, before you enable the wireless LAN you should configure some security by setting MAC filters and/or 802.1x security; otherwise your wireless LAN will be vulnerable upon enabling it.
Prestige 662H/HW Series User’s Guide Table 17 Wireless LAN (continued) LABEL DESCRIPTION Fragmentation Threshold The threshold (number of bytes) for the fragmentation boundary for directed messages. It is the maximum data fragment size that can be sent. Enter a value between 256 and 2432. WEP Encryption WEP (Wired Equivalent Privacy) encrypts data frames before transmitting over the wireless network.
Prestige 662H/HW Series User’s Guide Figure 27 MAC Address Filter The following table describes the fields in this menu. Table 18 MAC Address Filter LABEL DESCRIPTION Active Select Yes from the drop down list box to enable MAC address filtering. Action Define the filter action for the list of MAC addresses in the MAC Address table. Select Deny Association to block access to the router, MAC addresses not listed will be allowed to access the Prestige.
Prestige 662H/HW Series User’s Guide Table 18 MAC Address Filter (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the Prestige. Cancel Click Cancel to begin configuring this screen afresh. 8.6 Network Authentication You can set the Prestige and your network to authenticate a wireless station before the wireless station can communicate with the Prestige and the wired network to which the Prestige is connected. 8.6.
Prestige 662H/HW Series User’s Guide • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access. • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another AccessRequest message.
Prestige 662H/HW Series User’s Guide 3 The wireless station replies with identity information, including username and password. 4 The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. 8.7 Introduction to WPA Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i security specification draft. Key differences between WPA and WEP are user authentication and improved data encryption. 8.7.
Prestige 662H/HW Series User’s Guide By generating unique data encryption keys for every data packet and by creating an integrity checking mechanism (MIC), TKIP makes it much more difficult to decode data on a Wi-Fi network than WEP, making it difficult for an intruder to break into the network. The encryption mechanisms used for WPA and WPA-PSK are the same. The only difference between the two is that WPA-PSK uses a simple common password, instead of user-specific credentials.
Prestige 662H/HW Series User’s Guide 2 The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly.
Prestige 662H/HW Series User’s Guide Table 19 Wireless Security Relational Matrix (continued) AUTHENTICATION ENCRYPTION ENTER METHOD/ KEY METHOD MANUAL KEY MANAGEMENT PROTOCOL ENABLE IEEE 802.1X WPA WEP No Yes WPA TKIP No Yes WPA-PSK WEP Yes Yes WPA-PSK TKIP Yes Yes 8.11 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA.
Prestige 662H/HW Series User’s Guide Table 20 Wireless LAN: 802.1x/WPA LABEL DESCRIPTION Wireless Port Control To control wireless stations access to the wired network, select a control method from the drop-down list box. Choose from No Access Allowed, No Authentication Required and Authentication Required. No Access Allowed blocks all wireless stations access to the wired network.
Prestige 662H/HW Series User’s Guide Table 21 Wireless LAN: 802.1x/WPA for 802.1x Protocol LABEL DESCRIPTION Wireless Port Control To control wireless stations access to the wired network, select a control method from the drop-down list box. Choose from No Authentication Required, Authentication Required and No Access Allowed. The following fields are only available when you select Authentication Required.
Prestige 662H/HW Series User’s Guide Table 21 Wireless LAN: 802.1x/WPA for 802.1x Protocol (continued) LABEL DESCRIPTION Back Click Back to go to the main wireless LAN setup screen. Apply Click Apply to save your changes back to the Prestige. Cancel Click Cancel to begin configuring this screen afresh. Note: Once you enable user authentication, you need to specify an external RADIUS server or create local user accounts on the Prestige for authentication. 8.12.
Prestige 662H/HW Series User’s Guide Table 22 Wireless LAN: 802.1x/WPA for WPA Protocol LABEL DESCRIPTION Key Management Protocol Choose WPA in this field. WPA Mixed Mode The Prestige can operate in WPA Mixed Mode, which supports both clients running WPA and clients running dynamic WEP key exchange with 802.1x in the same Wi-Fi network. Select the check box to activate WPA mixed mode. Otherwise, clear the check box and configure the Group Data Privacy field.
Prestige 662H/HW Series User’s Guide Figure 34 Wireless LAN: 802.1x/WPA for WPA-PSK Protocol The following table describes the labels not previously discussed. Table 23 Wireless LAN: 802.1x/WPA for WPA-PSK Protocol 107 LABEL DESCRIPTION Key Management Protocol Choose WPA-PSK in this field. Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same. The only difference between the two is that WPA-PSK uses a simple common password, instead of user-specific credentials.
Prestige 662H/HW Series User’s Guide 8.13 Configuring Local User Authentication By storing user profiles locally, your Prestige is able to authenticate wireless users without interacting with a network RADIUS server. However, there is a limit on the number of users you may authenticate in this way. To change your Prestige’s local user database, click Wireless LAN, Local User Database. The screen appears as shown. Figure 35 Local User Database The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide Table 24 Local User Database LABEL DESCRIPTION # This is the index number of a local user account. Active Select this check box to enable the user profile. User Name Enter the user name of the user profile. Password Enter a password up to 31 characters long for this user profile. Back Click Back to go to the main wireless LAN setup screen. Apply Click Apply to save these settings back to the Prestige.
Prestige 662H/HW Series User’s Guide Table 25 RADIUS LABEL DESCRIPTION Authentication Server Active Select Yes from the drop-down list box to enable user authentication through an external authentication server. Server IP Address Enter the IP address of the external authentication server in dotted decimal notation. Port Number The default port of the RADIUS server for authentication is 1812.
Prestige 662H/HW Series User’s Guide 111 Chapter 8 Wireless LAN Setup
Prestige 662H/HW Series User’s Guide CHAPTER 9 WAN Setup This chapter describes how to configure WAN settings. 9.1 WAN Overview A WAN (Wide Area Network) is an outside connection to another network or the Internet. See Chapter 3, on page 60 for more information on the fields in the WAN screens. 9.2 Metric The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost".
Prestige 662H/HW Series User’s Guide 9.3 PPPoE Encapsulation The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPPoE option is for a dial-up connection using PPPoE. For the service provider, PPPoE offers an access and authentication method that works with existing access control systems (for example Radius).
Prestige 662H/HW Series User’s Guide Figure 37 Example of Traffic Shaping 9.5 Zero Configuration Internet Access Once you turn on and connect the Prestige to a telephone jack, it automatically detects the Internet connection settings (such as the VCI/VPI numbers and the encapsulation method) from the ISP and makes the necessary configuration changes.
Prestige 662H/HW Series User’s Guide Figure 38 WAN Setup (PPPoE) The following table describes the fields in this screen. Table 26 WAN Setup 115 LABEL DESCRIPTION Name Enter the name of your Internet Service Provider, e.g., MyISP. This information is for identification purposes only. Mode Select Routing (default) from the drop-down list box if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge.
Prestige 662H/HW Series User’s Guide Table 26 WAN Setup (continued) LABEL DESCRIPTION Encapsulation Select the method of encapsulation used by your ISP from the drop-down list box. Choices vary depending on the mode you select in the Mode field. If you select Bridge in the Mode field, select either PPPoA or RFC 1483. If you select Routing in the Mode field, select PPPoA, RFC 1483, ENET ENCAP or PPPoE. Multiplex Select the method of multiplexing used by your ISP from the drop-down list.
Prestige 662H/HW Series User’s Guide Table 26 WAN Setup (continued) LABEL DESCRIPTION Connect on Demand Select Connect on Demand when you don't want the connection up all the time and specify an idle time-out in the Max Idle Timeout field. Max Idle Timeout Specify an idle time-out in the Max Idle Timeout field when you select Connect on Demand. The default setting is 0, which means the Internet session will not timeout. PPPoE Passthrough This field is available when you select PPPoE encapsulation.
Prestige 662H/HW Series User’s Guide Figure 39 Traffic Redirect Example The following network topology allows you to avoid triangle route security issues when the backup gateway is connected to the LAN. Use IP alias to configure the LAN into two or three logical networks with the Prestige itself as the gateway for each LAN network. Put the protected LAN in one subnet (Subnet 1 in the following figure) and the backup gateway in another subnet (Subnet 2).
Prestige 662H/HW Series User’s Guide Figure 41 WAN Backup The following table describes the fields in this screen. Table 27 WAN Backup LABEL DESCRIPTION Backup Type Select the method that the Prestige uses to check the DSL connection. Select DSL Link to have the Prestige check if the connection to the DSLAM is up. Select ICMP to have the Prestige periodically ping the IP addresses configured in the Check WAN IP Address fields.
Prestige 662H/HW Series User’s Guide Table 27 WAN Backup (continued) LABEL DESCRIPTION Recovery Interval When the Prestige is using a lower priority connection (usually a WAN backup connection), it periodically checks to whether or not it can use a higher priority connection. Type the number of seconds (30 recommended) for the Prestige to wait between checks. Allow more time if your destination IP address handles lots of traffic.
Prestige 662H/HW Series User’s Guide 9.9 Configuring Advanced WAN Backup To edit your Prestige’s advanced WAN backup settings, click WAN, WAN Backup and then the Advanced Setup button. The screen appears as shown. Figure 42 Advanced WAN Backup The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide Table 28 Advanced WAN Backup LABEL DESCRIPTION Basic Login Name Type the login name assigned by your ISP. Password Type the password assigned by your ISP. Retype to Confirm Type your password again to make sure that you have entered is correctly. Authentication Type Use the drop-down list box to select an authentication protocol for outgoing calls. Options are: CHAP/PAP - Your Prestige accepts either CHAP or PAP when requested by this remote node.
Prestige 662H/HW Series User’s Guide Table 28 Advanced WAN Backup (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the Prestige sends (it recognizes both formats when receiving). Choose RIP-1, RIP-2B or RIP-2M. RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Prestige 662H/HW Series User’s Guide Table 28 Advanced WAN Backup (continued) LABEL DESCRIPTION Back Click Back to return to the previous screen. OK Click OK to return to the previous screen, then click Apply to save the changes. Cancel Click Cancel to begin configuring this screen afresh. 9.10 AT Command Strings For regular telephone lines, the default "Dial" string tells the modem that the line uses tone dialing. "ATDT" is the command for a switch that requires tone dialing.
Prestige 662H/HW Series User’s Guide Figure 43 Advanced Modem Setup The following table describes the fields in this screen. Table 29 Advanced Modem Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Example: atdt Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~+++~~ath" can be used if your modem has a slow response time. Answer Type the AT Command string to answer a call.
Prestige 662H/HW Series User’s Guide Table 29 Advanced Modem Setup (continued) LABEL DESCRIPTION Retry Interval Type a number of seconds for the Prestige to wait before trying another call after a call has failed. This applies before a phone number is blacklisted. Example: 10 Drop Timeout Type the number of seconds for the Prestige to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.
Prestige 662H/HW Series User’s Guide 127 Chapter 9 WAN Setup
Prestige 662H/HW Series User’s Guide CHAPTER 10 Network Address Translation (NAT) Screens This chapter discusses how to configure NAT on the Prestige. 10.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network. 10.1.
Prestige 662H/HW Series User’s Guide 10.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Prestige 662H/HW Series User’s Guide Figure 44 How NAT Works 10.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the Prestige can communicate with three distinct WAN networks. More examples follow at the end of this chapter. Figure 45 NAT Application With IP Alias 10.1.5 NAT Mapping Types NAT supports five types of IP/port mapping.
Prestige 662H/HW Series User’s Guide • One to One: In One-to-One mode, the Prestige maps one local IP address to one global IP address. • Many to One: In Many-to-One mode, the Prestige maps multiple local IP addresses to one global IP address. This is equivalent to SUA (for instance, PAT, port address translation), ZyXEL’s Single User Account feature that previous ZyXEL routers supported (the SUA Only option in today’s routers).
Prestige 662H/HW Series User’s Guide • Choose Full Feature if you have multiple public WAN IP addresses for your Prestige. 10.3 SUA Server A SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though SUA makes your whole inside network appear as a single computer to the outside world. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server.
Prestige 662H/HW Series User’s Guide Table 32 Services and Port Numbers (continued) SERVICES PORT NUMBER SNMP trap 162 PPTP (Point-to-Point Tunneling Protocol) 1723 10.3.3 Configuring Servers Behind SUA (Example) Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address.
Prestige 662H/HW Series User’s Guide Figure 47 NAT Mode The following table describes the labels in this screen. Table 33 NAT Mode LABEL DESCRIPTION None Select this radio button to disable NAT. SUA Only Select this radio button if you have just one public WAN IP address for your Prestige. The Prestige uses Address Mapping Set 1 in the NAT - Edit SUA/NAT Server Set screen. Edit Details Click this link to go to the NAT - Edit SUA/NAT Server Set screen.
Prestige 662H/HW Series User’s Guide Figure 48 Edit SUA/NAT Server Set The following table describes the fields in this screen. Table 34 Edit SUA/NAT Server Set LABEL DESCRIPTION Start Port No. Enter a port number in this field. To forward only one port, enter the port number again in the End Port No. field. To forward a series of ports, enter the start port number here and the end port number in the End Port No. field. End Port No. Enter a port number in this field.
Prestige 662H/HW Series User’s Guide 10.6 Configuring Address Mapping Ordering your rules is important because the Prestige applies the rules in the order that you specify. When a rule matches the current packet, the Prestige takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules.
Prestige 662H/HW Series User’s Guide Table 35 Address Mapping Rules (continued) LABEL DESCRIPTION Type 1-1: One-to-one mode maps one local IP address to one global IP address. Note that port numbers do not change for the One-to-one NAT mapping type. M-1: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported only.
Prestige 662H/HW Series User’s Guide Table 36 Address Mapping Rule Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. • One-to-One: One-to-One mode maps one local IP address to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type. • Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e.
Prestige 662H/HW Series User’s Guide 139 Chapter 10 Network Address Translation (NAT) Screens
Prestige 662H/HW Series User’s Guide C H A P T E R 11 Dynamic DNS Setup This chapter discusses how to configure your Prestige to use Dynamic DNS. 11.1 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.
Prestige 662H/HW Series User’s Guide Figure 51 Dynamic DNS The following table describes the fields in this screen. Table 37 Dynamic DNS 141 LABEL DESCRIPTION Active Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider. Host Names Type the domain name assigned to your Prestige by your Dynamic DNS provider. E-mail Address Type your e-mail address. User Type your user name. Password Type the password assigned to you.
Prestige 662H/HW Series User’s Guide CHAPTER 12 Time and Date This screen is not available on all models. Use this screen to configure the Prestige’s time and date settings. 12.1 Configuring Time and Date To change your Prestige’s time and date, click Time And Date. The screen appears as shown. Use this screen to configure the Prestige’s time based on your local time zone. Figure 52 Time and Date The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide Table 38 Time and Date LABEL DESCRIPTION Time Server Use Protocol when Select the time service protocol that your time server sends when you turn on the Bootup Prestige. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works. The main difference between them is the format. Daytime (RFC 867) format is day/month/year/time zone of the server.
Prestige 662H/HW Series User’s Guide CHAPTER 13 Firewalls This chapter gives some background information on firewalls and introduces the Prestige firewall. 13.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term “firewall” is a system or group of systems that enforces an access-control policy between two networks.
Prestige 662H/HW Series User’s Guide Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.
Prestige 662H/HW Series User’s Guide 13.3.1 Denial of Service Attacks Figure 53 Prestige Firewall Application 13.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources. The Prestige is pre-configured to automatically detect and thwart all known DoS attacks. 13.4.
Prestige 662H/HW Series User’s Guide Table 39 Common IP Ports 21 FTP 53 DNS 23 Telnet 80 HTTP 25 SMTP 110 POP3 13.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing. 5 "Ping of Death" and "Teardrop" attacks exploit bugs in the TCP/IP implementations of various computer and host systems.
Prestige 662H/HW Series User’s Guide Figure 54 Three-Way Handshake Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established. • SYN Attack floods a targeted system with a series of SYN packets.
Prestige 662H/HW Series User’s Guide amount of ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will also congest the network of the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic consumes all available bandwidth, making communications impossible. Figure 56 Smurf Attack 13.4.2.
Prestige 662H/HW Series User’s Guide Table 42 Legal SMTP Commands AUTH DATA EHLO ETRN EXPN HELO HELP MAIL QUIT RCPT RSET SAML SEND SOML TURN VRFY NOOP 13.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall.
Prestige 662H/HW Series User’s Guide Figure 57 Stateful Inspection The previous figure shows the Prestige’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked. 13.5.
Prestige 662H/HW Series User’s Guide temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection. 8 Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as required, and are forwarded through the interface.
Prestige 662H/HW Series User’s Guide If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.
Prestige 662H/HW Series User’s Guide Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web configurator’s Custom Ports feature to do this. 13.6 Guidelines for Enhancing Security with Your Firewall • Change the default password via SMT or web configurator. • Limit who can telnet into your router. • Don't enable any local service (such as SNMP or NTP) that you don't use. Any enabled service could present a potential security risk.
Prestige 662H/HW Series User’s Guide • Upgrade your software regularly. Many older versions of software, especially web browsers, have well known security deficiencies. When you upgrade to the latest versions, you get the latest patches and fixes. • If you use “chat rooms” or IRC sessions, be careful with any information you reveal to strangers. • If your system starts exhibiting odd behavior, contact your ISP. Some hackers will set off hacks that cause your system to slowly become unstable or unusable.
Prestige 662H/HW Series User’s Guide • The firewall provides e-mail service to notify you of routine reports and when alerts occur. 13.7.2.1 When To Use The Firewall • To prevent DoS attacks and prevent hackers cracking your network. • A range of source and destination IP addresses as well as port numbers can be specified within one firewall rule making the firewall a better choice when complex rules are required.
Prestige 662H/HW Series User’s Guide 157 Chapter 13 Firewalls
Prestige 662H/HW Series User’s Guide CHAPTER 14 Firewall Configuration This chapter shows you how to enable and configure the Prestige firewall. 14.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your Prestige has to offer. For this reason, it is recommended that you configure your firewall using the web configurator. SMT screens allow you to activate the firewall.
Prestige 662H/HW Series User’s Guide • WAN to WAN/ Router This prevents computers on the WAN from using the Prestige as a gateway to communicate with other computers on the WAN and/or managing the Prestige. • DMZ to LAN • DMZ to DMZ/ Router This prevents computers on the DMZ from communicating between networks or subnets connected to the DMZ interface and/or managing the Prestige. You may define additional rules and sets or modify existing ones but please exercise extreme caution in doing so.
Prestige 662H/HW Series User’s Guide 2 What direction of traffic does the rule apply to (refer to the Firewall Policies Overview section)? 3 What IP services will be affected? 4 What computers on the LAN or DMZ are to be affected (if any)? 5 What computers on the Internet will be affected? The more specific, the better. For example, if traffic is being allowed from the Internet to the LAN, it is better to allow only certain machines on the Internet to access the LAN. 14.3.
Prestige 662H/HW Series User’s Guide 14.3.3.4 Destination Address What is the connection’s destination address; is it on the LAN, DMZ, WAN? Is it a single IP, a range of IPs or a subnet? 14.4 Connection Direction Example This section describes examples for firewall rules for connections going from LAN to WAN and from WAN to LAN. Rules for the DMZ work in a similar fashion.
Prestige 662H/HW Series User’s Guide Figure 59 WAN to LAN Traffic 14.4.3 Alerts Alerts are reports on events, such as attacks, that you may want to know about right away. You can choose to generate an alert when an attack is detected in the Edit Rule screen (select the Send Alert Message to Administrator When Matched checkbox) or when a rule is matched in the Edit Rule screen (see the Configuring Firewall Rules section).
Prestige 662H/HW Series User’s Guide Figure 60 Firewall: Default Policy The following table describes the labels in this screen. Table 43 Firewall: Default Policy 163 LABEL DESCRIPTION Firewall Enabled Select this check box to activate the firewall. The Prestige performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Prestige 662H/HW Series User’s Guide 14.6 Rule Summary Note: The ordering of your rules is very important as rules are applied in turn. Click on Firewall, then Rule Summary to bring up the following screen. This screen is a summary of the existing rules. Note the order in which the rules are listed.
Prestige 662H/HW Series User’s Guide Table 44 Rule Summary (continued) LABEL DESCRIPTION Active This field displays whether a firewall is turned on (Y) or not (N). Source IP This drop-down list box displays the source addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any. Destination IP This drop-down list box displays the destination addresses or ranges of addresses to which this firewall rule applies.
Prestige 662H/HW Series User’s Guide Figure 62 Firewall: Edit Rule The following table describes the labels in this screen.
Prestige 662H/HW Series User’s Guide Table 45 Firewall: Edit Rule LABEL DESCRIPTION Active Select this option to enable this firewall rule. Action for Matched Packet Use the radio button to select whether to discard (Block) or allow the passage of (Forward) packets that match this rule. Source/Destination Address Address Type Do you want your rule to apply to packets with a particular (single) IP, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.
Prestige 662H/HW Series User’s Guide 14.7 Customized Services Configure customized services and port numbers not predefined by the Prestige. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) website. For further information on these services, please read the Predefined Services section. Click the Customized Services link while editing a firewall rule to configure a custom service port. This displays the following screen.
Prestige 662H/HW Series User’s Guide Figure 64 Firewall: Configure Customized Services The following table describes the labels in this screen. Table 47 Firewall: Configure Customized Services LABEL DESCRIPTION Service Name Type a unique name for your custom port. Service Type Choose the IP port (TCP, UDP or TCP/UDP) that defines your customized port from the drop down list box.
Prestige 662H/HW Series User’s Guide Figure 65 Firewall Example: Rule Summary 3 In the Rule Summary screen, type the index number for where you want to put the rule. For example, if you type “6”, your new rule becomes number 6 and the previous rule 6 (if there is one) becomes rule 7. 4 Click Insert to display the firewall rule configuration screen. 5 Select Any in the Destination Address box and then click Delete. 6 Configure the destination address screen as follows and click Add.
Prestige 662H/HW Series User’s Guide Figure 66 Firewall Example: Edit Rule: Destination Address 7 In the Edit Rule screen, click the Customized Services link to open the Customized Service screen. 8 Click an index number to display the Customized Services -Config screen and configure the screen as follows and click Apply. Figure 67 Edit Custom Port Example 9 In the Edit Rule screen, use the Add>> and Remove buttons between Available Services and Selected Services list boxes to configure it as follows.
Prestige 662H/HW Series User’s Guide Figure 68 Firewall Example: Edit Rule: Select Customized Services Note: Custom ports show up with an “*” before their names in the Services list box and the Rule Summary list box. Click Apply after you’ve created your custom port.
Prestige 662H/HW Series User’s Guide screen should look like the following. Rule 2 allows a “My Service” connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. Figure 69 Firewall Example: Rule Summary: My Service 14.10 Predefined Services The Available Services list box in the Edit Rule screen (see the Configuring Firewall Rules section) displays all predefined services that the Prestige already supports. Next to the name of the service, two fields appear in brackets.
Prestige 662H/HW Series User’s Guide Table 48 Predefined Services (continued) SERVICE DESCRIPTION BOOTP_SERVER(UDP:67) DHCP Server. CU-SEEME(TCP/UDP:7648, 24032) A popular videoconferencing solution from White Pines Software. DNS(UDP/TCP:53) Domain Name Server, a service that matches web names (e.g. www.zyxel.com) to IP numbers. FINGER(TCP:79) Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP(TCP:20.
Prestige 662H/HW Series User’s Guide Table 48 Predefined Services (continued) SERVICE DESCRIPTION SMTP(TCP:25) Simple Mail Transfer Protocol is the message-exchange standard for the Internet. SMTP enables you to move messages from one e-mail server to another. SNMP(TCP/UDP:161) Simple Network Management Program. SNMP-TRAPS (TCP/ UDP:162) Traps for use with the SNMP (RFC:1215).
Prestige 662H/HW Series User’s Guide Figure 70 Firewall: Anti Probing The following table describes the labels in this screen. Table 49 Firewall: Anti Probing LABEL DESCRIPTION Respond to PING on The Prestige does not respond to any incoming Ping requests when Disable is selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply to incoming WAN Ping requests. Select DMZ to reply to incoming DMZ Ping requests.
Prestige 662H/HW Series User’s Guide 14.12.1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. These default values should work fine for most small offices. Factors influencing choices for threshold values are: • • • • • The maximum number of opened sessions. The minimum capacity of server backlog in your LAN network. The CPU power of servers in your LAN network. Network bandwidth. Type of traffic for certain servers.
Prestige 662H/HW Series User’s Guide Whenever the number of half-open sessions with the same destination host address rises above a threshold (TCP Maximum Incomplete), the Prestige starts deleting half-open sessions according to one of the following methods: • If the Blocking Time timeout is 0 (the default), then the Prestige deletes the oldest existing half-open session for the host for every new connection request to the host.
Prestige 662H/HW Series User’s Guide Table 50 Firewall: Threshold (continued) LABEL DESCRIPTION DEFAULT VALUES One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-open sessions. When the rate of new connection attempts rises above this number, the Prestige deletes half-open sessions as required to accommodate new connection attempts. 100 half-open sessions per minute.
Prestige 662H/HW Series User’s Guide CHAPTER 15 Content Filtering This chapter covers how to configure content filtering. 15.1 Content Filtering Overview Internet content filtering allows you to create and enforce Internet access policies tailored to your needs. Content filtering gives you the ability to block web sites that contain key words (that you specify) in the URL. You can set a schedule for when the Prestige performs content filtering.
Prestige 662H/HW Series User’s Guide Figure 72 Content Filter: Keyword The following table describes the labels in this screen. Table 51 Content Filter: Keyword LABEL DESCRIPTION Enable Keyword Blocking Select this check box to enable this feature. Block Websites that contain This box contains the list of all the keywords that you have configured the these keywords in the URL: Prestige to block. Delete Highlight a keyword in the box and click Delete to remove it.
Prestige 662H/HW Series User’s Guide Figure 73 Content Filter: Schedule The following table describes the labels in this screen. Table 52 Content Filter: Schedule LABEL DESCRIPTION Days to Block: Select a check box to configure which days of the week (or everyday) you want the content filtering to be active. Time of Day to Block: Use the 24 hour format to configure which time of the day (or select the All day check box) you want the content filtering to be active.
Prestige 662H/HW Series User’s Guide Figure 74 Content Filter: Trusted The following table describes the labels in this screen. Table 53 Content Filter: Trusted LABEL DESCRIPTION Trusted User IP Range 183 From Type the IP address of a computer (or the beginning IP address of a specific range of computers) on the LAN that you want to exclude from content filtering. To Type the ending IP address of a specific range of users on your LAN that you want to exclude from content filtering.
Prestige 662H/HW Series User’s Guide CHAPTER 16 Content Access Control This chapter gives some background information on Content Access Control and explains how to get started with the Prestige Content Access Control. 16.1 Content Access Control Overview Content Access Control (CAC) lets a LAN administrator control a LAN user’s Internet access privileges by blocking services that you specify.
Prestige 662H/HW Series User’s Guide 16.2 Activating CAC and Create User Groups From the Site Map, click Content Access Control and General to open the configuration screen. Use this screen to activate Content Access Control and set up the four user groups. Note: You must set up all four user groups. Figure 76 Content Access Control: General The following table describes the labels in this screen.
Prestige 662H/HW Series User’s Guide Table 54 Content Access Control: General (continued) LABEL DESCRIPTION Group Name Enter the name of a user group for identification purposes. Restrictions Use the links below to configure the access restrictions for the user group.. Time Click Edit to set up the time allowances, start times and end times of the day(s) when access is allowed. Service Click Edit to select the services you wish to block access for a user group.
Prestige 662H/HW Series User’s Guide Figure 77 Control Access Control: General: Time Scheduling The following table describes the labels in this screen. Table 55 Control Access Control: General: Time Scheduling LABEL DESCRIPTION Time Scheduling Select the first radio button to allow everyday access at the same times to the Internet. Type the interval time allowance (number of hours and minutes).
Prestige 662H/HW Series User’s Guide 16.2.2 Configuring Services To customize services for each user group, click Edit under Services for that user group in the Content Access Control: General screen. Figure 78 Content Access Control: General: Services The following table describes the labels in this screen.
Prestige 662H/HW Series User’s Guide Table 56 Content Access Control: General: Services (continued) LABEL DESCRIPTION Add Click Add to add a service to be blocked to the Blocked Services box. Clear All Click Clear All to empty the Blocked Services box. Back Click Back to return to the previous screen. Apply Click Apply to save your changes back to the Prestige. Cancel Click Cancel to return to the previously saved settings. 16.2.2.
Prestige 662H/HW Series User’s Guide Table 57 Available Services (continued) SERVICE DESCRIPTION MSN Messenger(TCP:1863) Microsoft Networks’ messenger service uses this protocol. MULTICAST(IGMP:0) Internet Group Multicast Protocol is used when sending packets to a specific group of hosts. NEW-ICQ(TCP:5190) An Internet chat program. NEWS(TCP:144) A protocol for news groups.
Prestige 662H/HW Series User’s Guide Table 57 Available Services (continued) SERVICE DESCRIPTION TFTP(UDP:69) Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol). VDOLIVE(TCP:7000) Another videoconferencing solution. 16.2.
Prestige 662H/HW Series User’s Guide Figure 79 Content Access Control: General: Web Site Filter Chapter 16 Content Access Control 192
Prestige 662H/HW Series User’s Guide The following table describes the labels in this screen. Table 58 Content Access Control: General: Web Site Filter LABEL DESCRIPTION Pre-defined Web Content Categories Enable Pre-defined Web Content Categories to have the Prestige check an external database to find to which category a requested web page belongs. The Prestige then blocks or forwards access to the web page depending on the configuration of the rest of this page.
Prestige 662H/HW Series User’s Guide Table 58 Content Access Control: General: Web Site Filter (continued) LABEL DESCRIPTION Gambling Selecting this category excludes pages where a user can place a bet or participate in a betting pool (including lotteries) online. It also includes pages that provide information, assistance, recommendations, or training on placing bets or participating in games of chance. It does not include pages that sell gambling related products or machines.
Prestige 662H/HW Series User’s Guide Table 58 Content Access Control: General: Web Site Filter (continued) LABEL DESCRIPTION Games Selecting this category excludes pages that provide information and support game playing or downloading, video games, computer games, electronic games, tips, and advice on games or how to obtain cheat codes. It also includes pages dedicated to selling board games as well as journals and magazines dedicated to game playing.
Prestige 662H/HW Series User’s Guide Table 58 Content Access Control: General: Web Site Filter (continued) LABEL DESCRIPTION Religion Selecting this category excludes pages that promote and provide information on conventional or unconventional religious or quasi-religious subjects, as well as churches, synagogues, or other houses of worship. It does not include pages containing alternative religions such as Wicca or witchcraft (Cult/Occult) or atheist beliefs (Political/Activist Groups).
Prestige 662H/HW Series User’s Guide Table 58 Content Access Control: General: Web Site Filter (continued) LABEL DESCRIPTION More/Basic Click more... to see an expanded list of categories, or click basic... to see a smaller list. Keyword Blocking Select the Enable check box to block the URL containing the keywords in the keyword list. Block Websites that contain these keywords in the URL Type a keyword in this field. You may use any character (up to 64 characters). Wildcards are not allowed.
Prestige 662H/HW Series User’s Guide Figure 80 Content Access Control: General: Diagnose The following table describes the labels in this screen. Table 59 Content Access Control: General: Diagnose LABEL DESCRIPTION Test Web Site Attribute Test Result This field displays the web site address check result. Test if web site is blocked Enter the URL or web site address in the field provided and click Test to check the access restrictions of the web site.
Prestige 662H/HW Series User’s Guide Figure 81 Content Access Control: User Profiles The following table describes the labels in this screen. Table 60 Content Access Control: User Profiles 199 LABEL DESCRIPTION Index This field displays the index number. Username Enter the user name for this account. Password Enter a password associated to the user name above. Category Select a user group from the drop-down list box to associate this user account to the user group.
Prestige 662H/HW Series User’s Guide 16.4 User Online Status To view the online status of each user, click Content Access Control in the Site Map screen and click Online Status to display the screen as shown. Figure 82 Content Access Control: Online Status The following table describes the labels in this screen. Table 61 Content Access Control: Online Status LABEL DESCRIPTION Index This field displays the index number.
Prestige 662H/HW Series User’s Guide 16.5 Content Access Control Logins The following sections describe the user and administrator login experience. 16.5.1 User Login 1 Once the initial configuration is complete, a computer on the network cannot gain Internet access without first logging into the Prestige. 2 When you attempt to access a website, you are directed to the Prestige’s user login screen.
Prestige 662H/HW Series User’s Guide 16.5.2 Administrator Login The administrator can log into the system. • The administrator opens their browser and is directed to the Prestige user login page (this is the same as the user login). • The administrator enters “admin” as the username and the system password. • The system administrator Site Map screen opens.
Prestige 662H/HW Series User’s Guide 203 Chapter 16 Content Access Control
Prestige 662H/HW Series User’s Guide CHAPTER 17 Anti-Virus Packet Scan This chapter introduces and shows you how to configure the anti-virus packet scan. 17.1 Overview A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself.
Prestige 662H/HW Series User’s Guide For maximum protection, you must keep the pattern file up-to-date. 17.2.1 Computer Virus Infection and Prevention The follow describes a simplistic life cycle of a computer virus. 1 A computer gets a copy of a virus from an unknown source (such as the Internet, e-mail, file sharing or any removable storage media). The virus is harmless until the execution of an infected program. 2 The virus spreads to other files and programs on the computer.
Prestige 662H/HW Series User’s Guide This is an Internet file transfer service that operates on the Internet and over TCP/IP networks. A system running the FTP server accepts commands from a system running an FTP client. The service allows users to send commands to the server for uploading and downloading files. Note: The anti-virus packet scan on the Prestige offers the first defense against possible virus attacks on your network.
Prestige 662H/HW Series User’s Guide 17.4 Anti-virus Packet Scan Configuration Note: Before you can use the anti-virus packet scan on the Prestige, you must register for the anti-virus service in the Registration and Virus Information Update screen (see the Registration and Online Update section for more information). Click Anti Virus and Packet Scan to display the configuration screen as shown next. Figure 86 Anti Virus: Packet Scan The following table describes the labels in this screen.
Prestige 662H/HW Series User’s Guide Table 63 Anti Virus: Packet Scan (continued) LABEL DESCRIPTION Default action when session overflow Select whether to allow passage of (Forward Packet) or silently discard (Block Packet) the packets of new connections when the maximum number of opened connections is reached (default is 300 connections at a time). Packet Scan Information Packet Scan Engine Version This read-only field displays the version of the scanning engine on the Prestige.
Prestige 662H/HW Series User’s Guide Figure 87 Anti Virus: Registration and Virus Information Update The following table describes the labels in this screen. Table 64 Anti Virus: Registration and Virus Information Update 209 LABEL DESCRIPTION Registration You must register for the anti-virus service before you can use the packet scan feature on the Prestige. Registering for the service allows you to activate packet scan and download the virus pattern file.
Prestige 662H/HW Series User’s Guide 17.5.1 Updating the Anti Virus Packet Scan Follow the steps below to update the virus scan on the Prestige manually. Note: Do not turn off the Prestige while the virus scan update is in progress! 1 In the Registration and Virus Information Update screen, click Update Now. An update progress screen displays as shown. Figure 88 Virus Scan Update in Progress 2 After the virus scan update is successful, a screen displays as shown.
Prestige 662H/HW Series User’s Guide 211 Chapter 17 Anti-Virus Packet Scan
Prestige 662H/HW Series User’s Guide CHAPTER 18 Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 18.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
Prestige 662H/HW Series User’s Guide Figure 90 Encryption and Decryption 18.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 18.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission. 18.1.3.4 Data Origin Authentication The IPSec receiver can verify the source of IPSec packets. This service depends on the data integrity service. 18.1.
Prestige 662H/HW Series User’s Guide Figure 91 IPSec Architecture 18.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms). The Encryption Algorithm describes the use of encryption techniques such as DES (Data Encryption Standard) and Triple DES algorithms.
Prestige 662H/HW Series User’s Guide Figure 92 Transport and Tunnel Mode IPSec Encapsulation 18.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).
Prestige 662H/HW Series User’s Guide NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted. A NAT device in between the IPSec endpoints will rewrite either the source or destination address with one of its own choosing.
Prestige 662H/HW Series User’s Guide 217 Chapter 18 Introduction to IPSec
Prestige 662H/HW Series User’s Guide CHAPTER 19 VPN Screens This chapter introduces the VPN screens. See the Logs chapter for information on viewing logs and the appendix for IPSec log descriptions. 19.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections. 19.2 IPSec Algorithms The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN.
Prestige 662H/HW Series User’s Guide Table 66 AH and ESP ESP AH DES (default) MD5 (default) Data Encryption Standard (DES) is a widely MD5 (Message Digest 5) produces a 128-bit used method of data encryption using a digest to authenticate packet data. private (secret) key. DES applies a 56-bit key to each 64-bit block of data.
Prestige 662H/HW Series User’s Guide 19.4 Secure Gateway Address Secure Gateway Address is the WAN IP address or domain name of the remote IPSec router (secure gateway). If the remote secure gateway has a static WAN IP address, enter it in the Secure Gateway Address field. You may alternatively enter the remote secure gateway’s domain name (if it has one) in the Secure Gateway Address field.
Prestige 662H/HW Series User’s Guide Figure 94 VPN Summary The following table describes the fields in this screen. Table 67 VPN Summary 221 LABEL DESCRIPTION No. This is the VPN policy index number. Click a number to edit VPN policies. Name This field displays the identification name for this VPN policy. Active This field displays whether the VPN policy is active or not. A Yes signifies that this VPN policy is active. No signifies that this VPN policy is not active.
Prestige 662H/HW Series User’s Guide Table 67 VPN Summary (continued) LABEL DESCRIPTION Remote Address This is the IP address(es) of computer(s) on the remote network behind the remote IPSec router. This field displays N/A when the Secure Gateway Address field displays 0.0.0.0. In this case only the remote IPSec router can initiate the VPN. The same (static) IP address is displayed twice when the Remote Address Type field in the VPN-IKE (or VPN-Manual Key) screen is configured to Single.
Prestige 662H/HW Series User’s Guide Figure 95 NAT Router Between IPSec Routers Normally you cannot set up a VPN connection with a NAT router between the two IPSec routers because the NAT router changes the header of the IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN. The NAT router changes the IPSec packet’s header so it does not match the header for which IPSec router B is checking.
Prestige 662H/HW Series User’s Guide Figure 96 VPN Host using Intranet DNS Server Example If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote network. 19.8 ID Type and Content With aggressive negotiation mode (see the Negotiation Mode section ), the Prestige identifies incoming SAs by ID type and content since this identifying information is not encrypted.
Prestige 662H/HW Series User’s Guide Table 68 Local ID Type and Content Fields LOCAL ID TYPE= CONTENT= IP Type the IP address of your computer or leave the field blank to have the Prestige automatically use its own IP address. DNS Type a domain name (up to 31 characters) by which to identify this Prestige. E-mail Type an e-mail address (up to 31 characters) by which to identify this Prestige.
Prestige 662H/HW Series User’s Guide The two Prestiges in this example cannot complete their negotiation because Prestige B’s Local ID type is IP, but Prestige A’s Peer ID type is set to E-mail. An “ID mismatched” message displays in the IPSEC LOG. Table 71 Mismatching ID Type and Content Configuration Example PRESTIGE A PRESTIGE B Local ID type: IP Local ID type: IP Local ID content: 1.1.1.10 Local ID content: 1.1.1.10 Peer ID type: E-mail Peer ID type: IP Peer ID content: aa@yahoo.
Prestige 662H/HW Series User’s Guide Figure 97 VPN IKE The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide Table 72 VPN IKE LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy. This option determines whether a VPN rule is applied before a packet leaves the firewall. Keep Alive Select either Yes or No from the drop-down list box. Select Yes to have the Prestige automatically reinitiate the SA after the SA lifetime times out, even if there is no traffic.
Prestige 662H/HW Series User’s Guide Table 72 VPN IKE (continued) LABEL DESCRIPTION End / Subnet Mask When the Local Address Type field is configured to Single, this field is N/A. When the Local Address Type field is configured to Range, enter the end (static) IP address, in a range of computers on the LAN behind your Prestige. When the Local Address Type field is configured to Subnet, this is a subnet mask on the LAN behind your Prestige.
Prestige 662H/HW Series User’s Guide Table 72 VPN IKE (continued) LABEL DESCRIPTION My IP Address Enter the WAN IP address of your Prestige. The VPN tunnel has to be rebuilt if this IP address changes. The following applies if this field is configured as 0.0.0.0: The Prestige uses the current Prestige WAN IP address (static or dynamic) to set up the VPN tunnel.
Prestige 662H/HW Series User’s Guide Table 72 VPN IKE (continued) LABEL DESCRIPTION Pre-Shared Key Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters.
Prestige 662H/HW Series User’s Guide Figure 98 Two Phases to Set Up the IPSec SA In phase 1 you must: • • • • • • Choose a negotiation mode. Authenticate the connection by entering a pre-shared key. Choose an encryption algorithm. Choose an authentication algorithm. Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out.
Prestige 662H/HW Series User’s Guide • Main Mode ensures the highest level of security when the communicating parties are negotiating authentication (phase 1). It uses 6 messages in three round trips: SA negotiation, Diffie-Hellman exchange and an exchange of nonces (a nonce is a random number). This mode features identity protection (your identity is not revealed in the negotiation).
Prestige 662H/HW Series User’s Guide Figure 99 VPN IKE: Advanced Setup The following table describes the fields in this screen. Table 73 VPN IKE: Advanced Setup LABEL DESCRIPTION VPN - IKE Protocol Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any protocol.
Prestige 662H/HW Series User’s Guide Table 73 VPN IKE: Advanced Setup (continued) LABEL DESCRIPTION End Enter a port number in this field to define a port range. This port number must be greater than that specified in the previous field. If Remote Start Port is left at 0, End will also remain at 0. Phase 1 Negotiation Mode Select Main or Aggressive from the drop-down list box. Multiple SAs connecting through a secure gateway must have the same negotiation mode.
Prestige 662H/HW Series User’s Guide Table 73 VPN IKE: Advanced Setup (continued) LABEL DESCRIPTION Encryption Algorithm This field is available when you select ESP in the Active Protocol field. Select DES, 3DES, AES or NULL from the drop-down list box.
Prestige 662H/HW Series User’s Guide 19.14 Configuring Manual Key You only configure VPN Manual Key when you select Manual in the IPSec Key Mode field on the VPN IKE screen. This is the VPN Manual Key screen as shown next. Figure 100 VPN: Manual Key The following table describes the fields in this screen.
Prestige 662H/HW Series User’s Guide Table 74 VPN: Manual Key LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the Prestige drops trailing spaces. IPSec Key Mode Select IKE or Manual from the drop-down list box. Manual is a useful option for troubleshooting if you have problems using IKE key management.
Prestige 662H/HW Series User’s Guide Table 74 VPN: Manual Key (continued) LABEL DESCRIPTION End / Subnet Mask When the Remote Address Type field is configured to Single, this field is N/A. When the Remote Address Type field is configured to Range, enter the end (static) IP address, in a range of computers on the network behind the remote IPSec router. When the Remote Address Type field is configured to Subnet, enter a subnet mask on the network behind the remote IPSec router.
Prestige 662H/HW Series User’s Guide 19.15 Viewing SA Monitor Click VPN and Monitor to open the SA Monitor screen as shown. Use this screen to display and manage active VPN connections. A Security Association (SA) is the group of security settings related to a specific VPN tunnel. This screen displays active VPN connections. Use Refresh to display active VPN connections. This screen is read-only. The following table describes the fields in this tab.
Prestige 662H/HW Series User’s Guide Table 75 LABEL DESCRIPTION No This is the security association index number. Name This field displays the identification name for this VPN policy. Encapsulation This field displays Tunnel or Transport mode. IPSec Algorithm This field displays the security protocols used for an SA. Both AH and ESP increase Prestige processing requirements and communications latency (delay).
Prestige 662H/HW Series User’s Guide Table 76 VPN: Global Setting (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the Prestige. Cancel Click Cancel to begin configuring this screen afresh. 19.17 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single Prestige at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses. The Prestige at headquarters has a static public IP address. 19.
Prestige 662H/HW Series User’s Guide Table 77 Telecommuters Sharing One VPN Rule Example FIELDS TELECOMMUTERS My IP Address: 0.0.0.0 (dynamic IP address assigned Public static IP address by the ISP) Secure Gateway IP Address: Public static IP address 0.0.0.0 With this IP address only the telecommuter can initiate the IPSec tunnel. Local IP Address: Telecommuter A: 192.168.2.12 Telecommuter B: 192.168.3.2 Telecommuter C: 192.168.4.15 192.168.1.10 Remote IP Address: 192.168.1.10 HEADQUARTERS 0.0.
Prestige 662H/HW Series User’s Guide Figure 104 Telecommuters Using Unique VPN Rules Example Table 78 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS HEADQUARTERS All Telecommuter Rules: All Headquarters Rules: My IP Address 0.0.0.0 My IP Address: bigcompanyhq.com Secure Gateway Address: bigcompanyhq.com Local IP Address: 192.168.1.10 Remote IP Address: 192.168.1.10 Local ID Type: E-mail Peer ID Type: E-mail Local ID Content: bob@bigcompanyhq.com Peer ID Content: bob@bigcompanyhq.
Prestige 662H/HW Series User’s Guide 19.18 VPN and Remote Management If a VPN tunnel uses Telnet, FTP, WWW, then you should configure remote management (Remote Management) to allow access for that service.
Prestige 662H/HW Series User’s Guide CHAPTER 20 Remote Management Configuration This chapter provides information on configuring remote management. 20.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which Prestige interface (if any) from which computers. When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access.
Prestige 662H/HW Series User’s Guide • A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. • You have disabled that service in one of the remote management screens. • The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the Prestige will disconnect the session immediately. • There is already another remote management session with an equal or higher priority running.
Prestige 662H/HW Series User’s Guide 20.4 Web You can use the Prestige’s embedded web configurator for configuration and file management. See the online help for details. 20.5 Configuring Remote Management Click Remote Management to open the following screen. Figure 106 Remote Management The following table describes the fields in this screen. Table 79 Remote Management LABEL DESCRIPTION Server Type Each of these labels denotes a service that you may use to remotely manage the Prestige.
Prestige 662H/HW Series User’s Guide 249 Chapter 20 Remote Management Configuration
Prestige 662H/HW Series User’s Guide CHAPTER 21 Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configurator. 21.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network.
Prestige 662H/HW Series User’s Guide All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 21.2 UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum Creates UPnP™ Implementers Corp. (UIC). ZyXEL's UPnP implementation supports IGD 1.0 (Internet Gateway Device). At the time of writing ZyXEL's UPnP implementation supports Windows Messenger 4.6 and 4.7 while Windows Messenger 5.
Prestige 662H/HW Series User’s Guide Table 80 Configuring UPnP LABEL DESCRIPTION Enable the Universal Plug and Play (UPnP) Service Select this checkbox to activate UPnP. Be aware that anyone could use a UPnP application to open the web configurator's login screen without entering the Prestige's IP address (although you must still enter the password to access the web configurator).
Prestige 662H/HW Series User’s Guide Figure 108 Add/Remove Programs: Windows Setup: Communication 3 In the Communications window, select the Universal Plug and Play check box in the Components selection box. Figure 109 Add/Remove Programs: Windows Setup: Communication: Components 4 Click OK to go back to the Add/Remove Programs Properties window and click Next. 5 Restart the computer when prompted.
Prestige 662H/HW Series User’s Guide Installing UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP. 1 Click Start and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components …. Figure 110 Network Connections 4 The Windows Optional Networking Components Wizard window displays. Select Networking Service in the Components selection box and click Details.
Prestige 662H/HW Series User’s Guide Figure 111 Windows Optional Networking Components Wizard 5 In the Networking Services window, select the Universal Plug and Play check box.
Prestige 662H/HW Series User’s Guide Figure 112 Networking Services 6 Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 21.4 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the Prestige. Make sure the computer is connected to a LAN port of the Prestige. Turn on your computer and the Prestige.
Prestige 662H/HW Series User’s Guide Figure 113 Network Connections 3 In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created.
Prestige 662H/HW Series User’s Guide Figure 114 Internet Connection Properties 4 You may edit or delete the port mappings or click Add to manually add port mappings.
Prestige 662H/HW Series User’s Guide Figure 115 Internet Connection Properties: Advanced Settings Figure 116 Internet Connection Properties: Advanced Settings: Add 5 When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 6 Select Show icon in notification area when connected option and click OK. An icon displays in the system tray.
Prestige 662H/HW Series User’s Guide Figure 117 System Tray Icon 7 Double-click on the icon to display your current Internet connection status. Figure 118 Internet Connection Status Web Configurator Easy Access With UPnP, you can access the web-based configurator on the Prestige without finding out the IP address of the Prestige first. This comes helpful if you do not know the IP address of the Prestige. Follow the steps below to access the web configurator. 1 Click Start and then Control Panel.
Prestige 662H/HW Series User’s Guide Figure 119 Network Connections 4 An icon with the description for each UPnP-enabled device displays under Local Network. 5 Right-click on the icon for your Prestige and select Invoke. The web configurator login screen displays.
Prestige 662H/HW Series User’s Guide Figure 120 Network Connections: My Network Places 6 Right-click on the icon for your Prestige and select Properties. A properties window displays with basic information about the Prestige.
Prestige 662H/HW Series User’s Guide 263 Chapter 21 Universal Plug-and-Play (UPnP)
Prestige 662H/HW Series User’s Guide CHAPTER 22 Logs Screens This chapter contains information about configuring general log settings and viewing the Prestige’s logs. Refer to the appendix for example log message explanations. 22.1 Logs Overview The web configurator allows you to choose which categories of events and/or alerts to have the Prestige log and then display the logs or have the Prestige send them to an administrator (as e-mail) or to a syslog server. 22.1.
Prestige 662H/HW Series User’s Guide Figure 122 Log Settings The following table describes the fields in this screen. Table 81 Log Settings LABEL DESCRIPTION Address Info 265 Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via e-mail. Mail Subject Type a title that you want to be in the subject line of the log e-mail message that the Prestige sends.
Prestige 662H/HW Series User’s Guide Table 81 Log Settings (continued) LABEL DESCRIPTION Send log to Logs are sent to the e-mail address specified in this field. If this field is left blank, logs will not be sent via e-mail. Send alerts to Alerts are sent to the e-mail address specified in this field. If this field is left blank, alerts will not be sent via e-mail. UNIX Syslog Syslog logging sends a log to an external syslog server used to store logs. Active Click Active to enable syslog logging.
Prestige 662H/HW Series User’s Guide Figure 123 View Logs The following table describes the fields in this screen. Table 82 View Logs LABEL DESCRIPTION Display The categories that you select in the Log Settings screen (see section ) display in the drop-down list box. Select a category of logs to view; select All Logs to view logs from all of the log categories that you selected in the Log Settings page. Time This field displays the time the log was recorded.
Prestige 662H/HW Series User’s Guide Table 83 SMTP Error Messages (continued) -4 means HELO fail -5 means MAIL FROM fail -6 means RCPT TO fail -7 means DATA fail -8 means mail data send fail 22.4.1 Example E-mail Log An "End of Log" message displays for each mail in which a complete log has been sent. The following is an example of a log sent by e-mail. • • • • You may edit the subject title. The date format here is Day-Month-Year. The date format here is Month-Day-Year.
Prestige 662H/HW Series User’s Guide 269 Chapter 22 Logs Screens
Prestige 662H/HW Series User’s Guide CHAPTER 23 Media Bandwidth Management Advanced Setup This chapter describes the functions and advanced configuration of bandwidth management. 23.1 Bandwidth Management Advanced Setup Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic. It can also help you make sure that the Prestige forwards certain types of traffic (especially real-time applications) with minimum delay.
Prestige 662H/HW Series User’s Guide that you configure child-classes with filters for any classes that you configure without filters. The Prestige leaves the bandwidth budget allocated and unused for a class that does not have a filter itself or child-classes with filters. View your configured bandwidth classes and childclasses in the Class Setup screen (see the Configuring Class Setup section for details).
Prestige 662H/HW Series User’s Guide Figure 126 Subnet-based Bandwidth Management Example 23.4.3 Application and Subnet-based Bandwidth Management Example The following example uses bandwidth classes based on LAN subnets and applications (specific applications in each subnet are allotted bandwidth).
Prestige 662H/HW Series User’s Guide 23.5.1 Priority-based Scheduler With the priority-based scheduler, the Prestige forwards traffic from bandwidth classes according to the priorities that you assign to the bandwidth classes. The larger a bandwidth class’s priority number is, the higher the priority. Assign real-time applications (like those using audio or video) a higher priority number to provide smoother operation. 23.5.
Prestige 662H/HW Series User’s Guide 23.6.2 Maximize Bandwidth Usage Example Here is an example of a Prestige that has maximized bandwidth usage enabled on an interface. The first figure shows each bandwidth class’s bandwidth budget and priority. The classes are set up based on subnets. The interface is set to 10 Mbps. Each subnet is allocated 2 Mbps. The unbudgeted 2 Mbps allows traffic not defined in one of the bandwidth filters to go out when you do not select the maximize bandwidth option.
Prestige 662H/HW Series User’s Guide Figure 129 Maximize Bandwidth Usage Example 23.7 Bandwidth Borrowing Bandwidth borrowing allows a child-class to borrow unused bandwidth from its parent class, whereas maximize bandwidth usage allows bandwidth classes to borrow any unused or unbudgeted bandwidth on the whole interface. Enable bandwidth borrowing on a child-class to allow the child-class to use its parent class’s unused bandwidth.
Prestige 662H/HW Series User’s Guide Figure 130 Bandwidth Borrowing Example • The Bill class can borrow unused bandwidth from the Sales USA class because the Bill class has bandwidth borrowing enabled. • The Bill class can also borrow unused bandwidth from the Sales class because the Sales USA class also has bandwidth borrowing enabled. • The Bill class cannot borrow unused bandwidth from the Root class because the Sales class has bandwidth borrowing disabled.
Prestige 662H/HW Series User’s Guide 23.7.2 Maximize Bandwidth Usage With Bandwidth Borrowing If you configure both maximize bandwidth usage (on the interface) and bandwidth borrowing (on individual child-classes), the Prestige functions as follows. 1 The Prestige sends traffic according to each bandwidth class’s bandwidth budget. 2 The Prestige assigns a parent class’s unused bandwidth to its child-classes that have more traffic than their budgets and have bandwidth borrowing enabled.
Prestige 662H/HW Series User’s Guide Table 85 Media Bandwidth Management: Summary LABEL DESCRIPTION LAN WLAN WAN These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source. Traffic redirect or IP alias may cause LAN-to-LAN traffic to pass through the Prestige and be managed by bandwidth management.
Prestige 662H/HW Series User’s Guide Figure 132 Media Bandwidth Management: Class Setup The following table describes the labels in this screen. Table 86 Media Bandwidth Management: Class Setup LABEL DESCRIPTION Interface Select an interface from the drop-down list box for which you wish to set up classes. Back Click Back to go to the main Media Bandwidth Management screen. Add Child-Class Click Add Child-class to add a sub-class. Edit Click Edit to configure the selected class.
Prestige 662H/HW Series User’s Guide Figure 133 Media Bandwidth Management: Class Configuration The following table describes the labels in this screen Table 87 Media Bandwidth Management: Class Configuration LABEL DESCRIPTION Class Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces. BW Budget (kbps) Specify the maximum bandwidth allowed for the class in kbps.
Prestige 662H/HW Series User’s Guide Table 87 Media Bandwidth Management: Class Configuration (continued) LABEL DESCRIPTION Service You can select a predefined service instead of configuring the Destination Port, Source Port and Protocol ID fields. SIP (Session Initiation Protocol) is a signaling protocol used in Internet telephony, instant messaging and other VoIP (Voice over IP) applications. Select SIP from the drop-down list box to configure this bandwidth filter for traffic that uses SIP.
Prestige 662H/HW Series User’s Guide Table 88 Services and Port Numbers SERVICES PORT NUMBER Finger 79 HTTP (Hyper Text Transfer protocol or WWW, Web) 80 POP3 (Post Office Protocol) 110 NNTP (Network News Transport Protocol) 119 SNMP (Simple Network Management Protocol) 161 SNMP trap 162 PPTP (Point-to-Point Tunneling Protocol) 1723 23.9.2 Media Bandwidth Management Statistics Use the Media Bandwidth Management Statistics screen to view network performance information.
Prestige 662H/HW Series User’s Guide Table 89 Media Bandwidth Management Statistics LABEL DESCRIPTION Set Interval Click Set Interval to apply the new update period you entered in the Update Period field above. Stop Update Click Stop Update to stop the browser from refreshing bandwidth management statistics. Clear Counter Click Clear Counter to clear all of the bandwidth management statistics. 23.
Prestige 662H/HW Series User’s Guide CHAPTER 24 Maintenance This chapter displays system information such as ZyNOS firmware, port IP addresses and port traffic statistics. 24.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your Prestige. 24.2 System Status Screen Click System Status to open the following screen, where you can use to monitor your Prestige.
Prestige 662H/HW Series User’s Guide Figure 136 System Status The following table describes the fields in this screen. Table 91 System Status LABEL DESCRIPTION System Status System Name 285 This is the name of your Prestige. It is for identification purposes.
Prestige 662H/HW Series User’s Guide Table 91 System Status (continued) LABEL DESCRIPTION ZyNOS Firmware Version This is the ZyNOS firmware version and the date created. ZyNOS is ZyXEL's proprietary Network Operating System design. DSL FW Version This is the DSL firmware version associated with your Prestige. Standard This is the standard that your Prestige is using. WAN Information IP Address This is the WAN port IP address. IP Subnet Mask This is the WAN port IP subnet mask.
Prestige 662H/HW Series User’s Guide Figure 137 System Status: Show Statistics The following table describes the fields in this screen. Table 92 System Status: Show Statistics LABEL DESCRIPTION System up Time This is the elapsed time the system has been up. CPU Load This field specifies the percentage of CPU utilization. LAN or WAN Port Statistics This is the WAN or LAN port. Link Status This is the status of your WAN link. Upstream Speed This is the upstream speed of your Prestige.
Prestige 662H/HW Series User’s Guide Table 92 System Status: Show Statistics (continued) LABEL DESCRIPTION Poll Interval(s) Type the time interval for the browser to refresh system statistics. Set Interval Click this button to apply the new poll interval you entered in the Poll Interval field above. Stop Click this button to halt the refreshing of the system statistics. 24.
Prestige 662H/HW Series User’s Guide 24.4 Any IP Table Screen Click Maintenance, Any IP. The Any IP table shows current read-only information (including the IP address and the MAC address) of all network devices that use the Any IP feature to communicate with the Prestige. Refer to the Any IP section for more information. Figure 139 Any IP Table The following table describes the labels in this screen. Table 94 Any IP Table LABEL DESCRIPTION # This field displays the index number.
Prestige 662H/HW Series User’s Guide Figure 140 Association List The following table describes the fields in this screen. Table 95 Association List LABEL DESCRIPTION # This is the index number of an associated wireless station. MAC Address This field displays the MAC (Media Access Control) address of an associated wireless station. Every Ethernet device has a unique MAC address.
Prestige 662H/HW Series User’s Guide Figure 141 Diagnostic: General The following table describes the fields in this screen. Table 96 Diagnostic: General LABEL DESCRIPTION TCP/IP Address Type the IP address of a computer that you want to ping in order to test a connection. Ping Click this button to ping the IP address that you entered. Reset System Click this button to reboot the Prestige. A warning dialog box is then displayed asking you if you're sure you want to reboot the system.
Prestige 662H/HW Series User’s Guide Figure 142 Diagnostic: DSL Line The following table describes the fields in this screen. Table 97 Diagnostic: DSL Line LABEL Reset ADSL Line DESCRIPTION Click this button to reinitialize the ADSL line. The large text box above then displays the progress and results of this operation, for example: "Start to reset ADSL Loading ADSL modem F/W... Reset ADSL Line Successfully!" ATM Status Click this button to view ATM status.
Prestige 662H/HW Series User’s Guide 24.7 Firmware Screen Find firmware at www.zyxel.com in a file that (usually) uses the system model name with a "*.bin" extension, e.g., "Prestige.bin". The upload process uses HTTP (Hypertext Transfer Protocol) and may take up to two minutes. After a successful upload, the system will reboot. See Chapter 40 Firmware and Configuration File Maintenance in the parts that document the SMT for upgrading firmware using FTP/TFTP commands.
Prestige 662H/HW Series User’s Guide After you see the Firmware Upload in Process screen, wait two minutes before logging into the Prestige again. The Prestige automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 144 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the System Status screen.
Prestige 662H/HW Series User’s Guide 295 Chapter 24 Maintenance
Prestige 662H/HW Series User’s Guide CHAPTER 25 Introducing the SMT This chapter explains how to access and navigate the System Management Terminal and gives an overview of its menus. 25.1 SMT Introduction The Prestige’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator over a telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via Telnet, how to navigate the SMT and how to configure SMT menus. 25.1.
Prestige 662H/HW Series User’s Guide Figure 146 Login Screen Enter Password : **** 25.1.3 Prestige SMT Menu Overview We use the Prestige 662HW-61 SMT menus in this guide as an example. The SMT menus vary slightly for different Prestige models. The following figure gives you an overview of the various SMT menu screens of your Prestige. Figure 147 Prestige SMT Menu Overview 25.2 Navigating the SMT Interface The SMT (System Management Terminal) is the interface that you use to configure your Prestige.
Prestige 662H/HW Series User’s Guide Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below. Table 99 Navigating the SMT Interface OPERATION KEY STROKE DESCRIPTION Move down to another menu [ENTER] To move forward to a submenu, type in the number of the desired submenu and press [ENTER]. Move up to a previous menu [ESC] Press [ESC] to move back to the previous menu.
Prestige 662H/HW Series User’s Guide 25.2.1 System Management Terminal Interface Summary Table 101 Main Menu Summary # MENU TITLE DESCRIPTION 1 General Setup Use this menu to set up your general information. 2 WAN Backup Setup Use this menu to setup traffic redirect and dial-back up. 3 LAN Setup Use this menu to set up your wireless LAN and LAN connection. 4 Internet Access Setup A quick and easy way to set up an Internet connection.
Prestige 662H/HW Series User’s Guide Figure 148 Menu 23.1 Change Password Menu 23.1 - System Security - Change Password Old Password= ? New Password= ? Retype to confirm= ? Enter here to CONFIRM or ESC to CANCEL: 4 Type your new system password in the New Password field (up to 30 characters), and press [ENTER]. 5 Re-type your new system password in the Retype to confirm field for confirmation and press [ENTER]. Note: Note that as you type a password, the screen displays an “*” for each character you type.
Prestige 662H/HW Series User’s Guide 301 Chapter 25 Introducing the SMT
Prestige 662H/HW Series User’s Guide CHAPTER 26 Menu 1 General Setup Menu 1 - General Setup contains administrative and system-related information. 26.1 General Setup Menu 1 — General Setup contains administrative and system-related information (shown next). The System Name field is for identification purposes. However, because some ISPs check this name you should enter your computer's "Computer Name". • In Windows 95/98 click Start, Settings, Control Panel, Network.
Prestige 662H/HW Series User’s Guide Figure 149 Menu 1 General Setup Menu 1 General Setup System Name= ? Location= Contact Person's Name= Domain Name= Edit Dynamic DNS= No Route IP= Yes Bridge= No Press ENTER to Confirm or ESC to Cancel: Fill in the required fields. Refer to the table shown next for more information about these fields. Table 102 Menu 1 General Setup FIELD DESCRIPTION System Name Choose a descriptive name for identification purposes.
Prestige 662H/HW Series User’s Guide Figure 150 Menu 1.1 Configure Dynamic DNS Menu 1.1 - Configure Dynamic DNS Service Provider= WWW.DynDNS.ORG Active= No Host= EMAIL= USER= Password= ******** Enable Wildcard= No Press ENTER to Confirm or ESC to Cancel: Follow the instructions in the next table to configure dynamic DNS parameters. Table 103 Menu 1.1 Configure Dynamic DNS FIELD DESCRIPTION Service Provider This is the name of your dynamic DNS service provider.
Prestige 662H/HW Series User’s Guide 305 Chapter 26 Menu 1 General Setup
Prestige 662H/HW Series User’s Guide CHAPTER 27 Menu 2 WAN Backup Setup This chapter describes how to configure traffic redirect and dial-backup using menu 2 and 2.1. 27.1 Introduction to WAN Backup Setup This chapter explains how to configure the Prestige for traffic redirect and dial backup connections. 27.2 Configuring Dial Backup in Menu 2 From the main menu, enter 2 to open menu 2. Figure 151 Menu 2 WAN Backup Setup Menu 2 - Wan Backup Setup Check Mechanism = DSL Link Check WAN IP Address1 = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 104 Menu 2 WAN Backup Setup (continued) FIELD DESCRIPTION KeepAlive Fail Tolerance Type the number of times (2 recommended) that your Prestige may ping the IP addresses configured in the Check WAN IP Address field without getting a response before switching to a WAN backup connection (or a different WAN backup connection).
Prestige 662H/HW Series User’s Guide Table 105 Menu 2.1Traffic Redirect Setup (continued) FIELD DESCRIPTION Metric This field sets this route's priority among the routes the Prestige uses. The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks.
Prestige 662H/HW Series User’s Guide Table 106 Menu 2.2 Dial Backup Setup (continued) FIELD DESCRIPTION Edit Advanced To edit the advanced setup for the Dial Backup port, move the cursor to this field; press Setup the [SPACE BAR] to select Yes and then press [ENTER] to go to Menu 2.2.1 Advanced Dial Backup Setup. When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm or ESC to Cancel:” to save your configuration, or press [ESC] at any time to cancel. 27.
Prestige 662H/HW Series User’s Guide Figure 154 Menu 2.2.1 Advanced Dial Backup Setup Menu 2.2.1 - Advanced Dial Backup Setup AT Command Strings: Dial= atd Drop= ~~+++~~ath Answer= ata Call Control: Dial Timeout(sec)= 60 Retry Count= 0 Retry Interval(sec)= N/A Drop Timeout(sec)= 20 Call Back Delay(sec)= 15 Drop DTR When Hang Up= No AT Response Strings: CLID= NMBR = Called Id= Speed= CONNECT Press ENTER to Confirm or ESC to Cancel: The following table describes fields in this menu. Table 107 Menu 2.2.
Prestige 662H/HW Series User’s Guide Table 108 Menu 2.2.1 Advanced Dial Backup Setup: Call Control Parameters 311 FIELD DESCRIPTION Drop Timeout (sec) Enter a number of seconds for the Prestige to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation. Call Back Delay (sec) Enter a number of seconds for the Prestige to wait between dropping a callback request call and dialing the co-responding callback call.
Prestige 662H/HW Series User’s Guide CHAPTER 28 Menu 3 LAN Setup This chapter covers how to configure your wired Local Area Network (LAN) settings. 28.1 LAN Setup This section describes how to configure the Ethernet using Menu 3 — LAN Setup. From the main menu, enter 3 to display menu 3. Figure 155 Menu 3 LAN Setup Menu 3 - LAN Setup 1. LAN Port Filter Setup 2. TCP/IP and DHCP Setup 5. Wireless LAN Setup Enter Menu Selection Number: 28.1.
Prestige 662H/HW Series User’s Guide 28.2 Protocol Dependent Ethernet Setup Depending on the protocols for your applications, you need to configure the respective Ethernet Setup, as outlined below. • For TCP/IP Ethernet setup refer to the Internet Access Configuration section . • For bridging Ethernet setup refer to Chapter 33 Bridging Setup . 28.3 CP/IP Ethernet Setup and DHCP Use menu 3.2 to configure your Prestige for TCP/IP. To edit menu 3.2, enter 3 from the main menu to display Menu 3 — LAN Setup.
Prestige 662H/HW Series User’s Guide Figure 157 Menu 3.2 TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Setup DHCP Setup DHCP= Server Client IP Pool Starting Address= 192.168.1.33 Size of Client IP Pool= 32 Primary DNS Server= 0.0.0.0 Secondary DNS Server= 0.0.0.0 Remote DHCP Server= N/A TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.
Prestige 662H/HW Series User’s Guide Table 110 TCP/IP Ethernet Setup (continued) 315 FIELD DESCRIPTION IP Subnet Mask Your Prestige will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Prestige (refer to the IP Subnetting appendix for more information). RIP Direction Press [SPACE BAR] to select the RIP direction. Choices are Both, In Only, Out Only or None.
Prestige 662H/HW Series User’s Guide CHAPTER 29 Wireless LAN Setup This chapter covers how to configure wireless LAN settings in SMT menu 3.5. 29.1 Wireless LAN Overview Refer to the chapter on the wireless LAN screens for wireless LAN background information. 29.2 Wireless LAN Setup Use menu 3.5 to set up your Prestige as the wireless access point. To edit menu 3.5, enter 3 from the main menu to display Menu 3 – LAN Setup. When menu 3 appears, press 5 and then press [ENTER] to display Menu 3.
Prestige 662H/HW Series User’s Guide Table 111 Menu 3.5 - Wireless LAN Setup (continued) FIELD DESCRIPTION Channel ID Press [SPACE BAR] to select a channel. This allows you to set the operating frequency/ channel depending on your particular region. RTS Threshold RTS(Request To Send) threshold (number of bytes) enables RTS/CTS handshake. Data with its frame size larger than this value will perform the RTS/CTS handshake.
Prestige 662H/HW Series User’s Guide Figure 159 Menu 3.5.1 WLAN MAC Address Filtering Menu 3.5.
Prestige 662H/HW Series User’s Guide 319 Chapter 29 Wireless LAN Setup
Prestige 662H/HW Series User’s Guide CHAPTER 30 Internet Access This chapter shows you how to configure the LAN and WAN of your Prestige for Internet access. 30.1 Internet Access Overview Refer to the chapters on the web configurator’s wizard, LAN and WAN screens for more background information on fields in the SMT screens covered in this chapter. 30.2 IP Policies Traditionally, routing is based on the destination address only and the router takes the shortest path to forward a packet.
Prestige 662H/HW Series User’s Guide Figure 160 IP Alias Network Example Use menu 3.2.1 to configure IP Alias on your Prestige. 30.4 IP Alias Setup Use menu 3.2 to configure the first network. Move the cursor to Edit IP Alias field and press [SPACEBAR] to choose Yes and press [ENTER] to configure the second and third network. Figure 161 Menu 3.2 TCP/IP and DHCP Setup Menu 3.2 - TCP/IP and DHCP Setup DHCP Setup DHCP= Server Client IP Pool Starting Address= 192.168.1.
Prestige 662H/HW Series User’s Guide Figure 162 Menu 3.2.1 IP Alias Setup Menu 3.2.
Prestige 662H/HW Series User’s Guide Figure 163 Menu 1 General Setup Menu 1 - General Setup System Name= ? Location= location Contact Person's Name= Domain Name= Edit Dynamic DNS= No Route IP= Yes Bridge= No Press ENTER to Confirm or ESC to Cancel: 30.6 Internet Access Configuration Menu 4 allows you to enter the Internet Access information in one screen. Menu 4 is actually a simplified setup for one of the remote nodes that you can access in menu 11.
Prestige 662H/HW Series User’s Guide . Table 114 Menu 4 Internet Access Setup FIELD DESCRIPTION ISP’s Name Enter the name of your Internet Service Provider (ISP). This information is for identification purposes only. Encapsulation Press [SPACE BAR] to select the method of encapsulation used by your ISP. Choices are PPPoE, PPPoA, RFC 1483 or ENET ENCAP. Multiplexing Press [SPACE BAR] to select the method of multiplexing used by your ISP. Choices are VC-based or LLC-based.
Prestige 662H/HW Series User’s Guide 325 Chapter 30 Internet Access
Prestige 662H/HW Series User’s Guide CHAPTER 31 Remote Node Configuration This chapter covers remote node configuration. 31.1 Remote Node Setup Overview This section describes the protocol-independent parameters for a remote node. A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. When you use menu 4 to set up Internet access, you are configuring one of the remote nodes.
Prestige 662H/HW Series User’s Guide Figure 165 Menu 11 Remote Node Setup 1. 2. 3. 4. 5. 6. 7. 8. Menu 11 - Remote Node Setup MyISP (ISP, SUA) ________ ________ ________ ________ ________ ________ ________ Enter Node # to Edit: 31.2.2 Encapsulation and Multiplexing Scenarios For Internet access you should use the encapsulation and multiplexing methods used by your ISP.
Prestige 662H/HW Series User’s Guide Figure 166 Menu 11.1 Remote Node Profile Menu 11.
Prestige 662H/HW Series User’s Guide Table 115 Menu 11.1 Remote Node Profile (continued) FIELD DESCRIPTION PAP – accept PAP (Password Authentication Protocol) only. Route This field determines the protocol used in routing. Options are IP and None. Bridge When bridging is enabled, your Prestige will forward any packet that it does not route to this remote node; otherwise, the packets are discarded. Select Yes to enable and No to disable.
Prestige 662H/HW Series User’s Guide 31.3 Remote Node Network Layer Options For the TCP/IP parameters, perform the following steps to edit Menu 11.3 – Remote Node Network Layer Options as shown next. 1 In menu 11.1, make sure IP is among the protocols in the Route field. 2 Move the cursor to the Edit IP/Bridge field, press [SPACE BAR] to select Yes, then press [ENTER] to display Menu 11.3 – Remote Node Network Layer Options. Figure 167 Menu 11.3 Remote Node Network Layer Options Menu 11.
Prestige 662H/HW Series User’s Guide Table 116 Menu 11.3 Remote Node Network Layer Options (continued) FIELD DESCRIPTION Address Mapping Set When Full Feature is selected in the NAT field, configure address mapping sets in menu 15.1. Select one of the NAT server sets (2-10) in menu 15.2 (see Chapter 34 Network Address Translation (NAT) for details) and type that number here. When SUA Only is selected in the NAT field, the SMT uses NAT server set 1 in menu 15.
Prestige 662H/HW Series User’s Guide Figure 168 Sample IP Addresses for a TCP/IP LAN-to-LAN Connection 31.4 Remote Node Filter Move the cursor to the Edit Filter Sets field in menu 11.1, then press [SPACE BAR] to select Yes. Press [ENTER] to display Menu 11.5 – Remote Node Filter. Use Menu 11.5 – Remote Node Filter to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote node and the Prestige and also to prevent certain packets from triggering calls.
Prestige 662H/HW Series User’s Guide Figure 169 Menu 11.5 Remote Node Filter (RFC 1483 or ENET Encapsulation) Menu 11.5 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 170 Menu 11.5 Remote Node Filter (PPPoA or PPPoE Encapsulation) Menu 11.
Prestige 662H/HW Series User’s Guide Figure 171 Menu 11.6 for VC-based Multiplexing Menu 11.6 - Remote Node ATM Layer Options VPI/VCI (VC-Multiplexing) VC Options for IP: VPI #= 8 VCI #= 35 ATM QoS Type= UBR Peak Cell Rate (PCR)= 0 Sustain Cell Rate (SCR)= 0 Maximum Burst Size (MBS)= 0 VC Options for Bridge: VPI #= 1 VCI #= 36 ATM QoS Type= N/A Peak Cell Rate (PCR)= N/A Sustain Cell Rate (SCR)= N/A Maximum Burst Size (MBR)= N/A Enter here to CONFIRM or ESC to CANCEL: 31.5.
Prestige 662H/HW Series User’s Guide Figure 173 Menu 11.1 Remote Node Profile Menu 11.
Prestige 662H/HW Series User’s Guide CHAPTER 32 Static Route Setup This chapter shows how to setup IP static routes. 32.1 IP Static Route Overview Static routes tell the Prestige routing information that it cannot learn automatically through other means. This can arise in cases where RIP is disabled on the LAN or a remote network is beyond the one that is directly connected to a remote node.
Prestige 662H/HW Series User’s Guide Figure 176 Menu 12 Static Route Setup Menu 12 - Static Route Setup 1. IP Static Route 3. Bridge Static Route Please enter selection: From menu 12, select 1 to open Menu 12.1 — IP Static Route Setup (shown next). Figure 177 Menu 12.1 IP Static Route Setup Menu 12.1 - IP Static Route Setup 1. ________ 2. ________ 3. ________ 4. ________ 5. ________ 6. ________ 7. ________ 8. ________ 9. ________ 10. ________ 11. ________ 12. ________ 13. ________ 14. ________ 15.
Prestige 662H/HW Series User’s Guide The following table describes the fields for Menu 12.1.1 – Edit IP Static Route Setup. Table 118 Menu12.1.1 Edit IP Static Route FIELD DESCRIPTION Route # This is the index number of the static route that you chose in menu 12.1. Route Name Type a descriptive name for this route. This is for identification purpose only. Active This field allows you to activate/deactivate this static route.
Prestige 662H/HW Series User’s Guide 339 Chapter 32 Static Route Setup
Prestige 662H/HW Series User’s Guide CHAPTER 33 Bridging Setup This chapter shows you how to configure the bridging parameters of your Prestige. 33.1 Bridging in General Bridging bases the forwarding decision on the MAC (Media Access Control), or hardware address, while routing does it on the network layer (IP) address. Bridging allows the Prestige to transport packets of network layer protocols that it does not route, for example, SNA, from one network to another.
Prestige 662H/HW Series User’s Guide Figure 179 Menu 11.1 Remote Node Profile Menu 11.
Prestige 662H/HW Series User’s Guide 33.2.2 Bridge Static Route Setup Similar to network layer static routes, a bridging static route tells the Prestige the route to a node before a connection is established. You configure bridge static routes in menu 12.3.1 (go to menu 12, choose option 3, then choose a static route to edit) as shown next. Figure 181 Menu 12.3.1 Edit Bridge Static Route Menu 12.3.
Prestige 662H/HW Series User’s Guide 343 Chapter 33 Bridging Setup
Prestige 662H/HW Series User’s Guide CHAPTER 34 Network Address Translation (NAT) This chapter discusses how to configure NAT on the Prestige. 34.1 Using NAT You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the Prestige. 34.1.1 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
Prestige 662H/HW Series User’s Guide Figure 182 Menu 4 Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= RFC 1483 Multiplexing= LLC-based VPI #= 8 VCI #= 35 ATM QoS Type= UBR Peak Cell Rate (PCR)= 0 Sustain Cell Rate (SCR)= 0 Maximum Burst Size (MBS)= 0 My Login= N/A My Password= N/A ENET ENCAP Gateway= N/A IP Address Assignment= Static IP Address= 0.0.0.
Prestige 662H/HW Series User’s Guide Table 121 Applying NAT in Menus 4 & 11.3 FIELD DESCRIPTION NAT Press [SPACE BAR] and then [ENTER] to select Full Feature if you have multiple public WAN IP addresses for your Prestige. The SMT uses the address mapping set that you configure and enter in the Address Mapping Set field (see Figure 185 ). Select None to disable NAT. When you select SUA Only, the SMT uses Address Mapping Set 255 (see Figure 186 ).
Prestige 662H/HW Series User’s Guide Figure 185 Menu 15.1 Address Mapping Sets Menu 15.1 - Address Mapping Sets 1. 2. 3. 4. 5. 6. 7. 8. 255. SUA (read only) Enter Menu Selection Number: 34.3.1.1 SUA Address Mapping Set Enter 255 to display the next screen (see also section 27.1.1). The fields in this menu cannot be changed. Figure 186 Menu 15.1.255 SUA Address Mapping Rules Set Idx --1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Menu 15.1.
Prestige 662H/HW Series User’s Guide Table 122 SUA Address Mapping Rules (continued) FIELD DESCRIPTION Global Start IP This is the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global Start IP. Global End IP This is the ending global IP address (IGA). Type These are the mapping types. Server allows us to specify multiple servers of different types behind NAT to this machine. See later for some examples.
Prestige 662H/HW Series User’s Guide 34.3.1.3 Ordering Your Rules Ordering your rules is important because the Prestige applies the rules in the order that you specify. When a rule matches the current packet, the Prestige takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules.
Prestige 662H/HW Series User’s Guide Figure 188 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= End = N/A Global IP: Start= End = N/A Server Mapping Set= N/A Press ENTER to Confirm or ESC to Cancel: The following table explains the fields in this menu. Table 124 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION Type Press [SPACE BAR] and then [ENTER] to select from a total of five types.
Prestige 662H/HW Series User’s Guide Figure 189 Menu 15.2 NAT Server Setup Menu 15.2 - NAT Server Sets 1. Server Set 1 (Used for SUA Only) 2. Server Set 2 3. Server Set 3 4. Server Set 4 5. Server Set 5 6. Server Set 6 7. Server Set 7 8. Server Set 8 9. Server Set 9 10. Server Set 10 Enter Set Number to Edit: 3 Enter 1 to go to Menu 15.2.1 NAT Server Setup as follows. Figure 190 Menu 15.2.1 NAT Server Setup Menu 15.2 - NAT Server Setup Rule Start Port No. End Port No.
Prestige 662H/HW Series User’s Guide Figure 191 Multiple Servers Behind NAT Example 34.5 General NAT Examples The following are some examples of NAT configuration. 34.5.1 Example 1: Internet Access Only In the following Internet access example, you only need one rule where your ILAs (Inside Local addresses) all map to one dynamic IGA (Inside Global Address) assigned by your ISP.
Prestige 662H/HW Series User’s Guide Figure 192 NAT Example 1 Figure 193 Menu 4 Internet Access & NAT Example Menu 4 - Internet Access Setup ISP's Name= MyISP Encapsulation= RFC 1483 Multiplexing= LLC-based VPI #= 8 VCI #= 35 ATM QoS Type= UBR Peak Cell Rate (PCR)= 0 Sustain Cell Rate (SCR)= 0 Maximum Burst Size (MBS)= 0 My Login= N/A My Password= N/A ENET ENCAP Gateway= N/A IP Address Assignment= Static IP Address= 0.0.0.
Prestige 662H/HW Series User’s Guide Figure 194 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2 to specify the Inside Server behind the NAT as shown in the next figure. Figure 195 Menu 15.2.1 Specifying an Inside Server Menu 15.2.1 - NAT Server Setup (Used for SUA Only) Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 192.168.1.10 2. 0 0 0.0.0.0 3. 0 0 0.0.0.0 4.
Prestige 662H/HW Series User’s Guide You also map your third IGA to the web server and mail server on the LAN. Type Server allows you to specify multiple servers, of different types, to other computers behind NAT on the LAN. The example situation looks somewhat like this: Figure 196 NAT Example 3 In this case you need to configure Address Mapping Set 1 from Menu 15.1 - Address Mapping Sets. Therefore you must choose the Full Feature option from the Network Address Translation field (in menu 4 or menu 11.
Prestige 662H/HW Series User’s Guide Figure 197 Example 3: Menu 11.3 Menu 11.3 - Remote Node Network Layer Options IP Options: Bridge Options: IP Address Assignment= Static Ethernet Addr Timeout (min)= 0 Rem IP Addr: 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.
Prestige 662H/HW Series User’s Guide Figure 199 Example 3: Final Menu 15.1.1 Set Idx --1. 2 3. 4. 5. 6. 7. 8. 9. 10. Menu 15.1.1 - Address Mapping Rules Name= Example3 Local Start IP Local End IP Global Start IP --------------- --------------- --------------192.168.1.10 10.132.50.1 192.168.1.11 10.132.50.2 0.0.0.0 255.255.255.255 10.132.50.3 10.132.50.
Prestige 662H/HW Series User’s Guide Figure 200 Example 3: Menu 15.2.1 Menu 15.2.1 - NAT Server Setup Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 0.0.0.0 2. 80 80 192.168.1.21 3. 25 25 192.168.1.20 4. 0 0 0.0.0.0 5. 0 0 0.0.0.0 6. 0 0 0.0.0.0 7. 0 0 0.0.0.0 8. 0 0 0.0.0.0 9. 0 0 0.0.0.0 10. 0 0 0.0.0.0 11. 0 0 0.0.0.0 12. 0 0 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: 34.5.
Prestige 662H/HW Series User’s Guide Figure 202 Example 4: Menu 15.1.1.1 Address Mapping Rule Menu 15.1.1.1 Address Mapping Rule Type= Many-to-Many No Overload Local IP: Start= 192.168.1.10 End = 192.168.1.12 Global IP: Start= 10.132.50.1 End = 10.132.50.3 Server Mapping Set= N/A Press ENTER to Confirm or ESC to Cancel: After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as shown next. Figure 203 Example 4: Menu 15.1.1 Address Mapping Rules Set Idx --1. 2. 3. 4. 5.
Prestige 662H/HW Series User’s Guide CHAPTER 35 Enabling the Firewall This chapter shows you how to get started with the Prestige firewall. 35.1 Remote Management and the Firewall When SMT menu 24.11 is configured to allow management (see the Remote Management chapter) and the firewall is enabled: • The firewall blocks remote management from the WAN unless you configure a firewall rule to allow it. • The firewall allows remote management from the LAN. 35.
Prestige 662H/HW Series User’s Guide Figure 204 Menu 21.2 Firewall Setup Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DOS) attacks when it is active. The default Policy sets 1. allow all sessions originating from the LAN to the WAN and 2.
Prestige 662H/HW Series User’s Guide CHAPTER 36 Filter Configuration This chapter shows you how to create and apply filters. 36.1 About Filtering Your Prestige uses filters to decide whether or not to allow passage of a data packet and/or to make a call. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters, which are discussed later. Data filtering screens data to determine if the packet should be allowed to pass.
Prestige 662H/HW Series User’s Guide Figure 206 Filter Rule Process Start Packet intoFilter Fetch First Filter Set Filter Set Fetch Next Filter Set Fetch First Filter Rule Fetch Next Filter Rule Yes Yes Next Filter Set Available? No Next filter Rule Available? No Active? Yes Execute Filter Rule No Check Next Rule Forward Drop Drop Packet Accept Packet You can apply up to four filter sets to a particular port to block various types of packets.
Prestige 662H/HW Series User’s Guide 36.2 Configuring a Filter Set for the Prestige To configure a filter set, follow the steps shown next. 1 Enter 21 in the main menu to display Menu 21 – Filter and Firewall Setup. 2 Enter 1 to display Menu 21.1 – Filter Set Configuration as shown next. Figure 207 Menu 21 Filter Set Configuration Filter Set # -----1 2 3 4 5 6 Menu 21.
Prestige 662H/HW Series User’s Guide Figure 209 NetBIOS_LAN Filter Rules Summary Menu 21.1.3 - Filter Rules Summary # A Type Filter Rules M m n - - ---- --------------------------------------------------------------- - 1 Y IP Pr=17, SA=0.0.0.0, SP=137, DA=0.0.0.0, DP=53 N D F 2 N 3 N 4 N 5 N 6 N Enter Filter Rule Number (1-6) to Configure: Figure 210 IGMP Filter Rules Summary Menu 21.1.
Prestige 662H/HW Series User’s Guide Table 125 Abbreviations Used in the Filter Rules Summary Menu (continued) FIELD DESCRIPTION m Action Matched. “F” means to forward the packet immediately and skip checking the remaining rules. “D” means to drop the packet. “N“ means to check the next rule. n Action Not Matched. “F” means to forward the packet immediately and skip checking the remaining rules. “D” means to drop the packet. “N” means to check the next rule.
Prestige 662H/HW Series User’s Guide 36.4.1 TCP/IP Filter Rule This section shows you how to configure a TCP/IP filter rule. TCP/IP rules allow you to base the rule on the fields in the IP and the upper layer protocol, for example, UDP and TCP headers. To configure TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press [ENTER] to open Menu 21.1.x.1 – TCP/IP Filter Rule, as shown next. Figure 211 Menu 21.1.x.1 TCP/IP Filter Rule Menu 21.1.1.
Prestige 662H/HW Series User’s Guide Table 127 Menu 21.1.x.1 TCP/IP Filter Rule (continued) FIELD DESCRIPTION Port # Type the destination port of the packets you want to filter. The field range is 0 to 65535. A 0 field is ignored. Port # Comp Select the comparison to apply to the destination port in the packet against the value given in Destination: Port #. Choices are None, Less, Greater, Equal or Not Equal. Source: IP Addr Type the source IP Address of the packet you want to filter. A 0.0.0.
Prestige 662H/HW Series User’s Guide Figure 212 Executing an IP Filter Packet into IP Filter Filter Active? No Yes Apply SrcAddrMask to Src Addr Check Src IP Addr Not Matched Matched Apply DestAddrMask to Dest Addr Check Dest IP Addr Not Matched Matched Check IP Protocol Not Matched Matched Check Src & Dest Port Not Matched Matched More? Yes No Action Matched Drop Action Not Matched Check Next Rule Check Next Rule Drop Forward Forward Drop Packet Check Next Rule Accept Packet 36.4.
Prestige 662H/HW Series User’s Guide To configure a generic rule select an empty filter set in menu 21, for example 5. Select Generic Filter Rule in the Filter Type field and press [ENTER] to open Menu 21.1.5.1 – Generic Filter Rule, as shown in the following figure. Figure 213 Menu 21.1.5.1 Generic Filter Rule Menu 21.1.5.
Prestige 662H/HW Series User’s Guide Table 128 Menu 21.1.5.1 Generic Filter Rule (continued) FIELD DESCRIPTION Action Not Matched Select the action for a packet not matching the rule. Choices are Check Next Rule, Forward or Drop. When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm or ESC to Cancel:” to save your configuration, or press [ESC] at any time to cancel. 36.
Prestige 662H/HW Series User’s Guide Figure 215 Sample Telnet Filter 1 Enter 1 in the menu 21 to display Menu 21.1 — Filter Set Configuration. 2 Enter the index number of the filter set you want to configure (in this case 6). 3 Type a descriptive name or comment in the Edit Comments field (for example, TELNET_WAN) and press [ENTER]. 4 Press [ENTER] at the message “Press [ENTER] to confirm or [ESC] to cancel ...” to open Menu 21.1.6 — Filter Rules Summary. 5 Type 1 to configure the first filter rule.
Prestige 662H/HW Series User’s Guide 2 Go to the Edit Filter Sets field, press [SPACE BAR] to choose Yes and press [ENTER]. This brings you to menu 11.5. Apply the example filter set (for example, filter set 3) in this menu as shown in the next section. This shows you that you have configured and activated (A = Y) a TCP/IP filter rule (Type = IP, Pr = 6) for destination telnet ports (DP = 23). M = N means an action can be taken immediately.
Prestige 662H/HW Series User’s Guide 36.7.1 Ethernet Traffic You seldom need to filter Ethernet traffic; however, the filter sets may be useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and type the number(s) of the filter set(s) that you want to apply as appropriate. You can choose up to four filter sets (from twelve) by typing their numbers separated by commas, for example, 3, 4, 6, 11.
Prestige 662H/HW Series User’s Guide 375 Chapter 36 Filter Configuration
Prestige 662H/HW Series User’s Guide CHAPTER 37 SNMP Configuration This chapter explains SNMP Configuration menu 22. 37.1 About SNMP Simple Network Management Protocol (SNMP) is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your Prestige supports SNMP agent functionality, which allows a manager station to manage and monitor the Prestige through the network.
Prestige 662H/HW Series User’s Guide The managed devices contain object variables/managed objects that define each piece of information to be collected about a device. Examples of variables include the number of packets received, node port status etc. A Management Information Base (MIB) is a collection of managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects. SNMP itself is a simple request/response protocol based on the manager/agent model.
Prestige 662H/HW Series User’s Guide Figure 221 Menu 22 SNMP Configuration Menu 22 - SNMP Configuration SNMP: Get Community= public Set Community= public Trusted Host= 0.0.0.0 Trap: Community= public Destination= 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: The following table describes the SNMP configuration parameters.
Prestige 662H/HW Series User’s Guide Table 131 SNMP Traps (continued) TRAP # TRAP NAME DESCRIPTION 5 authenticationFailure (defined in RFC-1215) A trap is sent to the manager when receiving any SNMP gets or sets requirements with wrong community (password). 6 whyReboot (defined in ZYXEL-MIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start).
Prestige 662H/HW Series User’s Guide CHAPTER 38 System Security This chapter describes how to configure the system security on the Prestige. 38.1 System Security You can configure the system password.. 38.1.1 System Password Enter 23 in the main menu to display Menu 23 – System Security. You should change the default password. If you forget your password you have to restore the default configuration file.
Prestige 662H/HW Series User’s Guide Figure 224 Menu 23.2 System Security: RADIUS Server Menu 23.2 - System Security - RADIUS Server Authentication Server: Active= No Server Address= 10.11.12.13 Port #= 1812 Shared Secret= ******** Accounting Server: Active= No Server Address= 10.11.12.13 Port #= 1813 Shared Secret= ******** Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 133 Menu 23.
Prestige 662H/HW Series User’s Guide 38.1.3 IEEE802.1x The IEEE802.1x standards outline enhanced security methods for both the authentication of wireless stations and encryption key management. Follow the steps below to enable EAP authentication on your Prestige. 1 From the main menu, enter 23 to display Menu23 – System Security. Figure 225 Menu 23 System Security Menu 23 - System Security 1. Change Password 2. RADIUS Server 4. IEEE802.1x Enter Menu Selection Number: 2 Enter 4 to display Menu 23.
Prestige 662H/HW Series User’s Guide Table 134 Menu 23.4 System Security : IEEE802.1x FIELD DESCRIPTION Wireless Port Control Press [SPACE BAR] and select a security mode for the wireless LAN access. Select No Authentication Required to allow any wireless stations access to your wired network without entering usernames and passwords. This is the default setting. Selecting Authentication Required means wireless stations have to enter usernames and passwords before access to the wired network is allowed.
Prestige 662H/HW Series User’s Guide Table 134 Menu 23.4 System Security : IEEE802.1x (continued) FIELD DESCRIPTION Authentication Databases The authentication database contains wireless station login information. The local user database is the built-in database on the Prestige. The RADIUS is an external server. Use this field to decide which database the Prestige should use (first) to authenticate a wireless station.
Prestige 662H/HW Series User’s Guide Figure 227 Menu 14 Dial-in User Setup Menu 14 - Dial-in User Setup 1. 2. 3. 4. 5. 6. 7. 8. ________ ________ ________ ________ ________ ________ ________ ________ 9. 10. 11. 12. 13. 14. 15. 16. ________ ________ ________ ________ ________ ________ ________ ________ 17. 18. 19. 20. 21. 22. 23. 24. ________ ________ ________ ________ ________ ________ ________ ________ 25. 26. 27. 28. 29. 30. 31. 32.
Prestige 662H/HW Series User’s Guide CHAPTER 39 System Information and Diagnosis This chapter covers the information and diagnostic tools in SMT menus 24.1 to 24.4. 39.1 Overview These tools include updates on system status, port status, log and trace capabilities and upgrades for the system software. This chapter describes how to use these tools in detail. Type 24 in the main menu to open Menu 24 – System Maintenance, as shown in the following figure.
Prestige 662H/HW Series User’s Guide To get to System Status, type 24 to go to Menu 24 — System Maintenance. From this menu, type 1. System Status. There are two commands in Menu 24.1 — System Maintenance — Status. Entering 1 resets the counters; [ESC] takes you back to the previous screen. The following table describes the fields present in Menu 24.1 — System Maintenance — Status which are read-only and meant for diagnostic purposes. Figure 230 Menu 24.1 System Maintenance : Status Menu 24.
Prestige 662H/HW Series User’s Guide Table 136 Menu 24.1 System Maintenance : Status (continued) FIELD DESCRIPTION Rx Pkts This is the number of received packets from the LAN. Collision This is the number of collisions. WAN Line Status This shows statistics for the WAN. This shows the current status of the xDSL line, which can be Up or Down. Upstream Speed This shows the upstream transfer rate in kbps. Downstream Speed This shows the downstream transfer rate in kbps.
Prestige 662H/HW Series User’s Guide Figure 232 Menu 24.2.1 System Maintenance: Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP ZyNOS F/W Version: V3.40(QR.0)a2 | 3/12/2004 ADSL Chipset Vendor: TI AR7 01.01.00.00 Standard: Multi-Mode LAN Ethernet Address: 00:a0:c5:78:de:8d IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Press ESC or RETURN to Exit: The following table describes the fields in this menu. Table 137 Menu 24.2.
Prestige 662H/HW Series User’s Guide Figure 233 Menu 24.2.2 System Maintenance : Change Console Port Speed Menu 24.2.2 – System Maintenance – Change Console Port Speed Console Port Speed: 9600 Press ENTER to Confirm or ESC to Cancel: Once you change the Prestige console port speed, you must also set the speed parameter for the communication software you are using to connect to the Prestige. 39.4 Log and Trace There are two logging facilities in the Prestige.
Prestige 662H/HW Series User’s Guide Figure 235 Sample Error and Information Messages 53 Sat Jan 01 54 Sat Jan 01 55 Sat Jan 01 56 Sat Jan 01 57 Sat Jan 01 58 Sat Jan 01 59 Sat Jan 01 60 Sat Jan 01 62 Sat Jan 01 63 Sat Jan 01 Clear Error Log 00:00:03 00:00:03 00:00:03 00:00:03 00:00:03 00:03:06 00:03:06 00:23:21 00:23:38 00:23:38 (y/n): 2000 2000 2000 2000 2000 2000 2000 2000 2000 2000 PP01 -WARN PP01 INFO PP01 INFO PP20 INFO PP21 INFO PP19 INFO PP01 INFO PP01 INFO PP19 INFO PP01 INFO SNMP TRAP 0: cold
Prestige 662H/HW Series User’s Guide Figure 237 Syslog Example 1 - CDR SdcmdSyslogSend ( SYSLOG_CDR, SYSLOG_INFO, String); String = board xx line xx channel xx, call xx, str board = the hardware board ID line = the WAN ID in a board Channel = channel ID within the WAN call = the call reference number which starts from 1 and increments by 1 for each new call str = C01 Outgoing Call dev xx ch xx (dev:device No. ch:channel No.
Prestige 662H/HW Series User’s Guide Figure 237 Syslog Example (continued) prot: Protocol (“TCP”, ”UDP”, ”ICMP”) spo: Source port dpo: Destination port Jul 19 14:43:55 192.168.102.2 ZYXEL: IP [Src=202.132.154.123 Dst=255.255.255.255 UDP spo=0208 dpo=0208]} S03>R01mF Jul 19 14:44:00 192.168.102.2 ZYXEL: IP [Src=192.168.102.20 Dst=202.132.154.1 UDP spo=05d4 dpo=0035]} S03>R01mF Jul 19 14:44:04 192.168.102.2 ZYXEL: IP [Src=192.168.102.20 Dst=202.132.154.
Prestige 662H/HW Series User’s Guide The following table describes the diagnostic tests available in menu 24.4 for and the connections. Table 139 Menu 24.4 System Maintenance Menu: Diagnostic FIELD DESCRIPTION Reset xDSL Re-initialize the xDSL link to the telephone company. Ping Host Ping the host to see if the links and TCP/IP protocol on both systems are working. Reboot System Reboot the Prestige. Command Mode Type the mode to test and diagnose your Prestige using specified commands.
Prestige 662H/HW Series User’s Guide 395 Chapter 39 System Information and Diagnosis
Prestige 662H/HW Series User’s Guide CHAPTER 40 Firmware and Configuration File Maintenance This chapter tells you how to backup and restore your configuration file as well as upload new firmware and configuration files. 40.1 Filename Conventions The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup, TCP/IP Setup, etc. It arrives from ZyXEL with a “rom” filename extension.
Prestige 662H/HW Series User’s Guide The following table is a summary. Please note that the internal filename refers to the filename on the Prestige and the external filename refers to the filename not on the Prestige, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary. After uploading new firmware, see the ZyNOS F/W Version field in Menu 24.2.1 – System Maintenance – Information to confirm that you have uploaded the correct firmware version.
Prestige 662H/HW Series User’s Guide Figure 239 Telnet in Menu 24.5 Menu 24.5 - System Maintenance - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Prestige. Then type "root" and SMT password as requested. 3. Locate the 'rom-0' file. 4. Type 'get rom-0' to back up the current Prestige configuration to your workstation.
Prestige 662H/HW Series User’s Guide Figure 240 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit 40.2.4 GUI-based FTP Clients The following table describes some of the commands that you may see in GUI-based FTP clients.
Prestige 662H/HW Series User’s Guide 40.2.6 Backup Configuration Using TFTP The Prestige supports the up/downloading of the firmware and the configuration file using TFTP (Trivial File Transfer Protocol) over LAN. Although TFTP should work over WAN as well, it is not recommended. To use TFTP, your computer must have both telnet and TFTP clients. To backup the configuration file, follow the procedure shown next. 1 Use telnet from your computer to connect to the Prestige and log in.
Prestige 662H/HW Series User’s Guide Table 142 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the Prestige. 192.168.1.1 is the Prestige’s default IP address when shipped. Send/Fetch Use “Send” to upload the file to the Prestige and “Fetch” to back up the file on your computer. Local File Enter the path and name of the firmware file (*.bin extension) or configuration file (*.rom extension) on your computer.
Prestige 662H/HW Series User’s Guide Figure 243 Backup Configuration Example Type a location for storing the configuration file or click Browse to look for one. Choose the Xmodem protocol. Then click Receive. 4 After a successful backup you will see the following screen. Press any key to return to the SMT menu. Figure 244 Successful Backup Confirmation Screen ** Backup Configuration completed. OK. ### Hit any key to continue.### 40.
Prestige 662H/HW Series User’s Guide Figure 245 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Prestige. Then type "root" and SMT password as requested. 3.
Prestige 662H/HW Series User’s Guide 40.3.3 Restore Via Console Port Restore configuration via console port by following the HyperTerminal procedure shown next. Procedures using other serial communications programs should be similar. 1 Display menu 24.6 and enter “y” at the following screen. Figure 247 System Maintenance: Restore Configuration Ready to restore Configuration via Xmodem. Do you want to continue (y/n): 2 The following screen indicates that the Xmodem download has started.
Prestige 662H/HW Series User’s Guide Figure 250 Successful Restoration Confirmation Screen Save to ROM Hit any key to start system reboot. 40.4 Uploading Firmware and Configuration Files This section shows you how to upload firmware and configuration files. You can upload configuration files by following the procedure in the Backup Configuration section or by following the instructions in Menu 24.7.2 – System Maintenance – Upload System Configuration File.
Prestige 662H/HW Series User’s Guide Figure 252 Telnet Into Menu 24.7.2 System Maintenance Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload the system configuration file, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested. 3.
Prestige 662H/HW Series User’s Guide 40.4.4 FTP Session Example of Firmware File Upload Figure 253 FTP Session Example of Firmware File Upload 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> put firmware.bin ras 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 1103936 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit More commands (found in GUI-based FTP clients) are listed earlier in this chapter.
Prestige 662H/HW Series User’s Guide 40.4.6 TFTP Upload Command Example The following is an example TFTP command: tftp [-i] host put firmware.bin ras where “i” specifies binary image transfer mode (use this mode when transferring binary files), “host” is the Prestige’s IP address and “put” transfers the file source on the computer (firmware.bin – name of the firmware on the computer) to the file destination on the remote host (ras - name of the firmware on the Prestige).
Prestige 662H/HW Series User’s Guide 40.4.9 Example Xmodem Firmware Upload Using HyperTerminal Click Transfer, then Send File to display the following screen. Figure 255 Example Xmodem Upload After the firmware upload process has completed, the Prestige will automatically restart. 40.4.10 Uploading Configuration File Via Console Port 1 Select 2 from Menu 24.7 – System Maintenance – Upload Firmware to display Menu 24.7.2 - System Maintenance - Upload System Configuration File.
Prestige 662H/HW Series User’s Guide 3 Enter “atgo” to restart the Prestige. 40.4.11 Example Xmodem Configuration Upload Using HyperTerminal Click Transfer, then Send File to display the following screen. Figure 257 Example Xmodem Upload After the configuration upload process has completed, restart the Prestige by entering “atgo”.
Prestige 662H/HW Series User’s Guide 411 Chapter 40 Firmware and Configuration File Maintenance
Prestige 662H/HW Series User’s Guide CHAPTER 41 System Maintenance This chapter leads you through SMT menus 24.8 to 24.10. 41.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main system firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions. Enter the CI from the SMT by selecting menu 24.8. See the included disk or the zyxel.com web site for more detailed information on CI commands.
Prestige 662H/HW Series User’s Guide 41.2 Call Control Support Call Control Support is only applicable when Encapsulation is set to PPPoE in menu 4 or menu 11.1. The budget management function allows you to set a limit on the total outgoing call time of the Prestige within certain times. When the total outgoing call time exceeds the limit, the current call will be dropped and any future outgoing calls will be blocked. To access the call control menu, select option 9 in menu 24 to go to Menu 24.
Prestige 662H/HW Series User’s Guide Figure 261 Menu 24.9.1 System Maintenance: Budget Management Menu 24.9.1 - System Maintenance - Budget Management Remote Node 1.MyIsp 2.-------3.-------4.-------5.-------6.-------7.-------8.-------- Connection Time/Total Budget No Budget --------------- Elapsed Time/Total Period No Budget --------------- Reset Node (0 to update screen): The total budget is the time limit on the accumulated time for outgoing calls to a remote node.
Prestige 662H/HW Series User’s Guide Figure 262 Menu 24 System Maintenance Menu 24 - System Maintenance 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. System Status System Information and Console Port Speed Log and Trace Diagnostic Backup Configuration Restore Configuration Upload Firmware Command Interpreter Mode Call Control Time and Date Setting Remote Management Enter Menu Selection Number: Then enter 10 to go to Menu 24.
Prestige 662H/HW Series User’s Guide Table 144 Menu 24.10 System Maintenance: Time and Date Setting (continued) FIELD DESCRIPTION Current Time This field displays an updated time only when you reenter this menu. New Time Enter the new time in hour, minute and second format. Current Date This field displays an updated date only when you re-enter this menu. New Date Enter the new date in year, month and day format.
Prestige 662H/HW Series User’s Guide 417 Chapter 41 System Maintenance
Prestige 662H/HW Series User’s Guide CHAPTER 42 Remote Management This chapter covers remote management (SMT menu 24.11). 42.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which Prestige interface (if any) from which computers. When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access. See the firewall chapters for details on configuring firewall rules. 42.
Prestige 662H/HW Series User’s Guide Figure 264 Menu 24.11 Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: Server Port = 23 Secured Client IP = 0.0.0.0 FTP Server: Server Port = 21 Secured Client IP = 0.0.0.0 Web Server: Server Port = 80 Secured Client IP = 0.0.0.0 Server Access = LAN only Server Access = LAN only Server Access = LAN only Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 145 Menu 24.
Prestige 662H/HW Series User’s Guide 42.3 Remote Management and NAT When NAT is enabled: • Use the Prestige’s WAN IP address when configuring from the WAN. • Use the Prestige’s LAN IP address when configuring from the LAN. 42.4 System Timeout There is a default system management idle timeout of five minutes (three hundred seconds). The Prestige automatically logs you out if the management session remains idle for longer than this timeout period.
Prestige 662H/HW Series User’s Guide 421 Chapter 42 Remote Management
Prestige 662H/HW Series User’s Guide CHAPTER 43 IP Policy Routing This chapter covers setting and applying policies used for IP routing. 43.1 IP Policy Routing Overview Traditionally, routing is based on the destination address only and the IAD takes the shortest path to forward a packet. IP Routing Policy (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator.
Prestige 662H/HW Series User’s Guide • routing the packet to a different gateway (and hence the outgoing interface). • setting the TOS and precedence fields in the IP header. IPPR follows the existing packet filtering facility of RAS in style and in implementation. The policies are divided into sets, where related policies are grouped together. A user defines the policies before applying them to an interface or a remote node, in the same fashion as the filters.
Prestige 662H/HW Series User’s Guide Figure 266 Menu 25.1 IP Routing Policy Setup Menu 25.1 - IP Routing Policy Setup # A Criteria/Action - - -------------------------------------------------------------------------1 Y SA=1.1.1.1-1.1.1.1,DA=2.2.2.2-2.2.2.5 SP=20-25,DP=20-25,P=6,T=NM,PR=0 |GW=192.168.1.
Prestige 662H/HW Series User’s Guide Figure 267 Menu 25.1.1 IP Routing Policy Menu 25.1.1 - IP Routing Policy Policy Set Name= test Active= No Criteria: IP Protocol = 0 Type of Service= Don't Care Precedence = Don't Care Source: addr start= 0.0.0.0 port start= N/A Destination: addr start= 0.0.0.0 port start= N/A Action= Matched Gateway addr = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 147 Menu 25.1.1 IP Routing Policy (continued) FIELD DESCRIPTION Gateway addr Defines the outgoing gateway address. The gateway must be on the same subnet as the Prestige if it is on the LAN, otherwise, the gateway must be the IP address of a remote node. The default gateway is specified as 0.0.0.0. Type of Service Set the new TOS value of the outgoing packet.
Prestige 662H/HW Series User’s Guide Figure 268 Menu 3.2 TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Setup DHCP Setup DHCP= Server Client IP Pool Starting Address= 192.168.1.33 Size of Client IP Pool= 32 Primary DNS Server= 0.0.0.0 Secondary DNS Server= 0.0.0.0 Remote DHCP Server= N/A TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1 Multicast= None IP Policies= Edit IP Alias= No Press ENTER to Confirm or ESC to Cancel: Go to menu 11.
Prestige 662H/HW Series User’s Guide Figure 270 Example of IP Policy Routing To force packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the WAN port of the Prestige, follow the steps as shown next. 1 Create a routing policy set in menu 25. 2 Create a rule for this set in Menu 25.1.1 — IP Routing Policy as shown next. Figure 271 IP Routing Policy Example Menu 25.1.
Prestige 662H/HW Series User’s Guide 3 Create a rule in menu 25.1 for this set to route packets from any host (IP=0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100). Figure 272 IP Routing Policy Example Menu 25.1.1 - IP Routing Policy Policy Set Name= set2 Active= Yes Criteria: IP Protocol = 6 Type of Service= Don't Care Precedence = Don't Care Source: addr start= 0.0.0.0 port start= 0 Destination: addr start= 0.0.0.
Prestige 662H/HW Series User’s Guide CHAPTER 44 Call Scheduling Call scheduling (applicable for PPPoA or PPPoE encapsulation only) allows you to dictate when a remote node should be called and for how long. 44.1 Introduction The call scheduling feature allows the Prestige to manage a remote node and dictate when a remote node should be called and for how long. This feature is similar to the scheduler in a videocassette recorder (you can specify a time period for the VCR to record).
Prestige 662H/HW Series User’s Guide To setup a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 — Schedule Set Setup as shown next. Figure 275 Menu 26.1 Schedule Set Setup Menu 26.
Prestige 662H/HW Series User’s Guide Table 148 Menu 26.1 Schedule Set Setup (continued) FIELD DESCRIPTION Action Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field. Forced Down means that the connection is blocked whether or not there is a demand call on the line. Enable Dial-On-Demand means that this schedule permits a demand call on the line.
Prestige 662H/HW Series User’s Guide 433 Chapter 44 Call Scheduling
Prestige 662H/HW Series User’s Guide CHAPTER 45 VPN/IPSec Setup This chapter introduces the VPN SMT menus. 45.1 VPN/IPSec Overview The VPN/IPSec main SMT menu has these main submenus: Define VPN policies in menu 27.1 submenus, including security policies, endpoint IP addresses, peer IPSec router IP address and key management. Menu 27.2 - SA Monitor allows you to manage (refresh or disconnect) your SA connections. This is an overview of the VPN menu tree.
Prestige 662H/HW Series User’s Guide Figure 278 Menu 27 VPN/IPSec Setup Menu 27 - VPN/IPSec Setup 1. IPSec Summary 2. SA Monitor Enter Menu Selection Number: 45.2 IPSec Summary Screen Type 1 in menu 27 and then press [ENTER] to display Menu 27.1 IPSec Summary. This is a summary read-only menu of your IPSec rules (tunnels). Edit or create an IPSec rule by selecting an index number and then configuring the associated submenus. Figure 279 Menu 27.1 IPSec Summary Menu 27.
Prestige 662H/HW Series User’s Guide Table 149 Menu 27.1 IPSec Summary (continued) FIELD DESCRIPTION A Y signifies that this VPN rule is active. Local Addr Start When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Single, this is a static IP address on the LAN behind your Prestige. When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Range, this is the beginning (static) IP address, in a range of computers on the LAN behind your Prestige.
Prestige 662H/HW Series User’s Guide Table 149 Menu 27.1 IPSec Summary (continued) FIELD DESCRIPTION Secure GW Addr This is the WAN IP address or the domain name (up to the first 15 characters are displayed) of the IPSec router with which you are making the VPN connection. This field displays 0.0.0.0 when you configure the Secure Gateway Address field in SMT 27.1.1 to 0.0.0.0.
Prestige 662H/HW Series User’s Guide Figure 280 Menu 27.1.1 IPSec Setup Menu 27.1.1 – IPSec Setup Index= 1 Active= Yes Name= Taiwan Keep Alive= No Local ID type= IP Nat Traversal= No Content: My IP Addr= 0.0.0.0 Peer ID type= IP Content: Secure Gateway Address= zw50test.zyxel.com.tw Protocol= 0 DNS Server= 0.0.0.0 Local: Addr Type= SINGLE IP Addr Start= 1.1.1.1 Port Start= 0 Remote: End/Subnet Mask= N/A End= N/A Addr Type= SUBNET IP Addr Start= 4.4.4.4 Port Start= 0 End/Subnet Mask= 255.255.
Prestige 662H/HW Series User’s Guide Table 150 439 Menu 27.1.1 IPSec Setup (continued) FIELD DESCRIPTION Nat Traversal Press [SPACE BAR] to choose either Yes or No. Choose Yes and press [ENTER] to enable NAT traversal. NAT traversal allows you to set up a VPN connection when there are NAT routers between the two IPSec routers. The remote IPSec router must also have NAT traversal enabled.
Prestige 662H/HW Series User’s Guide Table 150 Menu 27.1.1 IPSec Setup (continued) FIELD DESCRIPTION DNS Server If there is a private DNS server that services the VPN, type its IP address here. The Prestige assigns this additional DNS server to the Prestige's DHCP clients that have IP addresses in this IPSec rule's range of local addresses. A DNS server allows clients on the VPN to find other computers and servers on the VPN by their (private) domain names.
Prestige 662H/HW Series User’s Guide Table 150 Menu 27.1.1 IPSec Setup (continued) FIELD DESCRIPTION IP Addr Start When the Addr Type field is configured to Single, enter a static IP address on the network behind the remote IPSec router. When the Addr Type field is configured to Range, enter the beginning (static) IP address, in a range of computers on the network behind the remote IPSec router.
Prestige 662H/HW Series User’s Guide Figure 281 Menu 27.1.1.1KE Setup Menu 27.1.1.
Prestige 662H/HW Series User’s Guide Table 151 Menu 27.1.1.1 IKE Setup (continued) FIELD DESCRIPTION Key Group You must choose a key group for phase 1 IKE setup. DH1 (default) refers to DiffieHellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. Phase 2 Active Protocol Press [SPACE BAR] to choose from ESP or AH and then press [ENTER]. See earlier for a discussion of these protocols.
Prestige 662H/HW Series User’s Guide Figure 282 Menu 27.1.1.2 Manual Setup Menu 27.1.1.2 – Manual Setup Active Protocol= ESP Tunnel ESP Setup SPI (Decimal)= 0 Encryption Algorithm= DES Key1= ? Key2= N/A Key3= N/A Authentication Algorithm= MD5 Key= ? AH Setup SPI (Decimal)= N/A Authentication Algorithm= N/A Key= N/A Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 153 Menu 27.1.1.
Prestige 662H/HW Series User’s Guide Table 153 Menu 27.1.1.2 Manual Setup (continued) FIELD DESCRIPTION Authentication Press [SPACE BAR] to choose from MD5 or SHA1 and then press [ENTER]. Algorithm Key Enter the authentication key to be used by IPSec if applicable. The key must be unique. Enter 16 characters for MD5 authentication and 20 characters for SHA-1 authentication. Any character may be used, including spaces, but trailing spaces are truncated.
Prestige 662H/HW Series User’s Guide CHAPTER 46 SA Monitor This chapter teaches you how to manage your SAs by using the SA Monitor in SMT menu 27.2. 46.1 SA Monitor Overview A Security Association (SA) is the group of security settings related to a specific VPN tunnel. This menu (shown next) displays active VPN connections. Note: When there is outbound traffic but no inbound traffic, the SA times out automatically after two minutes.
Prestige 662H/HW Series User’s Guide Figure 283 Menu 27.2 SA Monitor Menu 27.2 - SA Monitor # Name Encap. IPSec ALgorithm --- -------------------------------- --------- ---------------- 001 Taiwan : 3.3.3.1 – 3.3.3.3.100 Tunnel ESP DES MD5 002 003 004 005 006 007 008 009 010 Select Command= Refresh Select Connection= N/A Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 154 Menu 27.
Prestige 662H/HW Series User’s Guide Table 154 Menu 27.2 SA Monitor (continued) FIELD DESCRIPTION Select Command Press [SPACE BAR] to choose from Refresh, Disconnect, None, Next Page, or Previous Page and then press [ENTER]. You must select a connection in the next field when you choose the Disconnect command. Refresh displays current active VPN connections. None allows you to jump to the “Press ENTER to Confirm…” prompt.
Prestige 662H/HW Series User’s Guide 449 Chapter 46 SA Monitor
Prestige 662H/HW Series User’s Guide CHAPTER 47 Internal SPTGEN 47.1 Internal SPTGEN Overview Internal SPTGEN (System Parameter Table Generator) is a configuration text file useful for efficient configuration of multiple Prestiges. Internal SPTGEN lets you configure, save and upload multiple menus at the same time using just one configuration text file – eliminating the need to navigate and configure individual SMT menus for each Prestige. 47.
Prestige 662H/HW Series User’s Guide 47.2.1 Internal SPTGEN File Modification - Important Points to Remember Each parameter you enter must be preceded by one “=”sign and one space. Some parameters are dependent on others. For example, if you disable the Configured field in menu 1 (see Figure 284 ), then you disable every field in this menu.
Prestige 662H/HW Series User’s Guide Figure 287 Internal SPTGEN FTP Download Example c:\ftp 192.168.1.1 220 PPP FTP version 1.0 ready at Sat Jan 1 03:22:12 2000 User (192.168.1.1:(none)): 331 Enter PASS command Password: 230 Logged in ftp>bin 200 Type I OK ftp> get rom-t ftp>bye c:\edit rom-t (edit the rom-t text file by a text editor and save it) Note: You can rename your “rom-t” file when you save it to your computer but it must be named “rom-t” when you upload it to your Prestige. 47.
Prestige 662H/HW Series User’s Guide 453 Chapter 47 Internal SPTGEN
Prestige 662H/HW Series User’s Guide CHAPTER 48 Troubleshooting This chapter covers potential problems and the corresponding remedies. 48.1 Problems Starting Up the Prestige Table 155 Troubleshooting the Start-Up of Your Prestige PROBLEM CORRECTIVE ACTION None of the LEDs turn on when I turn on the Prestige. Make sure that the Prestige’s power adaptor is connected to the Prestige and plugged in to an appropriate power source. Check that the Prestige and the power source are both turned on.
Prestige 662H/HW Series User’s Guide 48.3 Problems with the DSL LED Table 157 Troubleshooting the DSL LED PROBLEM CORRECTIVE ACTION The DSL LED is off. Check the telephone wire and connections between the Prestige DSL port and the wall jack. Make sure that the telephone company has checked your phone line and set it up for DSL service. Reset your ADSL line to reinitialize your link to the DSLAM.
Prestige 662H/HW Series User’s Guide 48.6 Problems with Internet Access Table 160 Troubleshooting Internet Access PROBLEM CORRECTIVE ACTION I cannot access the Internet. Make sure the Prestige is turned on and connected to the network. If the DSL LED is off, refer to the Problems with the DSL LED section. Verify your WAN settings. Refer to the chapter on WAN setup (web configurator) or the section on Internet Access (SMT). Make sure you entered the correct user name and password.
Prestige 662H/HW Series User’s Guide 48.8 Problems with the Web Configurator Table 162 Troubleshooting the Web Configurator PROBLEM CORRECTIVE ACTION I cannot access the web configurator. Refer to the Quick Start Guide for hardware connections. Make sure that there is not an SMT console session running. Check that you have enabled web service access. If you have configured a secured client IP address, your computer’s IP address must match it. Refer to the chapter on remote management for details.
Prestige 662H/HW Series User’s Guide Appendix A Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The Prestige is DCE when you connect a computer to the console port. The Prestige is DTE when you connect a modem to the dial backup port.
Prestige 662H/HW Series User’s Guide Figure 2 Ethernet Cable Pin Assignments 459 Appendix A Cable Pin Assignments
Prestige 662H/HW Series User’s Guide Appendix B Splitters and Microfilters This appendix tells you how to install a POTS splitter or a telephone microfilter. Connecting a POTS Splitter When you use the Full Rate (G.dmt) ADSL standard, you can use a POTS (Plain Old Telephone Service) splitter to separate the telephone and ADSL signals. This allows simultaneous Internet access and telephone service on the same line. A splitter also eliminates the destructive interference conditions caused by telephone sets.
Prestige 662H/HW Series User’s Guide 1 Connect a phone cable from the wall jack to the single jack end of the Y- Connector. 2 Connect a cable from the double jack end of the Y-Connector to the “wall side” of the microfilter. 3 Connect another cable from the double jack end of the Y-Connector to the Prestige. 4 Connect the “phone side” of the microfilter to your telephone as shown in the following figure.
Prestige 662H/HW Series User’s Guide Appendix C Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.
Prestige 662H/HW Series User’s Guide Figure 6 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add. 2 Select Adapter and then click Add. 3 Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: 1 In the Network window, click Add.
Prestige 662H/HW Series User’s Guide 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click OK. 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab. • • If your IP address is dynamic, select Obtain an IP address automatically.
Prestige 662H/HW Series User’s Guide Figure 8 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • • If you do not know your gateway’s IP address, remove previously installed gateways. If you have a gateway IP address, type it in the New gateway field and click Add. 5 Click OK to save and close the TCP/IP Properties window. 6 Click OK to close the Network window. Insert the Windows CD if prompted. 7 Turn on your Prestige and restart your computer when prompted.
Prestige 662H/HW Series User’s Guide Figure 9 Windows XP: Start Menu 2 For Windows XP, click Network Connections. For Windows 2000/NT, click Network and Dial-up Connections. Figure 10 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties.
Prestige 662H/HW Series User’s Guide Figure 11 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties. Figure 12 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP). • 467 If you have a dynamic IP address click Obtain an IP address automatically.
Prestige 662H/HW Series User’s Guide • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. Click Advanced. Figure 13 Windows XP: Advanced TCP/IP Settings 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
Prestige 662H/HW Series User’s Guide • • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields. If you have previously configured DNS servers, click Advanced and then the DNS tab to order them.
Prestige 662H/HW Series User’s Guide Figure 15 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 16 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list.
Prestige 662H/HW Series User’s Guide 4 For statically assigned settings, do the following: • • • • From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your Prestige in the Router address box. 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save changes to your configuration. 7 Turn on your Prestige and restart your computer (if prompted).
Prestige 662H/HW Series User’s Guide Figure 18 Macintosh OS X: Network 4 For statically assigned settings, do the following: • • • • From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your Prestige in the Router address box. 5 Click Apply Now and close the window. 6 Turn on your Prestige and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the Network window.
Prestige 662H/HW Series User’s Guide 473 Appendix C Setting up Your Computer’s IP Address
Prestige 662H/HW Series User’s Guide Appendix D IP Subnetting IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1. IP addresses are categorized into different classes. The class of an address depends on the value of its first octet. • Class “A” addresses have a 0 in the left most bit.
Prestige 662H/HW Series User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B” address has a valid range of 128 to 191. The first octet of a class “C” address begins with “110”, and therefore has a range of 192 to 223.
Prestige 662H/HW Series User’s Guide Since the mask is always a continuous number of ones beginning from the left, followed by a continuous number of zeros for the remainder of the 32 bit mask, you can simply specify the number of ones instead of writing the value of each octet. This is usually specified by writing a “/” followed by the number of bits in the mask after the address. For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128.
Prestige 662H/HW Series User’s Guide Divide the network 192.168.1.0 into two separate subnets by converting one of the host ID bits of the IP address to a network number bit. The “borrowed” host ID bit can be either “0” or “1” thus giving two subnets; 192.168.1.0 with mask 255.255.255.128 and 192.168.1.128 with mask 255.255.255.128. Note: In the following charts, shaded/bolded last octet bit values indicate host ID bits “borrowed” to form network ID bits.
Prestige 662H/HW Series User’s Guide Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
Prestige 662H/HW Series User’s Guide Table 12 Subnet 4 NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 192 IP Address (Binary) 11000000.10101000.00000001. 11000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: 192.168.1.192 Lowest Host ID: 192.168.1.193 Broadcast Address: 192.168.1.255 Highest Host ID: 192.168.1.254 Example Eight Subnets Similarly use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110).
Prestige 662H/HW Series User’s Guide Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID. A class “B” address has two host ID octets available for subnetting and a class “A” address has three host ID octets (see Table 2) available for subnetting. The following table is a summary for class “B” subnet planning. Table 15 Class B Subnet Planning NO.
Prestige 662H/HW Series User’s Guide 481 Appendix D IP Subnetting
Prestige 662H/HW Series User’s Guide Appendix E PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access Concentrator where the PPP session terminates (see Figure 19). One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.
Prestige 662H/HW Series User’s Guide Figure 19 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC is acting as a L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the PPP frames to the ISP.
Prestige 662H/HW Series User’s Guide Appendix F Virtual Circuit Topology ATM is a connection-oriented technology, meaning that it sets up virtual circuits over which end systems communicate.
Prestige 662H/HW Series User’s Guide 485 Appendix F Virtual Circuit Topology
Prestige 662H/HW Series User’s Guide Appendix G Wireless LAN and IEEE 802.11 A wireless LAN (WLAN) provides a flexible data communications system that you can use to access various services (navigating the Internet, E-mail, printer services, etc.) without the use of a cabled connection. In effect a wireless LAN environment provides you the freedom to stay connected to the network while roaming around in the coverage area.
Prestige 662H/HW Series User’s Guide Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless nodes or stations (STA), which is called a Basic Service Set (BSS). In the most basic form, a wireless LAN connects a set of computers with wireless adapters.
Prestige 662H/HW Series User’s Guide Figure 23 ESS Provides Campus-Wide Coverage Appendix G Wireless LAN and IEEE 802.
Prestige 662H/HW Series User’s Guide 489 Appendix G Wireless LAN and IEEE 802.
Prestige 662H/HW Series User’s Guide Appendix H Wireless LAN With IEEE 802.1x As wireless networks become popular for both portable computing and corporate networks, security is now a priority. Security Flaws with IEEE 802.11 Wireless networks based on the original IEEE 802.11 have a poor reputation for safety. The IEEE 802.11b wireless access standard, first published in 1999, was based on the MAC address. As the MAC address is sent across the wireless link in clear text, it is easy to spoof and fake.
Prestige 662H/HW Series User’s Guide RADIUS Server Authentication Sequence The following figure depicts a typical wireless network with a remote RADIUS server for user authentication using EAPOL (EAP Over LAN). Figure 24 Sequences for EAP MD5–Challenge Authentication 491 Appendix H Wireless LAN With IEEE 802.
Prestige 662H/HW Series User’s Guide Appendix I Types of EAP Authentication This appendix discusses the five popular EAP authentication types: EAP-MD5, EAP-TLS, EAP-TTLS, PEAP and LEAP. The type of authentication you use depends on the RADIUS server or the AP. Consult your network administrator for more information. EAP-MD5 (Message-Digest Algorithm 5) MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wireless station.
Prestige 662H/HW Series User’s Guide PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication. EAP-GTC is implemented only by Cisco.
Prestige 662H/HW Series User’s Guide Appendix J Antenna Selection and Positioning Recommendation An antenna couples RF signals onto air. A transmitter within a wireless device sends an RF signal to the antenna, which propagates the signal through the air. The antenna also operates in reverse by capturing RF signals from the air. Choosing the right antennas and positioning them properly increases the range and coverage area of a wireless LAN.
Prestige 662H/HW Series User’s Guide • Omni-directional antennas send the RF signal out in all directions on a horizontal plane. The coverage area is torus-shaped (like a donut) which makes these antennas ideal for a room environment. With a wide coverage area, it is possible to make circular overlapping coverage areas with multiple access points. • Directional antennas concentrate the RF signal in a beam, like a flashlight.
Prestige 662H/HW Series User’s Guide Appendix K myZyXEL.com Introduction myZyXEL.com is ZyXEL’s online services center where you can register your ZyXEL device. You can also generate an activation key and service set key that may be needed to use devicespecific feature(s). A Note on myZyXEL.com Numbers You need the following (unique) numbers to install and activate device-specific feature(s). Table 17 myZyXEL.
Prestige 662H/HW Series User’s Guide Figure 25 myZyXEL.com Login Screen Click here to create a new myZyXEL.com account. Note: You are automatically logged out of your myZyXEL.com account after five minutes of inactivity. Simply log back into your myZyXEL.com account if this happens to you. Registering Your ZyXEL Device 1 After you have created a myZyXEL.com account, log in and register your ZyXEL device by clicking the hyperlink as shown in the next screen.
Prestige 662H/HW Series User’s Guide Figure 26 Logged Into myZyXEL.com Click here to register a new product. 2 Click Add in the next screen. Figure 27 Product Registration Click Add. 3 The Add New Product screen displays. Enter the produce serial number in the Serial Number field. 4 Your device category and model number automatically display in the Category and Model fields respectively. Otherwise, select the correct ones from the drop-down list boxes.
Prestige 662H/HW Series User’s Guide Figure 28 Add New Product Your ZyXEL device MAC address may already be entered here. 8 Specify the purchase information and click Continue. Figure 29 Product Survey 9 Click Continue again. 10After you have registered your ZyXEL device, you can view its registration details in the screen shown next.
Prestige 662H/HW Series User’s Guide Figure 30 Service Management This field displays the service(s) available for your ZyXEL device. Activating a Service The product is now registered but the related service(s) is not activated. You need to activate the service(s) before you can use it on your ZyXEL device. 1 Display the Service Management screen (see Figure 30) for your registered ZyXEL device (click My Product and the link for your ZyXEL device) .
Prestige 662H/HW Series User’s Guide Congratulations! You have successfully registered your ZyXEL device and activated a service at myZyXEL.com. Note: You must then activate the service(s) on your ZyXEL device via its web configurator to start using the service(s).
Prestige 662H/HW Series User’s Guide Appendix L Windows 98/Me Requirements for AntiVirus Packet Scan Message Display With the anti-virus packet scan, when a virus is detected, an alert message is displayed on Miscrosoft Windows-based operation systems only. For Windows 98/Me, you must open the WinPopup window in order to view real-time alert messages. Click Start, Run and enter “winpopup” in the field provided and click OK. The WinPopup window displays as shown.
Prestige 662H/HW Series User’s Guide Figure 34 Windows 98: Task Bar Properties 3 Double-click Programs and click StartUp. Figure 35 Windows 98: StartUp 4 Right-click in the StartUp pane and click New, Shortcut. 5 A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next.
Prestige 662H/HW Series User’s Guide Figure 36 Windows 98: Startup: Create Shortcut 6 Accept the default or specify a name for the shortcut and click Finish. Figure 37 Windows 98: Startup: Select a Title for the Program 7 A shortcut is created in the StartUp pane. Restart the computer when prompted.
Prestige 662H/HW Series User’s Guide Figure 38 Windows 98: Startup: Shortcut Note: The WinPopup window displays after the computer finishes the startup process 505 Appendix L
Prestige 662H/HW Series User’s Guide Appendix M Example Internal SPTGEN Screens This appendix covers Prestige Internal SPTGEN screens. Table 18 Abbreviations Used in the Example Internal SPTGEN Screens Table ABBREVIATION MEANING FIN Field Identification Number (not seen in SMT screens) FN Field Name PVA Parameter Values Allowed INPUT An example of what you may enter * Applies to the Prestige. The following are Internal SPTGEN screens associated with the SMT screens of your Prestige.
Prestige 662H/HW Series User’s Guide Table 20 Menu 3 (SMT Menu 1) 30100008 = Input device filters Set 4 = 256 30100009 = Output protocol filters Set 1 = 256 30100010 = Output protocol filters Set 2 = 256 30100011 = Output protocol filters Set 3 = 256 30100012 = Output protocol filters Set 4 = 256 30100013 = Output device filters Set 1 = 256 30100014 = Output device filters Set 2 = 256 30100015 = Output device filters Set 3 = 256 30100016 = Output device filters Set 4 = 256 / Menu
Prestige 662H/HW Series User’s Guide Table 20 Menu 3 (SMT Menu 1) 30201004 = RIP Direction <0(None) | 1(Both) | 2(In Only) | 3(Out Only)> = 0 30201005 = Version <0(Rip-1) | 1(Rip-2B) |2(Rip-2M)> = 0 30201006 = IP Alias #1 Incoming protocol filters Set 1 = 256 30201007 = IP Alias #1 Incoming protocol filters Set 2 = 256 30201008 = IP Alias #1 Incoming protocol filters Set 3 = 256 30201009 = IP Alias #1 Incoming protocol filters Set 4 = 256 30201010 = IP Alias #1 Outgoing protocol filters
Prestige 662H/HW Series User’s Guide Table 20 Menu 3 (SMT Menu 1) 30201026 = IP Alias #2 Outgoing protocol filters Set 4 = 256 */ Menu 3.5 Wireless LAN Setup (SMT Menu 3.5) 30500001 = ESSID Wireless 30500002 = Hide ESSID <0(No) | 1(Yes)> 30500003 = Channel ID <1|2|3|4|5|6|7 = 1 |8|9|10|11|12| 13> 30500004 = RTS Threshold <0 ~ 2432> = 2432 30500005 = FRAG.
Prestige 662H/HW Series User’s Guide Table 21 Menu 4 Internet Access Setup (SMT Menu 4) / Menu 4 Internet Access Setup (SMT Menu 4) FIN FN PVA INPUT 40000000 = Configured <0(No) | 1(Yes)> = 1 40000001 = ISP <0(No) | 1(Yes)> = 1 40000002 = Active <0(No) | 1(Yes)> = 1 40000003 = ISP's Name 40000004 = Encapsulation <2(PPPOE) | 3(RFC 1483)| 4(PPPoA )| 5(ENET ENCAP)> = 2 40000005 = Multiplexing <1(LLC-based) | 2(VC-based) = 1 40000006 = VPI # = 0 40000007 = VCI # = 35 40000008 =
Prestige 662H/HW Series User’s Guide Table 21 Menu 4 Internet Access Setup (SMT Menu 4) 40000027 = ATM QoS Type <0(CBR) | (1 (UBR)> = 1 40000028 = Peak Cell Rate (PCR) = 0 40000029 = Sustain Cell Rate (SCR) = 0 40000030 = Maximum Burst Size(MBS) = 0 40000031= RIP Direction <0(None) | 1(Both) | 2(In Only) | 3(Out Only)> = 0 40000032= RIP Version <0(Rip-1) | 1(Rip-2B) |2(Rip-2M)> = 0 40000033= Nailed-up Connection <0(No) |1(Yes)> = 0 Table 22 Menu 12(SMT Menu 12) / Menu 12.1.
Prestige 662H/HW Series User’s Guide Table 22 Menu 12(SMT Menu 12) (continued) 120103002 = IP Static Route set #3, Active <0(No) |1(Yes)> = 0 120103003 = IP Static Route set #3, Destination IP address = 0.0.0.0 120103004 = IP Static Route set #3, Destination IP subnetmask = 0 120103005 = IP Static Route set #3, Gateway = 0.0.0.0 120103006 = IP Static Route set #3, Metric = 0 120103007 = IP Static Route set #3, Private <0(No) |1(Yes)> = 0 / Menu 12.1.4 IP Static Route Setup (SMT Menu 12.
Prestige 662H/HW Series User’s Guide Table 22 Menu 12(SMT Menu 12) (continued) FIN FN PVA INPUT 120107001 = IP Static Route set #7, Name = 120107002 = IP Static Route set #7, Active <0(No) |1(Yes)> = 0 120107003 = IP Static Route set #7, Destination IP address = 0.0.0.0 120107004 = IP Static Route set #7, Destination IP subnetmask = 0 120107005 = IP Static Route set #7, Gateway = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 22 Menu 12(SMT Menu 12) (continued) 120110007 = IP Static Route set #10, Private <0(No) |1(Yes)> = 0 */ Menu 12.1.11 IP Static Route Setup (SMT Menu 12.1.11) FIN FN PVA INPUT 120111001 = IP Static Route set #11, Name = 120111002 = IP Static Route set #11, Active <0(No) |1(Yes)> = 0 120111003 = IP Static Route set #11, Destination IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 22 Menu 12(SMT Menu 12) (continued) 120114004 = IP Static Route set #14, Destination IP subnetmask = 0 120114005 = IP Static Route set #14, Gateway = 0.0.0.0 120114006 = IP Static Route set #14, Metric = 0 120114007 = IP Static Route set #14, Private <0(No) |1(Yes)> = 0 */ Menu 12.1.15 IP Static Route Setup (SMT Menu 12.1.
Prestige 662H/HW Series User’s Guide Table 23 Menu 15 SUA Server Setup (SMT Menu 15) (continued) 150000007 = SUA Server #3 Active <0(No) | 1(Yes)> = 0 150000008 = SUA Server #3 Protocol <0(All)|6(TCP)|17(U DP)> = 0 150000009 = SUA Server #3 Port Start = 0 150000010 = SUA Server #3 Port End = 0 150000011 = SUA Server #3 Local IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 23 Menu 15 SUA Server Setup (SMT Menu 15) (continued) 150000041 = SUA Server #9 Local IP address 150000042 = SUA Server #10 Active = 0.0.0.0 <0(No) | 1(Yes)> = 0 <0(All)|6(TCP)|17(U DP)> = 0 150000043 = SUA Server #10 Protocol 150000044 = SUA Server #10 Port Start = 0 150000045 = SUA Server #10 Port End = 0 150000046 = SUA Server #10 Local IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 24 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210101011 = IP Filter Set 1,Rule 1 Src Port Comp <0(none)|1(equal) |2(not equal)|3(less)|4( greater)> = 0 210101013 = IP Filter Set 1,Rule 1 Act Match <1(check next)|2(forward)| 3(drop)> = 3 210101014 = IP Filter Set 1,Rule 1 Act Not Match <1(check next)|2(forward)| 3(drop)> = 1 PVA INPUT / Menu 21.1.1.2 set #1, rule #2 (SMT Menu 21.1.1.
Prestige 662H/HW Series User’s Guide Table 24 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210103007 = IP Filter Set 1,Rule 3 Dest Port Comp <0(none)|1(equal) |2(not equal)|3(less)|4( greater)> = 1 210103008 = IP Filter Set 1,Rule 3 Src IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 24 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210105002 = IP Filter Set 1,Rule 5 Active <0(No)|1(Yes)> 210105003 = IP Filter Set 1,Rule 5 Protocol = 17 210105004 = IP Filter Set 1,Rule 5 Dest IP address = 0.0.0.0 210105005 = IP Filter Set 1,Rule 5 Dest Subnet Mask = 0 210105006 = IP Filter Set 1,Rule 5 Dest Port = 138 210105007 = IP Filter Set 1,Rule 5 Dest Port Comp 210105008 = IP Filter Set 1,Rule 5 Src IP Address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 24 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210106013 = IP Filter Set 1,Rule 6 Act Match <1(check next)|2(forward)| 3(drop)> = 3 210106014 = IP Filter Set 1,Rule 6 Act Not Match <1(check next)|2(forward)| 3(drop)> = 2 Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) / Menu 21.1 filter set #2, (SMT Menu 21.1) FIN FN PVA INPUT 210200001 = Filter Set 2, Nam = NetBIOS_WAN / Menu 21.1.2.1 Filter set #2, rule #1 (SMT Menu 21.1.2.
Prestige 662H/HW Series User’s Guide Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210202001 = IP Filter Set 2, Rule 2 Type <0(none)|2(TCP/IP)> = 2 210202002 = IP Filter Set 2, Rule 2 Active <0(No)|1(Yes)> 210202003 = IP Filter Set 2, Rule 2 Protocol = 6 210202004 = IP Filter Set 2, Rule 2 Dest IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210203011 = IP Filter Set 2, Rule 3 Src Port Comp <0(none)|1(equal)|2 = 0 (not equal)|3(less)|4(gr eater)> 210203013 = IP Filter Set 2, Rule 3 Act Match <1(check = 3 next)|2(forward)|3( drop)> 210203014 = IP Filter Set 2,Rule 3 Act Not Match <1(check = 1 next)|2(forward)|3( drop)> / Menu 21.1.2.4 Filter set #2, rule #4 (SMT Menu 21.1.2.
Prestige 662H/HW Series User’s Guide Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210205004 = IP Filter Set 2, Rule 5 Dest IP address = 0.0.0.0 210205005 = IP Filter Set 2, Rule 5 Dest Subnet Mask = 0 210205006 = IP Filter Set 2, Rule 5 Dest Port = 138 210205007 = IP Filter Set 2, Rule 5 Dest Port Comp 210205008 = IP Filter Set 2, Rule 5 Src IP address = 0.0.0.
Prestige 662H/HW Series User’s Guide Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210206013 = IP Filter Set 2,Rule 6 Act Match <1(check = 3 next)|2(forward)|3( drop)> 210206014 = IP Filter Set 2,Rule 6 Act Not Match <1(check = 2 next)|2(forward)|3( drop)> */ Menu 23.1 System Password Setup (SMT Menu 23.1) FIN FN 230000000 = System Password PVA INPUT = 1234 */ Menu 23.2 System security: radius server (SMT Menu 23.
Prestige 662H/HW Series User’s Guide Table 25 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 241100005 = FTP Server Access <0(all)|1(none)|2(L = 0 an)|3(Wan)> 241100006 = FTP Server Secured IP address = 0.0.0.0 241100007 = WEB Server Port = 80 241100008 = WEB Server Access 241100009 = WEB Server Secured IP address <0(all)|1(none)|2(L = 0 an) |3(Wan)> = 0.0.0.0 Command Examples The following are example Internal SPTGEN screens associated with the Prestige’s command interpreter commands.
Prestige 662H/HW Series User’s Guide 527 Appendix M
Prestige 662H/HW Series User’s Guide Appendix N Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode. See the included disk or zyxel.com for more detailed information on these commands. Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable.
Prestige 662H/HW Series User’s Guide 529 Appendix N
Prestige 662H/HW Series User’s Guide Appendix O Firewall Commands Sys Firewall Commands The following describes the firewall commands. See Appendix N for information on the command structure. Each of these commands must be preceded by sys firewall when you use them. For example, type sys firewall active yes to turn on the firewall. Table 27 Sys Firewall Commands Command Description acl disp Displays ACLs or a specific ACL set # and rule #.
Prestige 662H/HW Series User’s Guide 531 Appendix O
Prestige 662H/HW Series User’s Guide Appendix P NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. See Appendix N for information on the command structure. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls.
Prestige 662H/HW Series User’s Guide The filter types and their default settings are as follows. Table 28 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and WAN This field displays whether NetBIOS packets are blocked or forwarded between the LAN and the WAN. Block Between LAN and DMZ This field displays whether NetBIOS packets are blocked or forwarded between the LAN and the DMZ.
Prestige 662H/HW Series User’s Guide Appendix P sys filter netbios config 3 on This command blocks IPSec NetBIOS packets. sys filter netbios config 4 off This command stops NetBIOS commands from initiating calls.
Prestige 662H/HW Series User’s Guide 535 Appendix P
Prestige 662H/HW Series User’s Guide Appendix Q Brute-Force Password Guessing Protection The following describes the commands for enabling, disabling and configuring the brute-force password guessing protection mechanism for the password. See Appendix N for information on the command structure. Table 29 Brute-Force Password Guessing Protection Commands COMMAND DESCRIPTION sys pwderrtm This command displays the brute-force guessing password protection settings.
Prestige 662H/HW Series User’s Guide 537 Appendix Q
Prestige 662H/HW Series User’s Guide Appendix R Boot Commands The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your Prestige, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen. In debug mode you have access to a series of boot module commands, for example ATUR (for uploading firmware) and ATLC (for uploading the configuration file).
Prestige 662H/HW Series User’s Guide Figure 40 Boot Module Commands AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.
Prestige 662H/HW Series User’s Guide Appendix S Log Descriptions This appendix provides descriptions of example log messages. Table 30 System Maintenance Logs LOG MESSAGE DESCRIPTION Time calibration is successful The router has adjusted its time based on information from the time server. Time calibration failed The router failed to get information from the time server. WAN interface gets IP: %s A WAN interface got a new IP address from the DHCP, PPPoE, PPTP or dial-up server.
Prestige 662H/HW Series User’s Guide Table 30 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION Configuration Change: PC = 0x%x, Task ID = 0x%x The router is saving configuration changes. Successful SSH login Someone has logged on to the router’s SSH server. SSH login failed Someone has failed to log on to the router’s SSH server. Successful HTTPS login Someone has logged on to the router's web configurator interface using HTTPS protocol.
Prestige 662H/HW Series User’s Guide Table 33 TCP Reset Logs LOG MESSAGE DESCRIPTION Under SYN flood attack, sent TCP RST The router sent a TCP reset packet when a host was under a SYN flood attack (the TCP incomplete count is per destination host.) Exceed TCP MAX incomplete, sent TCP RST The router sent a TCP reset packet when the number of TCP incomplete connections exceeded the user configured threshold. (the TCP incomplete count is per destination host.
Prestige 662H/HW Series User’s Guide Table 35 ICMP Logs (continued) LOG MESSAGE DESCRIPTION Triangle route packet forwarded: ICMP The firewall allowed a triangle route session to pass through. Packet without a NAT table entry blocked: ICMP The router blocked a packet that didn’t have a corresponding NAT table entry. Unsupported/out-of-order ICMP: ICMP The firewall does not support this kind of ICMP packets or the ICMP packets are out of order.
Prestige 662H/HW Series User’s Guide Table 38 UPnP Logs LOG MESSAGE DESCRIPTION UPnP pass through Firewall UPnP packets can pass through the firewall. Table 39 Content Filtering Logs LOG MESSAGE DESCRIPTION %s: Keyword blocking The content of a requested web page matched a user defined keyword. %s: Not in trusted web list The web site is not in a trusted domain, and the router blocks all traffic except trusted domain sites. %s: Forbidden Web site The web site is in the forbidden web site list.
Prestige 662H/HW Series User’s Guide Table 40 Attack Logs 545 LOG MESSAGE DESCRIPTION attack [ TCP | UDP | IGMP | ESP | GRE | OSPF ] The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF attack. attack ICMP (type:%d, code:%d) The firewall detected an ICMP attack. For type and code details, see Table 45. land [ TCP | UDP | IGMP | ESP | GRE | OSPF ] The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF land attack. land ICMP (type:%d, code:%d) The firewall detected an ICMP land attack.
Prestige 662H/HW Series User’s Guide Table 41 IPSec Logs LOG MESSAGE DESCRIPTION Discard REPLAY packet The router received and discarded a packet with an incorrect sequence number. Inbound packet authentication failed The router received a packet that has been altered. A third party may have altered or tampered with the packet. Receive IPSec packet, but no corresponding tunnel exists The router dropped an inbound packet for which SPI could not find a corresponding phase 2 SA.
Prestige 662H/HW Series User’s Guide Table 42 IKE Logs (continued) 547 LOG MESSAGE DESCRIPTION Cannot resolve Secure Gateway Addr for rule <%d> The router couldn’t resolve the IP address from the domain name that was used for the secure gateway address. Peer ID: - The displayed ID information did not match between the two ends of the connection. vs.
Prestige 662H/HW Series User’s Guide Table 42 IKE Logs (continued) LOG MESSAGE DESCRIPTION XAUTH fail! Username: The router was not able to use extended authentication to authenticate the listed username. Rule[%d] Phase 1 negotiation mode mismatch The listed rule’s IKE phase 1 negotiation mode did not match between the router and the peer. Rule [%d] Phase 1 encryption algorithm mismatch The listed rule’s IKE phase 1 encryption algorithm did not match between the router and the peer.
Prestige 662H/HW Series User’s Guide Table 42 IKE Logs (continued) LOG MESSAGE DESCRIPTION Rule [%d] phase 2 mismatch The listed rule’s IKE phase 2 did not match between the router and the peer. Rule [%d] Phase 2 key length mismatch The listed rule’s IKE phase 2 key lengths (with the AES encryption algorithm) did not match between the router and the peer. Table 43 802.1X Logs LOG MESSAGE DESCRIPTION Local User Database accepts user. A user was authenticated by the local user database.
Prestige 662H/HW Series User’s Guide Table 44 ACL Setting Notes PACKET DIRECTION DIRECTION DESCRIPTION (L to W) LAN to WAN ACL set for packets traveling from the LAN to the WAN. (W to L) WAN to LAN ACL set for packets traveling from the WAN to the LAN. (D to L) DMZ to LAN ACL set for packets traveling from the DMZ to the LAN. (D to W) DMZ to WAN ACL set for packets traveling from the DMZ to the WAN. (W to D) WAN to DMZ ACL set for packets traveling from the WAN to the DMZ.
Prestige 662H/HW Series User’s Guide Table 45 ICMP Notes (continued) TYPE CODE DESCRIPTION Time Exceeded 11 0 Time to live exceeded in transit 1 Fragment reassembly time exceeded Parameter Problem 12 0 Pointer indicates the error Timestamp 13 0 Timestamp request message Timestamp Reply 14 0 Timestamp reply message Information Request 15 0 Information request message Information Reply 16 0 Information reply message Table 46 Syslog Logs LOG MESSAGE DESCRIPTION Mon dd
Prestige 662H/HW Series User’s Guide Table 47 RFC-2408 ISAKMP Payload Types (continued) LOG DISPLAY PAYLOAD TYPE SIG Signature NONCE Nonce NOTFY Notification DEL Delete VID Vendor ID Log Commands Go to the command interpreter interface (Appendix N explains how to access and use the commands). Configuring What You Want the Prestige to Log 1 Use the sys logs load command to load the log setting buffer that allows you to configure which logs the Prestige is to record.
Prestige 662H/HW Series User’s Guide Use 0 to not record logs for that category, 1 to record only logs for that category, 2 to record only alerts for that category, and 3 to record both logs and alerts for that category. Not every parameter is available with every category. 5 Use the sys logs save command to store the settings in the Prestige (you must do this in order to record logs). Displaying Logs • Use the sys logs display command to show all of the logs in the Prestige’s log.
Prestige 662H/HW Series User’s Guide Index A Access methods 360 Address Assignment 79 Address mapping 136 Address Resolution Protocol (ARP) 82 ADSL standards 44 ADSL, what is it? 42 AH 214 AH (Authentication Header) 436 AH Protocol 218 alert message 502 Alternative Subnet Mask Notation 476 Antenna Directional 495 Omni-directional 495 antenna 47 Antenna gain 494 Anti-virus Online update 208 Registration 208 Anti-virus packet scan Configuration 207 anti-virus packet scan 46, 502 packet types 46 Windows 98/M
Prestige 662H/HW Series User’s Guide BW Budget 280 C CA 492 CAC 184 call back delay 311 Call filtering 362 Call filters Built-in 362 User-defined 362 Call Scheduling 430 Maximum Number of Schedule Sets 430 PPPoE 432 Precedence 430 Precedence Example 430 CBR (Continuous Bit Rate) 116 CDR 392 CDR (Call Detail Record) 391 CE regulations 47 Certificate Authority 492 change password at login 55 Channel 90 Interference 90 Channel ID 317 CHAP 328 Class Name 280 Collision 388 Command Interpreter Mode 412 Communit
Prestige 662H/HW Series User’s Guide DeMilitarized Zone (DMZ) 48 Denial of Service 145, 146, 177, 360 Destination Address 161 Device Filter rules 371 device model number 293 Device rule 371 DH 233 DHCP 49, 69, 80, 140, 288, 314, 389 DHCP client 49 DHCP relay 49 DHCP server 49, 288, 314 DHCP table 288 diagnostic 290 Diagnostic Tools 386 dial timeout 310 Diffie-Hellman Key Groups 233 Direct Sequence Spread Spectrum 486 Distribution System 487 Distribution System (DS) 100 DMZ 86 DNS 314 DNS Server For VPN Hos
Prestige 662H/HW Series User’s Guide Remote Node Filter 332 Remote Node Filters 374 Sample 372 SUA 371 TCP/IP Filter Rule 367 Filter Log 392 Filter Rule Process 363 Filter Rule Setup 366 Filter Set Class 366 Filtering 362, 366 Filtering Process Outgoing Packets 362 Finger 132 Firewall Access Methods 158, 360 Address Type 167 Alerts 162 Anti-Probing 175 Attack alerts 176 Connection Direction 161 Creating/Editing Rules 165 Custom Ports 168 Enabling 162 Firewall Vs Filters 155 Guidelines For Enhancing Securit
Prestige 662H/HW Series User’s Guide Internal SPTGEN 450 FTP Upload Example 452 Points to Remember 451 Text File 450 Internal SPTGEN Screens 506 Internal SPTGEN screens 506 Internet Access 45, 51, 320, 323, 324 Internet access 60, 320 Internet Access Setup 344, 455 Internet access wizard setup 61 Internet Assigned Numbers AuthoritySee IANA 64 Internet Control Message Protocol (ICMP) 148, 175 Internet Key Exchange 231 Internet Protocol Security 212 IP Address 62, 80, 132, 288, 314, 338, 342, 368, 389, 394,
Prestige 662H/HW Series User’s Guide MAC filter 95 Macro virus 204 Main Menu 298 maintenance 284 management idle timeout period 55, 497 Management Information Base (MIB) 377 Manually Update Virus Information 209 Maximize Bandwidth Usage 273 Maximum Burst Size (MBS) 113, 116 Max-incomplete High 177 Max-incomplete Low 177 MBSSee Maximum Burst Size 324 MD5 (Message Digest 5) 442 MDI/MDI-X 48 Media Access Control 340 Media Bandwidth Management 47 Message Integrity Check (MIC) 99 Message Logging 390 Metric 112,
Prestige 662H/HW Series User’s Guide POP3 132, 146, 147 Port Numbers 132 power 454 PPP (Point-to-Point Protocol) 97 PPP Encapsulation 334 PPP Log 393 PPP session over Ethernet (PPP over Ethernet, RFC 2516) 60 PPPoA 327 PPPoE 113, 482 Benefits 113 PPPoE (Point-to-Point Protocol over Ethernet) 48, 113 PPPoE pass-through 335 PPTP 133 Precedence 422, 425 Pre-defined Web Content Categories 193 Pre-Shared Key 226, 383, 442 Format 100 Prestige anti-virus packet scan 205 Prestige model 396 Prestige models 44 Prest
Prestige 662H/HW Series User’s Guide LAN to WAN 161 Logic 159 Predefined Services 173 Summary 164 S SA 212, 440 SA life time 442 SA lifetime 446 SA Monitor 446 SA monitor 446 Sample IP Addresses 331 Saving the State 150 Scanning engine 204 Schedule Sets Duration 431 Scheduler 272 SCRSee Sustain Cell Rate 324 Secure Gateway Address 220, 439 Security Association 212, 446 Security In General 154 Security Parameter Index 236 Security Parameter Index (SPI) 443 Security Parameters 101 security protocols 436 Sec
Prestige 662H/HW Series User’s Guide System Status 387 System Timeout 247, 420 T task bar properties 503 TCP Maximum Incomplete 177, 178 TCP Security 152 TCP/IP 146, 147, 247, 371, 394 Teardrop 147 Telnet 247, 296 Telnet Configuration 247 Temporal Key Integrity Protocol (TKIP) 99 Text File Format 450 TFTP Restrictions 419 TFTP File Transfer 407 TFTP Restrictions 246, 399 The DeMilitarized Zone (DMZ) 86 Three-Way Handshake 148 Threshold Values 177 Time and Date Setting 414, 415 Time Zone 416 Timeout 307 TK
Prestige 662H/HW Series User’s Guide WEP encryption 93 Wi-Fi Protected Access 99 Wi-Fi Protected Access (WPA) 47 WinPopup window 502 Wireless Client WPA Supplicants 102 Wireless LAN 316, 486 Configuring 93 Wireless LAN MAC Address Filtering 47 Wireless LAN Setup 316 Wireless port control 103, 383 Wireless security 92 Wizard Setup 73 WLAN 486 Interference 90 Security parameters 101 Worm 204 WPA 99, 383 Supplicants 102 with RADIUS Application Example 100 WPA Mixed Mode 383 WPA -Pre-Shared Key 99 WPA with RAD
